Import Cobalt 13.102542
Change-Id: I6bda7b03a2e33edfd735efcb981e2a731696b90d
diff --git a/src/v8/test/mjsunit/regress/binop-in-effect-context-deopt.js b/src/v8/test/mjsunit/regress/binop-in-effect-context-deopt.js
new file mode 100644
index 0000000..8d60e90
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/binop-in-effect-context-deopt.js
@@ -0,0 +1,65 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+(function BinopInEffectContextDeoptAndOsr() {
+ function f(a, deopt, osr) {
+ var result = (a + 10, "result");
+ var dummy = deopt + 0;
+ for (var i = 0; osr && i < 2; i++) %OptimizeOsr();
+ return result;
+ }
+
+ assertEquals("result", f(true, 3, false));
+ assertEquals("result", f(true, 3, false));
+ %OptimizeFunctionOnNextCall(f);
+ assertEquals("result", f(true, "foo", true));
+})();
+
+
+(function BinopInEffectContextLazyDeopt() {
+ function deopt_f() {
+ %DeoptimizeFunction(f);
+ return "dummy";
+ }
+
+ function h() {
+ return { toString : deopt_f };
+ }
+
+ function g(x) {
+ }
+
+ function f() {
+ return g(void(h() + ""));
+ };
+
+ f();
+ %OptimizeFunctionOnNextCall(f);
+ f();
+})();
diff --git a/src/v8/test/mjsunit/regress/bitops-register-alias.js b/src/v8/test/mjsunit/regress/bitops-register-alias.js
new file mode 100644
index 0000000..389255d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/bitops-register-alias.js
@@ -0,0 +1,31 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test that the code generator can cope with left and right being in
+// the same register for bitops.
+function f() { for (var i = 10; i < 100; i++) { return i | i; } }
+assertEquals(10, f());
diff --git a/src/v8/test/mjsunit/regress/call-function-in-effect-context-deopt.js b/src/v8/test/mjsunit/regress/call-function-in-effect-context-deopt.js
new file mode 100644
index 0000000..72d3938
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/call-function-in-effect-context-deopt.js
@@ -0,0 +1,41 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function f(deopt, osr) {
+ var result = "result";
+ %_Call(function() {}, 0, 0);
+ var dummy = deopt + 0;
+ for (var i = 0; osr && i < 2; i++) %OptimizeOsr();
+ return result;
+}
+
+assertEquals("result", f(3, false));
+assertEquals("result", f(3, false));
+%OptimizeFunctionOnNextCall(f);
+assertEquals("result", f("foo", true));
diff --git a/src/v8/test/mjsunit/regress/clear-keyed-call.js b/src/v8/test/mjsunit/regress/clear-keyed-call.js
new file mode 100644
index 0000000..6870f60
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/clear-keyed-call.js
@@ -0,0 +1,40 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-gc --allow-natives-syntax
+
+function f(a) {
+ a[0](1);
+}
+
+f([function(a) { return a; }]);
+f([function(a) { return a; }]);
+f([function(a) { return a; }]);
+%NotifyContextDisposed();
+gc();
+gc();
+gc();
diff --git a/src/v8/test/mjsunit/regress/compare-map-elim1.js b/src/v8/test/mjsunit/regress/compare-map-elim1.js
new file mode 100644
index 0000000..d98c089
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/compare-map-elim1.js
@@ -0,0 +1,57 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax --check-elimination
+
+
+function foo(o) {
+ return o.foo1;
+}
+
+function getter() {
+ return this.x + this.z + foo2(this);
+}
+
+function foo2(o) {
+ return o.a;
+}
+
+var o1 = {z:0, x:1};
+var o2 = {z:0, a:1.5, x:1};
+var o3 = {z:0, a:1.5};
+Object.defineProperty(o1, "foo1", {get:getter});
+Object.defineProperty(o2, "foo1", {get:getter});
+
+foo(o1);
+foo(o1);
+foo(o2);
+%ClearFunctionFeedback(foo2);
+foo2(o2);
+foo2(o2);
+foo2(o3);
+%OptimizeFunctionOnNextCall(foo);
+foo(o1);
diff --git a/src/v8/test/mjsunit/regress/comparison-in-effect-context-deopt.js b/src/v8/test/mjsunit/regress/comparison-in-effect-context-deopt.js
new file mode 100644
index 0000000..b28dff7
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/comparison-in-effect-context-deopt.js
@@ -0,0 +1,47 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function lazyDeopt() {
+ %DeoptimizeFunction(test);
+ return "deopt";
+}
+
+var x = { toString : lazyDeopt };
+
+function g(x) {
+ return "result";
+}
+
+function test(x) {
+ return g(void(x == ""));
+}
+
+test(x);
+%OptimizeFunctionOnNextCall(test);
+assertEquals("result", test(x));
diff --git a/src/v8/test/mjsunit/regress/consolidated-holey-load.js b/src/v8/test/mjsunit/regress/consolidated-holey-load.js
new file mode 100644
index 0000000..ef8f1ef
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/consolidated-holey-load.js
@@ -0,0 +1,40 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function foo(array) {
+ return array[0];
+}
+
+var a = [1, 2, , 4]; // Holey Smi elements.
+var b = ["abcd", 0]; // Fast elements.
+foo(b); // Observe fast elements first, or the IC will transition without
+foo(a); // going polymorphic.
+%OptimizeFunctionOnNextCall(foo);
+var c = [, 0];
+assertEquals(undefined, foo(c)); // Elided hole check will leak the hole.
diff --git a/src/v8/test/mjsunit/regress/cross-script-vars.js b/src/v8/test/mjsunit/regress/cross-script-vars.js
new file mode 100644
index 0000000..fd235f9
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/cross-script-vars.js
@@ -0,0 +1,575 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function PrintDesc(desc, s) {
+ var json;
+ if (desc) {
+ json = JSON.stringify(desc);
+ } else {
+ json = "<no such property>";
+ }
+ if (s === undefined) {
+ print(json);
+ } else {
+ print(s + ": " + json);
+ }
+}
+
+
+var counters;
+var test_realm;
+var cfg;
+
+
+function GetDescriptor() {
+ var code = 'Object.getOwnPropertyDescriptor(global, "x")';
+ var desc = Realm.eval(test_realm, code);
+// PrintDesc(desc);
+ return desc;
+}
+
+function SetUp() {
+ counters = {};
+ Realm.shared = {counters: counters};
+ test_realm = Realm.create();
+ Realm.eval(test_realm, 'var global = Realm.global(Realm.current());');
+ print("=====================");
+ print("Test realm: " + test_realm);
+ assertEquals(undefined, GetDescriptor());
+}
+
+function TearDown() {
+ Realm.dispose(test_realm);
+ print("OK");
+}
+
+
+function AddStrict(code, cfg) {
+ return cfg.strict ? '"use strict"; ' + code : code;
+}
+
+function ForceMutablePropertyCellType() {
+ Realm.eval(test_realm, 'global.x = {}; global.x = undefined;');
+}
+
+function DeclareVar() {
+ var code = 'var x;';
+ return Realm.eval(test_realm, AddStrict(code, cfg));
+}
+
+function DefineVar(v) {
+ var code = 'var x = ' + v;
+ return Realm.eval(test_realm, AddStrict(code, cfg));
+}
+
+function DefineLoadVar() {
+ var name = 'LoadVar_' + test_realm;
+ var code =
+ 'var x;' +
+ 'function ' + name + '() {' +
+ ' return x;' +
+ '};';
+ return Realm.eval(test_realm, AddStrict(code, cfg));
+}
+
+function LoadVar() {
+ var name = 'LoadVar_' + test_realm;
+ var code =
+ (cfg.optimize ? '%OptimizeFunctionOnNextCall(' + name + ');' : '') +
+ name + '();';
+ return Realm.eval(test_realm, AddStrict(code, cfg));
+}
+
+function DefineStoreVar() {
+ var name = 'StoreVar_' + test_realm;
+ var code = 'var g = (Function("return this"))();' +
+ 'var x;' +
+ 'function ' + name + '(v) {' +
+// ' %DebugPrint(g);' +
+ ' return x = v;' +
+ '};';
+ return Realm.eval(test_realm, AddStrict(code, cfg));
+}
+
+function StoreVar(v) {
+ var name = 'StoreVar_' + test_realm;
+ var code =
+ (cfg.optimize ? '%OptimizeFunctionOnNextCall(' + name + ');' : '') +
+ name + '(' + v + ');';
+ return Realm.eval(test_realm, AddStrict(code, cfg));
+}
+
+// It does 13 iterations which results in 27 loads
+// and 14 stores.
+function LoadStoreLoop() {
+ var code = 'for(var x = 0; x < 13; x++);';
+ return Realm.eval(test_realm, AddStrict(code, cfg));
+}
+
+function DefineRWDataProperty() {
+ var code =
+ 'Object.defineProperty(global, "x", { ' +
+ ' value: 42, ' +
+ ' writable: true, ' +
+ ' enumerable: true, ' +
+ ' configurable: true ' +
+ '});';
+ return Realm.eval(test_realm, AddStrict(code, cfg));
+}
+
+function DefineRODataProperty() {
+ var code =
+ 'Object.defineProperty(global, "x", { ' +
+ ' value: 42, ' +
+ ' writable: false, ' +
+ ' enumerable: true, ' +
+ ' configurable: true ' +
+ '});';
+ return Realm.eval(test_realm, AddStrict(code, cfg));
+}
+
+function SetX_(v) {
+ var code =
+ 'global.x_ = ' + v + '; ';
+ return Realm.eval(test_realm, code);
+}
+
+function DefineRWAccessorProperty() {
+ var code =
+ 'Object.defineProperty(global, "x", {' +
+ ' get: function() { Realm.shared.counters.get_count++; return this.x_; },' +
+ ' set: function(v) { Realm.shared.counters.set_count++; this.x_ = v; },' +
+ ' enumerable: true, configurable: true' +
+ '});';
+ counters.get_count = 0;
+ counters.set_count = 0;
+ return Realm.eval(test_realm, AddStrict(code, cfg));
+}
+
+function DefineROAccessorProperty() {
+ var code =
+ 'Object.defineProperty(global, "x", {' +
+ ' get: function() { Realm.shared.counters.get_count++; return this.x_; },' +
+ ' enumerable: true, configurable: true' +
+ '});';
+ counters.get_count = 0;
+ counters.set_count = 0;
+ return Realm.eval(test_realm, AddStrict(code, cfg));
+}
+
+
+function testSuite(opt_cfg) {
+ //
+ // Non strict.
+ //
+
+ (function() {
+ SetUp();
+ cfg = {optimize: opt_cfg.optimize, strict: false};
+ DeclareVar();
+ DefineLoadVar();
+ DefineStoreVar();
+ assertEquals(undefined, LoadVar());
+ assertEquals(false, GetDescriptor().configurable);
+
+ // Force property cell type to kMutable.
+ DefineVar(undefined);
+ DefineVar(153);
+ assertEquals(false, GetDescriptor().configurable);
+
+ assertEquals(153, LoadVar());
+ assertEquals(113, StoreVar(113));
+ assertEquals(113, LoadVar());
+ LoadStoreLoop();
+ assertEquals(13, LoadVar());
+ TearDown();
+ })();
+
+
+ (function() {
+ SetUp();
+ cfg = {optimize: opt_cfg.optimize, strict: false};
+ ForceMutablePropertyCellType();
+ DefineLoadVar();
+ DefineStoreVar();
+ DefineRWDataProperty();
+ assertEquals(42, LoadVar());
+ assertEquals(true, GetDescriptor().configurable);
+
+ DefineVar(153);
+ assertEquals(true, GetDescriptor().configurable);
+
+ assertEquals(153, LoadVar());
+ assertEquals(113, StoreVar(113));
+ assertEquals(113, LoadVar());
+ LoadStoreLoop();
+ assertEquals(13, LoadVar());
+
+ // Now reconfigure to accessor.
+ DefineRWAccessorProperty();
+ assertEquals(undefined, GetDescriptor().value);
+ assertEquals(true, GetDescriptor().configurable);
+ assertEquals(0, counters.get_count);
+ assertEquals(0, counters.set_count);
+
+ assertEquals(undefined, LoadVar());
+ assertEquals(1, counters.get_count);
+ assertEquals(0, counters.set_count);
+
+ LoadStoreLoop();
+ assertEquals(28, counters.get_count);
+ assertEquals(14, counters.set_count);
+
+ assertEquals(13, LoadVar());
+ assertEquals(29, counters.get_count);
+ assertEquals(14, counters.set_count);
+
+ TearDown();
+ })();
+
+
+ (function() {
+ SetUp();
+ cfg = {optimize: opt_cfg.optimize, strict: false};
+ ForceMutablePropertyCellType();
+ DefineLoadVar();
+ DefineStoreVar();
+ DefineRODataProperty();
+ assertEquals(42, LoadVar());
+ assertEquals(true, GetDescriptor().configurable);
+
+ DefineVar(153);
+
+ assertEquals(42, LoadVar());
+ assertEquals(113, StoreVar(113));
+ assertEquals(42, LoadVar());
+ LoadStoreLoop();
+ assertEquals(42, LoadVar());
+
+ // Now reconfigure to accessor property.
+ DefineRWAccessorProperty();
+ assertEquals(undefined, GetDescriptor().value);
+ assertEquals(true, GetDescriptor().configurable);
+ assertEquals(0, counters.get_count);
+ assertEquals(0, counters.set_count);
+
+ assertEquals(undefined, LoadVar());
+ assertEquals(1, counters.get_count);
+ assertEquals(0, counters.set_count);
+
+ LoadStoreLoop();
+ assertEquals(28, counters.get_count);
+ assertEquals(14, counters.set_count);
+
+ assertEquals(13, LoadVar());
+ assertEquals(29, counters.get_count);
+ assertEquals(14, counters.set_count);
+
+ TearDown();
+ })();
+
+
+ (function() {
+ SetUp();
+ cfg = {optimize: opt_cfg.optimize, strict: false};
+ ForceMutablePropertyCellType();
+ DefineLoadVar();
+ DefineStoreVar();
+ DefineRWAccessorProperty();
+ assertEquals(0, counters.get_count);
+ assertEquals(0, counters.set_count);
+ assertEquals(true, GetDescriptor().configurable);
+
+ assertEquals(undefined, LoadVar());
+ assertEquals(1, counters.get_count);
+ assertEquals(0, counters.set_count);
+
+ DefineVar(153);
+ assertEquals(true, GetDescriptor().configurable);
+ assertEquals(1, counters.get_count);
+ assertEquals(1, counters.set_count);
+
+ assertEquals(153, LoadVar());
+ assertEquals(2, counters.get_count);
+ assertEquals(1, counters.set_count);
+
+ assertEquals(113, StoreVar(113));
+ assertEquals(2, counters.get_count);
+ assertEquals(2, counters.set_count);
+
+ assertEquals(113, LoadVar());
+ assertEquals(3, counters.get_count);
+ assertEquals(2, counters.set_count);
+
+ LoadStoreLoop();
+ assertEquals(30, counters.get_count);
+ assertEquals(16, counters.set_count);
+
+ assertEquals(13, LoadVar());
+ assertEquals(31, counters.get_count);
+ assertEquals(16, counters.set_count);
+
+ // Now reconfigure to data property.
+ DefineRWDataProperty();
+ assertEquals(42, GetDescriptor().value);
+ assertEquals(42, LoadVar());
+ assertEquals(113, StoreVar(113));
+ assertEquals(31, counters.get_count);
+ assertEquals(16, counters.set_count);
+
+ TearDown();
+ })();
+
+
+ (function() {
+ SetUp();
+ cfg = {optimize: opt_cfg.optimize, strict: false};
+ ForceMutablePropertyCellType();
+ DefineLoadVar();
+ DefineStoreVar();
+ DefineROAccessorProperty();
+ assertEquals(0, counters.get_count);
+ assertEquals(0, counters.set_count);
+ assertEquals(true, GetDescriptor().configurable);
+
+ assertEquals(undefined, LoadVar());
+ assertEquals(1, counters.get_count);
+ assertEquals(0, counters.set_count);
+
+ SetX_(42);
+ assertEquals(42, LoadVar());
+ assertEquals(2, counters.get_count);
+ assertEquals(0, counters.set_count);
+
+ DefineVar(153);
+ assertEquals(true, GetDescriptor().configurable);
+ assertEquals(2, counters.get_count);
+ assertEquals(0, counters.set_count);
+
+ assertEquals(42, LoadVar());
+ assertEquals(3, counters.get_count);
+ assertEquals(0, counters.set_count);
+
+ assertEquals(113, StoreVar(113));
+ assertEquals(3, counters.get_count);
+ assertEquals(0, counters.set_count);
+
+ assertEquals(42, LoadVar());
+ assertEquals(4, counters.get_count);
+ assertEquals(0, counters.set_count);
+
+ LoadStoreLoop();
+ assertEquals(5, counters.get_count);
+ assertEquals(0, counters.set_count);
+
+ assertEquals(42, LoadVar());
+ assertEquals(6, counters.get_count);
+ assertEquals(0, counters.set_count);
+
+ // Now reconfigure to data property.
+ DefineRWDataProperty();
+ assertEquals(42, GetDescriptor().value);
+ assertEquals(42, LoadVar());
+ assertEquals(113, StoreVar(113));
+ assertEquals(6, counters.get_count);
+ assertEquals(0, counters.set_count);
+
+ TearDown();
+ })();
+
+
+ //
+ // Strict.
+ //
+
+ (function() {
+ SetUp();
+ cfg = {optimize: opt_cfg.optimize, strict: true};
+ DeclareVar();
+ DefineLoadVar();
+ DefineStoreVar();
+ assertEquals(undefined, LoadVar());
+ assertEquals(false, GetDescriptor().configurable);
+
+ // Force property cell type to kMutable.
+ DefineVar(undefined);
+ DefineVar(153);
+ assertEquals(false, GetDescriptor().configurable);
+
+ assertEquals(153, LoadVar());
+ assertEquals(113, StoreVar(113));
+ assertEquals(113, LoadVar());
+ LoadStoreLoop();
+ assertEquals(13, LoadVar());
+ TearDown();
+ })();
+
+
+ (function() {
+ SetUp();
+ cfg = {optimize: opt_cfg.optimize, strict: true};
+ ForceMutablePropertyCellType();
+ DefineLoadVar();
+ DefineStoreVar();
+ DefineRWDataProperty();
+ assertEquals(42, LoadVar());
+ assertEquals(true, GetDescriptor().configurable);
+
+ DefineVar(153);
+ assertEquals(true, GetDescriptor().configurable);
+
+ assertEquals(153, LoadVar());
+ assertEquals(113, StoreVar(113));
+ assertEquals(113, LoadVar());
+ LoadStoreLoop();
+ assertEquals(13, LoadVar());
+ TearDown();
+ })();
+
+
+ (function() {
+ SetUp();
+ cfg = {optimize: opt_cfg.optimize, strict: true};
+ ForceMutablePropertyCellType();
+ DefineLoadVar();
+ DefineStoreVar();
+ DefineRWDataProperty();
+ assertEquals(true, GetDescriptor().configurable);
+ assertEquals(true, GetDescriptor().writable);
+ assertEquals(113, StoreVar(113));
+
+ DefineRODataProperty();
+ assertEquals(true, GetDescriptor().configurable);
+ assertEquals(false, GetDescriptor().writable);
+
+ assertEquals(42, LoadVar());
+ assertEquals(true, GetDescriptor().configurable);
+ assertThrows('DefineVar(153)');
+ assertEquals(42, LoadVar());
+ assertThrows('StoreVar(113)');
+ assertThrows('StoreVar(113)');
+ assertEquals(42, LoadVar());
+ assertThrows('StoreVar(42)');
+ assertEquals(42, LoadVar());
+ assertThrows('LoadStoreLoop()');
+ assertEquals(42, LoadVar());
+ TearDown();
+ })();
+
+
+ (function() {
+ SetUp();
+ cfg = {optimize: opt_cfg.optimize, strict: true};
+ ForceMutablePropertyCellType();
+ DefineLoadVar();
+ DefineStoreVar();
+ DefineRWAccessorProperty();
+ assertEquals(0, counters.get_count);
+ assertEquals(0, counters.set_count);
+ assertEquals(true, GetDescriptor().configurable);
+
+ assertEquals(undefined, LoadVar());
+ assertEquals(1, counters.get_count);
+ assertEquals(0, counters.set_count);
+
+ DefineVar(153);
+ assertEquals(true, GetDescriptor().configurable);
+ assertEquals(1, counters.get_count);
+ assertEquals(1, counters.set_count);
+
+ assertEquals(153, LoadVar());
+ assertEquals(2, counters.get_count);
+ assertEquals(1, counters.set_count);
+
+ assertEquals(113, StoreVar(113));
+ assertEquals(2, counters.get_count);
+ assertEquals(2, counters.set_count);
+
+ assertEquals(113, LoadVar());
+ assertEquals(3, counters.get_count);
+ assertEquals(2, counters.set_count);
+
+ LoadStoreLoop();
+ assertEquals(30, counters.get_count);
+ assertEquals(16, counters.set_count);
+
+ assertEquals(13, LoadVar());
+ assertEquals(31, counters.get_count);
+ assertEquals(16, counters.set_count);
+
+ // Now reconfigure to data property.
+ DefineRWDataProperty();
+ assertEquals(42, GetDescriptor().value);
+ assertEquals(42, LoadVar());
+ assertEquals(113, StoreVar(113));
+ assertEquals(31, counters.get_count);
+ assertEquals(16, counters.set_count);
+
+ TearDown();
+ })();
+
+
+ (function() {
+ SetUp();
+ cfg = {optimize: opt_cfg.optimize, strict: true};
+ ForceMutablePropertyCellType();
+ DefineLoadVar();
+ DefineStoreVar();
+ DefineROAccessorProperty();
+ assertEquals(0, counters.get_count);
+ assertEquals(0, counters.set_count);
+ assertEquals(true, GetDescriptor().configurable);
+
+ assertEquals(undefined, LoadVar());
+ assertEquals(1, counters.get_count);
+ assertEquals(0, counters.set_count);
+
+ SetX_(42);
+ assertEquals(42, LoadVar());
+ assertEquals(2, counters.get_count);
+ assertEquals(0, counters.set_count);
+
+ assertThrows('DefineVar(153)');
+ assertEquals(true, GetDescriptor().configurable);
+ assertEquals(2, counters.get_count);
+ assertEquals(0, counters.set_count);
+
+ assertEquals(42, LoadVar());
+ assertEquals(3, counters.get_count);
+ assertEquals(0, counters.set_count);
+
+ assertThrows('StoreVar(113)');
+ assertEquals(3, counters.get_count);
+ assertEquals(0, counters.set_count);
+
+ assertEquals(42, LoadVar());
+ assertEquals(4, counters.get_count);
+ assertEquals(0, counters.set_count);
+
+ assertThrows('LoadStoreLoop()');
+ assertEquals(4, counters.get_count);
+ assertEquals(0, counters.set_count);
+
+ assertEquals(42, LoadVar());
+ assertEquals(5, counters.get_count);
+ assertEquals(0, counters.set_count);
+
+ // Now reconfigure to data property.
+ DefineRWDataProperty();
+ assertEquals(42, GetDescriptor().value);
+ assertEquals(42, LoadVar());
+ assertEquals(113, StoreVar(113));
+ assertEquals(5, counters.get_count);
+ assertEquals(0, counters.set_count);
+
+ TearDown();
+ })();
+
+} // testSuite
+
+
+testSuite({optimize: false});
+testSuite({optimize: true});
diff --git a/src/v8/test/mjsunit/regress/d8-readbuffer.js b/src/v8/test/mjsunit/regress/d8-readbuffer.js
new file mode 100644
index 0000000..8aec02d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/d8-readbuffer.js
@@ -0,0 +1,40 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test that reading a file actually returns the file's contents.
+
+// Env: TEST_FILE_NAME
+assertEquals("string", typeof TEST_FILE_NAME);
+
+var a = new Uint8Array(readbuffer(TEST_FILE_NAME));
+
+// First line of this file.
+var expected = "// Copyright 2014 the V8 project authors. All rights reserved.";
+
+for (var i = 0; i < expected.length; i++) {
+ assertEquals(expected.charCodeAt(i), a[i]);
+}
diff --git a/src/v8/test/mjsunit/regress/external-and-normal-array-polymorphism.js b/src/v8/test/mjsunit/regress/external-and-normal-array-polymorphism.js
new file mode 100644
index 0000000..0ac1545
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/external-and-normal-array-polymorphism.js
@@ -0,0 +1,48 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function store_generator(compare) {
+ return function(a,i,v) {
+ a[i] = v;
+ assertEquals(compare, a[i]);
+ assertEquals(compare, a[i]);
+ }
+}
+
+f = store_generator(5);
+a = [0,0,0];
+f(a,0,5);
+a = [0,0,0];
+f(a,1,5);
+a = [0,0,0];
+f(a,2,5);
+
+f = store_generator(5.5);
+a = new Float32Array(5);
+f(a,0,5.5);
+f(a,1,5.5);
+f(a,2,5.5);
diff --git a/src/v8/test/mjsunit/regress/get-array-keys-oob.js b/src/v8/test/mjsunit/regress/get-array-keys-oob.js
new file mode 100644
index 0000000..22a59e8
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/get-array-keys-oob.js
@@ -0,0 +1,6 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+Array.prototype[10000000] = 1;
+Array(1000).join();
diff --git a/src/v8/test/mjsunit/regress/internalized-string-not-equal.js b/src/v8/test/mjsunit/regress/internalized-string-not-equal.js
new file mode 100644
index 0000000..911279b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/internalized-string-not-equal.js
@@ -0,0 +1,40 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// A bug in r15773, when masks for internalized string and string types
+// were reorganized.
+function equal(o1, o2) {
+ return (o1 == o2);
+}
+var a = "abc";
+var b = "abc";
+equal(a, b);
+equal(a, b);
+%OptimizeFunctionOnNextCall(equal);
+assertTrue(equal(1.3, 1.3));
diff --git a/src/v8/test/mjsunit/regress/json-stringifier-emptyhandle.js b/src/v8/test/mjsunit/regress/json-stringifier-emptyhandle.js
new file mode 100644
index 0000000..970b0b8
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/json-stringifier-emptyhandle.js
@@ -0,0 +1,44 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+function explode() {
+ var array = [1,2,3];
+
+ Object.defineProperty(array, 4, {
+ get: function () { throw "dynamite"; },
+ });
+
+ JSON.stringify(array);
+}
+
+try {
+ explode();
+ assertUnreachable();
+} catch(e) {
+ assertEquals("dynamite", e);
+}
diff --git a/src/v8/test/mjsunit/regress/math-min.js b/src/v8/test/mjsunit/regress/math-min.js
new file mode 100644
index 0000000..942e9d0
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/math-min.js
@@ -0,0 +1,66 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var a = new Float64Array(4);
+a[2] *= -1;
+a[3] *= -1;
+assertEquals(0, a[0]);
+assertEquals(0, a[1]);
+assertEquals(-0, a[2]);
+assertEquals(-0, a[3]);
+
+function f1() {
+ var z = a[0];
+ // Same register.
+ assertEquals(0, Math.min(z, z));
+}
+
+function f2() {
+ // Different registers.
+ assertEquals(0, Math.min(a[0], a[1]));
+}
+
+function f3() {
+ // Zero and minus zero.
+ assertEquals(-0, Math.min(a[1], a[2]));
+}
+
+function f4() {
+ // Zero and minus zero, reversed order.
+ assertEquals(-0, Math.min(a[2], a[1]));
+}
+
+function f5() {
+ // Minus zero, same register.
+ var m_z = a[2];
+ assertEquals(-0, Math.min(m_z, m_z));
+}
+
+function f6() {
+ // Minus zero, different registers.
+ assertEquals(-0, Math.min(a[2], a[3]));
+}
+
+for (var i = 0; i < 3; i++) {
+ f1();
+ f2();
+ f3();
+ f4();
+ f5();
+ f6();
+}
+%OptimizeFunctionOnNextCall(f1);
+%OptimizeFunctionOnNextCall(f2);
+%OptimizeFunctionOnNextCall(f3);
+%OptimizeFunctionOnNextCall(f4);
+%OptimizeFunctionOnNextCall(f5);
+%OptimizeFunctionOnNextCall(f6);
+f1();
+f2();
+f3();
+f4();
+f5();
+f6();
diff --git a/src/v8/test/mjsunit/regress/negative_lookup.js b/src/v8/test/mjsunit/regress/negative_lookup.js
new file mode 100644
index 0000000..e23e365
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/negative_lookup.js
@@ -0,0 +1,65 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function s(v) {
+ v.x = 1;
+}
+
+function c(p) {
+ return {__proto__: p};
+}
+
+var p = {};
+
+// Make p the last prototype in the chain.
+p.__proto__ = null;
+
+var o1 = c(p);
+var o2 = c(p);
+var o3 = c(p);
+var o4 = c(p);
+
+// Make y go to slow mode.
+// Do this after using p as prototype, since using an object as prototype kicks
+// it back into fast mode.
+p.y = 1;
+delete p.y;
+
+// Initialize the store IC.
+s(o1);
+s(o2);
+
+// Do something with x in slow-mode p.
+Object.defineProperty(p, "x", { writable: false, value: 5 });
+
+// Verify that directly setting x fails.
+o3.x = 10;
+assertEquals(5, o3.x);
+
+// Verify that setting x through the IC fails.
+s(o4);
+assertEquals(5, o4.x);
diff --git a/src/v8/test/mjsunit/regress/number-named-call-deopt.js b/src/v8/test/mjsunit/regress/number-named-call-deopt.js
new file mode 100644
index 0000000..1598af1
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/number-named-call-deopt.js
@@ -0,0 +1,41 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function f(x, deopt, osr) {
+ var res = "result";
+ void(x.toString(10, deopt + 0));
+ if (osr) for (var i = 0; i < 100000; i++) { }
+ return res;
+}
+
+f(4, 0, false);
+f(4, 0, false);
+f(4, 0, false);
+%OptimizeFunctionOnNextCall(f);
+assertEquals("result", f(4, "deopt", true));
diff --git a/src/v8/test/mjsunit/regress/poly_count_operation.js b/src/v8/test/mjsunit/regress/poly_count_operation.js
new file mode 100644
index 0000000..a8a1ed2
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/poly_count_operation.js
@@ -0,0 +1,155 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var o1 = {x:1};
+var o2 = {};
+var deopt_getter = false;
+var deopt_setter = false;
+
+function f_mono(o) {
+ return 5 + o.x++;
+}
+
+var to_deopt = f_mono;
+
+var v = 1;
+var g = 0;
+var s = 0;
+
+Object.defineProperty(o2, "x",
+ {get:function() {
+ g++;
+ if (deopt_getter) {
+ deopt_getter = false;
+ %DeoptimizeFunction(to_deopt);
+ }
+ return v;
+ },
+ set:function(new_v) {
+ v = new_v;
+ s++;
+ if (deopt_setter) {
+ deopt_setter = false;
+ %DeoptimizeFunction(to_deopt);
+ }
+ }});
+
+assertEquals(6, f_mono(o2));
+assertEquals(1, g);
+assertEquals(1, s);
+assertEquals(7, f_mono(o2));
+assertEquals(2, g);
+assertEquals(2, s);
+%OptimizeFunctionOnNextCall(f_mono);
+deopt_setter = true;
+assertEquals(8, f_mono(o2));
+assertEquals(3, g);
+assertEquals(3, s);
+
+function f_poly(o) {
+ return 5 + o.x++;
+}
+
+v = 1;
+to_deopt = f_poly;
+
+f_poly(o1);
+f_poly(o1);
+assertEquals(6, f_poly(o2));
+assertEquals(4, g);
+assertEquals(4, s);
+assertEquals(7, f_poly(o2));
+assertEquals(5, g);
+assertEquals(5, s);
+%OptimizeFunctionOnNextCall(f_poly);
+deopt_setter = true;
+assertEquals(8, f_poly(o2));
+assertEquals(6, g);
+assertEquals(6, s);
+
+%OptimizeFunctionOnNextCall(f_poly);
+v = undefined;
+assertEquals(NaN, f_poly(o2));
+assertEquals(7, g);
+assertEquals(7, s);
+
+function f_pre(o) {
+ return 5 + ++o.x;
+}
+
+v = 1;
+to_deopt = f_pre;
+
+f_pre(o1);
+f_pre(o1);
+assertEquals(7, f_pre(o2));
+assertEquals(8, g);
+assertEquals(8, s);
+assertEquals(8, f_pre(o2));
+assertEquals(9, g);
+assertEquals(9, s);
+%OptimizeFunctionOnNextCall(f_pre);
+deopt_setter = true;
+assertEquals(9, f_pre(o2));
+assertEquals(10, g);
+assertEquals(10, s);
+
+%OptimizeFunctionOnNextCall(f_pre);
+v = undefined;
+assertEquals(NaN, f_pre(o2));
+assertEquals(11, g);
+assertEquals(11, s);
+
+
+function f_get(o) {
+ return 5 + o.x++;
+}
+
+v = 1;
+to_deopt = f_get;
+
+f_get(o1);
+f_get(o1);
+assertEquals(6, f_get(o2));
+assertEquals(12, g);
+assertEquals(12, s);
+assertEquals(7, f_get(o2));
+assertEquals(13, g);
+assertEquals(13, s);
+%OptimizeFunctionOnNextCall(f_get);
+deopt_getter = true;
+assertEquals(8, f_get(o2));
+assertEquals(14, g);
+assertEquals(14, s);
+
+%OptimizeFunctionOnNextCall(f_get);
+v = undefined;
+assertEquals(NaN, f_get(o2));
+assertEquals(15, g);
+assertEquals(15, s);
diff --git a/src/v8/test/mjsunit/regress/polymorphic-accessor-test-context.js b/src/v8/test/mjsunit/regress/polymorphic-accessor-test-context.js
new file mode 100644
index 0000000..6188279
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/polymorphic-accessor-test-context.js
@@ -0,0 +1,25 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function t1() { return this instanceof t1; }
+function t2() { return this instanceof t2; }
+
+var o1 = new (function() { })();
+Object.defineProperty(o1, "t", {get:function() { return this instanceof o1.constructor; }});
+var o2 = new (function() { })();
+Object.defineProperty(o2, "t", {get:function() { return this instanceof o1.constructor; }});
+var o3 = new (function() { })();
+o3.t = true;
+
+function f(o) {
+ return 1 + (o.t ? 1 : 2);
+}
+
+f(o1);
+f(o1);
+f(o2);
+%OptimizeFunctionOnNextCall(f);
+f(o3);
diff --git a/src/v8/test/mjsunit/regress/post-increment-close-context.js b/src/v8/test/mjsunit/regress/post-increment-close-context.js
new file mode 100644
index 0000000..08ade10
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/post-increment-close-context.js
@@ -0,0 +1,42 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var foo = {bar: -2};
+function crash() {
+ return !(foo.bar++);
+}
+assertFalse(crash());
+assertEquals(-1, foo.bar);
+%OptimizeFunctionOnNextCall(crash);
+assertFalse(crash());
+assertEquals(0, foo.bar);
+assertTrue(crash());
+assertEquals(1, foo.bar);
+assertFalse(crash());
+assertEquals(2, foo.bar);
diff --git a/src/v8/test/mjsunit/regress/property-descriptor-to-object.js b/src/v8/test/mjsunit/regress/property-descriptor-to-object.js
new file mode 100644
index 0000000..e47d5a5
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/property-descriptor-to-object.js
@@ -0,0 +1,8 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var o = { prop: 1 };
+Object.prototype.value = 0;
+var d = Object.getOwnPropertyDescriptor(o, "prop");
+assertEquals(1, d.value);
diff --git a/src/v8/test/mjsunit/regress/readonly1.js b/src/v8/test/mjsunit/regress/readonly1.js
new file mode 100644
index 0000000..366f432
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/readonly1.js
@@ -0,0 +1,71 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function s(v) {
+ v.x = 1;
+}
+
+function s_strict(v) {
+ "use strict";
+ v.x = 1;
+}
+
+function c(p) {
+ return {__proto__: p};
+}
+
+var p = {};
+
+var o1 = c(p);
+var o2 = c(p);
+var o3 = c(p);
+var o4 = c(p);
+
+// Make p go slow.
+// Do this after using p as prototype, since using an object as prototype kicks
+// it back into fast mode.
+p.y = 1;
+delete p.y;
+p.x = 5;
+
+// Initialize the store IC.
+s(o1);
+s(o2);
+s_strict(o1);
+s_strict(o2);
+
+// Make x non-writable.
+Object.defineProperty(p, "x", { writable: false });
+
+// Verify that direct setting fails.
+o3.x = 20;
+assertEquals(5, o3.x);
+
+// Verify that setting through the IC fails.
+s(o4);
+assertEquals(5, o4.x);
+assertThrows("s_strict(o4);", TypeError);
diff --git a/src/v8/test/mjsunit/regress/readonly2.js b/src/v8/test/mjsunit/regress/readonly2.js
new file mode 100644
index 0000000..4e53925
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/readonly2.js
@@ -0,0 +1,62 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+Object.defineProperty(this, "x", { writable:true });
+
+function s(v) {
+ v.x = 1;
+}
+
+function s_strict(v) {
+ "use strict";
+ v.x = 1;
+}
+
+function c(p) {
+ return {__proto__: p};
+}
+
+var o1 = c(this);
+var o2 = c(this);
+
+// Initialize the store IC.
+s(c(this));
+s(c(this));
+s_strict(c(this));
+s_strict(c(this));
+
+// Make x non-writable.
+Object.defineProperty(this, "x", { writable:false, value:5 });
+
+// Verify that direct setting fails.
+o1.x = 20;
+assertEquals(5, o1.x);
+
+// Verify that setting through the IC fails.
+s(o2);
+assertEquals(5, o2.x);
+assertThrows("s_strict(o2);", TypeError);
diff --git a/src/v8/test/mjsunit/regress/readonly3.js b/src/v8/test/mjsunit/regress/readonly3.js
new file mode 100644
index 0000000..f81979d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/readonly3.js
@@ -0,0 +1,65 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+this.x = 0;
+
+var p = {};
+Object.defineProperty(p, "x", {writable:false, value:5});
+this.__proto__ = p;
+
+function s(v) {
+ v.x = 1;
+}
+
+function s_strict(v) {
+ "use strict";
+ v.x = 1;
+}
+
+function c(p) {
+ return {__proto__: p};
+}
+
+var o1 = c(this);
+var o2 = c(this);
+
+// Initialize the store IC.
+s(c(this));
+s(c(this));
+s_strict(c(this));
+s_strict(c(this));
+
+delete this.x;
+
+// Verify that direct setting fails.
+o1.x = 20;
+assertEquals(5, o1.x);
+
+// Verify that setting through the IC fails.
+s(o2);
+assertEquals(5, o2.x);
+assertThrows("s_strict(o2);", TypeError);
diff --git a/src/v8/test/mjsunit/regress/readonly4.js b/src/v8/test/mjsunit/regress/readonly4.js
new file mode 100644
index 0000000..b2fde29
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/readonly4.js
@@ -0,0 +1,74 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var slow = {};
+var p = {};
+
+slow.__proto__ = p;
+slow.x = 10;
+slow.y = 10;
+Object.defineProperty(p, "x", {writable:false, value:5});
+
+function c(p) {
+ return {__proto__: p};
+}
+
+function s(v) {
+ return v.x = 1;
+}
+
+function s_strict(v) {
+ "use strict";
+ v.x = 1;
+}
+
+var o1 = c(slow);
+var o2 = c(slow);
+var o1_strict = c(slow);
+var o2_strict = c(slow);
+var o3 = c(slow);
+var o4 = c(slow);
+
+// Make s slow.
+// Do this after using slow as prototype, since using an object as prototype
+// kicks it back into fast mode.
+delete slow.y;
+
+s(o1);
+s(o2);
+s_strict(o1_strict);
+s_strict(o2_strict);
+
+delete slow.x;
+// Directly setting x should fail.
+o3.x = 20
+assertEquals(5, o3.x);
+
+// Setting x through IC should fail.
+s(o4);
+assertEquals(5, o4.x);
+assertThrows("s_strict(o4);", TypeError);
diff --git a/src/v8/test/mjsunit/regress/readonly5.js b/src/v8/test/mjsunit/regress/readonly5.js
new file mode 100644
index 0000000..b1499dd
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/readonly5.js
@@ -0,0 +1,68 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+this.__proto__ = null;
+this.x = 10;
+delete this.x;
+
+function s(v) {
+ return v.x = 1;
+}
+
+function s_strict(v) {
+ "use strict";
+ return v.x = 1;
+}
+
+function c() {
+ var o = {__proto__:this};
+ return o;
+}
+
+var o1 = c();
+var o2 = c();
+var o1_strict = c();
+var o2_strict = c();
+var o3 = c();
+var o4 = c();
+
+// Initialize the store IC.
+s(o1);
+s(o2);
+s_strict(o1_strict);
+s_strict(o2_strict);
+
+Object.defineProperty(this, "x", {writable:false, configurable:true});
+
+// Verify that directly setting x fails.
+o3.x = 1;
+assertEquals(undefined, o3.x);
+
+// Verify that setting x through the IC fails.
+assertThrows("s_strict(o4)", TypeError);
+s(o4);
+assertEquals(undefined, o4.x);
diff --git a/src/v8/test/mjsunit/regress/redeclaration-error-types.js b/src/v8/test/mjsunit/regress/redeclaration-error-types.js
new file mode 100644
index 0000000..72e097d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/redeclaration-error-types.js
@@ -0,0 +1,145 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+
+function doTest(scripts, expectedError) {
+ var realm = Realm.create();
+
+ for (var i = 0; i < scripts.length - 1; i++) {
+ Realm.eval(realm, scripts[i]);
+ }
+ assertThrows(function() {
+ Realm.eval(realm, scripts[scripts.length - 1]);
+ }, Realm.eval(realm, expectedError));
+
+ Realm.dispose(realm);
+}
+
+var tests = [
+ {
+ // ES#sec-globaldeclarationinstantiation 5.a:
+ // If envRec.HasVarDeclaration(name) is true, throw a SyntaxError
+ // exception.
+ scripts: [
+ "var a;",
+ "let a;",
+ ],
+ expectedError: "SyntaxError",
+ },
+ {
+ // ES#sec-globaldeclarationinstantiation 6.a:
+ // If envRec.HasLexicalDeclaration(name) is true, throw a SyntaxError
+ // exception.
+ scripts: [
+ "let a;",
+ "var a;",
+ ],
+ expectedError: "SyntaxError",
+ },
+ {
+ // ES#sec-globaldeclarationinstantiation 5.b:
+ // If envRec.HasLexicalDeclaration(name) is true, throw a SyntaxError
+ // exception.
+ scripts: [
+ "let a;",
+ "let a;",
+ ],
+ expectedError: "SyntaxError",
+ },
+ {
+ // ES#sec-evaldeclarationinstantiation 5.a.i.1:
+ // If varEnvRec.HasLexicalDeclaration(name) is true, throw a SyntaxError
+ // exception.
+ scripts: [
+ 'let a; eval("var a;");',
+ ],
+ expectedError: "SyntaxError",
+ },
+ {
+ // ES#sec-evaldeclarationinstantiation 5.a.i.1:
+ // If varEnvRec.HasLexicalDeclaration(name) is true, throw a SyntaxError
+ // exception.
+ scripts: [
+ 'let a; eval("function a() {}");',
+ ],
+ expectedError: "SyntaxError",
+ },
+ {
+ // ES#sec-evaldeclarationinstantiation 5.d.ii.2.a.i:
+ // Throw a SyntaxError exception.
+ scripts: [
+ '(function() { let a; eval("var a;"); })();',
+ ],
+ expectedError: "SyntaxError",
+ },
+ {
+ // ES#sec-evaldeclarationinstantiation 5.d.ii.2.a.i:
+ // Throw a SyntaxError exception.
+ scripts: [
+ '(function() { let a; eval("function a() {}"); })();',
+ ],
+ expectedError: "SyntaxError",
+ },
+ {
+ // ES#sec-globaldeclarationinstantiation 5.d:
+ // If hasRestrictedGlobal is true, throw a SyntaxError exception.
+ scripts: [
+ 'let NaN;',
+ ],
+ expectedError: "SyntaxError",
+ },
+ {
+ // ES#sec-globaldeclarationinstantiation 5.d:
+ // If hasRestrictedGlobal is true, throw a SyntaxError exception.
+ scripts: [
+ 'function NaN() {}',
+ ],
+ expectedError: "SyntaxError",
+ },
+
+ {
+ // ES#sec-evaldeclarationinstantiation 8.a.iv.1.b:
+ // If fnDefinable is false, throw a TypeError exception.
+ scripts: [
+ 'eval("function NaN() {}");',
+ ],
+ expectedError: "TypeError",
+ },
+ {
+ // ES#sec-evaldeclarationinstantiation 8.a.iv.1.b:
+ // If fnDefinable is false, throw a TypeError exception.
+ scripts: [
+ `
+ let a;
+ try {
+ eval("function a() {}");
+ } catch (e) {}
+ eval("function NaN() {}");
+ `,
+ ],
+ expectedError: "TypeError",
+ },
+ {
+ // ES#sec-evaldeclarationinstantiation 8.a.iv.1.b:
+ // If fnDefinable is false, throw a TypeError exception.
+ scripts: [
+ `
+ eval("
+ function f() {
+ function b() {
+ (0, eval)('function NaN() {}');
+ }
+ b();
+ }
+ f();
+ ");
+ `.replace(/"/g, '`'),
+ ],
+ expectedError: "TypeError",
+ },
+];
+
+tests.forEach(function(test) {
+ doTest(test.scripts, test.expectedError);
+});
diff --git a/src/v8/test/mjsunit/regress/regress-100409.js b/src/v8/test/mjsunit/regress/regress-100409.js
new file mode 100644
index 0000000..c29250f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-100409.js
@@ -0,0 +1,55 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function outer () {
+ var val = 0;
+
+ function foo () {
+ val = 0;
+ val;
+ var z = false;
+ var y = true;
+ if (!z) {
+ while (z = !z) {
+ if (y) val++;
+ }
+ }
+ return val++;
+ }
+
+ return foo;
+}
+
+
+var foo = outer();
+
+assertEquals(1, foo());
+assertEquals(1, foo());
+ %OptimizeFunctionOnNextCall(foo);
+assertEquals(1, foo());
diff --git a/src/v8/test/mjsunit/regress/regress-100702.js b/src/v8/test/mjsunit/regress/regress-100702.js
new file mode 100644
index 0000000..46494ab
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-100702.js
@@ -0,0 +1,44 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Regression test for correct handling of non-object receiver values
+// passed to built-in array functions.
+
+String.prototype.isThatMe = function () {
+ assertFalse(this === str);
+};
+
+var str = "abc";
+str.isThatMe();
+str.isThatMe.call(str);
+
+var arr = [1];
+arr.forEach("".isThatMe, str);
+arr.filter("".isThatMe, str);
+arr.some("".isThatMe, str);
+arr.every("".isThatMe, str);
+arr.map("".isThatMe, str);
diff --git a/src/v8/test/mjsunit/regress/regress-1015.js b/src/v8/test/mjsunit/regress/regress-1015.js
new file mode 100644
index 0000000..9e4406a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1015.js
@@ -0,0 +1,66 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// See: http://code.google.com/p/v8/issues/detail?id=1015
+
+// Object and array literals should be created using DefineOwnProperty, and
+// therefore not hit setters in the prototype.
+
+function mkFail(message) {
+ return function () { assertUnreachable(message); }
+}
+
+Object.defineProperty(Object.prototype, "foo",
+ {get: mkFail("oget"), set: mkFail("oset")});
+Object.defineProperty(Array.prototype, "2",
+ {get: mkFail("aget"), set: mkFail("aset")});
+
+function inFunction() {
+ for (var i = 0; i < 10; i++) {
+ // in loop.
+ var ja = JSON.parse('[1,2,3,4]');
+ var jo = JSON.parse('{"bar": 10, "foo": 20}')
+ var jop = JSON.parse('{"bar": 10, "__proto__": { }, "foo": 20}')
+ var a = [1,2,3,4];
+ var o = { bar: 10, foo: 20 };
+ var op = { __proto__: { set bar(v) { assertUnreachable("bset"); } },
+ bar: 10 };
+ }
+}
+
+for (var i = 0; i < 10; i++) {
+ // In global scope.
+ var ja = JSON.parse('[1,2,3,4]');
+ var jo = JSON.parse('{"bar": 10, "foo": 20}')
+ var jop = JSON.parse('{"bar": 10, "__proto__": { }, "foo": 20}')
+ var a = [1,2,3,4];
+ var o = { bar: 10, foo: 20 };
+ var op = { __proto__: { set bar(v) { assertUnreachable("bset"); } },
+ bar: 10 };
+ // In function scope.
+ inFunction();
+}
diff --git a/src/v8/test/mjsunit/regress/regress-1017.js b/src/v8/test/mjsunit/regress/regress-1017.js
new file mode 100644
index 0000000..440449a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1017.js
@@ -0,0 +1,35 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// See: http://code.google.com/p/v8/issues/detail?id=1017
+
+// 32 ASCII-characters followed by a non-ASCII character.
+// This causes an internal buffer to first expand to 64 bytes, then expand the
+// 32 ASCII characters to 64 bytes of UC16 characters, leaving no room
+// to store the 33rd character. This fails an ASSERT in debug mode.
+
+assertEquals(33, "12345678901234567890123456789012\u2028".length);
diff --git a/src/v8/test/mjsunit/regress/regress-1020.js b/src/v8/test/mjsunit/regress/regress-1020.js
new file mode 100644
index 0000000..307a61e
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1020.js
@@ -0,0 +1,32 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function isObject(o) {
+ return o instanceof Object;
+}
+
+assertTrue(isObject(Object));
diff --git a/src/v8/test/mjsunit/regress/regress-1030466.js b/src/v8/test/mjsunit/regress/regress-1030466.js
new file mode 100644
index 0000000..8427ba0
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1030466.js
@@ -0,0 +1,45 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Whenever we enter a with-scope, we copy the context. This in itself is fine
+// (contexts may escape), but when leaving a with-scope, we currently also copy
+// the context instead of reverting to the original. This does not work because
+// inner functions may already have been created using the original context. In
+// the failing test case below, the inner function is run in the original context
+// (where x is undefined), but the assignment to x after the with-statement is
+// run in the copied context:
+
+var result = (function outer() {
+ with ({}) { }
+ var x = 10;
+ function inner() {
+ return x;
+ };
+ return inner();
+})();
+
+assertEquals(10, result);
diff --git a/src/v8/test/mjsunit/regress/regress-103259.js b/src/v8/test/mjsunit/regress/regress-103259.js
new file mode 100644
index 0000000..447073c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-103259.js
@@ -0,0 +1,36 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var a = [];
+a[8192] = '';
+assertTrue(%HasDictionaryElements(a));
+var uc16 = '\u0094';
+var test = uc16;
+for (var i = 0; i < 13; i++) test += test;
+assertEquals(test, a.join(uc16));
diff --git a/src/v8/test/mjsunit/regress/regress-1036894.js b/src/v8/test/mjsunit/regress/regress-1036894.js
new file mode 100644
index 0000000..03ed8f9
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1036894.js
@@ -0,0 +1,38 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+assertThrows("$=function anonymous() { /*noex*/do {} while(({ get x(x) { break ; }, set x() { (undefined);} })); }");
+
+function foo() {
+ assertThrows("$=function anonymous() { /*noex*/do {} while(({ get x(x) { break ; }, set x() { (undefined);} })); }");
+}
+foo();
+
+assertThrows("$=function anonymous() { /*noex*/do {} while(({ get x(x) { break ; }, set x() { (undefined);} })); }");
+
+xeval = function(s) { eval(s); }
+xeval('$=function(){L: {break L;break L;}};');
diff --git a/src/v8/test/mjsunit/regress/regress-1039610.js b/src/v8/test/mjsunit/regress/regress-1039610.js
new file mode 100644
index 0000000..757801f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1039610.js
@@ -0,0 +1,29 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Make sure that the Debug object does not return to the global object
+assertTrue(typeof(Debug) === 'undefined');
diff --git a/src/v8/test/mjsunit/regress/regress-105.js b/src/v8/test/mjsunit/regress/regress-105.js
new file mode 100644
index 0000000..877cb82
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-105.js
@@ -0,0 +1,43 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var custom_valueOf = function() {
+ assertEquals(null, custom_valueOf.caller);
+ return 2;
+}
+
+var custom_toString = function() {
+ assertEquals(null, custom_toString.caller);
+ return "I used to be an adventurer like you";
+}
+
+var object = {};
+object.valueOf = custom_valueOf;
+object.toString = custom_toString;
+
+assertEquals(2, Number(object));
+assertEquals('I', String(object)[0]);
diff --git a/src/v8/test/mjsunit/regress/regress-1050043.js b/src/v8/test/mjsunit/regress/regress-1050043.js
new file mode 100644
index 0000000..e42728f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1050043.js
@@ -0,0 +1,51 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function unsignedShiftRight(val, shift) {
+ return val >>> shift;
+}
+
+assertEquals( 15, unsignedShiftRight(15, 0), "15 >>> 0");
+assertEquals( 7, unsignedShiftRight(15, 1), "15 >>> 1");
+assertEquals( 3, unsignedShiftRight(15, 2), "15 >>> 2");
+
+assertEquals(4294967288, unsignedShiftRight(-8, 0), "-8 >>> 0");
+assertEquals(2147483644, unsignedShiftRight(-8, 1), "-8 >>> 1");
+assertEquals(1073741822, unsignedShiftRight(-8, 2), "-8 >>> 2");
+
+assertEquals( 1, unsignedShiftRight(-8, 31), "-8 >>> 31");
+assertEquals(4294967288, unsignedShiftRight(-8, 32), "-8 >>> 32");
+assertEquals(2147483644, unsignedShiftRight(-8, 33), "-8 >>> 33");
+assertEquals(1073741822, unsignedShiftRight(-8, 34), "-8 >>> 34");
+
+assertEquals(2147483648, unsignedShiftRight(0x80000000, 0), "0x80000000 >>> 0");
+assertEquals(1073741824, unsignedShiftRight(0x80000000, 1), "0x80000000 >>> 1");
+assertEquals( 536870912, unsignedShiftRight(0x80000000, 2), "0x80000000 >>> 2");
+
+assertEquals(1073741824, unsignedShiftRight(0x40000000, 0), "0x40000000 >>> 0");
+assertEquals( 536870912, unsignedShiftRight(0x40000000, 1), "0x40000000 >>> 1");
+assertEquals( 268435456, unsignedShiftRight(0x40000000, 2), "0x40000000 >>> 2");
diff --git a/src/v8/test/mjsunit/regress/regress-1060.js b/src/v8/test/mjsunit/regress/regress-1060.js
new file mode 100644
index 0000000..8abe178
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1060.js
@@ -0,0 +1,32 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Make sure that we do not record multiple bailouts in the unoptimized code
+// for the (shared) .arguments proxy, even for calls.
+function f(x) { arguments; return x() + x(); }
+
+assertEquals("hesthest", f(function () { return "hest"; }));
diff --git a/src/v8/test/mjsunit/regress/regress-1062422.js b/src/v8/test/mjsunit/regress/regress-1062422.js
new file mode 100644
index 0000000..1e2c798
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1062422.js
@@ -0,0 +1,30 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// 1062422 Ensure that accessors can handle unexpected receivers.
+Number.prototype.__proto__ = String.prototype;
+assertEquals((123).length, 0)
diff --git a/src/v8/test/mjsunit/regress/regress-1066899.js b/src/v8/test/mjsunit/regress/regress-1066899.js
new file mode 100644
index 0000000..5840f26
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1066899.js
@@ -0,0 +1,36 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// This test case segfaults in generated code. See
+// issue #1066899.
+function Crash() {
+ for (var key in [0]) {
+ try { } finally { continue; }
+ }
+}
+
+Crash();
diff --git a/src/v8/test/mjsunit/regress/regress-1079.js b/src/v8/test/mjsunit/regress/regress-1079.js
new file mode 100644
index 0000000..208dc5b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1079.js
@@ -0,0 +1,48 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// Getting the arguments property of an optimized function should not crash,
+// even if called through our optimized version of Function.prototype.apply.
+
+function optimized() {
+ return unoptimized.apply(null, arguments);
+}
+
+// It's not crucial that this is unoptimized.
+function unoptimized() {
+ with ({}) {
+ return optimized.arguments;
+ }
+}
+
+for (var i = 0; i < 5; ++i) {
+ assertEquals(3, optimized(1, 2, 3).length);
+}
+%OptimizeFunctionOnNextCall(optimized);
+assertEquals(3, optimized(1, 2, 3).length);
diff --git a/src/v8/test/mjsunit/regress/regress-108296.js b/src/v8/test/mjsunit/regress/regress-108296.js
new file mode 100644
index 0000000..38ecda7
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-108296.js
@@ -0,0 +1,52 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// This test checks that young immediates embedded into code objects
+// are referenced through a cell.
+
+function f (k, a, b) {
+ // Create control flow for a.foo. Control flow resolution will
+ // be generated as a part of a gap move. Gap move operate on immediates as
+ // a.foo is a CONSTANT_FUNCTION.
+ var x = k ? a.foo : a.foo;
+ return x.prototype;
+}
+
+var a = { };
+
+// Make sure that foo is a CONSTANT_FUNCTION but not be pretenured.
+a.foo = (function () { return function () {}; })();
+
+// Ensure that both branches of ternary operator have monomorphic type feedback.
+f(true, a, a);
+f(true, a, a);
+f(false, a, a);
+f(false, a, a);
+%OptimizeFunctionOnNextCall(f);
+f(true, a, a);
diff --git a/src/v8/test/mjsunit/regress/regress-1083.js b/src/v8/test/mjsunit/regress/regress-1083.js
new file mode 100644
index 0000000..d231899
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1083.js
@@ -0,0 +1,38 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test that changing the generic descriptor flags on a property
+// on the global object doesn't break invariants.
+Object.defineProperty(this, 'Object', {enumerable:true});
+
+var desc = Object.getOwnPropertyDescriptor(this, 'Object');
+assertTrue(desc.enumerable);
+assertTrue(desc.configurable);
+assertFalse(desc.hasOwnProperty('get'));
+assertFalse(desc.hasOwnProperty('set'));
+assertTrue(desc.hasOwnProperty('value'));
+assertTrue(desc.writable);
diff --git a/src/v8/test/mjsunit/regress/regress-1092.js b/src/v8/test/mjsunit/regress/regress-1092.js
new file mode 100644
index 0000000..24efb37
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1092.js
@@ -0,0 +1,34 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test that CodeGenerator::EmitKeyedPropertyAssignment for the start
+// of an initialization block doesn't normalize the properties of the
+// JSGlobalProxy.
+this.w = 0;
+this.x = 1;
+this.y = 2;
+this.z = 3;
diff --git a/src/v8/test/mjsunit/regress/regress-1099.js b/src/v8/test/mjsunit/regress/regress-1099.js
new file mode 100644
index 0000000..49e4a52
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1099.js
@@ -0,0 +1,51 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// Test that LApplyArguments lithium instruction restores context after the call.
+
+function X() {
+ var slot = "foo"; return function (a) { return slot === a; }
+}
+
+function Y(x) {
+ var slot = "bar";
+ return function (a) {
+ x.apply(this, arguments);
+ return slot === 'bar';
+ };
+}
+
+var y = Y(X());
+
+for (var i = 0; i < 5; i++) {
+ assertTrue(y("foo"));
+}
+
+%OptimizeFunctionOnNextCall(y);
+assertTrue(y("foo"));
diff --git a/src/v8/test/mjsunit/regress/regress-1102760.js b/src/v8/test/mjsunit/regress/regress-1102760.js
new file mode 100644
index 0000000..890ecab
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1102760.js
@@ -0,0 +1,35 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function F() {
+ return arguments.length;
+}
+
+assertEquals(0, F.apply(), "no receiver or args");
+assertEquals(0, F.apply(this), "no args");
+assertEquals(0, F.apply(this, []), "empty args");
+assertEquals(0, F.apply(this, [], 0), "empty args, extra argument");
diff --git a/src/v8/test/mjsunit/regress/regress-1103.js b/src/v8/test/mjsunit/regress/regress-1103.js
new file mode 100644
index 0000000..4ad25b3
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1103.js
@@ -0,0 +1,32 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test that freezing the global object functions correctly and does not
+// freeze the global proxy.
+
+var obj = this;
+obj = Object.freeze(obj);
diff --git a/src/v8/test/mjsunit/regress/regress-1104.js b/src/v8/test/mjsunit/regress/regress-1104.js
new file mode 100644
index 0000000..aca0a66
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1104.js
@@ -0,0 +1,37 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// A redeclaration of a variable that aliases a parameter and so rewrites to
+// an arguments object access should not record duplicate AST IDs for
+// bailout.
+function test(f) {
+ function f() {}
+ function f() {}
+ return arguments;
+}
+
+test();
diff --git a/src/v8/test/mjsunit/regress/regress-110509.js b/src/v8/test/mjsunit/regress/regress-110509.js
new file mode 100644
index 0000000..132bd23
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-110509.js
@@ -0,0 +1,41 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// Verify that LRandom preserves rsi correctly.
+
+function foo() {
+ Math.random();
+ new Function("");
+}
+
+foo();
+foo();
+foo();
+%OptimizeFunctionOnNextCall(foo);
+foo();
diff --git a/src/v8/test/mjsunit/regress/regress-1106.js b/src/v8/test/mjsunit/regress/regress-1106.js
new file mode 100644
index 0000000..e462d5d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1106.js
@@ -0,0 +1,56 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// Test for issue 1106, where the optimizing compiler broke when accessing
+// a property lying on a prototype of the global object, and that prototype
+// object was in dictionary mode.
+
+x = Object.prototype;
+x.foo = 3;
+x.bar = 4;
+delete x.foo;
+x.foo = 5;
+
+function f() { return foo; }
+
+for (i=0 ; i < 5; ++i) {
+ assertEquals(5, f());
+}
+%OptimizeFunctionOnNextCall(f);
+assertEquals(5, f());
+
+// Test calls on functions defined in the prototype of the global object.
+x.gee = function() { return 42; }
+function g() { return gee(); }
+
+for (i=0 ; i < 5; ++i) {
+ assertEquals(42, g());
+}
+%OptimizeFunctionOnNextCall(g);
+assertEquals(42, g());
diff --git a/src/v8/test/mjsunit/regress/regress-1107.js b/src/v8/test/mjsunit/regress/regress-1107.js
new file mode 100644
index 0000000..4ba277a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1107.js
@@ -0,0 +1,32 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test that even if we cannot set element 0 on all the objects, we still
+// can format exception messages to some extent.
+
+Object.prototype.__defineGetter__(0, function(){});
+assertThrows("x");
diff --git a/src/v8/test/mjsunit/regress/regress-1110.js b/src/v8/test/mjsunit/regress/regress-1110.js
new file mode 100644
index 0000000..124f520
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1110.js
@@ -0,0 +1,37 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test that the illegal continue is thrown at parse time.
+
+try {
+ eval("function Crash() { assertUnreachable(); continue;if (Crash) { } }");
+ Crash();
+ assertUnreachable();
+} catch (e) {
+ assertTrue(e instanceof SyntaxError);
+ assertTrue(/continue/.test(e.message));
+}
diff --git a/src/v8/test/mjsunit/regress/regress-1110164.js b/src/v8/test/mjsunit/regress/regress-1110164.js
new file mode 100644
index 0000000..33f96af
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1110164.js
@@ -0,0 +1,46 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var o = { x: 0, f: function() { return 42; } };
+delete o.x; // go dictionary
+
+function CallF(o) {
+ return o.f();
+}
+
+// Make sure the call IC in CallF is initialized.
+for (var i = 0; i < 10; i++) assertEquals(42, CallF(o));
+
+var caught = false;
+o.f = 87;
+try {
+ CallF(o);
+} catch (e) {
+ caught = true;
+ assertTrue(e instanceof TypeError);
+}
+assertTrue(caught);
diff --git a/src/v8/test/mjsunit/regress/regress-1112.js b/src/v8/test/mjsunit/regress/regress-1112.js
new file mode 100644
index 0000000..41c9193
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1112.js
@@ -0,0 +1,35 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Regression test making sure that defineProperty on the global proxy
+// defines the property on the global object.
+
+Object.defineProperty(this,
+ 1,
+ { configurable: true, enumerable: true, value: 3 });
+assertEquals(3, this[1]);
+assertTrue(this.hasOwnProperty("1"));
diff --git a/src/v8/test/mjsunit/regress/regress-1112051.js b/src/v8/test/mjsunit/regress/regress-1112051.js
new file mode 100644
index 0000000..0af6bb4
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1112051.js
@@ -0,0 +1,33 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Regression test for issue #1112051.
+function f() { }
+assertThrows("f.call.apply()");
+assertThrows("f.call.apply(null)");
+assertThrows("f.call.apply(null, [], 0)");
+assertThrows("f.call.apply(null, [1,2,3,4,5,6,7,8,9], 0)");
diff --git a/src/v8/test/mjsunit/regress/regress-1114040.js b/src/v8/test/mjsunit/regress/regress-1114040.js
new file mode 100644
index 0000000..ef7ee31
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1114040.js
@@ -0,0 +1,57 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function TestBreak() {
+ var sequence = "";
+ for (var a in [0,1]) {
+ L: {
+ for (var b in [2,3,4]) {
+ break L;
+ }
+ }
+ sequence += a;
+ }
+ return sequence;
+}
+
+
+function TestContinue() {
+ var sequence = "";
+ for (var a in [0,1]) {
+ L: do {
+ for (var b in [2,3,4]) {
+ continue L;
+ }
+ } while (false);
+ sequence += a;
+ }
+ return sequence;
+}
+
+
+assertEquals("01", TestBreak());
+assertEquals("01", TestContinue());
diff --git a/src/v8/test/mjsunit/regress/regress-1117.js b/src/v8/test/mjsunit/regress/regress-1117.js
new file mode 100644
index 0000000..664dadd
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1117.js
@@ -0,0 +1,43 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// Test that we actually return the right value (-0) when we multiply
+// constant 0 with a negative integer.
+
+function foo(y) {return 0 * y; }
+assertEquals(1/foo(-42), -Infinity);
+assertEquals(1/foo(-42), -Infinity);
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(1/foo(-42), -Infinity);
+
+function bar(x) { return x * 0; }
+assertEquals(Infinity, 1/bar(5));
+assertEquals(Infinity, 1/bar(5));
+%OptimizeFunctionOnNextCall(bar);
+assertEquals(-Infinity, 1/bar(-5));
diff --git a/src/v8/test/mjsunit/regress/regress-1118.js b/src/v8/test/mjsunit/regress/regress-1118.js
new file mode 100644
index 0000000..05b192d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1118.js
@@ -0,0 +1,52 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// An exception thrown in a function optimized by on-stack replacement (OSR)
+// should be able to construct a receiver from all optimized stack frames.
+
+function A() { }
+A.prototype.f = function() { }
+
+function B() { }
+
+var o = new A();
+
+// This function throws if o does not have an f property, and should not be
+// inlined.
+function g() { try { return o.f(); } finally { }}
+
+// This function should be optimized via OSR.
+function h() {
+ for (var i = 0; i < 10; i++) %OptimizeOsr();
+ g();
+}
+
+h();
+o = new B();
+assertThrows("h()");
diff --git a/src/v8/test/mjsunit/regress/regress-1119.js b/src/v8/test/mjsunit/regress/regress-1119.js
new file mode 100644
index 0000000..1163ca0
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1119.js
@@ -0,0 +1,44 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test runtime declaration of properties with var which are intercepted
+// by JS accessors.
+
+this.__defineSetter__("x", function() { hasBeenInvoked = true; });
+this.__defineSetter__("y", function() { throw 'exception'; });
+
+var hasBeenInvoked = false;
+eval("try { } catch (e) { var x = false; }");
+assertTrue(hasBeenInvoked);
+
+// This has to run in global scope, so cannot use assertThrows...
+try {
+ eval("try { } catch (e) { var y = false; }");
+ assertUnreachable();
+} catch (e) {
+ assertEquals('exception', e);
+}
diff --git a/src/v8/test/mjsunit/regress/regress-1120.js b/src/v8/test/mjsunit/regress/regress-1120.js
new file mode 100644
index 0000000..c8c06aa
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1120.js
@@ -0,0 +1,33 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test that retrieving the extensible value for the global object is
+// working correctly and does not return the bit from the global proxy map.
+
+var obj = this;
+Object.freeze(obj);
+assertFalse(Object.isExtensible(obj));
diff --git a/src/v8/test/mjsunit/regress/regress-1121.js b/src/v8/test/mjsunit/regress/regress-1121.js
new file mode 100644
index 0000000..0ad29cc
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1121.js
@@ -0,0 +1,34 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// See: http://code.google.com/p/v8/issues/detail?id=1121
+
+// Test that changing Array.prototype.__proto__ keeps Array functions working.
+
+Array.prototype.__proto__ = null;
+// pop has custom call generator, so we need some beefier function.
+assertEquals([1, 2, 3], [1, 2, 3].slice());
diff --git a/src/v8/test/mjsunit/regress/regress-1122.js b/src/v8/test/mjsunit/regress/regress-1122.js
new file mode 100644
index 0000000..8f0bfb6
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1122.js
@@ -0,0 +1,66 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test that we can handle function calls with up to 32766 arguments, and
+// that function calls with more arguments throw an exception. Apply a
+// similar limit to the number of function parameters.
+
+// See http://code.google.com/p/v8/issues/detail?id=1122 and
+// http://code.google.com/p/v8/issues/detail?id=1413.
+
+function function_with_n_params_and_m_args(n, m) {
+ test_prefix = 'prefix ';
+ test_suffix = ' suffix';
+ var source = 'test_prefix + (function f(';
+ for (var arg = 0; arg < n ; arg++) {
+ if (arg != 0) source += ',';
+ source += 'arg' + arg;
+ }
+ source += ') { return arg' + (n - n % 2) / 2 + '; })(';
+ for (var arg = 0; arg < m ; arg++) {
+ if (arg != 0) source += ',';
+ source += arg;
+ }
+ source += ') + test_suffix';
+ return eval(source);
+}
+
+assertEquals('prefix 4000 suffix',
+ function_with_n_params_and_m_args(8000, 8000));
+assertEquals('prefix 3000 suffix',
+ function_with_n_params_and_m_args(6000, 8000));
+assertEquals('prefix 5000 suffix',
+ function_with_n_params_and_m_args(10000, 8000));
+assertEquals('prefix 9000 suffix',
+ function_with_n_params_and_m_args(18000, 18000));
+assertEquals('prefix 16000 suffix',
+ function_with_n_params_and_m_args(32000, 32000));
+assertEquals('prefix undefined suffix',
+ function_with_n_params_and_m_args(32000, 10000));
+
+assertThrows("function_with_n_params_and_m_args(66000, 30000)");
+assertThrows("function_with_n_params_and_m_args(30000, 66000)");
diff --git a/src/v8/test/mjsunit/regress/regress-1125.js b/src/v8/test/mjsunit/regress/regress-1125.js
new file mode 100644
index 0000000..b0e1cb7
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1125.js
@@ -0,0 +1,41 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test a lot of updates to freshly created contexts.
+
+function f(x, y) {
+ with ("abcdefghijxxxxxxxxxx")
+ var y = {};
+}
+
+function g() {
+ f.apply(this, arguments);
+}
+
+for (var i = 0; i < 150000; i++) {
+ g(i);
+}
diff --git a/src/v8/test/mjsunit/regress/regress-1126.js b/src/v8/test/mjsunit/regress/regress-1126.js
new file mode 100644
index 0000000..303583b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1126.js
@@ -0,0 +1,35 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// This should properly catch the exception from the setter triggered
+// by the loaded file, and it should not fail an assertion in debug mode.
+
+try {
+ eval('--');
+ assertUnreachable();
+} catch (e) {
+}
diff --git a/src/v8/test/mjsunit/regress/regress-1129.js b/src/v8/test/mjsunit/regress/regress-1129.js
new file mode 100644
index 0000000..37bf9a8
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1129.js
@@ -0,0 +1,44 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --verify-heap --expose-gc
+
+// This should not hit an assertion in debug mode.
+
+// Create RegExp that is syntactically correct, but throws a stack overflow
+// during compilation.
+var source = Array(50000).join("(") + "a" + Array(50000).join(")");
+var r = RegExp(source);
+try {
+ // Try to compile in UC16 mode, and drop the exception.
+ r.test("\x80");
+ assertUnreachable();
+} catch (e) {
+}
+
+// Trigger a heap validation.
+gc();
diff --git a/src/v8/test/mjsunit/regress/regress-1130.js b/src/v8/test/mjsunit/regress/regress-1130.js
new file mode 100644
index 0000000..6ba430b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1130.js
@@ -0,0 +1,40 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test that parser errors can be build up correctly even in the presence
+// of JS accessors on Object's prototype elements.
+
+Object.prototype.__defineGetter__(0, function() { throw 42; } );
+
+var exception = false;
+try {
+ eval("(function() { const x; var x })")();
+} catch (e) {
+ exception = true;
+ assertTrue(e instanceof SyntaxError);
+}
+assertTrue(exception);
diff --git a/src/v8/test/mjsunit/regress/regress-1131.js b/src/v8/test/mjsunit/regress/regress-1131.js
new file mode 100644
index 0000000..a1af9c9
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1131.js
@@ -0,0 +1,29 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var nonArray = { length: 4, 0: 42, 2: 37, 0xf7da5000: undefined, 4: 0 };
+Array.prototype.sort.call(nonArray);
diff --git a/src/v8/test/mjsunit/regress/regress-1132.js b/src/v8/test/mjsunit/regress/regress-1132.js
new file mode 100644
index 0000000..adb56b0
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1132.js
@@ -0,0 +1,50 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test the case when exception is thrown from the parser when lazy
+// compiling a function.
+
+// Flags: --stack-size=100
+// NOTE: stack size constant above has been empirically chosen.
+// If the test starts to fail in Genesis, consider increasing this constant.
+
+function test() {
+ try {
+ test(1, test(1));
+ } catch(e) {
+ assertFalse(delete e, "deleting catch variable");
+ assertEquals(42, e);
+ }
+}
+
+var exception = false;
+try {
+ test();
+} catch (e) {
+ exception = true;
+}
+assertTrue(exception);
diff --git a/src/v8/test/mjsunit/regress/regress-1134697.js b/src/v8/test/mjsunit/regress/regress-1134697.js
new file mode 100644
index 0000000..3d851ae
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1134697.js
@@ -0,0 +1,31 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Regression test case for issue 1134697.
+// Must run using valgrind.
+
+(-90).toPrecision(6);
diff --git a/src/v8/test/mjsunit/regress/regress-113924.js b/src/v8/test/mjsunit/regress/regress-113924.js
new file mode 100644
index 0000000..3ecdec4
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-113924.js
@@ -0,0 +1,31 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var count=12000;
+while(count--) {
+ eval("var a = new Object(10); a[2] += 7;");
+}
diff --git a/src/v8/test/mjsunit/regress/regress-114.js b/src/v8/test/mjsunit/regress/regress-114.js
new file mode 100644
index 0000000..6c1a6a3
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-114.js
@@ -0,0 +1,43 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// German eszett
+assertEquals("FRIEDRICHSTRASSE 14", "friedrichstra\xDFe 14".toUpperCase());
+assertEquals("XXSSSSSSXX", "xx\xDF\xDF\xDFxx".toUpperCase());
+assertEquals("(SS)", "(\xDF)".toUpperCase());
+assertEquals("SS", "\xDF".toUpperCase());
+
+// Turkish dotted upper-case I lower-case converts to two characters
+assertEquals("i\u0307", "\u0130".toLowerCase());
+assertEquals("(i\u0307)", "(\u0130)".toLowerCase());
+assertEquals("xxi\u0307xx", "XX\u0130XX".toLowerCase());
+
+// Greek small upsilon with dialytika and tonos upper-case converts to three
+// characters
+assertEquals("\u03A5\u0308\u0301", "\u03B0".toUpperCase());
+assertEquals("(\u03A5\u0308\u0301)", "(\u03B0)".toUpperCase());
+assertEquals("XX\u03A5\u0308\u0301XX", "xx\u03B0xx".toUpperCase());
diff --git a/src/v8/test/mjsunit/regress/regress-1146.js b/src/v8/test/mjsunit/regress/regress-1146.js
new file mode 100644
index 0000000..e8028ce
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1146.js
@@ -0,0 +1,48 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test keyed calls with different key types.
+function F() {}
+var a = new F();
+function f(i) { return a[i](); }
+
+a.first = function() { return 11; }
+a[0] = function() { return 22; }
+var obj = {};
+a[obj] = function() { return 33; }
+
+// Make object slow-case.
+a.foo = 0;
+delete a.foo;
+// Do multiple calls for IC transitions.
+var b = "first";
+f(b);
+f(b);
+
+assertEquals(11, f(b));
+assertEquals(22, f(0));
+assertEquals(33, f(obj));
diff --git a/src/v8/test/mjsunit/regress/regress-1149.js b/src/v8/test/mjsunit/regress/regress-1149.js
new file mode 100644
index 0000000..d7a7d1b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1149.js
@@ -0,0 +1,39 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// We should not try to record duplicate bailout IDs for the 'left-hand
+// side' of a for/in, even if it is a parameter in a function using the
+// arguments object.
+
+function f(x) {
+ for (x in arguments) {
+ for (x in arguments) {
+ }
+ }
+}
+
+f();
diff --git a/src/v8/test/mjsunit/regress/regress-1150.js b/src/v8/test/mjsunit/regress/regress-1150.js
new file mode 100644
index 0000000..57f739a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1150.js
@@ -0,0 +1,33 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test that Object.keys is working correctly on the global object.
+
+var a = 10;
+var global = (function () { return this; }) ();
+var keys = Object.keys(global);
+assertTrue(keys.indexOf("a") > 0);
diff --git a/src/v8/test/mjsunit/regress/regress-1151.js b/src/v8/test/mjsunit/regress/regress-1151.js
new file mode 100644
index 0000000..8d0bca9
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1151.js
@@ -0,0 +1,49 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test that we do not try to create prototypes on objects that has the,
+// should_have_prototype flag set to false.
+
+__defineSetter__.__proto__ = function() {};
+__defineSetter__['prototype']
+
+eval.__proto__ = function () { };
+eval['prototype'] = {};
+
+// Test that we are compatible with Safari on prototypes set locally and
+// on the actual prototype set using __proto__ on objects that has the
+// should_have_prototype set to false.
+function f() { return 42; }
+f.prototype = 43;
+__defineGetter__.__proto__ = f;
+
+// Regression test for not returning undefined.
+assertEquals(__defineGetter__.prototype, 43);
+
+// Regression test for not crashing.
+__defineGetter__.prototype = "foo";
+assertEquals(__defineGetter__.prototype, "foo");
diff --git a/src/v8/test/mjsunit/regress/regress-115100.js b/src/v8/test/mjsunit/regress/regress-115100.js
new file mode 100644
index 0000000..c917446
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-115100.js
@@ -0,0 +1,36 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function foo(obj) { obj.prop = 0; }
+function mk() { return Object.create(null); }
+
+foo(mk());
+foo(mk());
+%OptimizeFunctionOnNextCall(foo);
+foo(mk());
diff --git a/src/v8/test/mjsunit/regress/regress-115452.js b/src/v8/test/mjsunit/regress/regress-115452.js
new file mode 100644
index 0000000..f745e1b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-115452.js
@@ -0,0 +1,45 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test that a function declaration cannot overwrite a read-only property.
+
+function foobl() {}
+assertTrue(typeof this.foobl == "function");
+assertTrue(Object.getOwnPropertyDescriptor(this, "foobl").writable);
+
+Object.defineProperty(this, "foobl", {value: 1, writable: false});
+assertSame(1, this.foobl);
+assertFalse(Object.getOwnPropertyDescriptor(this, "foobl").writable);
+
+// This has to run in global scope, so cannot use assertThrows...
+try {
+ eval("function foobl() {}"); // Should throw.
+ assertUnreachable();
+} catch (e) {
+ assertInstanceof(e, TypeError);
+}
+assertSame(1, this.foobl);
diff --git a/src/v8/test/mjsunit/regress/regress-1156.js b/src/v8/test/mjsunit/regress/regress-1156.js
new file mode 100644
index 0000000..3446578
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1156.js
@@ -0,0 +1,49 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// Test that we do not crash we invoke builtins from optimized code that
+// is then deoptimized.
+
+function foo(a) {
+ delete a[1];
+ delete a[2];
+ delete a[3];
+ delete a[4];
+ delete a[5];
+ return void 0;
+}
+
+function call_and_deopt() {
+ var b = [1,2,3];
+ foo(b);
+ foo(b);
+ %DeoptimizeFunction(foo);
+}
+
+call_and_deopt();
diff --git a/src/v8/test/mjsunit/regress/regress-116.js b/src/v8/test/mjsunit/regress/regress-116.js
new file mode 100644
index 0000000..7b4620c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-116.js
@@ -0,0 +1,40 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var testCache = {};
+var doLookup = function(id) {
+ return testCache[id] = 'foo';
+};
+
+var r2 = doLookup(0);
+var r1 = doLookup([0]);
+
+assertFalse(r1 === testCache);
+assertEquals('foo', r1);
+assertEquals('f', r1[0]);
+assertEquals('foo', r2);
+assertEquals('f', r2[0]);
diff --git a/src/v8/test/mjsunit/regress/regress-1160.js b/src/v8/test/mjsunit/regress/regress-1160.js
new file mode 100644
index 0000000..10d3bc3
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1160.js
@@ -0,0 +1,41 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// See: http://code.google.com/p/v8/issues/detail?id=1160
+
+// Array.prototype.join uses a temporary array internally. Verify it
+// does not crash and throws an illegal argument exception instead
+// when keyed store on the array does not work as expected because of
+// the setter on its prototype.
+
+var N = 10;
+var array = Array(N);
+for (var i = 0; i < N; ++i) {
+ array[i] = i;
+}
+Array.prototype.__defineSetter__(2, function() { });
+assertEquals("0,1,2,3,4,5,6,7,8,9", array.join(","));
diff --git a/src/v8/test/mjsunit/regress/regress-1166.js b/src/v8/test/mjsunit/regress/regress-1166.js
new file mode 100644
index 0000000..8278aba
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1166.js
@@ -0,0 +1,40 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// Deoptimization after a short-circuit logical operation in an effect
+// context should not see the value of the expression.
+function observe(x, y) { return x; }
+
+function test(x) { return observe(1, ((false || false), x + 1)); }
+
+for (var i = 0; i < 5; ++i) test(0);
+%OptimizeFunctionOnNextCall(test);
+test(0);
+
+test("a");
diff --git a/src/v8/test/mjsunit/regress/regress-1167.js b/src/v8/test/mjsunit/regress/regress-1167.js
new file mode 100644
index 0000000..2206f3d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1167.js
@@ -0,0 +1,76 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// Deoptimization after a logical not in an effect context should not see a
+// value for the logical not expression.
+function test0(n) {
+ var a = new Array(n);
+ for (var i = 0; i < n; ++i) {
+ // ~ of a non-numeric value is used to trigger deoptimization.
+ a[i] = void(!(delete 'object')) % ~(delete 4);
+ }
+}
+
+// OSR (after deoptimization) is used to observe the stack height mismatch.
+for (var i = 0; i < 5; ++i) {
+ for (var j = 1; j < 12; ++j) {
+ test0(j * 1000);
+ }
+}
+
+
+// Similar test with a different subexpression of unary !.
+function test1(n) {
+ var a = new Array(n);
+ for (var i = 0; i < n; ++i) {
+ a[i] = void(!(- 'object')) % ~(delete 4);
+ }
+}
+
+for (i = 0; i < 5; ++i) {
+ for (j = 1; j < 12; ++j) {
+ test1(j * 1000);
+ }
+}
+
+
+// A similar issue, different subexpression of unary ! (e0 !== e1 is
+// translated into !(e0 == e1)) and different effect context.
+function side_effect() { }
+function observe(x, y) { return x; }
+function test2(x) {
+ return observe(this,
+ (((side_effect.observe <= side_effect.side_effect) !== false),
+ x + 1));
+}
+
+for (var i = 0; i < 5; ++i) test2(0);
+%OptimizeFunctionOnNextCall(test2);
+test2(0);
+test2(test2);
diff --git a/src/v8/test/mjsunit/regress/regress-1170.js b/src/v8/test/mjsunit/regress/regress-1170.js
new file mode 100644
index 0000000..5d5800e
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1170.js
@@ -0,0 +1,95 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var setter_value = 0;
+
+this.__defineSetter__("a", function(v) { setter_value = v; });
+eval("var a = 1");
+assertEquals(1, setter_value);
+assertFalse("value" in Object.getOwnPropertyDescriptor(this, "a"));
+
+eval("with({}) { eval('var a = 2') }");
+assertTrue("get" in Object.getOwnPropertyDescriptor(this, "a"));
+assertFalse("value" in Object.getOwnPropertyDescriptor(this, "a"));
+assertEquals(2, setter_value);
+
+// Function declarations are treated specially to match Safari. We do
+// not call setters for them.
+this.__defineSetter__("a", function(v) { assertUnreachable(); });
+eval("function a() {}");
+assertTrue("value" in Object.getOwnPropertyDescriptor(this, "a"));
+
+this.__defineSetter__("b", function(v) { setter_value = v; });
+try {
+ eval("const b = 3");
+} catch(e) { }
+assertEquals(2, setter_value);
+
+try {
+ eval("with({}) { eval('const b = 23') }");
+} catch(e) {
+ assertInstanceof(e, TypeError);
+}
+
+this.__defineSetter__("c", function(v) { throw 42; });
+try {
+ eval("var c = 1");
+ assertUnreachable();
+} catch(e) {
+ assertEquals(42, e);
+ assertFalse("value" in Object.getOwnPropertyDescriptor(this, "c"));
+}
+
+
+
+
+__proto__.__defineSetter__("aa", function(v) { assertUnreachable(); });
+eval("var aa = 1");
+assertTrue(this.hasOwnProperty("aa"));
+
+__proto__.__defineSetter__("bb", function(v) { assertUnreachable(); });
+eval("with({}) { eval('var bb = 2') }");
+assertTrue(this.hasOwnProperty("bb"));
+
+// Function declarations are treated specially to match Safari. We do
+// not call setters for them.
+__proto__.__defineSetter__("cc", function(v) { assertUnreachable(); });
+eval("function cc() {}");
+assertTrue(this.hasOwnProperty("cc"));
+
+__proto__.__defineSetter__("dd", function(v) { assertUnreachable(); });
+try {
+ eval("const dd = 23");
+} catch(e) {
+ assertUnreachable();
+}
+
+try {
+ eval("with({}) { eval('const dd = 23') }");
+} catch(e) {
+ assertInstanceof(e, TypeError);
+}
diff --git a/src/v8/test/mjsunit/regress/regress-1172-bis.js b/src/v8/test/mjsunit/regress/regress-1172-bis.js
new file mode 100644
index 0000000..01b637c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1172-bis.js
@@ -0,0 +1,39 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Verifies that exception thrown from JS accessors when attempting a call
+// are properly treated.
+
+Object.prototype.__defineGetter__(0, function() { throw 42; });
+var exception = false;
+try {
+ Object[0]();
+} catch(e) {
+ exception = true;
+ assertEquals(42, e);
+}
+assertTrue(exception);
diff --git a/src/v8/test/mjsunit/regress/regress-1172.js b/src/v8/test/mjsunit/regress/regress-1172.js
new file mode 100644
index 0000000..f5ef67b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1172.js
@@ -0,0 +1,39 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Check that 'constructor' property is forcefully installed on
+// function's prototype even in the presence of JS accessors.
+
+// Note: no setters would lead to runtime exception if we ever attempt
+// to use JS accessors to set 'constructor' property.
+Object.prototype.__defineGetter__('constructor', function() { throw 42; });
+
+function f() {}
+assertSame(f, f.prototype.constructor);
+
+var o = new f();
+assertSame(f, o.constructor);
diff --git a/src/v8/test/mjsunit/regress/regress-1173979.js b/src/v8/test/mjsunit/regress/regress-1173979.js
new file mode 100644
index 0000000..42649d0
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1173979.js
@@ -0,0 +1,48 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Ensure that null only equals null and undefined, also for variables.
+
+var null_var = null;
+var undef_var = [][0];
+var boolean_var = false;
+var number_var = 0;
+var string_var = "";
+var object_var = { foo : 0 };
+
+assertTrue(null_var == null_var);
+assertTrue(null_var == undef_var);
+assertTrue(null_var != boolean_var);
+assertTrue(null_var != number_var);
+assertTrue(null_var != string_var);
+assertTrue(null_var != object_var);
+
+assertTrue(undef_var == null_var);
+assertTrue(boolean_var != null_var);
+assertTrue(number_var != null_var);
+assertTrue(string_var != null_var);
+assertTrue(object_var != null_var);
diff --git a/src/v8/test/mjsunit/regress/regress-1174.js b/src/v8/test/mjsunit/regress/regress-1174.js
new file mode 100644
index 0000000..7c014bf
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1174.js
@@ -0,0 +1,43 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// Test that we do not crash when doing deoptimization of a function that has
+// reloc info that only take up 1 byte per call (like KeyedStoreIC).
+
+function Regular() {
+ this[0] >>= 0;
+ this[1] ^= 1;
+}
+
+function foo() {
+ var regular = new Regular();
+ %DeoptimizeFunction(Regular);
+}
+
+foo();
diff --git a/src/v8/test/mjsunit/regress/regress-117409.js b/src/v8/test/mjsunit/regress/regress-117409.js
new file mode 100644
index 0000000..98aab5a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-117409.js
@@ -0,0 +1,52 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-gc
+
+function KeyedStoreIC(a) { a[0] = Math.E; }
+
+// Create literal with a fast double elements backing store
+var literal = [1.2];
+
+// Specialize the IC for fast double elements
+KeyedStoreIC(literal);
+KeyedStoreIC(literal);
+
+// Truncate array to 0 elements, at which point backing store will be replaced
+// with empty fixed array.
+literal.length = 0;
+
+// ArrayPush built-in will replace empty fixed array backing store with 19
+// elements fixed array backing store. This leads to a mismatch between the map
+// and the backing store. Debug mode will crash here in set_elements accessor.
+literal.push(Math.E, Math.E);
+
+// Corrupt the backing store!
+KeyedStoreIC(literal);
+
+// Release mode will crash here when trying to visit parts of E as pointers.
+gc();
diff --git a/src/v8/test/mjsunit/regress/regress-1175390.js b/src/v8/test/mjsunit/regress/regress-1175390.js
new file mode 100644
index 0000000..7b1a7e0
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1175390.js
@@ -0,0 +1,30 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --print-code --debug-code
+// Simply ensure that we can generate comments without crashing.
+a = 0;
diff --git a/src/v8/test/mjsunit/regress/regress-1176.js b/src/v8/test/mjsunit/regress/regress-1176.js
new file mode 100644
index 0000000..58eda1b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1176.js
@@ -0,0 +1,33 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+"use strict";
+function strict_delete_this() {
+ // "delete this" is allowed in strict mode.
+ delete this;
+}
+strict_delete_this();
diff --git a/src/v8/test/mjsunit/regress/regress-1177518.js b/src/v8/test/mjsunit/regress/regress-1177518.js
new file mode 100644
index 0000000..2ba3c11
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1177518.js
@@ -0,0 +1,39 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Make sure that natives and delayed natives don't use methods from the global
+// scope that could have been modified by input javascript.
+
+isFinite = 0;
+Math.floor = 0;
+Math.abs = 0;
+
+// uses Math.floor
+assertEquals(4, parseInt(4.5));
+
+// uses Math.abs, Math.floor and isFinite
+assertEquals('string', typeof (new Date(9999)).toString());
diff --git a/src/v8/test/mjsunit/regress/regress-1177809.js b/src/v8/test/mjsunit/regress/regress-1177809.js
new file mode 100644
index 0000000..703e607
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1177809.js
@@ -0,0 +1,31 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// The encoding of large pc jumps caused code to be overwritten with
+// relocation information. We pass this test if it does not crash.
+
+String.fromCharCode(48,48,48,59,32,102,111,110,116,45,119,101,105,103,104,116,58,98,111,108,100,59,102,111,110,116,45,102,97,109,105,108,121,58,65,114,105,97,108,44,32,72,101,108,118,101,116,105,99,97,44,32,115,97,110,115,45,115,101,114,105,102,44,86,101,114,100,97,110,97,34,32,99,111,108,111,114,61,34,35,70,70,48,48,48,48,34,62,70,79,82,69,88,47,80,65,82,38,35,51,48,52,59,60,119,98,114,32,47,62,84,69,32,38,35,51,48,52,59,38,35,51,53,48,59,76,69,77,76,69,82,38,35,51,48,52,59,60,47,102,111,110,116,62,60,47,115,112,97,110,62,60,47,116,100,62,10,60,47,116,114,62,60,116,114,62,10,60,116,100,32,97,108,105,103,110,61,34,108,101,102,116,34,62,60,115,112,97,110,32,105,100,61,34,97,99,95,100,101,115,99,34,62,60,102,111,110,116,32,115,116,121,108,101,61,34,102,111,110,116,45,115,105,122,101,58,49,49,112,120,59,32,99,111,108,111,114,58,35,48,48,48,48,48,48,59,32,102,111,110,116,45,102,97,109,105,108,121,58,65,114,105,97,108,44,32,72,101,108,118,101,116,105,99,97,44,32,115,97,110,115,45,115,101,114,105,102,44,86,101,114,100,97,110,97,34,62,38,112,111,117,110,100,59,47,36,32,50,32,112,105,112,44,32,89,84,76,32,49,50,32,112,105,112,44,65,108,116,38,35,51,48,53,59,110,32,51,32,99,101,110,116,46,32,83,97,98,105,116,32,83,112,114,101,97,100,45,84,38,117,117,109,108,59,114,60,119,98,114,32,47,62,107,32,66,97,110,107,97,115,38,35,51,48,53,59,32,65,86,65,78,84,65,74,73,60,47,102,111,110,116,62,60,47,115,112,97,110,62,60,47,116,100,62,10,60,47,116,114,62,60,116,114,62,10,60,116,100,32,97,108,105,103,110,61,34,108,101,102,116,34,62,60,100,105,118,32,105,100,61,34,97,99,95,117,114,108,34,62,60,102,111,110,116,32,115,116,121,108,101,61,34,102,111,110,116,45,115,105,122,101,58,49,48,112,120,59,32,99,111,108,111,114,58,35,70,70,54,54,57,57,59,32,102,111,110,116,45,102,97,109,105,108,121,58,65,114,105,97,108,44,32,72,101,108,118,101,116,105,99,97,44,32,115,97,110,115,45,115,101,114,105,102,44,86,101,114,100,97,110,97,34,62,119,119,119,46,104,101,100,101,102,111,60,119,98,114,32,47,62,110,108,105,110,101,46,99,111,109,60,47,102,111,110,116,62,60,47,100,105,118,62,60,47,116,100,62,60,47,116,114,62,60,47,116,97,98,108,101,62,60,47,116,100,62,60,47,116,114,62,60,116,114,62,10,60,116,100,32,99,108,97,115,115,61,34,97,99,95,107,97,114,105,109,34,32,104,101,105,103,104,116,61,34,50,48,37,34,32,98,103,99,111,108,111,114,61,34,35,70,70,70,70,70,70,34,32,105,100,61,34,116,97,119,52,34,32,97,108,105,103,110,61,34,108,101,102,116,34,32,118,97,108,105,103,110,61,34,109,105,100,100,108,101,34,32,111,110,70,111,99,117,115,61,34,115,115,40,39,103,111,32,116,111,32,119,119,119,46,107,97,108,101,100,101,60,119,98,114,32,47,62,46,99,111,109,39,44,39,97,119,52,39,41,34,32,111,110,77,111,117,115,101,79,118,101,114,61,34,115,115,40,39,103,111,32,116,111,32,119,119,119,46,107,97,108,101,100,101,60,119,98,114,32,47,62,46,99,111,109,39,44,39,97,119,52,39,41,34,32,32,111,110,77,111,117,115,101,79,117,116,61,34,99,115,40,41,34,32,111,110,67,108,105,99,107,61,34,103,97,40,39,104,116,116,112,58,47,47,97,100,115,101,114,118,101,114,46,109,121,110,101,116,46,99,111,109,47,65,100,83,101,114,118,101,114,47,99,108,105,99,107,46,106,115,112,63,117,114,108,61,56,56,49,48,48,50,53,49,50,49,55,54,51,57,52,54,50,51,49,56,52,52,48,51,57,54,48,48,54,51,49,51,54,54,52,52,56,50,56,54,50,48,49,49,49,52,55,51,55,54,52,51,50,57,50,52,50,56,51,53,56,51,54,53,48,48,48,48,53,56,49,55,50,56,57,53,48,48,52,49,57,48,54,56,56,55,50,56,49,55,48,55,53,48,57,50,55,53,55,57,57,51,54,53,50,52,54,49,51,56,49,57,53,55,52,53,50,49,52,50,55,54,48,57,53,57,56,52,55,50,55,48,56,52,51,49,54,52,49,54,57,53,48,56,57,50,54,54,54,48,57,49,54,53,55,57,48,57,49,55,57,52,55,52,55,57,50,48,55,50,55,51,51,53,51,50,55,53,50,54,55,50,56,48,51,57,49,56,54,50,56,55,49,51,55,48,52,51,49,51,52,55,56,51,54,51,52,53,50,54,55,53,57,48,57,48,56,54,57,49,52,53,49,49,52,55,53,50,120,49,57,50,88,49,54,56,88,51,56,88,52,49,88,56,48,56,48,88,65,39,41,34,32,115,116,121,108,101,61,34,99,117,114,115,111,114,58,112,111,105,110,116,101,114,34,62,10,60,116,97,98,108,101,32,119,105,100,116,104,61,34,49,53,54,34,32,98,111,114,100,101,114,61,34,48,34,32,99,101,108,108,115,112,97,99,105,110,103,61,34,49,34,32,99,101,108,108,112,97,100,100,105,110,103,61,34,49,34,62,10,60,116,114,62,10,32,32,60,116,100,32,97,108,105,103,110,61,34,108,101,102,116,34,32,62,60,115,112,97,110,32,105,100,61,34,97,99,95,116,105,116,108,101,34,62,60,102,111,110,116,32,115,116,121,108,101,61,34,102,111,110,116,45,115,105,122,101,58,49,50,112,120,59,32,99,111,108,111,114,58,35,70,70,48,48,48,48,59,32,102,111,110,116,45,119,101,105,103,104,116,58,98,111,108,100,59,102,111,110,116,45,102,97,109,105,108,121,58,65,114,105,97,108,44,32,72,101,108,118,101,116,105,99,97,44,32,115,97,110,115,45,115,101,114,105,102,44,86,101,114,100,97,110,97,34,32,99,111,108,111,114,61,34,35,70,70,48,48,48,48,34,62,66,108,117,101,32,72,111,117,115,101,32,77,105,107,115,101,114,39,100,101,32,38,35,51,53,48,59,111,107,33,60,47,102,111,110,116,62,60,47,115,112,97,110,62,60,47,116,100,62,10,60,47,116,114,62,60,116,114,62,10,60,116,100,32,97,108,105,103,110,61,34,108,101,102,116,34,62,60,115,112,97,110,32,105,100,61,34,97,99,95,100,101,115,99,34,62,60,102,111,110,116,32,115,116,121,108,101,61,34,102,111,110,116,45,115,105,122,101,58,49,49,112,120,59,32,99,111,108,111,114,58,35,48,48,48,48,48,48,59,32,102,111,110,116,45,102,97,109,105,108,121,58,65,114,105,97,108,44,32,72,101,108,118,101,116,105,99,97,44,32,115,97,110,115,45,115,101,114,105,102,44,86,101,114,100,97,110,97,34,62,66,108,117,101,32,72,111,117,115,101,32,77,105,107,115,101,114,39,100,101,32,65,110,110,101,108,101,114,101,32,38,79,117,109,108,59,122,101,108,32,70,105,121,97,116,32,83,65,68,69,67,69,32,50,57,44,57,54,32,89,84,76,33,60,47,102,111,110,116,62,60,47,115,112,97,110,62,60,47,116,100,62,10,60,47,116,114,62,60,116,114,62,10,60,116,100,32,97,108,105,103,110,61,34,108,101,102,116,34,62,60,100,105,118,32,105,100,61,34,97,99,95,117,114,108,34,62,60,102,111,110,116,32,115,116,121,108,101,61,34,102,111,110,116,45,115,105,122,101,58,49,48,112,120,59,32,99,111,108,111,114,58,35,70,70,54,54,57,57,59,32,102,111,110,116,45,102,97,109,105,108,121,58,65,114,105,97,108,44,32,72,101,108,118,101,116,105,99,97,44,32,115,97,110,115,45,115,101,114,105,102,44,86,101,114,100,97,110,97,34,62,119,119,119,46,107,97,108,101,100,101,60,119,98,114,32,47,62,46,99,111,109,60,47,102,111,110,116,62,60,47,100,105,118,62,60,47,116,100,62,60,47,116,114,62,60,47,116,97,98,108,101,62,60,47,116,100,62,60,47,116,114,62,60,116,114,62,10,60,116,100,32,99,108,97,115,115,61,34,97,99,95,107,97,114,105,109,34,32,104,101,105,103,104,116,61,34,50,48,37,34,32,98,103,99,111,108,111,114,61,34,35,70,70,70,70,70,70,34,32,105,100,61,34,116,97,119,53,34,32,97,108,105,103,110,61,34,108,101,102,116,34,32,118,97,108,105,103,110,61,34,109,105,100,100,108,101,34,32,111,110,70,111,99,117,115,61,34,115,115,40,39,103,111,32,116,111,32,119,119,119,46,98,105,116,109,101,100,60,119,98,114,32,47,62,101,110,46,99,111,109,39,44,39,97,119,53,39,41,34,32,111,110,77,111,117,115,101,79,118,101,114,61,34,115,115,40,39,103,111,32,116,111,32,119,119,119,46,98,105,116,109,101,100,60,119,98,114,32,47,62,101,110,46,99,111,109,39,44,39,97,119,53,39,41,34,32,32,111,110,77,111,117,115,101,79,117,116,61,34,99,115,40,41,34,32,111,110,67,108,105,99,107,61,34,103,97,40,39,104,116,116,112,58,47,47,97,100,115,101,114,118,101,114,46,109,121,110,101,116,46,99,111,109,47,65,100,83,101,114,118,101,114,47,99,108,105,99,107,46,106,115,112,63,117,114,108,61,51,51,54,49,55,53,56,50,56,51,56,50,53,52,57,55,54,49,48)
diff --git a/src/v8/test/mjsunit/regress/regress-117794.js b/src/v8/test/mjsunit/regress/regress-117794.js
new file mode 100644
index 0000000..5e11b40
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-117794.js
@@ -0,0 +1,57 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Loads specialized to be from the global object should not omit the
+// smi check on the receiver. The code below should not crash.
+
+print = function() {}
+
+function constructor() {};
+
+function assertHasOwnProperties(object, limit) {
+ for (var i = 0; i < limit; i++) { }
+}
+
+try {
+ Object.keys();
+} catch(exc2) {
+ print(exc2.stack);
+}
+
+var x1 = new Object();
+
+try {
+ new Function("A Man Called Horse", x1.d);
+} catch(exc3) {
+ print(exc3.stack);
+}
+
+try {
+ (-(true)).toPrecision(0x30, 'lib1-f1');
+} catch(exc1) {
+ print(exc1.stack);
+}
diff --git a/src/v8/test/mjsunit/regress/regress-1178598.js b/src/v8/test/mjsunit/regress/regress-1178598.js
new file mode 100644
index 0000000..cca5016
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1178598.js
@@ -0,0 +1,71 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Regression test cases for issue 1178598.
+
+
+// Make sure that catch variables can be accessed using eval.
+var value = (function() {
+ var result;
+ try {
+ throw 42;
+ } catch (e) {
+ result = eval("e");
+ }
+ return result;
+})();
+
+assertEquals(42, value);
+
+
+
+// Make sure that heap-allocated locals for catch variables aren't
+// visible outside the catch scope and that they are visible from
+// within.
+var value = (function() {
+ var result;
+ try {
+ throw 87;
+ } catch(e) {
+ // Force the 'e' variable to be heap-allocated
+ // by capturing it in a function closure.
+ (function() { e; });
+ result = eval("e");
+ }
+
+ // Expect accessing 'e' to yield an exception because
+ // it is not defined in the current scope.
+ try {
+ eval("e");
+ assertTrue(false); // should throw exception
+ } catch(exception) {
+ assertTrue(exception instanceof ReferenceError);
+ return result;
+ }
+})();
+
+assertEquals(87, value);
diff --git a/src/v8/test/mjsunit/regress/regress-1181.js b/src/v8/test/mjsunit/regress/regress-1181.js
new file mode 100644
index 0000000..d5b8ab1
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1181.js
@@ -0,0 +1,54 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// The first count times, test is called with an integer argument and
+// crankshaft produces code for int32 representation. Test that the
+// implementation correctly deoptimizes.
+
+// Flags: --allow-natives-syntax
+
+function test(x) {
+ var xp = x * 1 - 1;
+ return xp;
+}
+
+
+function check(count) {
+ %DeoptimizeFunction(test);
+ var i;
+ for(var x=0; x < count; x++){
+ for(var y=0; y < count; y++){
+ i = test(x / 100);
+ }
+ }
+ assertEquals((count - 1) / 100, i + 1);
+}
+
+
+check(150);
+check(200);
+check(350);
diff --git a/src/v8/test/mjsunit/regress/regress-1184.js b/src/v8/test/mjsunit/regress/regress-1184.js
new file mode 100644
index 0000000..0bb1b3c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1184.js
@@ -0,0 +1,47 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test the case when finally clause throws another exception (stack overflow)
+// which goes through some try/catch block---we need to clear v8::TryCatch
+// catcher as it doesn't catch original exception any more.
+
+o = {};
+o.__defineGetter__('foo', function() { throw 42; });
+function f() {
+ try {
+ // throw below sets up Top::thread_local_.catcher_...
+ throw 42;
+ } finally {
+ // ...JS accessor traverses v8 runtime/JS boundary and
+ // when coming back from JS to v8 runtime, retraverses
+ // stack with catcher set while processing exception
+ // which is not caught by external try catch.
+ try { o.foo; } catch(e) { };
+ return;
+ }
+};
+f();
diff --git a/src/v8/test/mjsunit/regress/regress-1187524.js b/src/v8/test/mjsunit/regress/regress-1187524.js
new file mode 100644
index 0000000..2aeb1c5
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1187524.js
@@ -0,0 +1,34 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Make sure we don't die on conversion to Smi in string indexing
+
+assertEquals(undefined, ""[0x40000000]);
+assertEquals(undefined, ""[0x80000000]);
+assertEquals(undefined, ""[-1]);
+assertEquals(undefined, ""[-0x40000001]);
+assertEquals(undefined, ""[-0x80000000]);
diff --git a/src/v8/test/mjsunit/regress/regress-119429.js b/src/v8/test/mjsunit/regress/regress-119429.js
new file mode 100644
index 0000000..859702a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-119429.js
@@ -0,0 +1,37 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var d = 0;
+function recurse() {
+ if (++d == 25135) { // A magic number just below stack overflow on ia32
+ %HandleDebuggerStatement();
+ }
+ recurse();
+}
+assertThrows(function() { recurse();} );
diff --git a/src/v8/test/mjsunit/regress/regress-119925.js b/src/v8/test/mjsunit/regress/regress-119925.js
new file mode 100644
index 0000000..6712754
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-119925.js
@@ -0,0 +1,34 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test that the throw is not inlined if object literals cannot be
+// inlined.
+Array.prototype.__proto__ = { 77e4 : null };
+function continueWithinLoop() {
+ for (var key in [(1.2)]) { }
+};
+continueWithinLoop();
diff --git a/src/v8/test/mjsunit/regress/regress-1199401.js b/src/v8/test/mjsunit/regress/regress-1199401.js
new file mode 100644
index 0000000..cc7985d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1199401.js
@@ -0,0 +1,75 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Ensure that we can correctly change the sign of the most negative smi.
+
+// Possible Smi ranges.
+var ranges = [{min: -1073741824, max: 1073741823, bits: 31},
+ {min: -2147483648, max: 2147483647, bits: 32}];
+
+for (var i = 0; i < ranges.length; i++) {
+ var range = ranges[i];
+ var min_smi = range.min;
+ var max_smi = range.max;
+ var bits = range.bits;
+ var name = bits + "-bit";
+
+ var result = max_smi + 1;
+
+ // Min smi as literal
+ assertEquals(result, eval(min_smi + " * -1"), name + "-litconmult");
+ assertEquals(result, eval(min_smi + " / -1"), name + "-litcondiv");
+ assertEquals(result, eval("-(" + min_smi + ")"), name + "-litneg");
+ assertEquals(result, eval("0 - (" + min_smi + ")")), name + "-conlitsub";
+
+ // As variable:
+ assertEquals(result, min_smi * -1, name + "-varconmult");
+ assertEquals(result, min_smi / -1, name + "-varcondiv");
+ assertEquals(result, -min_smi, name + "-varneg");
+ assertEquals(result, 0 - min_smi, name + "-convarsub");
+
+ // Only variables:
+ var zero = 0;
+ var minus_one = -1;
+
+ assertEquals(result, min_smi * minus_one, name + "-varvarmult");
+ assertEquals(result, min_smi / minus_one, name + "-varvardiv");
+ assertEquals(result, zero - min_smi, name + "-varvarsub");
+
+ // Constants as variables
+ assertEquals(result, eval(min_smi + " * minus_one"), name + "-litvarmult");
+ assertEquals(result, eval(min_smi + " / minus_one"), name + "-litvarmdiv");
+ assertEquals(result, eval("0 - (" + min_smi + ")"), name + "-varlitsub");
+
+ var half_min_smi = -(1 << (bits >> 1));
+ var half_max_smi = 1 << ((bits - 1) >> 1);
+
+ assertEquals(max_smi + 1, -half_min_smi * half_max_smi, name + "-half1");
+ assertEquals(max_smi + 1, half_min_smi * -half_max_smi, name + "-half2");
+ assertEquals(max_smi + 1, half_max_smi * -half_min_smi, name + "-half3");
+ assertEquals(max_smi + 1, -half_max_smi * half_min_smi, name + "-half4");
+}
diff --git a/src/v8/test/mjsunit/regress/regress-1199637.js b/src/v8/test/mjsunit/regress/regress-1199637.js
new file mode 100644
index 0000000..ae7c5e0
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1199637.js
@@ -0,0 +1,75 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// Make sure that we can introduce global variables that shadow even
+// READ_ONLY variables in the prototype chain.
+var NONE = 0;
+var READ_ONLY = 1;
+
+// Use DeclareGlobal...
+%AddNamedProperty(this.__proto__, "a", 1234, NONE);
+assertEquals(1234, a);
+eval("var a = 5678;");
+assertEquals(5678, a);
+
+%AddNamedProperty(this.__proto__, "b", 1234, NONE);
+assertEquals(1234, b);
+eval("var b = 5678;");
+assertEquals(5678, b);
+
+%AddNamedProperty(this.__proto__, "c", 1234, READ_ONLY);
+assertEquals(1234, c);
+eval("var c = 5678;");
+assertEquals(5678, c);
+
+%AddNamedProperty(this.__proto__, "d", 1234, READ_ONLY);
+assertEquals(1234, d);
+eval("var d = 5678;");
+assertEquals(5678, d);
+
+// Use DeclareContextSlot...
+%AddNamedProperty(this.__proto__, "x", 1234, NONE);
+assertEquals(1234, x);
+eval("with({}) { var x = 5678; }");
+assertEquals(5678, x);
+
+%AddNamedProperty(this.__proto__, "y", 1234, NONE);
+assertEquals(1234, y);
+eval("with({}) { var y = 5678; }");
+assertEquals(5678, y);
+
+%AddNamedProperty(this.__proto__, "z", 1234, READ_ONLY);
+assertEquals(1234, z);
+eval("with({}) { var z = 5678; }");
+assertEquals(5678, z);
+
+%AddNamedProperty(this.__proto__, "w", 1234, READ_ONLY);
+assertEquals(1234, w);
+eval("with({}) { var w = 5678; }");
+assertEquals(5678, w);
diff --git a/src/v8/test/mjsunit/regress/regress-1200351.js b/src/v8/test/mjsunit/regress/regress-1200351.js
new file mode 100644
index 0000000..f752a1e
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1200351.js
@@ -0,0 +1,2032 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Make sure the 'constructor' property isn't enumerable.
+var enums = "";
+for (var k in this) enums += (k + '|');
+assertEquals(-1, enums.split('|').indexOf("constructor"));
+
+// Make sure this doesn't crash.
+new this.constructor;
+new this.constructor();
+new this.constructor(1,2,3,4,5,6);
+
+var x = 0;
+try {
+ eval("SetValueOf(typeof(break.prototype.name), Math.max(typeof(break)))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("export Join((void), false.className(), null instanceof continue, return 'a', 0.__defineGetter__(x,function(){native}))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("with ({ void&&null.push(goto NaN) : Math.max(undef).toText }) { {-1/null,1.isNull} }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new break>>>=native.charCodeAt(-1.valueOf())")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new Number(this > native)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new {native,0.2}?continue+undef:IsSmi(0.2)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("const x = break.toString()&&return continue")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("for (-1==continue.toJSONProtocol, GetFunctionFor(break.call(NaN)), (!new RegExp).prototype.new Object()<<void) { debugger.__defineSetter__(null,function(){continue})>>>=GetFunctionFor(-1) }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("for (parseFloat(NaN).splice() in null.add(1).className()) { true[0.2]<<x.splice() }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("let (debugger.constructor.valueOf()) { this.sort().true.splice() }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("unescape(break.toObject()).prototype.new RegExp.continue.__lookupGetter__(x.slice(1, NaN)) = typeof(null.push(0.2))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new Date(Iterator(continue.pop()))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("function X(x) { return new RegExp.shift().concat({debugger,continue}) }; X(return goto 0)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("Instantiate(0.add(break)&&x > null)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("with ({ eval(Array(x)) : 1.call('a').superConstructor }) { debugger.lastIndex.toLocaleString() }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("x = return true.__defineGetter__(this,function(){0.2})")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("x = new typeof(0)&this.lastIndex")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("String(new RegExp.call(1)).prototype.unescape(parseFloat(-1)) = false<<true.x.lastIndexOf(1)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("with ({ 1+debugger.valueOf() : continue.join().name() }) { parseInt(true)==undef.sort() }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new RegExp>>0.2.superConstructor.prototype.eval(void).className() = false.join().prototype.name")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("export (new Object()?undef:native)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("x = new null.isNull.slice(x.prototype.value, Iterator(undef))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("export function () { 0.2 }.unshift()")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new Math.max(continue.valueOf())")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("x = return debugger.toObject()")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("switch (-1.length+new Object().prototype.name) { case (debugger.constructor.sort()): IsPrimitive(undef.__defineSetter__(undef,function(){native})); break; }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("delete (!new Object().toLocaleString())")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new Date(0<<'a'>>>=new RegExp['a'])")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("native {unescape(true),new RegExp.isNull}")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("const x = -1.lastIndexOf(false)?parseFloat(void):Join(null, continue, new Object(), x, break)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("label null/void-break.__lookupGetter__(native)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new Function(0.2.join().constructor)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("label function () { false }.__lookupGetter__(this==1)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("Instantiate(-1.prototype.0.2.unshift())")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("const x = new return goto -1")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new {Number(debugger)}")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("if (parseInt(break) instanceof 0.length) { this.(!0.2) }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("SetValueOf(break.superConstructor[throw new false(true)], this.~x)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("SetValueOf(function () { IsSmi(-1) }, unescape(IsPrimitive(void)))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("for (new RegExp.join().className() in new Object().length()>>true.toObject()) { parseFloat(escape(debugger)) }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("const x = new String(debugger).toJSONProtocol")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("SetValueOf(1.indexOf('a')<<break.__lookupGetter__('a'), new Object().null.prototype.new RegExp.charCodeAt(-1))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("const x = new {parseInt(0)}")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new Date(void.join().add(escape(undef)))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("native parseFloat(false.charAt(new RegExp))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new Date(~Iterator(void))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new Function(NaN.shift().toJSONProtocol)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new Date(native-debugger<<continue.slice(x, new RegExp))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("x = parseFloat(~new Object())")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("for (null.size/true.add(void) in 0+continue&true.null) { continue.toObject()/throw new true(debugger) }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("for (Iterator(native+break) in debugger.superConstructor.constructor) { Math.max(0.add(undef)) }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new {-1.add(native),true.sort()}")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new {IsSmi(break),throw new 'a'(null)}")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("switch (parseInt(0).length()) { case ('a'.toObject().__defineSetter__(GetFunctionFor(null),function(){(!x)})): IsSmi(void).constructor; break; }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("x = new 0.lastIndexOf(NaN).shift()")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("with ({ 0>>>=this.lastIndex : new Object().lastIndexOf(true).toObject() }) { x.lastIndex > 1.__defineSetter__(false,function(){this}) }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("with ({ throw new false(0.2).prototype.name : parseFloat(false)+(!debugger) }) { escape(undef.lastIndex) }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("Math.pow(0.2).toJSONProtocol.prototype.break.superConstructor.slice(NaN.exec(undef), -1.lastIndexOf(NaN)) = true.splice().length")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("native continue.className().constructor")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("let (0.2.isNull&undef.toString()) { continue/void+parseInt(null) }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("const x = new Math.pow(break==this)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("SetValueOf(continue.__lookupGetter__(null).constructor, debugger.filter(0.2)>>>=this.'a')")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("with ({ 0.2.unshift() > true.size : return Math.max(new RegExp) }) { void.splice().toString() }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new unescape(false).unshift()")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("function X(x) { return this.true?'a'==this:0.2.__lookupGetter__(void) }; X(Iterator(false).length)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("const x = function () { null }.__defineSetter__(0.charCodeAt(new Object()),function(){null>>>=new Object()})")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("import goto 'a'.charAt(native.className())")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("import 0.2.isNull.__lookupGetter__(debugger.size)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("for (~new Object().push(Array(null)) in new RegExp>>>=void.prototype.name) { goto break.lastIndex }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("delete String(x).slice(String('a'), parseFloat(false))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new parseInt(continue.__defineGetter__(0.2,function(){1}))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("Instantiate(true.concat(undef)==0.2.new RegExp)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("function X(x) { return NaN['a']?-1.exec(0):NaN.prototype.this }; X(native.prototype.name.toLocaleString())")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("for (debugger==continue.toObject(), Array(NaN.className()), Math.max(new RegExp).prototype.value) { GetFunctionFor('a').prototype.value }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("const x = new parseInt(break)==Array(x)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("for (parseInt(0.2.charCodeAt(this)), this.continue.prototype.name, native.superConstructor.superConstructor) { Join(0.__defineGetter__(continue,function(){undef}), {1}, parseFloat(0), undef.__defineSetter__(break,function(){null}), x?-1:-1) }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("export Join(debugger.splice(), parseInt(NaN), new RegExp.pop(), this.false, x.-1)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("x = Math.max(native).charCodeAt(continue==break)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("for (void==NaN.sort(), new Object()==new RegExp.toObject(), -1/NaN.unshift()) { GetFunctionFor(true).name() }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("for ((!'a'.join()), ~NaN.__defineGetter__(undef,function(){this}), Math.pow(NaN).__lookupGetter__(typeof(false))) { throw new debugger.toObject()(Math.max(-1)) }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("for (NaN.shift()&&undef&&continue in throw new x(NaN).prototype.-1&x) { return native.toJSONProtocol }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("x = new (0).charAt(this.charCodeAt(new Object()))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("function X(x) { return x.valueOf().size }; X(0.2.unshift().unshift())")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("if (eval(new Object().valueOf())) { break.prototype.name.__defineGetter__(eval(NaN),function(){Math.max(native)}) }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("for (Math.pow(1).isNull in Iterator(continue.length())) { Join(true, 0.2, null, x, new Object()).length }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("SetValueOf(0>>>=void.unshift(), void.exec('a').undef.length())")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("delete throw new this(0.2).pop()")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new Iterator(unescape(continue))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("function X(x) { return unescape(goto debugger) }; X(new RegExp.push(break).name())")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("x = undef/'a'.indexOf(-1.exec(false))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("for (continue.isNull.filter(this.toText), function () { throw new 'a'(0.2) }, native?break:undef.prototype.return continue) { Array(void.toText) }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("const x = new this.slice(new Object(), 1).isNull")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("for (0.2.className().call((!debugger)), native.__defineGetter__(0,function(){x}).name(), null.splice().splice()) { NaN.charCodeAt(new Object()) > true.toString() }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("native false.length?new RegExp instanceof this:Array(undef)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new ~0.2.call(typeof(false))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new Number(0.2.sort())")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new x.join().shift()")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("switch (~new Object().toText) { case (new RegExp.unshift().exec(new RegExp<<debugger)): -1.length.exec(this.isNull); break; }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new parseInt(~true)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new unescape(debugger.call(null))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("const x = new GetFunctionFor(0.2).toObject()")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("delete IsPrimitive(null.join())")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("for (eval(0.2) instanceof debugger.splice() in null.superConstructor==new Object()&void) { Number(0+x) }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("let ('a'-continue?null.length():escape(continue)) { return undef.push(false.shift()) }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("for (Array(x.length) in 'a'.length().sort()) { goto (new Object()) }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("let (NaN==true.length) { IsPrimitive(0.2).prototype.value }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("SetValueOf(return true&&void, new RegExp.toObject().length())")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new Math.pow(void).length")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new Function(void.add(continue).charCodeAt(this.toObject()))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("export Join(break.toObject(), 0.2.isNull, false.call(0), break.filter(break), 1.length())")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("if (1/NaN.__lookupGetter__(undef.prototype.value)) { escape(eval(this)) }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new Function(Join(unescape(x), new RegExp.__defineGetter__(debugger,function(){NaN}), 'a'.indexOf(0.2), false.prototype.name, (this)))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("const x = new Math.pow(native).indexOf(1>>>=-1)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new RegExp?native:continue.join().prototype.Math.max(x.__defineSetter__(1,function(){continue})) = parseFloat(parseInt(null))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("native function () { new RegExp }.new RegExp.pop()")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("import typeof(new RegExp.valueOf())")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("switch (0.2.size>>NaN-continue) { case ('a'.push(true).indexOf(NaN.lastIndexOf(-1))): {0.2,x}.toObject(); break; }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("if (IsSmi(new Object())/false.filter('a')) { function () { Iterator(debugger) } }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("x = break.lastIndex.size")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new Function(new Object() > 0.length())")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("native IsPrimitive(continue)==break.charCodeAt(new Object())")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new break.true<<'a'-NaN")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new Number(-1?'a':-1)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("for (parseFloat('a'.exec(continue)) in (!new RegExp)&&0.2.toObject()) { {true,x}.add(void.prototype.NaN) }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("let (-1.prototype.value.join()) { (!1.prototype.name) }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new GetFunctionFor(continue).toJSONProtocol")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("for (Math.pow(continue.slice(null, native)), goto (!0), native?1:this.charAt(String(debugger))) { parseFloat(~this) }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("SetValueOf(debugger.pop().length, new RegExp.isNull.toText)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("for (typeof(new RegExp.slice(new RegExp, 0)) in native.toLocaleString().lastIndexOf(0.2.length())) { native>>>=new RegExp.length() }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("native x.join().className()")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new 0?0:true.toLocaleString()")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("x = IsPrimitive(0).concat(new Object().name())")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("x = new parseFloat(x)?this.valueOf():IsSmi(x)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("x = new 'a'.slice(null, -1).shift()")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("label 'a'+void.concat('a'>>>=-1)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new Function(escape(0.length))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("const x = parseInt(0.lastIndexOf(NaN))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("SetValueOf(null&debugger.valueOf(), 0[false].push(false.add(debugger)))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("x = parseInt(new RegExp.__lookupGetter__(break))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("SetValueOf(~false&&break>>0, new RegExp.lastIndex.add({this}))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("x = Join(break, continue, 0, debugger, NaN).toLocaleString()")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("import new Object().sort().superConstructor")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("const x = new IsSmi(goto -1)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("function X(x) { return Iterator(null).toObject() }; X(-1==new Object()==0.__lookupGetter__(native))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("native void.join().add(parseFloat(continue))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("let (function () { -1 }.shift()) { escape(1.unshift()) }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new Function(new RegExp.indexOf(1).filter(continue instanceof break))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("if (NaN?continue:NaN.shift()) { native.push(null).add(new Object().superConstructor) }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("function X(x) { return new Object().length().toText }; X(debugger.indexOf(this).toText)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("const x = new Object().call('a').charCodeAt(native.size)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new function () { continue }.add(true.slice(continue, new RegExp))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("x[native] instanceof -1.join().prototype.this.null.size = 0.2.prototype.x+0.2.indexOf(false)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("for (this instanceof new RegExp.splice() in null>>>=new RegExp.valueOf()) { function () { unescape(1) } }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("for (true.shift()/native.null in undef.call(NaN).isNull) { native+this-x.size }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("function X(x) { return false.pop()<<Join(continue, false, break, NaN, -1) }; X(IsSmi(debugger>>x))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("if ({parseFloat(null),Math.max(native)}) { 0.2-new Object().__lookupGetter__(eval(new Object())) }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("SetValueOf(Array(1).toLocaleString(), null.name().exec(undef.filter(false)))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new Function(true.filter(this).pop())")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("let (break.lastIndex.superConstructor) { new Object().toString().length() }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("label (!0.2/debugger)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("with ({ NaN.concat(new RegExp)+Join(1, false, new Object(), new Object(), x) : unescape(x).concat(Iterator(-1)) }) { 'a'.isNull.__lookupGetter__(this+native) }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("export break.name()/IsPrimitive(this)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new {null}.prototype.value")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new true+false.__lookupGetter__(null&continue)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("if (-1.push(new RegExp)[void.valueOf()]) { new RegExp.className().__lookupGetter__(Array(0)) }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("export NaN.__lookupGetter__(undef).__lookupGetter__(void.isNull)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("with ({ ~new RegExp.filter(undef&&this) : String(continue)<<NaN.toText }) { this.exec(this).length }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("for (true&void.exec(void.exec(continue)) in Join('a', undef, new Object(), continue, x) instanceof {undef}) { unescape(-1.prototype.name) }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("import void.push(true).join()")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("SetValueOf({break}&x.name(), 1.charAt(false).slice(continue.superConstructor, this&&break))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("let (this.call(this) > Iterator(continue)) { new Object().prototype.value.slice(1.slice(native, -1), (!false)) }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("export parseInt(new RegExp>>>=x)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("for (escape(x==debugger), NaN.shift()&debugger?false:0.2, (!new RegExp)&goto break) { unescape(x.toText) }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new Date(throw new NaN.toObject()(this?break:true))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new (typeof(this))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("for (unescape('a'/0) in ~new Object().lastIndex) { IsSmi(0).push(0.concat(0.2)) }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("(!new RegExp)[0.2 > new Object()].prototype.Number(debugger.join()) = native&-1.size")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new false.toJSONProtocol&&0.2.constructor")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("for (~0?0.2:undef in new RegExp.charCodeAt(0).prototype.name) { NaN.toLocaleString().splice() }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("for (~IsPrimitive(new RegExp), true.toString().size, null.charCodeAt('a') > null.concat(0)) { break.toJSONProtocol/IsPrimitive(break) }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new parseInt(new Object()).lastIndexOf(NaN > void)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("export break.splice()&&-1.prototype.new Object()")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("{{true,0}}.prototype.break.length.splice() = 'a'.toText.superConstructor")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("let (debugger>>>=continue > break.exec(1)) { Math.pow(new RegExp)==NaN>>>=0.2 }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("with ({ 0.2==0.2/goto true : IsSmi(native).isNull }) { throw new {x,null}(false.className()) }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("x = {false.concat(null),Math.pow(NaN)}")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("export Array(null).add(NaN.valueOf())")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("for (parseFloat(new Object()==true) in GetFunctionFor('a'&false)) { native&undef.toJSONProtocol }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("x = new {eval(null),(debugger)}")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("import {this.0,debugger.filter(NaN)}")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("import break.charAt(-1)<<false.__defineSetter__(0,function(){x})")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("x = goto false > new Object()")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("null.superConstructor[debugger.isNull].prototype.Math.max('a').shift() = parseInt(0).size")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("native eval(void.add(break))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new Date(x > void.join())")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("with ({ {this.toObject()} : Number(NaN).toJSONProtocol }) { 0.2.className().prototype.name }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("if (false.__defineGetter__(undef,function(){undef}).exec(NaN.splice())) { typeof(Join(void, new RegExp, break, -1, -1)) }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("for (false.splice().toObject(), continue.name().size, Join(void?debugger:this, new RegExp.__defineSetter__(NaN,function(){NaN}), x.unshift(), this.true, parseInt(break))) { undef<<continue.toText }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("let (this.0.indexOf(break)) { break.charAt(this).unshift() }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("import Join(new Object().splice(), this instanceof 1, parseFloat(NaN), undef.concat(x), void.className())")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new Function(goto NaN.toString())")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("label 'a'<<break.shift()")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("const x = Iterator(continue)[new Object()>>NaN]")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("x = Join(new RegExp, 'a', this, void, true)>>>=continue>>native")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("import new Object().toJSONProtocol.splice()")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("function X(x) { return undef.__defineSetter__(native,function(){void}).toJSONProtocol }; X(eval(x).charCodeAt('a'.concat(true)))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("Instantiate(throw new 0.2.__defineGetter__(NaN,function(){-1})(void&&new RegExp))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("const x = 0.unshift() > IsSmi(NaN)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("label x.call(null).lastIndex")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("SetValueOf(IsSmi(0.2.add(0)), x.add(break).this.__defineGetter__(undef,function(){new RegExp}))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("native Number(this).toObject()")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new NaN.shift().add(String(new Object()))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new null.name().splice()")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("const x = 1.undef.push(new Object().call(null))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new Function(parseInt(1).size)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("const x = this.x.sort()")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("Instantiate(continue.valueOf().prototype.new RegExp.splice())")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("Instantiate(this.charAt(continue)?undef+'a':unescape(1))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("SetValueOf({throw new 'a'(0.2),void.lastIndexOf(NaN)}, Math.pow(new Object().className()))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("if (1.slice(new Object(), this).valueOf()) { parseInt(true).pop() }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("with ({ 0.2.superConstructor.lastIndex : goto debugger<<Join(undef, 1, true, undef, debugger) }) { function () { NaN }.prototype.name }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("-1.exec(debugger).length.prototype.debugger > null.slice(Iterator(void), continue.concat(0)) = parseInt(throw new 1(1))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new Date(new Object().constructor.call(Number(1)))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("const x = new null.unshift().call(escape(x))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("switch (Math.pow(native).toLocaleString()) { case (false instanceof native.join()): Math.pow(NaN).size; break; }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("label function () { new Object() }.prototype.true.size")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("const x = Join('a', 0.2, false, new Object(), void).continue.className()")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("const x = IsPrimitive(break.__lookupGetter__(-1))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("x = new Object()>>0.2.prototype.name")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("const x = new IsPrimitive(new Object()).shift()")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("if (Array(parseInt(break))) { 'a'.toString().unshift() }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("const x = return 0.2>>>=-1?undef:undef")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new Object().splice().unshift().prototype.null&&native.__lookupGetter__(undef>>>=NaN) = (1<<break)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("delete NaN.charAt(1).concat(NaN.0.2)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("Instantiate(new RegExp.sort().toJSONProtocol)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("function X(x) { return GetFunctionFor(false).lastIndexOf(1.shift()) }; X(this.0.2.charCodeAt(0.2))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("for (goto NaN.toObject(), ~true.'a', parseInt(debugger)+eval(false)) { eval(0.2.constructor) }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("switch (parseInt(debugger).pop()) { case (this.push(true).valueOf()): Join(continue, debugger, native, native, debugger).filter(Array(continue)); break; }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("x = new debugger.sort() instanceof this>>1")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("with ({ parseFloat(false).prototype.(!new Object()) : {unescape(-1)} }) { Math.max(new RegExp.superConstructor) }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("Instantiate({Math.pow(break)})")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("import typeof(break.valueOf())")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("Instantiate(Math.pow(-1[new RegExp]))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("native IsPrimitive(1).concat({x,null})")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("NaN.length.prototype.value.prototype.function () { null==new Object() } = break.name()&IsPrimitive(0)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("delete NaN.prototype.-1.toString()")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new continue.unshift()+parseFloat(undef)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("const x = new NaN-break.call(false.pop())")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("native new RegExp.exec(break).pop()")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("SetValueOf({'a',null}.prototype.value, 1.shift() instanceof {'a',0})")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("for (debugger.valueOf().size, function () { x.unshift() }, IsSmi(1)&&true==native) { new Object().__defineGetter__(this,function(){'a'})&&eval(native) }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("export 'a'.pop().charCodeAt(x.className())")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("export String(IsSmi(debugger))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("typeof(debugger).valueOf().prototype.(1).lastIndexOf(this.break) = x.prototype.name.toLocaleString()")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("native Array(typeof(false))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new Function(1.__defineGetter__(1,function(){1}).null.constructor)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("x = 1.charAt(0).toObject()")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new Date(Math.max('a'.filter(new Object())))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new Date(void.prototype.name.unshift())")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("for (-1.toJSONProtocol.call(-1.size) in ~x.sort()) { eval(0&debugger) }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("for ('a'==undef.join() in Math.pow(IsSmi(false))) { undef > this>>goto x }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("Instantiate('a'.constructor.isNull)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("for (GetFunctionFor(this.slice(0.2, this)), this.prototype.void?null.unshift():native.className(), Number(new Object().call(-1))) { 0.splice() > debugger&&this }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("with ({ {goto new RegExp,Join(new Object(), native, continue, -1, x)} : NaN&x/{0,break} }) { this.lastIndexOf(new RegExp).join() }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("let (typeof(break.length())) { native&&false.sort() }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("x = new parseFloat(-1 instanceof break)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("label throw new continue.unshift()(null.shift())")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("import Math.max(0.2.toLocaleString())")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("function X(x) { return false.unshift().className() }; X(escape(NaN&NaN))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new Date(Join(native.toText, goto x, 0.2.splice(), Join('a', 0, void, NaN, 1), eval(native)))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("if (GetFunctionFor(true.prototype.name)) { parseInt(NaN).toLocaleString() }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new escape(native).__defineSetter__(return native,function(){undef > native})")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("const x = new typeof(true > 'a')")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("switch (debugger.prototype.0.2<<new RegExp+false) { case (native.splice().filter({x})): false&true.indexOf(1.__defineGetter__(native,function(){continue})); break; }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("label true-NaN.prototype.native.shift()")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new typeof(new RegExp.splice())")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("switch (function () { this.NaN }) { case (this.continue.prototype.parseFloat(false)): IsPrimitive(new Object()-'a'); break; }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("export break.__lookupGetter__(debugger).indexOf(native.pop())")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("switch (GetFunctionFor(NaN.lastIndex)) { case (new RegExp.lastIndex.toLocaleString()): NaN.join().indexOf(eval(-1)); break; }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("native {void.charAt(true)}")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new new Object()==NaN.join()")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new Date(typeof(Array(new Object())))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("label throw new (false)(eval(x))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new new RegExp.size.charAt(true > -1)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("x = debugger.toObject().charAt(this<<undef)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("with ({ 'a'.valueOf()+parseInt(undef) : IsPrimitive(null).lastIndex }) { NaN.toObject().isNull }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("x = new new Object()&&void.lastIndexOf(0.2.splice())")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("with ({ 1+1.name() : Join(Math.pow(debugger), new RegExp-1, x > 1, x<<-1, new RegExp.size) }) { undef[undef].size }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("delete native.call(-1).isNull")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("if (new Object()>>>=break==Math.pow(debugger)) { IsPrimitive(this).lastIndex }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("for ((!x&&new RegExp) in undef.toLocaleString().slice(new RegExp.indexOf(NaN), IsPrimitive(-1))) { false.size+debugger[x] }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("import 0.length.__defineGetter__(0.2.shift(),function(){'a'.className()})")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("Instantiate(goto new Object().push(void))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("with ({ Array(this.0) : parseFloat(void).pop() }) { escape(true).slice(continue.lastIndex, false.toObject()) }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new native==true.filter({NaN,-1})")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("for ('a'.__defineSetter__(continue,function(){-1}).unshift(), Array(undef).toLocaleString(), undef.__lookupGetter__(void).toLocaleString()) { parseInt(false/native) }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("this.x<<false.prototype.true.toLocaleString()==NaN.pop() = this.superConstructor>>Math.max(true)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("function X(x) { return this.prototype.name.splice() }; X(unescape(x).__lookupGetter__(Number(debugger)))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("x = new (!NaN).unshift()")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new Function(escape(Iterator(this)))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("function X(x) { return Number(new RegExp)<<this?true:-1 }; X(Number(null).lastIndex)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("export this.void.splice()")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("for (this.prototype.null.sort() in -1.className()&void.filter(new Object())) { GetFunctionFor(new Object()).pop() }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("label 0[break].sort()")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("for (null.length().toString(), eval(-1).toObject(), (!continue.concat(continue))) { true.name()/native<<new RegExp }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("for (unescape(null).sort(), Number(undef).charCodeAt(IsPrimitive(NaN)), null>>true/null.join()) { 0.2.toObject() > IsPrimitive(new RegExp) }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new Date({NaN,native}&&1+undef)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("Instantiate(IsPrimitive(undef>>>=1))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("for (Join(true, 'a', true, 1, NaN).add({1}), GetFunctionFor(new Object().push(new Object())), goto 1.length) { Math.pow(GetFunctionFor(native)) }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("function X(x) { return break.isNull > parseInt(continue) }; X((new RegExp instanceof 1))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("with ({ Number(false).indexOf(x instanceof new Object()) : function () { x.toString() } }) { false.name().indexOf(GetFunctionFor(null)) }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new Date('a'.constructor.prototype.name)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("GetFunctionFor(void&new Object()).prototype.debugger.add(null)[void.unshift()] = new RegExp.isNull.Iterator(this)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("delete false?break:undef.constructor")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("with ({ (native.filter(1)) : eval(this&&0.2) }) { undef.length instanceof new Object().toText }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("export String(break.lastIndexOf(null))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("label (!Iterator(new RegExp))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("SetValueOf(String(null==-1), {1&0})")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new Date(parseInt('a' > 0))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("SetValueOf(debugger.toJSONProtocol.indexOf(escape(0)), this.filter(null).__defineSetter__(continue.break,function(){debugger>>null}))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("this.name().length().prototype.goto false.exec(true.charCodeAt(continue)) = Join(-1-false, undef.superConstructor, 'a'.shift(), (!x), NaN.this)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new Function(typeof(new RegExp).sort())")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new 0.2.concat(x).splice()")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("for (goto void.indexOf(throw new x(1)), typeof(return new RegExp), IsPrimitive(-1).add(void.lastIndexOf(debugger))) { null.indexOf(void).toText }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("return new RegExp.pop().prototype.String(x.toObject()) = 1.superConstructor.charCodeAt(new RegExp.charCodeAt(null))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new null&true.prototype.name")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("const x = -1>>>=NaN.indexOf((debugger))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("const x = new parseFloat(null).splice()")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("import -1.lastIndexOf(new RegExp) instanceof throw new void(0.2)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("if ((0.shift())) { Join(IsPrimitive(-1), break.__defineSetter__(true,function(){break}), parseInt(null), parseFloat(break), true/null) }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("x = new escape(1 > continue)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("switch (parseInt(undef)>>false.filter(continue)) { case (this.undef/new Object()): 'a'.toJSONProtocol.__defineGetter__(new RegExp-undef,function(){parseFloat(new RegExp)}); break; }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("{void}.shift().prototype.this.Array(new Object()) = {0.2,new RegExp}.lastIndexOf(break.splice())")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new continue&&new Object().lastIndexOf(new Object() instanceof 1)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("for (throw new 'a'.exec(x)(return false), native/void.constructor, {native}==true.toLocaleString()) { goto 1 instanceof 1.isNull }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("for (break.concat(break) > native>>>=-1, (debugger.x), Join(x, void, void, new RegExp, null).name()) { void.charCodeAt(true).valueOf() }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("const x = new 'a'>>0 instanceof new Object().push(new RegExp)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("if (return ~break) { break.__defineGetter__(break,function(){-1}).shift() }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("Instantiate(Join(null, -1, undef, null, 0).toString())")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("let ({new RegExp,void}.slice(break.isNull, false.shift())) { eval(debugger.slice(this, 1)) }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("function X(x) { return {GetFunctionFor(0)} }; X('a'.prototype.debugger.concat(void.constructor))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("let (~true instanceof continue) { escape(new RegExp.toObject()) }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("escape(0[native]).prototype.debugger.add(1).unshift() = (true.join())")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("for (unescape(void).length, undef.toObject() instanceof x.toObject(), 0.2+true.concat(true.__lookupGetter__(this))) { (x).toJSONProtocol }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("Instantiate(escape(null).__lookupGetter__(undef.size))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("label Array(continue[false])")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("function X(x) { return Number(this&&false) }; X(NaN.toJSONProtocol.toJSONProtocol)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("null.toString().shift().prototype.Array(x).__lookupGetter__('a'.prototype.x) = {1.length,break.join()}")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("x = new 1.charCodeAt(break)+IsSmi(false)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("SetValueOf(String(this) > 0.2.toText, new RegExp.length.lastIndexOf(1<<0.2))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("switch (new RegExp.pop().charAt(IsSmi(new RegExp))) { case (native.indexOf(this)/native.lastIndex): this.debugger.indexOf(debugger); break; }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new Date(Number(x)[debugger.prototype.break])")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("function X(x) { return new RegExp>>>=x.unshift() }; X(Math.max(continue.name()))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("Instantiate(IsSmi(null.size))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("x = native?0.2:1+GetFunctionFor(void)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("for (IsPrimitive(-1)>>>=break.valueOf() in String(0 > 0.2)) { Math.max(true.length()) }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("switch (escape(unescape(NaN))) { case (Math.pow(eval(undef))): true.charAt(null)&new RegExp.pop(); break; }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("delete Join(new RegExp, 1, false, new Object(), this).toLocaleString()")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("label return x.filter(x.join())")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new new RegExp.pop().shift()")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("x = new (!debugger.size)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("label Math.max(debugger.__lookupGetter__(NaN))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("Instantiate(eval(debugger[debugger]))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new 0.2.filter(true)&throw new true(debugger)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new Date(continue.exec(debugger) > Math.pow(0.2))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("void.prototype.value.name().prototype.Number(undef&NaN) = false.__lookupGetter__(-1).name()")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("Instantiate(null.__defineGetter__(native,function(){continue}).valueOf())")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("with ({ {new Object()[continue],native.length()} : undef.name().superConstructor }) { Math.pow(break).indexOf(0.toJSONProtocol) }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("switch (Iterator(native.call(new RegExp))) { case (String(new RegExp).isNull): goto new RegExp.pop(); break; }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("const x = new x.constructor instanceof undef.indexOf(-1)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("SetValueOf(this.~null, continue.pop()&0&'a')")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("switch (GetFunctionFor(~0)) { case ('a'.'a'<<undef.__defineGetter__(false,function(){true})): (!1).lastIndex; break; }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("function X(x) { return debugger.unshift().0.toString() }; X(Number(break).0.2>>>=false)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new Date(Iterator(x)/undef.pop())")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("SetValueOf(undef.join().toLocaleString(), null.add(false).valueOf())")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("IsSmi(x).toString().prototype.0>>continue.indexOf(NaN.__lookupGetter__(new Object())) = ~-1&typeof(0)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("for (continue.__lookupGetter__(new RegExp).toObject(), false-0.toString(), return native.sort()) { new RegExp.name().className() }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("switch (escape(new RegExp).toString()) { case (goto eval(1)): this.filter(new Object()).call(new RegExp.slice(null, this)); break; }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("x = debugger-false.toText")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("const x = Number(null>>new RegExp)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("delete this&native.indexOf('a'.splice())")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("SetValueOf(~Math.max(break), 0.2.valueOf().length)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("Instantiate(Number(native.charCodeAt(x)))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("const x = new goto continue.add(0)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("delete typeof(debugger).name()")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("'a'<<false.toText.prototype.throw new true(1).lastIndex = 'a'.name().length")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("native 'a'.indexOf(debugger).charAt(NaN.add(new Object()))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("SetValueOf(break>>false.toString(), (false.indexOf(this)))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("delete goto NaN==(!debugger)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new Date(0.2.join().superConstructor)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("const x = new this.void.toLocaleString()")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("SetValueOf(x.exec(debugger)[GetFunctionFor(0)], native.toObject().exec(new RegExp.sort()))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("Instantiate(0.2.valueOf().toLocaleString())")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new Function(-1.toJSONProtocol.prototype.name)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new Date(Array(-1.shift()))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("export break.concat(undef).unshift()")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("native parseFloat(-1)?NaN.toText:debugger.toString()")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("for (void-continue/continue.prototype.undef in String(break.toText)) { parseInt(false).isNull }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("Instantiate(true.isNull.toObject())")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("with ({ typeof(debugger).toObject() : x.constructor>>>=null.__defineGetter__(native,function(){debugger}) }) { unescape(undef.lastIndexOf(false)) }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("export unescape(continue)<<native[0]")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("if (String(0).unescape(debugger)) { {break.pop(),0.2.constructor} }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("String({true}).prototype.break.length.call(false > 0.2) = GetFunctionFor(0.prototype.new RegExp)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("with ({ false.push(0.2).indexOf(Math.max(debugger)) : x&x.prototype.name }) { goto 1.lastIndex }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new Function(0.2.lastIndex&0.2?break:NaN)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("const x = -1.prototype.value.toText")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("import native.toLocaleString()-1.prototype.0")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("export debugger[-1].indexOf(Join(new Object(), 0, x, new Object(), 0.2))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("function X(x) { return (!true).lastIndexOf(true.splice()) }; X(NaN.toString().prototype.value)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("function X(x) { return continue.slice(-1, 1).prototype.true.name() }; X('a'.push(void).prototype.value)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("for (goto new RegExp.length(), x.sort().className(), Math.max(new RegExp.toJSONProtocol)) { (IsSmi(-1)) }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("const x = 0.splice()&&-1.sort()")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("let (Math.max(-1>>1)) { break.toLocaleString().toJSONProtocol }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new {void.prototype.break,new RegExp.toString()}")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new IsSmi(debugger).name()")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new 'a'.concat(undef).sort()")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("x = new {debugger.toObject(),'a' > false}")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("if (goto 1.concat(Join(x, undef, native, x, new Object()))) { new RegExp.prototype.name==new RegExp.superConstructor }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("function X(x) { return new Object().__defineGetter__(0.2,function(){0.2}).length() }; X(void.isNull<<parseFloat(NaN))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("delete continue.toJSONProtocol.toLocaleString()")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("for (continue.constructor.toObject() in true&&undef.toJSONProtocol) { String(0+break) }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("import true.call(continue)>>break.toString()")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("label escape(this) > Math.pow(new RegExp)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new {void}/IsSmi(new Object())")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("switch (native==null?debugger.prototype.name:null.toLocaleString()) { case (NaN.push(this).join()): (break instanceof continue); break; }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("x = new Math.pow(x.push(0))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new (Array(NaN))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("label IsSmi(new RegExp).toLocaleString()")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("label NaN.push(1).shift()")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("{escape(undef),debugger.filter(0.2)}.prototype.-1 > new RegExp[0.2.valueOf()] = new RegExp.prototype.value.splice()")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("x = new Join(0.2, x, continue, debugger, new Object()).size")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("with ({ Number(null).name() : Math.pow(true).__defineGetter__(debugger.toString(),function(){false+0.2}) }) { this.{x,break} }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new Math.pow(goto debugger)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("x = IsPrimitive(void.pop())")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("x = new Object().toString().toJSONProtocol")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("Instantiate(this.String(0.2))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("let ({-1.call(new RegExp)}) { break.length().splice() }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("import null.size.__defineGetter__(void.filter(x),function(){null.pop()})")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("const x = new IsPrimitive(null.superConstructor)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new eval(-1.prototype.continue)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("switch (typeof(Iterator('a'))) { case (0.constructor>>~1): void.__defineGetter__(void,function(){1})/GetFunctionFor(0); break; }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("for (false instanceof x.add(true.charAt(new RegExp)) in Join(undef.lastIndexOf(break), 0.2.add(new Object()), Iterator(1), {'a',x}, Array(new Object()))) { function () { null }/1&&-1 }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new escape('a'.concat(undef))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new Function(Math.pow(NaN).toText)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("x = new throw new 0(NaN).className()")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("delete String(GetFunctionFor(new Object()))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("x = Iterator(new Object()).charAt((0.2))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("Number(undef.charAt(1)).prototype.undef.lastIndexOf(true).slice(1.className(), undef.filter(-1)) = null<<null.push(parseInt('a'))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("x = {Math.max(1),IsSmi(new Object())}")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("switch (new Object().exec(0).isNull) { case (escape(IsSmi(false))): false.toObject()-null.size; break; }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new 'a'.__defineSetter__(debugger,function(){false}).name()")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("x = debugger?-1:0+true.prototype.1")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new {false instanceof continue,native.size}")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("GetFunctionFor(continue.__lookupGetter__(0.2)).prototype.Math.max(1.splice()) = true.__defineGetter__(undef,function(){NaN}).filter(String(new RegExp))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("null.size-1.toLocaleString().prototype.(this).shift() = GetFunctionFor(native.charAt(break))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("Instantiate((!null.indexOf(-1)))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("x = {break.sort()}")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new throw new debugger.splice()(this.__lookupGetter__(undef))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("unescape(x[native]).prototype.0.splice().-1.prototype.true = x.prototype.value.className()")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("export x+true.length")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("export debugger.indexOf(-1).indexOf(true.constructor)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("for ({break}.exec(new Object().continue) in eval(0.2.charAt(new Object()))) { throw new null.length(null?break:-1) }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("const x = NaN.toLocaleString().toObject()")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("function X(x) { return Math.pow(break+false) }; X(Join(true.add(new Object()), null[-1], new RegExp[true], NaN&&debugger, x.charAt(undef)))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("switch ((break).add(true.sort())) { case (undef.charAt(native).__defineGetter__(IsPrimitive(1),function(){NaN<<new RegExp})): -1.__defineSetter__(null,function(){-1}) > this.charCodeAt(this); break; }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("import return 0.2.length")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("continue.join().toText.prototype.Number(debugger).slice(new RegExp.-1, (NaN)) = function () { (!null) }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("export Number(break.__lookupGetter__(false))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new Date(return null/x)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("export Number(undef).shift()")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("const x = 1[native]/this&true")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("delete typeof(debugger.unshift())")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("import x.charAt(false)&-1>>x")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("if (null.toText.superConstructor) { typeof(-1).toString() }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("let (parseFloat(continue.superConstructor)) { 0.2.toText.prototype.value }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("label parseInt(IsSmi(null))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("delete new Object().valueOf().indexOf(true-x)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("x = new unescape(1.__defineGetter__(new Object(),function(){x}))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("let (undef.size.splice()) { 1.constructor.charCodeAt(0+'a') }")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("this.new RegExp.pop().prototype.eval(debugger).toJSONProtocol = unescape(continue).valueOf()")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("const x = new this.new RegExp.indexOf(unescape(new Object()))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("x = new break instanceof false instanceof native.length()")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("Instantiate(parseFloat(x).valueOf())")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("label {escape(true),Math.max(null)}")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("'a'>>>=void.prototype.value.prototype.break.prototype.break.indexOf(0.className()) = (!this&native)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("import Number(NaN).push(IsSmi(break))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("export true.exec(void).toObject()")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new Function({'a',true}/eval(new Object()))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("label null.concat(null).toObject()")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("native {0.2.length,new RegExp.lastIndexOf(-1)}")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("function X(x) { return Math.max({0.2}) }; X(true.charCodeAt(null).add(new RegExp.name()))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("delete -1.lastIndex.length")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("new Function(0.2[1].call(true > break))")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("Instantiate('a'.toLocaleString().splice())")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
+
+try {
+ eval("x = typeof(void&&void)")
+} catch (e) { if (e.message.length > 0) { print (e.message); } };
diff --git a/src/v8/test/mjsunit/regress/regress-120099.js b/src/v8/test/mjsunit/regress/regress-120099.js
new file mode 100644
index 0000000..3b06f4d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-120099.js
@@ -0,0 +1,40 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+'use strict';
+
+var a = Object.create(Object.prototype);
+var b = Object.create(Object.prototype);
+assertFalse(a === b);
+
+Object.defineProperty(a, 'x', { value: 1 });
+assertTrue(a.x === 1);
+assertTrue(b.x === undefined);
+
+b.x = 2;
+assertTrue(a.x === 1);
+assertTrue(b.x === 2);
diff --git a/src/v8/test/mjsunit/regress/regress-1203459.js b/src/v8/test/mjsunit/regress/regress-1203459.js
new file mode 100644
index 0000000..da1e0ed
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1203459.js
@@ -0,0 +1,29 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Ensure that we allow non-index number properties in object literals.
+var obj = { 0.2 : 'a' }
diff --git a/src/v8/test/mjsunit/regress/regress-1207.js b/src/v8/test/mjsunit/regress/regress-1207.js
new file mode 100644
index 0000000..102178a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1207.js
@@ -0,0 +1,35 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test throwing an exception from instanceof.
+try {
+var object = { };
+function fib(n) {
+ var f0 = (object instanceof encodeURI)('#2: var x = 1; x <= 1 === true'), f1 = 1;
+}
+fib(75);
+} catch (o) { }
diff --git a/src/v8/test/mjsunit/regress/regress-1209.js b/src/v8/test/mjsunit/regress/regress-1209.js
new file mode 100644
index 0000000..c017fb5
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1209.js
@@ -0,0 +1,34 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function crashMe(n) {
+ var nasty = [];
+ while (n--)
+ nasty.push("a" + 0);
+ return Function.apply(null, nasty);
+}
+crashMe(64 + 1).length;
diff --git a/src/v8/test/mjsunit/regress/regress-1210.js b/src/v8/test/mjsunit/regress/regress-1210.js
new file mode 100644
index 0000000..43500e7
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1210.js
@@ -0,0 +1,52 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// Deoptimization of the key expression in an arguments access should see
+// the arguments object as the value of the receiver.
+
+var a = 0;
+
+function observe(x, y) { return x; }
+
+function side_effect(x) { a = x; }
+
+function test() {
+ // We will trigger deoptimization of 'a + 0' which should bail out to
+ // immediately after the call to 'side_effect' (i.e., still in the key
+ // subexpression of the arguments access).
+ return observe(a, arguments[side_effect(a), a + 0]);
+}
+
+// Run enough to optimize assuming global 'a' is a smi.
+for (var i = 0; i < 10; ++i) test(0);
+%OptimizeFunctionOnNextCall(test);
+test(0);
+
+a = "hello";
+test(0);
diff --git a/src/v8/test/mjsunit/regress/regress-1213.js b/src/v8/test/mjsunit/regress/regress-1213.js
new file mode 100644
index 0000000..d66e3ce
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1213.js
@@ -0,0 +1,43 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test that we do not allow overwriting a global property with a
+// redeclaration that makes the property configurable (and hence
+// deletable).
+
+var x = 0;
+
+function TestGlobal() {
+ for (var i = 0; i < 2; i++) {
+ x = x + 1;
+ }
+ this.eval('function x() {};');
+ delete this['x'];
+}
+
+TestGlobal();
+TestGlobal();
diff --git a/src/v8/test/mjsunit/regress/regress-1213516.js b/src/v8/test/mjsunit/regress/regress-1213516.js
new file mode 100644
index 0000000..6703f32
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1213516.js
@@ -0,0 +1,40 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function run() {
+ var a = 0;
+ L: try {
+ throw "x";
+ } catch(x) {
+ break L;
+ } finally {
+ a = 1;
+ }
+ assertEquals(1, a);
+}
+
+run();
diff --git a/src/v8/test/mjsunit/regress/regress-121407.js b/src/v8/test/mjsunit/regress/regress-121407.js
new file mode 100644
index 0000000..4403708
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-121407.js
@@ -0,0 +1,40 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var a = [0,1,2,3];
+a[2000000] = 2000000;
+a.length=2000;
+for (var i = 0; i <= 256; i++) {
+ a[i] = new Object();
+}
+
+a = [0.5,1.5,2.5,3.5,4.5,5.5];
+a[2000000] = 2000000;
+a.length=2000;
+for (var i = 0; i <= 256; i++) {
+ a[i] = new Object();
+}
diff --git a/src/v8/test/mjsunit/regress/regress-1215.js b/src/v8/test/mjsunit/regress/regress-1215.js
new file mode 100644
index 0000000..93a89f6
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1215.js
@@ -0,0 +1,36 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Make sure that the "message" property on Error.prototype
+// has the following descriptor:
+// {writable: true, enumerable: false, and configurable: true}
+
+var desc = Object.getOwnPropertyDescriptor(Error.prototype, 'message');
+
+assertEquals(desc.writable, true);
+assertEquals(desc.enumerable, false);
+assertEquals(desc.configurable, true);
diff --git a/src/v8/test/mjsunit/regress/regress-1215653.js b/src/v8/test/mjsunit/regress/regress-1215653.js
new file mode 100644
index 0000000..881e22c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1215653.js
@@ -0,0 +1,365 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Make sure this doesn't crash the VM.
+
+var caught = false;
+try {
+ OverflowParserStack();
+ assertTrue(false);
+} catch (e) {
+ assertTrue(e instanceof RangeError);
+ caught = true;
+}
+assertTrue(caught);
+
+
+function OverflowParserStack() {
+ var s =
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((" +
+ "((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((";
+ eval(s);
+}
diff --git a/src/v8/test/mjsunit/regress/regress-1218.js b/src/v8/test/mjsunit/regress/regress-1218.js
new file mode 100644
index 0000000..dd036ed
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1218.js
@@ -0,0 +1,29 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Builtin functions should not have prototype objects.
+assertFalse(Error.prototype.toString.hasOwnProperty("prototype"));
diff --git a/src/v8/test/mjsunit/regress/regress-1233.js b/src/v8/test/mjsunit/regress/regress-1233.js
new file mode 100644
index 0000000..a09b715
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1233.js
@@ -0,0 +1,47 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test that Object.freeze and Object.getOwnPropertyDescriptor do not
+// call toString or valueOf on members of the object.
+
+// See http://code.google.com/p/v8/issues/detail?id=1233.
+
+
+var delicate = new Object();
+delicate.toString = function(){ throw Error("toString"); };
+delicate.valueOf = function(){ throw Error("valueOf"); };
+
+var x = { foo: delicate };
+
+var status = "fail";
+try {
+ Object.getOwnPropertyDescriptor(x, "foo");
+ Object.freeze(x);
+ status = "succeed";
+} catch (e) {}
+
+assertEquals("succeed", status);
diff --git a/src/v8/test/mjsunit/regress/regress-123512.js b/src/v8/test/mjsunit/regress/regress-123512.js
new file mode 100644
index 0000000..8a747bc
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-123512.js
@@ -0,0 +1,78 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// Test that boilerplate objects for array literals with non-constant
+// elements (which will contain the hole at non-constant positions) will
+// not cause prototype chain lookups when generating optimized code.
+
+function f(x) {
+ return [x][0];
+}
+
+// Test data element on prototype.
+Object.prototype[0] = 23;
+assertSame(1, f(1));
+assertSame(2, f(2));
+%OptimizeFunctionOnNextCall(f);
+assertSame(3, f(3));
+%DeoptimizeFunction(f);
+
+// Test accessor element on prototype.
+Object.prototype.__defineGetter__(0, function() { throw Error(); });
+assertSame(4, f(4));
+assertSame(5, f(5));
+%OptimizeFunctionOnNextCall(f);
+assertSame(6, f(6));
+%DeoptimizeFunction(f);
+
+// Test the same on boilerplate objects for object literals that contain
+// both non-constant properties and non-constant elements.
+
+function g(x, y) {
+ var o = { foo:x, 0:y };
+ return o.foo + o[0];
+}
+
+// Test data property and element on prototype.
+Object.prototype[0] = 23;
+Object.prototype.foo = 42;
+assertSame(3, g(1, 2));
+assertSame(5, g(2, 3));
+%OptimizeFunctionOnNextCall(g);
+assertSame(7, g(3, 4));
+%DeoptimizeFunction(g);
+
+// Test accessor property and element on prototype.
+Object.prototype.__defineGetter__(0, function() { throw Error(); });
+Object.prototype.__defineGetter__('foo', function() { throw Error(); });
+assertSame(3, g(1, 2));
+assertSame(5, g(2, 3));
+%OptimizeFunctionOnNextCall(g);
+assertSame(7, g(3, 4));
+%DeoptimizeFunction(g);
diff --git a/src/v8/test/mjsunit/regress/regress-1236.js b/src/v8/test/mjsunit/regress/regress-1236.js
new file mode 100644
index 0000000..48e3d3d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1236.js
@@ -0,0 +1,34 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Should not crash.
+
+pattern = RegExp("",""); // RegExp is irrelevant, as long as it's not an atom.
+string = 'a'; // Anything non-empty (flat ASCII).
+pattern.exec(string); // Ensure that JSRegExp is compiled.
+pattern["@"] = 42; // Change layout of JSRegExp object.
+pattern.exec(string); // Call again to trigger bug in stub.
diff --git a/src/v8/test/mjsunit/regress/regress-1237.js b/src/v8/test/mjsunit/regress/regress-1237.js
new file mode 100644
index 0000000..111df80
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1237.js
@@ -0,0 +1,41 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// Deoptimization after a conditional expression in an effect context should
+// not see the value of the expression.
+function observe(x, y) { return x; }
+function test(x) {
+ return observe(1, ((x? observe(observe.prototype.x): 'c'), x + 1));
+}
+
+for (var i = 0; i < 5; ++i) test(0);
+%OptimizeFunctionOnNextCall(test);
+test(0);
+
+test("a");
diff --git a/src/v8/test/mjsunit/regress/regress-123919.js b/src/v8/test/mjsunit/regress/regress-123919.js
new file mode 100644
index 0000000..be34608
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-123919.js
@@ -0,0 +1,47 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax --gc-global
+
+function g(max,val) {
+ this.x = 0;
+ for (var i = 0; i < max; i++) {
+ this.x = i/100;
+ }
+ this.val = val;
+}
+
+function f(max) {
+ var val = 0.5;
+ var obj = new g(max,val);
+ assertSame(val, obj.val);
+}
+
+f(1);
+f(1);
+%OptimizeFunctionOnNextCall(f);
+f(200000);
diff --git a/src/v8/test/mjsunit/regress/regress-124.js b/src/v8/test/mjsunit/regress/regress-124.js
new file mode 100644
index 0000000..1197467
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-124.js
@@ -0,0 +1,57 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+assertEquals("[object global]", this.toString());
+assertEquals("[object Undefined]", toString());
+
+assertEquals("[object global]", eval("this.toString()"));
+assertEquals("[object Undefined]", eval("toString()"));
+
+assertEquals("[object global]", eval("var f; this.toString()"));
+assertEquals("[object Undefined]", eval("var f; toString()"));
+
+
+function F(f) {
+ assertEquals("[object global]", this.toString());
+ assertEquals("[object Undefined]", toString());
+
+ assertEquals("[object global]", eval("this.toString()"));
+ assertEquals("[object Undefined]", eval("toString()"));
+
+ assertEquals("[object global]", eval("var f; this.toString()"));
+ assertEquals("[object Undefined]", eval("var f; toString()"));
+
+ assertEquals("[object Undefined]", eval("f()"));
+
+ // Receiver should be the arguments object here.
+ assertEquals("[object Arguments]", eval("arguments[0]()"));
+ with (arguments) {
+ assertEquals("[object Arguments]", toString());
+ }
+}
+
+F(Object.prototype.toString);
diff --git a/src/v8/test/mjsunit/regress/regress-1240.js b/src/v8/test/mjsunit/regress/regress-1240.js
new file mode 100644
index 0000000..57d72b0
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1240.js
@@ -0,0 +1,41 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// This regression tests that we are not allowed to overwrite an existing
+// non-configurable getter with a new getter. In addition, we should not
+// be able to change the configurable flag from false to true.
+
+var a = {};
+Object.defineProperty(a, 'b',
+ { get: function () { return 42; }, configurable: false });
+// Do not allow us to redefine b on a.
+try {
+ a.__defineGetter__('b', function _b(){ return 'foo'; });
+} catch (e) {}
+assertEquals(42, a.b);
+var desc = Object.getOwnPropertyDescriptor(a, 'b');
+assertFalse(desc.configurable);
diff --git a/src/v8/test/mjsunit/regress/regress-124594.js b/src/v8/test/mjsunit/regress/regress-124594.js
new file mode 100644
index 0000000..d51e1f6
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-124594.js
@@ -0,0 +1,50 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax --expose-gc
+
+// Test that a GC inside a constructor frame is correctly handled right
+// after we deoptimize from an inlined constructor to a constructor stub
+// stack frame.
+
+function f(deopt) {
+ var x = 1;
+ if (deopt) {
+ x = x + "foo";
+ gc();
+ }
+ this.x = x;
+}
+
+function g(deopt) {
+ return new f(deopt);
+}
+
+assertEquals({x:1}, g(false));
+assertEquals({x:1}, g(false));
+%OptimizeFunctionOnNextCall(g);
+assertEquals({x:"1foo"}, g(true));
diff --git a/src/v8/test/mjsunit/regress/regress-1254366.js b/src/v8/test/mjsunit/regress/regress-1254366.js
new file mode 100644
index 0000000..9acda3c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1254366.js
@@ -0,0 +1,37 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function gee() {};
+
+Object.prototype.findOrStore = function() {
+ var z = this.vvv = gee;
+ return z;
+};
+
+var a = new Object();
+assertEquals(gee, a.findOrStore());
+assertEquals(gee, a.findOrStore());
diff --git a/src/v8/test/mjsunit/regress/regress-125515.js b/src/v8/test/mjsunit/regress/regress-125515.js
new file mode 100644
index 0000000..91650ce
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-125515.js
@@ -0,0 +1,41 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-gc --debug-code
+
+function test(a) {
+ a[0] = 1.5;
+ assertEquals(0, a.length = 0);
+}
+a = new Array();
+test(a);
+test(a);
+// Make sure that a ends up in old space
+gc();
+gc();
+test(a);
+test(a);
diff --git a/src/v8/test/mjsunit/regress/regress-1257.js b/src/v8/test/mjsunit/regress/regress-1257.js
new file mode 100644
index 0000000..c20fb86
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1257.js
@@ -0,0 +1,58 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function g(y) { assertEquals(y, 12); }
+
+var X = 0;
+
+function foo () {
+ var cnt = 0;
+ var l = -1;
+ var x = 0;
+ while (1) switch (l) {
+ case -1:
+ var y = x + 12;
+ l = 0;
+ break;
+ case 0:
+ // Loop for to hit OSR.
+ if (cnt++ < 10000000) {
+ l = 0;
+ break;
+ } else {
+ l = 1;
+ break;
+ }
+ case 1:
+ // This case will contain deoptimization
+ // because it has no type feedback.
+ g(y);
+ return;
+ };
+}
+
+foo();
diff --git a/src/v8/test/mjsunit/regress/regress-126412.js b/src/v8/test/mjsunit/regress/regress-126412.js
new file mode 100644
index 0000000..0677f70
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-126412.js
@@ -0,0 +1,33 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+"".match(/(A{9999999999}B|C*)*D/);
+"C".match(/(A{9999999999}B|C*)*D/);
+"".match(/(A{9999999999}B|C*)*/ );
+"C".match(/(A{9999999999}B|C*)*/ );
+"".match(/(9u|(2\`shj{2147483649,}\r|3|f|y|3*)+8\B)\W93+/);
+"9u8 ".match(/(9u|(2\`shj{2147483649,}\r|3|f|y|3*)+8\B)\W93+/);
diff --git a/src/v8/test/mjsunit/regress/regress-1278.js b/src/v8/test/mjsunit/regress/regress-1278.js
new file mode 100644
index 0000000..7ad8cda
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1278.js
@@ -0,0 +1,69 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// See: http://code.google.com/p/v8/issues/detail?id=1278
+
+// Test that that handling of 0/-0 is correct for binary operations when the
+// TypeRecordingBinaryOpStub transitions through different states.
+
+function add(x, y) {
+ return x + y;
+}
+
+function sub(x, y) {
+ return x - y;
+}
+
+function mul(x, y) {
+ return x * y;
+}
+
+function div(x, y) {
+ return x / y;
+}
+
+for (var i = 0; i < 10; i++) {
+ assertEquals(0, add(0, 0));
+ assertEquals(0, add(0, -0));
+ assertEquals(0, add(-0, 0));
+ assertEquals(-0, add(-0, -0));
+
+ assertEquals(0, sub(0, 0));
+ assertEquals(0, sub(0, -0));
+ assertEquals(-0, sub(-0, 0));
+ assertEquals(0, sub(-0, -0));
+
+ assertEquals(0, mul(0, 0));
+ assertEquals(-0, mul(0, -0));
+ assertEquals(-0, mul(-0, 0));
+ assertEquals(0, mul(-0, -0));
+
+ assertEquals(0, div(0, 1));
+ assertEquals(-0, div(0, -1));
+ assertEquals(-0, div(-0, 1));
+ assertEquals(0, div(-0, -1));
+}
diff --git a/src/v8/test/mjsunit/regress/regress-128018.js b/src/v8/test/mjsunit/regress/regress-128018.js
new file mode 100644
index 0000000..7bd1585
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-128018.js
@@ -0,0 +1,35 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-gc
+
+function KeyedStoreIC(a) { a[(1)] = Math.E; }
+var literal = [1.2];
+literal.length = 0;
+literal.push('0' && 0 );
+KeyedStoreIC(literal);
+gc();
diff --git a/src/v8/test/mjsunit/regress/regress-128146.js b/src/v8/test/mjsunit/regress/regress-128146.js
new file mode 100644
index 0000000..730dd91
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-128146.js
@@ -0,0 +1,33 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Define accessor properties, resulting in an AccessorPair with 2 transitions.
+Object.defineProperty({},"foo",{set:function(){},configurable:false});
+Object.defineProperty({},"foo",{get:function(){},configurable:false});
+
+// Define a data property under the same name.
+Object.defineProperty({},"foo",{});
diff --git a/src/v8/test/mjsunit/regress/regress-1309.js b/src/v8/test/mjsunit/regress/regress-1309.js
new file mode 100644
index 0000000..122e591
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1309.js
@@ -0,0 +1,30 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+var o = Object.preventExtensions({});
+assertThrows("o.__proto__ = {}");
diff --git a/src/v8/test/mjsunit/regress/regress-131923.js b/src/v8/test/mjsunit/regress/regress-131923.js
new file mode 100644
index 0000000..58da07c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-131923.js
@@ -0,0 +1,30 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+assertFalse(/\u9999{4}/.test(""));
+assertTrue(/\u9999{0,4}/.test(""));
+assertFalse(/\u9999{4,}/.test(""));
diff --git a/src/v8/test/mjsunit/regress/regress-1323.js b/src/v8/test/mjsunit/regress/regress-1323.js
new file mode 100644
index 0000000..552a48d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1323.js
@@ -0,0 +1,50 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// Regression test for load/store operating with wrong number of bits.
+function get(a, index) {
+ return a[index];
+}
+
+var a = new Float32Array(2);
+a[0] = 2.5;
+a[1] = 3.5;
+for (var i = 0; i < 5; i++) get(a, 0);
+%OptimizeFunctionOnNextCall(get);
+assertEquals(2.5, get(a, 0));
+assertEquals(3.5, get(a, 1));
+
+function set(a, index, value) {
+ a[index] = value;
+}
+for (var i = 0; i < 5; i++) set(a, 0, 4.5);
+%OptimizeFunctionOnNextCall(set);
+set(a, 0, 4.5);
+assertEquals(4.5, a[0]);
+assertEquals(3.5, a[1]);
diff --git a/src/v8/test/mjsunit/regress/regress-1327557.js b/src/v8/test/mjsunit/regress/regress-1327557.js
new file mode 100644
index 0000000..cd8f08f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1327557.js
@@ -0,0 +1,38 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var x = { valueOf: function() { throw "x"; } };
+var y = { valueOf: function() { throw "y"; } };
+
+var exception = false;
+try {
+ x * -y;
+} catch (e) {
+ exception = true;
+ assertEquals("y", e);
+}
+assertTrue(exception);
diff --git a/src/v8/test/mjsunit/regress/regress-133211.js b/src/v8/test/mjsunit/regress/regress-133211.js
new file mode 100644
index 0000000..f9473d1
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-133211.js
@@ -0,0 +1,35 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Make sure we don't leak maps when reading intermediate property descriptors.
+
+var o = {};
+var x = {};
+Object.defineProperty(o, "foo", { get: undefined });
+Object.defineProperty(x, "foo", { get: undefined, set: undefined });
+var pd = Object.getOwnPropertyDescriptor(o, "foo");
+assertEquals(undefined, pd.set);
diff --git a/src/v8/test/mjsunit/regress/regress-133211b.js b/src/v8/test/mjsunit/regress/regress-133211b.js
new file mode 100644
index 0000000..87e35f4
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-133211b.js
@@ -0,0 +1,39 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-gc
+
+setter = function(x) { return; }
+var o = {};
+Object.defineProperty(o, "foo", { set: setter });
+var x = {};
+Object.defineProperty(x, "foo", { set: setter });
+x.bar = 20;
+x = {};
+gc();
+o.foo = 20;
+assertEquals(undefined, o.foo);
diff --git a/src/v8/test/mjsunit/regress/regress-1337.js b/src/v8/test/mjsunit/regress/regress-1337.js
new file mode 100644
index 0000000..ebcf84b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1337.js
@@ -0,0 +1,40 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// Test that the throw is not inlined if object literals cannot be
+// inlined.
+function bar() { throw {}; }
+
+function foo() { bar(); }
+
+for (var i = 0; i < 5; ++i) {
+ try { foo() } catch (e) { }
+}
+%OptimizeFunctionOnNextCall(foo)
+try { foo() } catch (e) { }
diff --git a/src/v8/test/mjsunit/regress/regress-1346700.js b/src/v8/test/mjsunit/regress/regress-1346700.js
new file mode 100644
index 0000000..fe2d6fa
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1346700.js
@@ -0,0 +1,29 @@
+// Copyright 2007-2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var o = {"\u59cb\u53d1\u7ad9": 1};
+assertEquals(1, o.\u59cb\u53d1\u7ad9);
diff --git a/src/v8/test/mjsunit/regress/regress-1351.js b/src/v8/test/mjsunit/regress/regress-1351.js
new file mode 100644
index 0000000..656b19f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1351.js
@@ -0,0 +1,42 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// Test that the arguments value is does not escape when it appears as
+// an intermediate value in an expression.
+
+function h() { }
+
+function f() {
+ var a = null;
+ h(a = arguments);
+}
+
+f();
+%OptimizeFunctionOnNextCall(f);
+f();
diff --git a/src/v8/test/mjsunit/regress/regress-1355.js b/src/v8/test/mjsunit/regress/regress-1355.js
new file mode 100644
index 0000000..de9364a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1355.js
@@ -0,0 +1,44 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test that an exception is not thrown when trying to set a value for
+// a property that has only a defined getter, except when in strict mode.
+
+var foo = Object.defineProperty({}, "bar", {
+ get: function () {
+ return 10;
+ }
+ });
+
+assertDoesNotThrow("foo.bar = 20");
+
+function shouldThrow() {
+ 'use strict';
+ foo.bar = 20;
+}
+
+assertThrows("shouldThrow()");
diff --git a/src/v8/test/mjsunit/regress/regress-1360.js b/src/v8/test/mjsunit/regress/regress-1360.js
new file mode 100644
index 0000000..bebad28
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1360.js
@@ -0,0 +1,39 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Check the receiver for the sort and replace functions to
+// Array.prototype.sort and String.prototype.replace.
+
+var global = this;
+function strict() { "use strict"; assertEquals(void 0, this); }
+function non_strict() { assertEquals(global, this); }
+
+[1,2,3].sort(strict);
+[1,2,3].sort(non_strict);
+
+"axc".replace("x", strict);
+"axc".replace("x", non_strict);
diff --git a/src/v8/test/mjsunit/regress/regress-136048.js b/src/v8/test/mjsunit/regress/regress-136048.js
new file mode 100644
index 0000000..21ae622
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-136048.js
@@ -0,0 +1,34 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+try {
+ eval("/foo/\\u0069")
+} catch (e) {
+ assertEquals(
+ "SyntaxError: Invalid regular expression flags",
+ e.toString());
+}
diff --git a/src/v8/test/mjsunit/regress/regress-1365.js b/src/v8/test/mjsunit/regress/regress-1365.js
new file mode 100644
index 0000000..59290f9
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1365.js
@@ -0,0 +1,82 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// See: http://code.google.com/p/v8/issues/detail?id=1365
+
+// Check that builtin methods are passed undefined as the receiver
+// when called as functions through variables.
+
+// Flags: --allow-natives-syntax
+
+// Global variable.
+var valueOf = Object.prototype.valueOf;
+var hasOwnProperty = Object.prototype.hasOwnProperty;
+
+function callGlobalValueOf() { valueOf(); }
+function callGlobalHasOwnProperty() { valueOf(); }
+
+assertEquals(Object.prototype, Object.prototype.valueOf());
+assertThrows(callGlobalValueOf);
+assertThrows(callGlobalHasOwnProperty);
+
+%OptimizeFunctionOnNextCall(Object.prototype.valueOf);
+Object.prototype.valueOf();
+
+assertEquals(Object.prototype, Object.prototype.valueOf());
+assertThrows(callGlobalValueOf);
+assertThrows(callGlobalHasOwnProperty);
+
+function CheckExceptionCallLocal() {
+ var valueOf = Object.prototype.valueOf;
+ var hasOwnProperty = Object.prototype.hasOwnProperty;
+ var exception = false;
+ try { valueOf(); } catch(e) { exception = true; }
+ assertTrue(exception);
+ exception = false;
+ try { hasOwnProperty(); } catch(e) { exception = true; }
+ assertTrue(exception);
+}
+CheckExceptionCallLocal();
+
+function CheckExceptionCallParameter(f) {
+ var exception = false;
+ try { f(); } catch(e) { exception = true; }
+ assertTrue(exception);
+}
+CheckExceptionCallParameter(Object.prototype.valueOf);
+CheckExceptionCallParameter(Object.prototype.hasOwnProperty);
+
+function CheckPotentiallyShadowedByEval() {
+ var exception = false;
+ try {
+ eval("hasOwnProperty('x')");
+ } catch(e) {
+ exception = true;
+ }
+ assertTrue(exception);
+}
+CheckPotentiallyShadowedByEval();
diff --git a/src/v8/test/mjsunit/regress/regress-1369.js b/src/v8/test/mjsunit/regress/regress-1369.js
new file mode 100644
index 0000000..48a8e7e
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1369.js
@@ -0,0 +1,31 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-gc
+
+assertDoesNotThrow('gc.call(1)');
+assertDoesNotThrow('gc.call("asdf")');
diff --git a/src/v8/test/mjsunit/regress/regress-137.js b/src/v8/test/mjsunit/regress/regress-137.js
new file mode 100644
index 0000000..f343eba
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-137.js
@@ -0,0 +1,45 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// See <URL:http://code.google.com/p/v8/issues/detail?id=137>
+
+(function () {
+ var strNum = 170;
+ var base = strNum / 16;
+ var rem = strNum % 16;
+ var base = base - (rem / 16); // base is now HeapNumber with valid Smi value.
+
+ switch(base) {
+ case 10: return "A"; // Expected result.
+ case 11: return "B";
+ case 12: return "C";
+ case 13: return "D";
+ case 14: return "E";
+ case 15: return "F"; // Enough cases to trigger fast-case Smi switch.
+ };
+ fail("case 10", "Default case", "Heap number not recognized as Smi value");
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-137768.js b/src/v8/test/mjsunit/regress/regress-137768.js
new file mode 100644
index 0000000..9fbd7f3
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-137768.js
@@ -0,0 +1,73 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// Create elements in a constructor function to ensure map sharing.
+function TestConstructor() {
+ this[0] = 1;
+ this[1] = 2;
+ this[2] = 3;
+}
+
+function bad_func(o,a) {
+ var s = 0;
+ for (var i = 0; i < 1; ++i) {
+ o.newFileToChangeMap = undefined;
+ var x = a[0];
+ s += x;
+ }
+ return s;
+}
+
+o = new Object();
+a = new TestConstructor();
+bad_func(o, a);
+
+// Make sure that we're out of pre-monomorphic state for the member add of
+// 'newFileToChangeMap' which causes a map transition.
+o = new Object();
+a = new TestConstructor();
+bad_func(o, a);
+
+// Optimize, before the fix, the element load and subsequent tagged-to-i were
+// hoisted above the map check, which can't be hoisted due to the map-changing
+// store.
+o = new Object();
+a = new TestConstructor();
+%OptimizeFunctionOnNextCall(bad_func);
+bad_func(o, a);
+
+// Pass in a array of doubles. Before the fix, the optimized load and
+// tagged-to-i will treat part of a double value as a pointer and de-ref it
+// before the map check was executed that should have deopt.
+o = new Object();
+// Pass in an elements buffer where the bit representation of the double numbers
+// are two adjacent small 32-bit values with the lowest bit set to one, causing
+// tagged-to-i to SIGSEGV.
+a = [2.122e-314, 2.122e-314, 2.122e-314];
+bad_func(o, a);
diff --git a/src/v8/test/mjsunit/regress/regress-1383.js b/src/v8/test/mjsunit/regress/regress-1383.js
new file mode 100644
index 0000000..387c8b4
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1383.js
@@ -0,0 +1,40 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test that passing the strict_mode flag in extra ic state from
+// StubCache::ComputeKeyedLoadOrStoreExternalArray does not
+// hit an assertion in Code::ComputeFlags.
+
+x="";
+function foo(){
+ "use strict";
+ var wxemsx=(4);
+ var wxemsx_0=new Float32Array(wxemsx);
+ wxemsx_0[0]={};
+}
+
+foo()
diff --git a/src/v8/test/mjsunit/regress/regress-1387.js b/src/v8/test/mjsunit/regress/regress-1387.js
new file mode 100644
index 0000000..0d58eab
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1387.js
@@ -0,0 +1,38 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Tests that we always return the same type error function when trying to
+// access or set strict mode callee.
+
+function foo() {
+ 'use strict';
+ return arguments;
+}
+
+var get = Object.getOwnPropertyDescriptor(foo(), "callee").get;
+var set = Object.getOwnPropertyDescriptor(foo(), "callee").set;
+assertEquals(get, set);
diff --git a/src/v8/test/mjsunit/regress/regress-1389.js b/src/v8/test/mjsunit/regress/regress-1389.js
new file mode 100644
index 0000000..9b89bbf
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1389.js
@@ -0,0 +1,42 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test optimized implementation of postfix ++ on undefined input.
+// See http://code.google.com/p/v8/issues/detail?id=1389
+
+for (var i=0; i<4; i++) {
+ (function () {
+ (function () {
+ (function () {
+ var x;
+ y = x++;
+ })();
+ })();
+ })();
+}
+
+assertEquals(NaN, y);
diff --git a/src/v8/test/mjsunit/regress/regress-1401.js b/src/v8/test/mjsunit/regress/regress-1401.js
new file mode 100644
index 0000000..33eb067
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1401.js
@@ -0,0 +1,45 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// See: http://code.google.com/p/v8/issues/detail?id=1401
+
+var bottom = 0;
+var sizes = new Array();
+
+for (i = 0; i < 10; i++) {
+ sizes[i] = 0;
+}
+
+function foo() {
+ var size = bottom + 1 + 10;
+ var t = (sizes[++bottom] = size);
+ return t;
+}
+
+for (i = 0; i < 5; i++) {
+ assertEquals(i + 11, foo());
+}
diff --git a/src/v8/test/mjsunit/regress/regress-1403.js b/src/v8/test/mjsunit/regress/regress-1403.js
new file mode 100644
index 0000000..91df6d6
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1403.js
@@ -0,0 +1,36 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// See: http://code.google.com/p/v8/issues/detail?id=1403
+
+a = [];
+assertThrows(() => Object.prototype.__proto__ = { __proto__: null }, TypeError);
+a.shift();
+
+a = [];
+Array.prototype.__proto__ = { __proto__: null };
+a.shift();
diff --git a/src/v8/test/mjsunit/regress/regress-1412.js b/src/v8/test/mjsunit/regress/regress-1412.js
new file mode 100644
index 0000000..b043f19
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1412.js
@@ -0,0 +1,59 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test that the apply with arguments optimization passes values
+// unchanged to strict-mode functions and builtins.
+
+// Flags: --allow-natives-syntax
+
+function strict() { "use strict"; return this; }
+
+function test_strict() {
+ assertEquals(void 0, strict.apply(undefined, arguments));
+ assertEquals(42, strict.apply(42, arguments));
+ assertEquals("asdf", strict.apply("asdf", arguments));
+}
+
+for (var i = 0; i < 10; i++) test_strict();
+%OptimizeFunctionOnNextCall(test_strict);
+test_strict();
+
+function test_builtin(receiver) {
+ Object.prototype.valueOf.apply(receiver, arguments);
+}
+
+for (var i = 0; i < 10; i++) test_builtin(this);
+%OptimizeFunctionOnNextCall(test_builtin);
+test_builtin(this);
+
+var exception = false;
+try {
+ test_builtin(undefined);
+} catch(e) {
+ exception = true;
+}
+assertTrue(exception);
diff --git a/src/v8/test/mjsunit/regress/regress-1415.js b/src/v8/test/mjsunit/regress/regress-1415.js
new file mode 100644
index 0000000..f993e9b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1415.js
@@ -0,0 +1,42 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Surrogate pair range.
+// U+D800
+assertThrows(function(){ decodeURIComponent("%ED%A0%80"); }, URIError);
+// U+DBFF
+assertThrows(function(){ decodeURIComponent("%ED%AF%BF"); }, URIError);
+// U+DC00
+assertThrows(function(){ decodeURIComponent("%ED%B0%80"); }, URIError);
+// U+DFFF
+assertThrows(function(){ decodeURIComponent("%ED%BF%BF"); }, URIError);
+
+// Overlong encodings
+// U+007F in two bytes.
+assertThrows(function(){ decodeURIComponent("%C1%BF"); }, URIError);
+// U+07FF in three bytes.
+assertThrows(function(){ decodeURIComponent("%E0%9F%BF"); }, URIError);
diff --git a/src/v8/test/mjsunit/regress/regress-1419.js b/src/v8/test/mjsunit/regress/regress-1419.js
new file mode 100644
index 0000000..55bcd7c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1419.js
@@ -0,0 +1,55 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test that using bind several time does not change the length of existing
+// bound functions.
+
+function foo() {
+}
+
+var f1 = function (x) {}.bind(foo);
+var f2 = function () {};
+
+assertEquals(1, f1.length);
+
+// the object we bind to can be any object
+f2.bind(foo);
+
+assertEquals(1, f1.length);
+
+var desc = Object.getOwnPropertyDescriptor(f1, 'length');
+assertEquals(false, desc.writable);
+assertEquals(false, desc.enumerable);
+assertEquals(true, desc.configurable);
+
+Object.defineProperty(f1, 'length', {
+ value: 'abc',
+ writable: true
+});
+assertEquals('abc', f1.length);
+f1.length = 42;
+assertEquals(42, f1.length);
diff --git a/src/v8/test/mjsunit/regress/regress-1423.js b/src/v8/test/mjsunit/regress/regress-1423.js
new file mode 100644
index 0000000..b0d0ca3
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1423.js
@@ -0,0 +1,65 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// Test that the Lithium environment iterator does stop iteration early.
+"use strict";
+
+function f0() {
+ return f1('literal', true);
+}
+
+function f1(x, y) {
+ return f2(x, y);
+}
+
+// Because it's strict, f2 has an environment containing only the constants
+// undefined, 'literal', and false. Bug 1423 would cause environment
+// iteration to stop early.
+//
+// Bug manifests as UNREACHABLE code (due to an unallocated register) in
+// debug builds.
+function f2(x, y) {
+ if (y) {
+ if (f3(x, 'other-literal')) {
+ return 0;
+ } else {
+ return 1;
+ }
+ } else {
+ return 2;
+ }
+}
+
+function f3(x, y) {
+ return x === y;
+}
+
+for (var i = 0; i < 5; ++i) f0();
+%OptimizeFunctionOnNextCall(f0);
+assertEquals(1, f0());
diff --git a/src/v8/test/mjsunit/regress/regress-1434.js b/src/v8/test/mjsunit/regress/regress-1434.js
new file mode 100644
index 0000000..6f197af
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1434.js
@@ -0,0 +1,36 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function compare(a, b) {
+ return a === b;
+}
+
+compare(1.5, 2.5);
+%OptimizeFunctionOnNextCall(compare);
+assertTrue(compare(undefined, undefined));
diff --git a/src/v8/test/mjsunit/regress/regress-1436.js b/src/v8/test/mjsunit/regress/regress-1436.js
new file mode 100644
index 0000000..390ccee
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1436.js
@@ -0,0 +1,79 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Check that reduce and reduceRight call the callback function with
+// undefined as the receiver (which for non-strict functions is
+// transformed to the global object).
+
+// Check receiver for reduce and reduceRight.
+
+var global = this;
+function non_strict(){ assertEquals(global, this); }
+function strict(){ "use strict"; assertEquals(void 0, this); }
+function strict_null(){ "use strict"; assertEquals(null, this); }
+
+[2, 3].reduce(non_strict);
+[2, 3].reduce(strict);
+[2, 3].reduceRight(non_strict);
+[2, 3].reduceRight(strict);
+
+
+// Check the receiver for callbacks in other array methods.
+[2, 3].every(non_strict);
+[2, 3].every(non_strict, undefined);
+[2, 3].every(non_strict, null);
+[2, 3].every(strict);
+[2, 3].every(strict, undefined);
+[2, 3].every(strict_null, null);
+
+[2, 3].filter(non_strict);
+[2, 3].filter(non_strict, undefined);
+[2, 3].filter(non_strict, null);
+[2, 3].filter(strict);
+[2, 3].filter(strict, undefined);
+[2, 3].filter(strict_null, null);
+
+[2, 3].forEach(non_strict);
+[2, 3].forEach(non_strict, undefined);
+[2, 3].forEach(non_strict, null);
+[2, 3].forEach(strict);
+[2, 3].forEach(strict, undefined);
+[2, 3].forEach(strict_null, null);
+
+[2, 3].map(non_strict);
+[2, 3].map(non_strict, undefined);
+[2, 3].map(non_strict, null);
+[2, 3].map(strict);
+[2, 3].map(strict, undefined);
+[2, 3].map(strict_null, null);
+
+[2, 3].some(non_strict);
+[2, 3].some(non_strict, undefined);
+[2, 3].some(non_strict, null);
+[2, 3].some(strict);
+[2, 3].some(strict, undefined);
+[2, 3].some(strict_null, null);
diff --git a/src/v8/test/mjsunit/regress/regress-1439135.js b/src/v8/test/mjsunit/regress/regress-1439135.js
new file mode 100644
index 0000000..737a7ba
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1439135.js
@@ -0,0 +1,40 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+function Test() {
+ var left = "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX";
+ var right = "YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY";
+ for (var i = 0; i < 100000; i++) {
+ var cons = left + right;
+ var substring = cons.substring(20, 80);
+ var index = substring.indexOf('Y');
+ assertEquals(34, index);
+ }
+}
+
+Test();
diff --git a/src/v8/test/mjsunit/regress/regress-143967.js b/src/v8/test/mjsunit/regress/regress-143967.js
new file mode 100644
index 0000000..7c12e67
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-143967.js
@@ -0,0 +1,34 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Check that Accessors::FunctionGetPrototype traverses the prototype
+// chain correctly and doesn't get stuck.
+
+var functionWithoutProto = [].filter;
+var obj = Object.create(functionWithoutProto);
+functionWithoutProto.__proto__ = function() {};
+assertEquals(functionWithoutProto.prototype, obj.prototype);
diff --git a/src/v8/test/mjsunit/regress/regress-1447.js b/src/v8/test/mjsunit/regress/regress-1447.js
new file mode 100644
index 0000000..2c1ee59
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1447.js
@@ -0,0 +1,37 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+[0].forEach(function(){ Object.freeze(Array.prototype.forEach); });
+[0].every(function(){ Object.seal(Array.prototype.every); });
+
+function testStrict(){
+ "use strict";
+ [0].forEach(function(){ Object.freeze(Array.prototype.forEach); });
+ [0].every(function(){ Object.seal(Array.prototype.every); });
+}
+
+testStrict();
diff --git a/src/v8/test/mjsunit/regress/regress-145201.js b/src/v8/test/mjsunit/regress/regress-145201.js
new file mode 100644
index 0000000..7fe7bce
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-145201.js
@@ -0,0 +1,107 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Fix some corner cases in skipping native methods using caller.
+var net = [];
+
+
+var x = 0;
+
+function collect () {
+ function item(operator) {
+ binary(operator, 1, false);
+ binary(operator, 1, true);
+ binary(operator, '{}', false);
+ binary(operator, '{}', true);
+ binary(operator, '"x"', false);
+ binary(operator, '"x"', true);
+ unary(operator, "");
+ }
+
+ function unary(op, after) {
+ // Capture:
+ try {
+ eval(op + " custom " + after);
+ } catch(e) {
+ }
+ }
+
+ function binary(op, other_side, inverted) {
+ // Capture:
+ try {
+ if (inverted) {
+ eval("custom " + op + " " + other_side);
+ } else {
+ eval(other_side + " " + op + " custom");
+ }
+ } catch(e) {
+ }
+ }
+
+ function catcher() {
+ var caller = catcher.caller;
+ if (/native/i.test(caller) || /ADD/.test(caller)) {
+ net[caller] = 0;
+ }
+ }
+
+ var custom = Object.create(null, {
+ toString: { value: catcher },
+ length: { get: catcher }
+ });
+
+ item('^');
+ item('~');
+ item('<<');
+ item('<');
+ item('==');
+ item('>>>');
+ item('>>');
+ item('|');
+ item('-');
+ item('*');
+ item('&');
+ item('%');
+ item('+');
+ item('in');
+ item('instanceof');
+ unary('{}[', ']');
+ unary('delete {}[', ']');
+ unary('(function() {}).apply(null, ', ')');
+}
+
+collect();
+collect();
+collect();
+
+var keys = 0;
+for (var key in net) {
+ print(key);
+ keys++;
+}
+
+assertTrue(keys == 0);
diff --git a/src/v8/test/mjsunit/regress/regress-1472.js b/src/v8/test/mjsunit/regress/regress-1472.js
new file mode 100644
index 0000000..b2a30d2
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1472.js
@@ -0,0 +1,40 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Avoid excessive expansions of regexp repetitions inside regexp repetitions.
+// Some of these caused stack overflows, others cause out-of-memory.
+var r1 = /(?:a(?:b(?:c(?:d(?:e(?:f(?:g(?:h(?:i(?:j(?:k(?:l(?:m(?:n(?:o(?:p(?:q(?:r(?:s(?:t(?:u(?:v(?:w(?:x(?:y(?:z(?:FooBar)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)+)/;
+"xxx".match(r1);
+
+var r2 = /(?:a(?:b(?:c(?:d(?:e(?:f(?:g(?:h(?:i(?:j(?:k(?:l(?:FooBar){0,2}){0,2}){0,2}){0,2}){0,2}){0,2}){0,2}){0,2}){0,2}){0,2}){0,2}){0,2}){0,2}/;
+"xxx".match(r2);
+
+var r3 = /(?:a(?:b(?:c(?:d(?:e(?:f(?:g(?:h(?:i(?:j(?:k(?:l(?:FooBar){2}){2}){2}){2}){2}){2}){2}){2}){2}){2}){2}){2}){2}/;
+"xxx".match(r3);
+
+var r4 = /(?:a(?:b(?:c(?:d(?:e(?:f(?:g(?:h(?:i(?:FooBar){3,6}){3,6}){3,6}){3,6}){3,6}){3,6}){3,6}){3,6}){3,6}){3,6}/;
+"xxx".match(r4);
diff --git a/src/v8/test/mjsunit/regress/regress-1476.js b/src/v8/test/mjsunit/regress/regress-1476.js
new file mode 100644
index 0000000..1277e7f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1476.js
@@ -0,0 +1,35 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function foo (i) { return (i % 2) | 0; }
+
+assertEquals (-1, foo(-1));
+assertEquals (-1, foo(-1));
+%OptimizeFunctionOnNextCall(foo);
+assertEquals (-1, foo(-1));
diff --git a/src/v8/test/mjsunit/regress/regress-148378.js b/src/v8/test/mjsunit/regress/regress-148378.js
new file mode 100644
index 0000000..d37cea1
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-148378.js
@@ -0,0 +1,38 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+"a".replace(/a/g, function() { return "c"; });
+
+function test() {
+ try {
+ test();
+ } catch(e) {
+ "b".replace(/(b)/g, function() { return "c"; });
+ }
+}
+
+test();
diff --git a/src/v8/test/mjsunit/regress/regress-149.js b/src/v8/test/mjsunit/regress/regress-149.js
new file mode 100644
index 0000000..6377a5b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-149.js
@@ -0,0 +1,28 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+assertEquals(String.fromCharCode(0x26B), String.fromCharCode(0x2C62).toLowerCase());
diff --git a/src/v8/test/mjsunit/regress/regress-1491.js b/src/v8/test/mjsunit/regress/regress-1491.js
new file mode 100644
index 0000000..1a3d3bf
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1491.js
@@ -0,0 +1,38 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test that the Array length accessor correctly deals with non-array
+// receivers.
+
+// Create an object with an array as the prototype.
+var o = Object.create([]);
+
+// Check that writing the length property of the non-array object
+// works as expected.
+var value = "asdf";
+o.length = value;
+assertEquals(value, o.length);
diff --git a/src/v8/test/mjsunit/regress/regress-1493017.js b/src/v8/test/mjsunit/regress/regress-1493017.js
new file mode 100644
index 0000000..b46397c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1493017.js
@@ -0,0 +1,52 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test collection of abandoned maps. Tests that deleted map
+// transitions do not show up as properties in for in.
+
+// Flags: --expose-gc
+
+function C() {}
+
+
+// Create an instance of C. Add a property to the instance and then
+// remove all references to instances of C.
+var o = new C();
+o.x = 42;
+o = null;
+
+// Force a global GC. This will collect the maps starting from C and
+// delete map transitions.
+gc();
+
+// Create a new instance of C.
+o = new C();
+
+// Test that the deleted map transitions do not show up in for in.
+for (var p in o) {
+ assertTrue(false);
+}
diff --git a/src/v8/test/mjsunit/regress/regress-1513.js b/src/v8/test/mjsunit/regress/regress-1513.js
new file mode 100644
index 0000000..06c5edf
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1513.js
@@ -0,0 +1,44 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Deleting a mapped arguments property and adding it via
+// Object.defineProperty should not crash.
+
+function testcase() {
+ return (function (a, b, c) {
+ delete arguments[0];
+ Object.defineProperty(arguments, "0", {
+ value: 10,
+ writable: false,
+ enumerable: false,
+ configurable: false
+ });
+ assertEquals(10, arguments[0]);
+ }(0, 1, 2));
+}
+
+testcase();
diff --git a/src/v8/test/mjsunit/regress/regress-1521.js b/src/v8/test/mjsunit/regress/regress-1521.js
new file mode 100644
index 0000000..3149f05
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1521.js
@@ -0,0 +1,48 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+//
+// Flags: --allow-natives-syntax
+
+// Optimized variable access inside through a catch context should work.
+function test(x) {
+ try {
+ throw new Error();
+ } catch (e) {
+ var y = {f: 1};
+ var f = function () {
+ var z = y;
+ var g = function () {
+ if (y.f === z.f) return x;
+ };
+ %OptimizeFunctionOnNextCall(g);
+ return g;
+ }
+ assertEquals(3, f()());
+ }
+}
+
+test(3);
diff --git a/src/v8/test/mjsunit/regress/regress-1528.js b/src/v8/test/mjsunit/regress/regress-1528.js
new file mode 100644
index 0000000..2eb6be1
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1528.js
@@ -0,0 +1,40 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// With (or catch) scopes nested inside catch scopes should look at the
+// first outer non-catch scope to decide which closure to use when
+// allocating the new context.
+
+// Code below should not assert or crash.
+try {
+ fail;
+} catch (e) {
+ with({}) { // With scope inside catch scope.
+ // Dynamic declaration forces runtime lookup to observe the context chain.
+ eval('const x = 7');
+ }
+}
diff --git a/src/v8/test/mjsunit/regress/regress-1529.js b/src/v8/test/mjsunit/regress/regress-1529.js
new file mode 100644
index 0000000..212d7b3
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1529.js
@@ -0,0 +1,35 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// See: http://code.google.com/p/v8/issues/detail?id=1529
+
+try {
+ Error.prepareStackTrace = function (error, stackTrace) {
+ stackTrace.some();
+ };
+ x;
+} catch (e) {}
diff --git a/src/v8/test/mjsunit/regress/regress-1530.js b/src/v8/test/mjsunit/regress/regress-1530.js
new file mode 100644
index 0000000..fa86f62
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1530.js
@@ -0,0 +1,89 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test that redefining the 'prototype' property of a function object
+// does actually set the internal value and does not screw up any
+// shadowing between said property and the internal value.
+
+var f = function() {};
+
+// Verify that normal assignment of 'prototype' property works properly
+// and updates the internal value.
+var a = { foo: 'bar' };
+f.prototype = a;
+assertSame(f.prototype, a);
+assertSame(f.prototype.foo, 'bar');
+assertSame(new f().foo, 'bar');
+assertSame(Object.getPrototypeOf(new f()), a);
+assertSame(Object.getOwnPropertyDescriptor(f, 'prototype').value, a);
+assertTrue(Object.getOwnPropertyDescriptor(f, 'prototype').writable);
+
+// Verify that 'prototype' behaves like a data property when it comes to
+// redefining with Object.defineProperty() and the internal value gets
+// updated.
+var b = { foo: 'baz' };
+Object.defineProperty(f, 'prototype', { value: b, writable: true });
+assertSame(f.prototype, b);
+assertSame(f.prototype.foo, 'baz');
+assertSame(new f().foo, 'baz');
+assertSame(Object.getPrototypeOf(new f()), b);
+assertSame(Object.getOwnPropertyDescriptor(f, 'prototype').value, b);
+assertTrue(Object.getOwnPropertyDescriptor(f, 'prototype').writable);
+
+// Verify that the previous redefinition didn't screw up callbacks and
+// the internal value still gets updated.
+var c = { foo: 'other' };
+f.prototype = c;
+assertSame(f.prototype, c);
+assertSame(f.prototype.foo, 'other');
+assertSame(new f().foo, 'other');
+assertSame(Object.getPrototypeOf(new f()), c);
+assertSame(Object.getOwnPropertyDescriptor(f, 'prototype').value, c);
+assertTrue(Object.getOwnPropertyDescriptor(f, 'prototype').writable);
+
+// Verify that 'prototype' can be redefined to contain a different value
+// and have a different writability attribute at the same time.
+var d = { foo: 'final' };
+Object.defineProperty(f, 'prototype', { value: d, writable: false });
+assertSame(f.prototype, d);
+assertSame(f.prototype.foo, 'final');
+assertSame(new f().foo, 'final');
+assertSame(Object.getPrototypeOf(new f()), d);
+assertSame(Object.getOwnPropertyDescriptor(f, 'prototype').value, d);
+assertFalse(Object.getOwnPropertyDescriptor(f, 'prototype').writable);
+
+// Verify that non-writability of redefined 'prototype' is respected.
+assertThrows("'use strict'; f.prototype = {}");
+assertThrows("Object.defineProperty(f, 'prototype', { value: {} })");
+
+// Verify that non-configurability of other properties is respected, but
+// non-writability is ignored by Object.defineProperty().
+// name and length are configurable in ES6
+Object.defineProperty(f, 'name', { value: {} });
+Object.defineProperty(f, 'length', { value: {} });
+assertThrows("Object.defineProperty(f, 'caller', { value: {} })");
+assertThrows("Object.defineProperty(f, 'arguments', { value: {} })");
diff --git a/src/v8/test/mjsunit/regress/regress-1531.js b/src/v8/test/mjsunit/regress/regress-1531.js
new file mode 100644
index 0000000..09e61a6
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1531.js
@@ -0,0 +1,49 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Regression test for computing elements keys of arguments object. Should
+// not crash or assert.
+function test(x) {
+ arguments[10] = 0;
+ var arr = [];
+ for (var p in arguments) arr.push(p);
+ return arr;
+}
+assertEquals(["0", "10"], test(0));
+
+// Regression test for lookup after delete of a dictionary-mode arguments
+// backing store. Should not crash or assert.
+function test1(x, y, z) {
+ // Put into dictionary mode.
+ arguments.__defineGetter__("5", function () { return 0; });
+ // Delete a property from the dictionary.
+ delete arguments[5];
+ // Look up a property in the dictionary.
+ return arguments[2];
+}
+
+assertEquals(void 0, test1(0));
diff --git a/src/v8/test/mjsunit/regress/regress-1546.js b/src/v8/test/mjsunit/regress/regress-1546.js
new file mode 100644
index 0000000..3f1839c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1546.js
@@ -0,0 +1,32 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// See: http://code.google.com/p/v8/issues/detail?id=1546
+
+// Should't throw. Scanner incorrectly truncated to char before comparing
+// with "*", so it ended the comment early.
+eval("/*\u822a/ */");
diff --git a/src/v8/test/mjsunit/regress/regress-1548.js b/src/v8/test/mjsunit/regress/regress-1548.js
new file mode 100644
index 0000000..5330e13
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1548.js
@@ -0,0 +1,48 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test that the caller and arguments objects are not available on native
+// functions.
+
+function testfn(f) { return [1].map(f)[0]; }
+function foo() { return [].map.caller; }
+assertThrows(function() { testfn(foo); } );
+
+// Try to delete the caller property (to make sure that we can't get to the
+// caller accessor on the prototype.
+delete Array.prototype.map.caller;
+assertThrows(function() { testfn(foo); } );
+
+// Redo tests with arguments object.
+function testarguments(f) { return [1].map(f)[0]; }
+function bar() { return [].map.arguments; }
+assertThrows(function() { testarguments(bar); } );
+
+// Try to delete the arguments property (to make sure that we can't get to the
+// caller accessor on the prototype.
+delete Array.prototype.map.arguments;
+assertThrows(function() { testarguments(bar); } );
diff --git a/src/v8/test/mjsunit/regress/regress-155924.js b/src/v8/test/mjsunit/regress/regress-155924.js
new file mode 100644
index 0000000..666e3ba
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-155924.js
@@ -0,0 +1,46 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// A HeapNumber with certain bits in the mantissa of the floating point
+// value should not be able to masquerade as a string in a keyed lookup
+// inline cache stub. See http://codereview.chromium.org/155924.
+
+A = [ 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10 ];
+
+function foo() {
+ x = 1 << 26;
+ x = x * x;
+ // The following floating-point heap number has a second word similar
+ // to that of the string "5":
+ // 2^52 + index << cached_index_shift + cached_index_tag
+ x = x + (5 << 2) + (1 << 1);
+ return A[x];
+}
+
+assertEquals(undefined, foo(), "First lookup A[bad_float]");
+assertEquals(undefined, foo(), "Second lookup A[bad_float]");
+assertEquals(undefined, foo(), "Third lookup A[bad_float]");
diff --git a/src/v8/test/mjsunit/regress/regress-1560.js b/src/v8/test/mjsunit/regress/regress-1560.js
new file mode 100644
index 0000000..a0aa7e6
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1560.js
@@ -0,0 +1,68 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax --expose-gc
+
+function mkCOWArray() {
+ var a = [''];
+ assertEquals('', a[0]);
+ return a;
+}
+
+function mkArray() {
+ var a = [];
+ a[0] = '';
+ return a;
+}
+
+function mkNumberDictionary() {
+ var a = new Array();
+ a[0] = '';
+ a[100000] = '';
+ return a;
+}
+
+function write(a, i) { a[i] = "bazinga!"; }
+
+function test(factories, w) {
+ factories.forEach(function(f) { w(f(), 0); });
+ factories.forEach(function(f) { w(f(), 0); });
+ %OptimizeFunctionOnNextCall(w);
+ factories.forEach(function(f) { w(f(), 0); });
+}
+
+// Monomorphic case.
+for (var i = 0; i < 5; i++) write(mkArray(), 0);
+%OptimizeFunctionOnNextCall(write);
+write(mkCOWArray(), 0);
+var failure = mkCOWArray();
+
+// Cleanup, then polymorphic case.
+%DeoptimizeFunction(write);
+gc();
+test([mkArray, mkNumberDictionary], write);
+test([mkArray, mkNumberDictionary, mkCOWArray], write);
diff --git a/src/v8/test/mjsunit/regress/regress-1563.js b/src/v8/test/mjsunit/regress/regress-1563.js
new file mode 100644
index 0000000..884b125
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1563.js
@@ -0,0 +1,44 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+obj = new Uint8ClampedArray(10);
+
+// Test that undefined gets properly clamped in Crankshafted pixel array
+// assignments.
+function set_pixel(obj, arg) {
+ obj[0] = arg;
+}
+
+set_pixel(obj, 1.5);
+set_pixel(obj, NaN);
+%OptimizeFunctionOnNextCall(set_pixel);
+set_pixel(obj, undefined);
+set_pixel(obj, undefined);
+
+assertEquals(0, obj[0]);
diff --git a/src/v8/test/mjsunit/regress/regress-1582.js b/src/v8/test/mjsunit/regress/regress-1582.js
new file mode 100644
index 0000000..346d68a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1582.js
@@ -0,0 +1,47 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function f(restIsArray, rest) {
+ var arr;
+ if (typeof rest === "object" && (rest instanceof Array)) {
+ arr = rest;
+ } else {
+ arr = arguments;
+ }
+ var i = arr.length;
+ while (--i >= 0) arr[i];
+ var arrIsArguments = (arr[1] !== rest);
+ assertEquals(restIsArray, arrIsArguments);
+}
+
+f(false, 'b', 'c');
+f(false, 'b', 'c');
+f(false, 'b', 'c');
+%OptimizeFunctionOnNextCall(f);
+f(true, ['b', 'c']);
diff --git a/src/v8/test/mjsunit/regress/regress-1583.js b/src/v8/test/mjsunit/regress/regress-1583.js
new file mode 100644
index 0000000..c4a344c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1583.js
@@ -0,0 +1,57 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// Regression test for a bug in recompilation of anonymous functions inside
+// catch. We would incorrectly hoist them outside the catch in some cases.
+function f() {
+ try {
+ throw 0;
+ } catch (e) {
+ try {
+ var x = { a: 'hest' };
+ x.m = function (e) { return x.a; };
+ } catch (e) {
+ }
+ }
+ return x;
+}
+
+var o = f();
+assertEquals('hest', o.m());
+assertEquals('hest', o.m());
+assertEquals('hest', o.m());
+%OptimizeFunctionOnNextCall(o.m);
+assertEquals('hest', o.m());
+
+// Fixing the bug above introduced (revealed?) an inconsistency in named
+// getters and setters. The property name was also treated as a function
+// name.
+var global = 'horse';
+var p = { get global() { return global; }};
+assertEquals('horse', p.global);
diff --git a/src/v8/test/mjsunit/regress/regress-1591.js b/src/v8/test/mjsunit/regress/regress-1591.js
new file mode 100644
index 0000000..dbf40df
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1591.js
@@ -0,0 +1,47 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var stack;
+var used_custom_lookup = false;
+
+({
+ __lookupGetter__ : function() {
+ used_custom_lookup = true;
+ },
+
+ test : function() {
+ try {
+ f();
+ } catch (err) {
+ stack = err.stack;
+ }
+ }
+}).test();
+
+var expected_message = "ReferenceError: f is not defined";
+assertTrue(stack.indexOf(expected_message) >= 0);
+assertFalse(used_custom_lookup);
diff --git a/src/v8/test/mjsunit/regress/regress-1592.js b/src/v8/test/mjsunit/regress/regress-1592.js
new file mode 100644
index 0000000..8f6fba0
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1592.js
@@ -0,0 +1,45 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var f = {
+ apply: function(a, b) {}
+};
+
+function test(a) {
+ f.apply(this, arguments);
+}
+
+// Initialize ICs.
+test(1);
+test(1);
+
+%OptimizeFunctionOnNextCall(test);
+
+// Kaboom!
+test(1);
diff --git a/src/v8/test/mjsunit/regress/regress-1620.js b/src/v8/test/mjsunit/regress/regress-1620.js
new file mode 100644
index 0000000..6d72974
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1620.js
@@ -0,0 +1,54 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Don't allow malformed unicode escape sequences in identifiers.
+// In strings and regexps we currently allow malformed unicode escape
+// sequences without throwing a SyntaxError. Instead "\u22gk" would
+// treat the "\u" as an identity escape, and evaluate to "u22gk".
+// Due to code sharing, we did the same in identifiers. This should
+// no longer be the case.
+// See: http://code.google.com/p/v8/issues/detail?id=1620
+
+assertThrows("var \\u\\u\\u = 42;");
+assertThrows("var \\u41 = 42;");
+assertThrows("var \\u123 = 42;");
+eval("var \\u1234 = 42;");
+assertEquals(42, eval("\u1234"));
+assertThrows("var uuu = 42; var x = \\u\\u\\u");
+
+// Regressions introduced and fixed again while fixing the above.
+
+// Handle 0xFFFD correctly (it's a valid value, and shouldn't be used
+// to mark an error).
+assertEquals(0xFFFD, "\uFFFD".charCodeAt(0));
+
+// Handle unicode escapes in regexp flags correctly.
+assertThrows("/x/g\\uim", SyntaxError);
+assertThrows("/x/g\\u2im", SyntaxError);
+assertThrows("/x/g\\u22im", SyntaxError);
+assertThrows("/x/g\\u222im", SyntaxError);
+assertThrows("/x/g\\\\u2222im", SyntaxError);
diff --git a/src/v8/test/mjsunit/regress/regress-1624-strict.js b/src/v8/test/mjsunit/regress/regress-1624-strict.js
new file mode 100644
index 0000000..8bc58d5
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1624-strict.js
@@ -0,0 +1,140 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test that global eval calls of strict code (independent from whether being
+// direct or indirect) have their own lexical and variable environment.
+
+"use strict";
+var evil = eval;
+
+// Test global direct strict eval in strict script.
+// Expects new environment.
+var no_touch = 0;
+eval('"use strict"; var no_touch = 1;');
+assertSame(0, no_touch);
+
+// Test global indirect strict eval in strict script.
+// Expects new environment.
+var no_touch = 0;
+evil('"use strict"; var no_touch = 2;');
+assertSame(0, no_touch);
+
+// Test global direct non-strict eval in strict script.
+// Expects new environment.
+var no_touch = 0;
+eval('var no_touch = 3;');
+assertSame(0, no_touch);
+
+// Test global indirect non-strict eval in strict script.
+// Expects global environment.
+var no_touch = 0;
+evil('var no_touch = 4;');
+assertSame(4, no_touch);
+
+// Test non-global direct strict eval in strict script.
+// Expects new environment.
+var no_touch = 0;
+(function() {
+ var no_touch = 0;
+ eval('"use strict"; var no_touch = 5;');
+ assertSame(0, no_touch);
+})()
+assertSame(0, no_touch);
+
+// Test non-global indirect strict eval in strict script.
+// Expects new environment.
+var no_touch = 0;
+(function() {
+ var no_touch = 0;
+ evil('"use strict"; var no_touch = 6;');
+ assertSame(0, no_touch);
+})()
+assertSame(0, no_touch);
+
+// Test non-global direct non-strict eval in strict script.
+// Expects new environment.
+var no_touch = 0;
+(function() {
+ var no_touch = 0;
+ eval('var no_touch = 7;');
+ assertSame(0, no_touch);
+})()
+assertSame(0, no_touch);
+
+// Test non-global indirect non-strict eval in strict script.
+// Expects global environment.
+var no_touch = 0;
+(function() {
+ var no_touch = 0;
+ evil('var no_touch = 8;');
+ assertSame(0, no_touch);
+})()
+assertSame(8, no_touch);
+
+// Test non-global direct strict eval in strict script.
+// Expects new environment.
+var no_touch = 0;
+(function() {
+ "use strict";
+ var no_touch = 0;
+ eval('"use strict"; var no_touch = 9;');
+ assertSame(0, no_touch);
+})()
+assertSame(0, no_touch);
+
+// Test non-global indirect strict eval in strict script.
+// Expects new environment.
+var no_touch = 0;
+(function() {
+ "use strict";
+ var no_touch = 0;
+ evil('"use strict"; var no_touch = 10;');
+ assertSame(0, no_touch);
+})()
+assertSame(0, no_touch);
+
+// Test non-global direct non-strict eval in strict script.
+// Expects new environment.
+var no_touch = 0;
+(function() {
+ "use strict";
+ var no_touch = 0;
+ eval('var no_touch = 11;');
+ assertSame(0, no_touch);
+})()
+assertSame(0, no_touch);
+
+// Test non-global indirect non-strict eval in strict script.
+// Expects global environment.
+var no_touch = 0;
+(function() {
+ "use strict";
+ var no_touch = 0;
+ evil('var no_touch = 12;');
+ assertSame(0, no_touch);
+})()
+assertSame(12, no_touch);
diff --git a/src/v8/test/mjsunit/regress/regress-1624.js b/src/v8/test/mjsunit/regress/regress-1624.js
new file mode 100644
index 0000000..987e036
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1624.js
@@ -0,0 +1,139 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test that global eval calls of strict code (independent from whether being
+// direct or indirect) have their own lexical and variable environment.
+
+var evil = eval;
+
+// Test global direct strict eval.
+// Expects new environment.
+var no_touch = 0;
+eval('"use strict"; var no_touch = 1;');
+assertSame(0, no_touch);
+
+// Test global indirect strict eval.
+// Expects new environment.
+var no_touch = 0;
+evil('"use strict"; var no_touch = 2;');
+assertSame(0, no_touch);
+
+// Test global direct non-strict eval.
+// Expects global environment.
+var no_touch = 0;
+eval('var no_touch = 3;');
+assertSame(3, no_touch);
+
+// Test global indirect non-strict eval.
+// Expects global environment.
+var no_touch = 0;
+evil('var no_touch = 4;');
+assertSame(4, no_touch);
+
+// Test non-global direct strict eval in non-strict function.
+// Expects new environment.
+var no_touch = 0;
+(function() {
+ var no_touch = 0;
+ eval('"use strict"; var no_touch = 5;');
+ assertSame(0, no_touch);
+})()
+assertSame(0, no_touch);
+
+// Test non-global indirect strict eval in non-strict function.
+// Expects new environment.
+var no_touch = 0;
+(function() {
+ var no_touch = 0;
+ evil('"use strict"; var no_touch = 6;');
+ assertSame(0, no_touch);
+})()
+assertSame(0, no_touch);
+
+// Test non-global direct non-strict eval in non-strict function.
+// Expects function environment.
+var no_touch = 0;
+(function() {
+ var no_touch = 0;
+ eval('var no_touch = 7;');
+ assertSame(7, no_touch);
+})()
+assertSame(0, no_touch);
+
+// Test non-global indirect non-strict eval in non-strict function.
+// Expects global environment.
+var no_touch = 0;
+(function() {
+ var no_touch = 0;
+ evil('var no_touch = 8;');
+ assertSame(0, no_touch);
+})()
+assertSame(8, no_touch);
+
+// Test non-global direct strict eval in strict function.
+// Expects new environment.
+var no_touch = 0;
+(function() {
+ "use strict";
+ var no_touch = 0;
+ eval('"use strict"; var no_touch = 9;');
+ assertSame(0, no_touch);
+})()
+assertSame(0, no_touch);
+
+// Test non-global indirect strict eval in strict function.
+// Expects new environment.
+var no_touch = 0;
+(function() {
+ "use strict";
+ var no_touch = 0;
+ evil('"use strict"; var no_touch = 10;');
+ assertSame(0, no_touch);
+})()
+assertSame(0, no_touch);
+
+// Test non-global direct non-strict eval in strict function.
+// Expects new environment.
+var no_touch = 0;
+(function() {
+ "use strict";
+ var no_touch = 0;
+ eval('var no_touch = 11;');
+ assertSame(0, no_touch);
+})()
+assertSame(0, no_touch);
+
+// Test non-global indirect non-strict eval in strict function.
+// Expects global environment.
+var no_touch = 0;
+(function() {
+ "use strict";
+ var no_touch = 0;
+ evil('var no_touch = 12;');
+ assertSame(0, no_touch);
+})()
+assertSame(12, no_touch);
diff --git a/src/v8/test/mjsunit/regress/regress-1625.js b/src/v8/test/mjsunit/regress/regress-1625.js
new file mode 100644
index 0000000..a2ef8df
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1625.js
@@ -0,0 +1,36 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test that overwriting Array.prototype.push does not make
+// Object.defineProperties misbehave.
+
+Array.prototype.push = 1;
+var desc = {foo: {value: 10}, bar: {get: function() {return 42; }}};
+var obj = {};
+var x = Object.defineProperties(obj, desc);
+assertEquals(x.foo, 10);
+assertEquals(x.bar, 42);
diff --git a/src/v8/test/mjsunit/regress/regress-164442.js b/src/v8/test/mjsunit/regress/regress-164442.js
new file mode 100644
index 0000000..1160d87
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-164442.js
@@ -0,0 +1,45 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// Should not take a very long time (n^2 algorithms are bad)
+
+
+function ensureNotNegative(x) {
+ return Math.max(0, x | 0);
+}
+
+
+ensureNotNegative(1);
+ensureNotNegative(2);
+
+%OptimizeFunctionOnNextCall(ensureNotNegative);
+
+var r = ensureNotNegative(-1);
+
+assertEquals(0, r);
diff --git a/src/v8/test/mjsunit/regress/regress-1647.js b/src/v8/test/mjsunit/regress/regress-1647.js
new file mode 100644
index 0000000..ab6608c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1647.js
@@ -0,0 +1,42 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// Test for correct deoptimization in named function expressions.
+
+var t = { foo: function() {} };
+
+var f = (function bar() {
+ t.foo();
+ assertEquals("function", typeof bar);
+});
+
+for (var i = 0; i < 10; i++) f();
+%OptimizeFunctionOnNextCall(f);
+t.number = 2;
+f();
diff --git a/src/v8/test/mjsunit/regress/regress-1650.js b/src/v8/test/mjsunit/regress/regress-1650.js
new file mode 100644
index 0000000..fb6a178
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1650.js
@@ -0,0 +1,60 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function g(f) { return f.call.apply(f.bind, arguments); }
+
+var x = new Object;
+
+function t() { }
+
+g(t, x);
+g(t, x);
+g(t, x);
+%OptimizeFunctionOnNextCall(g);
+
+function Fake() {}
+
+var fakeCallInvoked = false;
+
+Fake.prototype.call = function () {
+ assertSame(Fake.prototype.bind, this);
+ assertEquals(2, arguments.length);
+ assertSame(fake, arguments[0]);
+ assertSame(x, arguments[1]);
+ fakeCallInvoked = true;
+};
+
+Fake.prototype.bind = function () {
+};
+
+var fake = new Fake;
+
+g(fake, x);
+
+assertTrue(fakeCallInvoked);
diff --git a/src/v8/test/mjsunit/regress/regress-165637.js b/src/v8/test/mjsunit/regress/regress-165637.js
new file mode 100644
index 0000000..6e28726
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-165637.js
@@ -0,0 +1,57 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// Should not take a very long time (n^2 algorithms are bad)
+
+function do_slices() {
+ var data = new Array(1024 * 12); // 12kB
+
+ for (var i = 0; i < data.length; i++) {
+ data[i] = 255;
+ }
+
+ var start = Date.now();
+
+ for (i = 0; i < 20000; i++) {
+ data.slice(4, 1);
+ }
+
+ return Date.now() - start;
+}
+
+// Should never take more than 3 seconds (if the bug is fixed, the test takes
+// considerably less time than 3 seconds).
+assertTrue(do_slices() < (3 * 1000));
+
+// Make sure that packed and unpacked array slices are still properly handled
+var holey_array = [1, 2, 3, 4, 5,,,,,,];
+assertEquals([undefined], holey_array.slice(6, 7));
+assertEquals(undefined, holey_array.slice(6, 7)[0]);
+assertEquals([], holey_array.slice(2, 1));
+assertEquals(3, holey_array.slice(2, 3)[0]);
diff --git a/src/v8/test/mjsunit/regress/regress-166379.js b/src/v8/test/mjsunit/regress/regress-166379.js
new file mode 100644
index 0000000..2cda611
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-166379.js
@@ -0,0 +1,38 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function mod(a, b) { return a % b; }
+
+// Feed integer type info and optimize.
+assertEquals(0, mod(4, 2));
+assertEquals(1, mod(3, 2));
+%OptimizeFunctionOnNextCall(mod);
+
+// Surprise mod with overflow.
+assertEquals(-Infinity, 1/mod(-2147483648, -1));
diff --git a/src/v8/test/mjsunit/regress/regress-166553.js b/src/v8/test/mjsunit/regress/regress-166553.js
new file mode 100644
index 0000000..38fc0b5
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-166553.js
@@ -0,0 +1,33 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-gc
+
+JSON.stringify(String.fromCharCode(1, -11).toString())
+gc();
+var s = String.fromCharCode(1, -11)
+assertEquals(65525, s.charCodeAt(1))
diff --git a/src/v8/test/mjsunit/regress/regress-1692.js b/src/v8/test/mjsunit/regress/regress-1692.js
new file mode 100644
index 0000000..32be87f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1692.js
@@ -0,0 +1,89 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test that Object.prototype.propertyIsEnumerable handles array indices
+// correctly.
+
+var p = Object.create({}, {
+ a : { value : 42, enumerable : true },
+ b : { value : 42, enumerable : false },
+ 1 : { value : 42, enumerable : true },
+ 2 : { value : 42, enumerable : false },
+ f : { get: function(){}, enumerable: true },
+ g : { get: function(){}, enumerable: false },
+ 11 : { get: function(){}, enumerable: true },
+ 12 : { get: function(){}, enumerable: false }
+});
+var o = Object.create(p, {
+ c : { value : 42, enumerable : true },
+ d : { value : 42, enumerable : false },
+ 3 : { value : 42, enumerable : true },
+ 4 : { value : 42, enumerable : false },
+ h : { get: function(){}, enumerable: true },
+ k : { get: function(){}, enumerable: false },
+ 13 : { get: function(){}, enumerable: true },
+ 14 : { get: function(){}, enumerable: false }
+});
+
+// Inherited properties are ignored.
+assertFalse(o.propertyIsEnumerable("a"));
+assertFalse(o.propertyIsEnumerable("b"));
+assertFalse(o.propertyIsEnumerable("1"));
+assertFalse(o.propertyIsEnumerable("2"));
+
+// Own properties.
+assertTrue(o.propertyIsEnumerable("c"));
+assertFalse(o.propertyIsEnumerable("d"));
+assertTrue(o.propertyIsEnumerable("3"));
+assertFalse(o.propertyIsEnumerable("4"));
+
+// Inherited accessors.
+assertFalse(o.propertyIsEnumerable("f"));
+assertFalse(o.propertyIsEnumerable("g"));
+assertFalse(o.propertyIsEnumerable("11"));
+assertFalse(o.propertyIsEnumerable("12"));
+
+// Own accessors.
+assertTrue(o.propertyIsEnumerable("h"));
+assertFalse(o.propertyIsEnumerable("k"));
+assertTrue(o.propertyIsEnumerable("13"));
+assertFalse(o.propertyIsEnumerable("14"));
+
+// Nonexisting properties.
+assertFalse(o.propertyIsEnumerable("xxx"));
+assertFalse(o.propertyIsEnumerable("999"));
+
+// String object properties.
+var o = Object("string");
+// Non-string property on String object.
+o[10] = 42;
+assertTrue(o.propertyIsEnumerable(10));
+assertTrue(o.propertyIsEnumerable(0));
+
+// Fast elements.
+var o = [1,2,3,4,5];
+assertTrue(o.propertyIsEnumerable(3));
diff --git a/src/v8/test/mjsunit/regress/regress-1708.js b/src/v8/test/mjsunit/regress/regress-1708.js
new file mode 100644
index 0000000..a293775
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1708.js
@@ -0,0 +1,67 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Regression test of a very rare corner case where left-trimming an
+// array caused invalid marking bit patterns on lazily swept pages.
+//
+// Lazy sweeping was deprecated. We are keeping the test case to make
+// sure that concurrent sweeping, which relies on similar assumptions
+// as lazy sweeping works correctly.
+
+// Flags: --expose-gc --noincremental-marking --max-semi-space-size=1
+
+(function() {
+ var head = new Array(1);
+ var tail = head;
+
+ // Fill heap to increase old-space size and trigger concurrent sweeping on
+ // some of the old-space pages.
+ for (var i = 0; i < 200; i++) {
+ tail[1] = new Array(1000);
+ tail = tail[1];
+ }
+ array = new Array(100);
+ gc(); gc();
+
+ // At this point "array" should have been promoted to old-space and be
+ // located in a concurrently swept page with intact marking bits. Now shift
+ // the array to trigger left-trimming operations.
+ assertEquals(100, array.length);
+ for (var i = 0; i < 50; i++) {
+ array.shift();
+ }
+ assertEquals(50, array.length);
+
+ // At this point "array" should have been trimmed from the left with
+ // marking bits being correctly transferred to the new object start.
+ // Scavenging operations cause concurrent sweeping to advance and verify
+ // that marking bit patterns are still sane.
+ for (var i = 0; i < 200; i++) {
+ tail[1] = new Array(1000);
+ tail = tail[1];
+ }
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-171.js b/src/v8/test/mjsunit/regress/regress-171.js
new file mode 100644
index 0000000..fe981da
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-171.js
@@ -0,0 +1,41 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function f(s) { return s.length; }
+function g(s, key) { return s[key]; }
+
+assertEquals(f(new String("a")), 1);
+assertEquals(f(new String("a")), 1);
+assertEquals(f(new String("a")), 1);
+assertEquals(f("a"), 1);
+assertEquals(f(new String("a")), 1);
+
+assertEquals(g(new String("a"), "length"), 1);
+assertEquals(g(new String("a"), "length"), 1);
+assertEquals(g(new String("a"), "length"), 1);
+assertEquals(g("a", "length"), 1);
+assertEquals(g(new String("a"), "length"), 1);
diff --git a/src/v8/test/mjsunit/regress/regress-1711.js b/src/v8/test/mjsunit/regress/regress-1711.js
new file mode 100644
index 0000000..15591b1
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1711.js
@@ -0,0 +1,38 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// string.split needs to evaluate the separator's toString even if limit
+// is 0 because toString may have side effects.
+
+var side_effect = false;
+var separator = new Object();
+separator.toString = function() {
+ side_effect = true;
+ return undefined;
+}
+'subject'.split(separator, 0);
+assertTrue(side_effect);
diff --git a/src/v8/test/mjsunit/regress/regress-171641.js b/src/v8/test/mjsunit/regress/regress-171641.js
new file mode 100644
index 0000000..8db6781
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-171641.js
@@ -0,0 +1,40 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function foo(k, p) {
+ for (var i = 0; i < 1; i++) {
+ p = Math.min(p, i);
+ }
+ m = Math.floor((k | 0) / p);
+}
+
+foo(0, 1);
+foo(0, 1);
+%OptimizeFunctionOnNextCall(foo);
+foo(0, 1);
diff --git a/src/v8/test/mjsunit/regress/regress-1748.js b/src/v8/test/mjsunit/regress/regress-1748.js
new file mode 100644
index 0000000..41b7c70
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1748.js
@@ -0,0 +1,35 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test that /^/ only matches at beginning of string.
+// Bug in x64 caused it to match when executing the RegExp on a part
+// of a string that starts at a multiplum of 256.
+
+var str = Array(10000).join("X");
+str.replace(/^|X/g, function(m, i, s) {
+ if (i > 0) assertEquals("X", m, "at position 0x" + i.toString(16));
+});
diff --git a/src/v8/test/mjsunit/regress/regress-1757.js b/src/v8/test/mjsunit/regress/regress-1757.js
new file mode 100644
index 0000000..a850f70
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1757.js
@@ -0,0 +1,33 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --string-slices --expose-externalize-string
+
+var a = "internalized dummy";
+a = "abcdefghijklmnopqrstuvqxy"+"z";
+externalizeString(a, true);
+assertEquals('b', a.substring(1).charAt(0));
diff --git a/src/v8/test/mjsunit/regress/regress-176.js b/src/v8/test/mjsunit/regress/regress-176.js
new file mode 100644
index 0000000..ef0c4f1
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-176.js
@@ -0,0 +1,50 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// See http://code.google.com/p/v8/issues/detail?id=176
+
+assertArrayEquals(["f", undefined],
+ "foo".match(/(?:(?=(f)o))?f/),
+ "zero length match in (?:) with capture in lookahead");
+assertArrayEquals(["f", undefined],
+ "foo".match(/(?=(f)o)?f/),
+ "zero length match in (?=) with capture in lookahead");
+assertArrayEquals(["fo", "f"],
+ "foo".match(/(?:(?=(f)o)f)?o/),
+ "non-zero length match with capture in lookahead");
+assertArrayEquals(["fo", "f"],
+ "foo".match(/(?:(?=(f)o)f?)?o/),
+ "non-zero length match with greedy ? in (?:)");
+assertArrayEquals(["fo", "f"],
+ "foo".match(/(?:(?=(f)o)f??)?o/),
+ "non-zero length match with non-greedy ? in (?:), o forces backtrack");
+assertArrayEquals(["fo", "f"],
+ "foo".match(/(?:(?=(f)o)f??)?./),
+ "non-zero length match with non-greedy ? in (?:), zero length match causes backtrack");
+assertArrayEquals(["f", undefined],
+ "foo".match(/(?:(?=(f)o)fx)?./),
+ "x causes backtrack inside (?:)");
diff --git a/src/v8/test/mjsunit/regress/regress-1790.js b/src/v8/test/mjsunit/regress/regress-1790.js
new file mode 100644
index 0000000..8848eea
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1790.js
@@ -0,0 +1,58 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Regression test checking that the sequence of element access in built-in
+// array functions is specification conform (i.e. [[HasProperty]] might return
+// bogus result after [[Get]] has been called).
+
+function CheckSequence(builtin, callback) {
+ var array = [1,2,3];
+ var callback_count = 0;
+ var callback_wrapper = function() {
+ callback_count++;
+ return callback()
+ }
+
+ // Define getter that will delete itself upon first invocation.
+ Object.defineProperty(array, '1', {
+ get: function () { delete array[1]; },
+ configurable: true
+ });
+
+ assertTrue(array.hasOwnProperty('1'));
+ builtin.apply(array, [callback_wrapper, 'argument']);
+ assertFalse(array.hasOwnProperty('1'));
+ assertEquals(3, callback_count);
+}
+
+CheckSequence(Array.prototype.every, function() { return true; });
+CheckSequence(Array.prototype.filter, function() { return true; });
+CheckSequence(Array.prototype.forEach, function() { return 0; });
+CheckSequence(Array.prototype.map, function() { return 0; });
+CheckSequence(Array.prototype.reduce, function() { return 0; });
+CheckSequence(Array.prototype.reduceRight, function() { return 0; });
+CheckSequence(Array.prototype.some, function() { return false; });
diff --git a/src/v8/test/mjsunit/regress/regress-1849.js b/src/v8/test/mjsunit/regress/regress-1849.js
new file mode 100644
index 0000000..d12c0c6
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1849.js
@@ -0,0 +1,39 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// See: http://code.google.com/p/v8/issues/detail?id=1849
+
+// Flags: --allow-natives-syntax
+
+var count = 1e5;
+var arr = new Array(count);
+assertFalse(%HasDoubleElements(arr));
+for (var i = 0; i < count; i++) {
+ arr[i] = 0;
+}
+assertFalse(%HasDoubleElements(arr));
+assertTrue(%HasSmiElements(arr));
diff --git a/src/v8/test/mjsunit/regress/regress-186.js b/src/v8/test/mjsunit/regress/regress-186.js
new file mode 100644
index 0000000..0c2dbc6
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-186.js
@@ -0,0 +1,61 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Make sure that eval can introduce a local variable called __proto__.
+// See http://code.google.com/p/v8/issues/detail?id=186
+
+var setterCalled = false;
+
+var o = {};
+o.__defineSetter__("x", function() { setterCalled = true; });
+
+function runTest(test) {
+ setterCalled = false;
+ test();
+}
+
+function testLocal() {
+ // Add property called __proto__ to the extension object.
+ eval("var __proto__ = o");
+ // Check that the extension object's prototype did not change.
+ eval("var x = 27");
+ assertFalse(setterCalled, "prototype of extension object changed");
+ assertEquals(o, eval("__proto__"));
+}
+
+function testGlobal() {
+ // Assign to the global __proto__ property.
+ eval("__proto__ = o");
+ // Check that the prototype of the global object changed.
+ eval("x = 27");
+ assertTrue(setterCalled, "prototype of global object did not change");
+ setterCalled = false;
+ assertEquals(o, eval("__proto__"));
+}
+
+runTest(testLocal);
+runTest(testGlobal);
diff --git a/src/v8/test/mjsunit/regress/regress-187.js b/src/v8/test/mjsunit/regress/regress-187.js
new file mode 100644
index 0000000..2f8b0a1
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-187.js
@@ -0,0 +1,30 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// See http://code.google.com/p/v8/issues/detail?id=187
+
+assertEquals(["f", undefined], "foo".match(/(?:(?=(f)o)fx|)./));
diff --git a/src/v8/test/mjsunit/regress/regress-189.js b/src/v8/test/mjsunit/regress/regress-189.js
new file mode 100644
index 0000000..a84b620
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-189.js
@@ -0,0 +1,36 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test that we can handle initialization of a deleted const variable.
+
+// See http://code.google.com/p/v8/issues/detail?id=189.
+
+function f() {
+ eval("delete x; const x = 32");
+}
+
+f();
diff --git a/src/v8/test/mjsunit/regress/regress-1898.js b/src/v8/test/mjsunit/regress/regress-1898.js
new file mode 100644
index 0000000..5440446
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1898.js
@@ -0,0 +1,37 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function f(x) {
+ Math.log(Math.min(0.1, Math.abs(x)));
+}
+
+f(0.1);
+f(0.1);
+%OptimizeFunctionOnNextCall(f);
+f(0.1);
diff --git a/src/v8/test/mjsunit/regress/regress-191.js b/src/v8/test/mjsunit/regress/regress-191.js
new file mode 100644
index 0000000..ca513c9
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-191.js
@@ -0,0 +1,42 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Make sure that accessor setters are ignored on context extension
+// objects.
+// See http://code.google.com/p/v8/issues/detail?id=191
+
+var setterCalled = false;
+
+Object.prototype.__defineSetter__("x", function() { setterCalled = true; });
+
+function test() {
+ eval("var x = 42");
+ assertFalse(setterCalled, "accessor setter call on context object");
+ assertEquals(42, eval("x"));
+}
+
+test();
diff --git a/src/v8/test/mjsunit/regress/regress-1919169.js b/src/v8/test/mjsunit/regress/regress-1919169.js
new file mode 100644
index 0000000..fbb82ba
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1919169.js
@@ -0,0 +1,39 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+function test() {
+ var s2 = "s2";
+ for (var i = 0; i < 2; i++) {
+ // Crashes in round i==1 with IllegalAccess in %StringAdd(x,y)
+ var res = 1 + s2;
+ s2 = 2;
+ }
+}
+
+// Crash does not occur when code is run at the top level.
+test();
diff --git a/src/v8/test/mjsunit/regress/regress-192.js b/src/v8/test/mjsunit/regress/regress-192.js
new file mode 100644
index 0000000..a8e5e9d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-192.js
@@ -0,0 +1,45 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test that exceptions are correctly propagated when creating object
+// literals.
+
+// See http://code.google.com/p/v8/issues/detail?id=192
+
+// UPDATE: This bug report is no longer valid. In ES5, creating object
+// literals MUST NOT trigger inherited accessors, but act as if creating
+// the properties using DefineOwnProperty.
+
+Object.prototype.__defineGetter__("x", function() {});
+Object.prototype.__defineSetter__("y",
+ function() { assertUnreachable("setter"); });
+
+// Creating this object literal will *not* throw an exception because we are
+// assigning to a property that has only a getter.
+var x = ({ x: 42, y: 37 });
+assertEquals(42, x.x);
+assertEquals(37, x.y);
diff --git a/src/v8/test/mjsunit/regress/regress-1924.js b/src/v8/test/mjsunit/regress/regress-1924.js
new file mode 100644
index 0000000..8039541
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1924.js
@@ -0,0 +1,42 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// For http://code.google.com/p/v8/issues/detail?id=1924
+
+a: break a;
+a: b: break a;
+a: b: break b;
+assertThrows("a: break a a", SyntaxError)
+assertThrows("a: break a 1", SyntaxError)
+assertThrows("a: break a ''", SyntaxError)
+assertThrows("a: break a var b", SyntaxError)
+assertThrows("a: break a {}", SyntaxError)
+
+a: if (0) break a;
+b: if (0) {break b;} else {}
+c: if (0) break c; else {}
+d: if (0) break d; else break d;
diff --git a/src/v8/test/mjsunit/regress/regress-193.js b/src/v8/test/mjsunit/regress/regress-193.js
new file mode 100644
index 0000000..457c208
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-193.js
@@ -0,0 +1,42 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test that context extension objects do not have a constructor
+// property.
+
+// See http://code.google.com/p/v8/issues/detail?id=193.
+
+function f() {
+ return eval("var x; constructor");
+}
+
+// It should be ok to call the constructor function returned by f.
+f()();
+
+// The call to f should get the constructor of the receiver which is
+// the constructor of the global object.
+assertEquals(constructor, f());
diff --git a/src/v8/test/mjsunit/regress/regress-1973.js b/src/v8/test/mjsunit/regress/regress-1973.js
new file mode 100644
index 0000000..8708bf1
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1973.js
@@ -0,0 +1,52 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test that getters and setters pass unwrapped this values in strict mode
+// and wrapped this values is non-strict mode.
+
+function TestAccessorWrapping(primitive) {
+ var prototype = Object.getPrototypeOf(Object(primitive))
+ // Check that strict mode passes unwrapped this value.
+ var strict_type = typeof primitive;
+ Object.defineProperty(prototype, "strict", {
+ get: function() { "use strict"; assertSame(strict_type, typeof this); },
+ set: function() { "use strict"; assertSame(strict_type, typeof this); }
+ });
+ primitive.strict = primitive.strict;
+ // Check that non-strict mode passes wrapped this value.
+ var sloppy_type = typeof Object(primitive);
+ Object.defineProperty(prototype, "sloppy", {
+ get: function() { assertSame(sloppy_type, typeof this); },
+ set: function() { assertSame(sloppy_type, typeof this); }
+ });
+ primitive.sloppy = primitive.sloppy;
+}
+
+TestAccessorWrapping(true);
+TestAccessorWrapping(0);
+TestAccessorWrapping({});
+TestAccessorWrapping("");
diff --git a/src/v8/test/mjsunit/regress/regress-1980.js b/src/v8/test/mjsunit/regress/regress-1980.js
new file mode 100644
index 0000000..e1e492b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-1980.js
@@ -0,0 +1,42 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// See: http://code.google.com/p/v8/issues/detail?id=1980
+
+var msg = "Method Error.prototype.toString called on incompatible receiver ";
+
+var invalid_this = [ "invalid", 23, undefined, null ];
+for (var i = 0; i < invalid_this.length; i++) {
+ var exception = false;
+ try {
+ Error.prototype.toString.call(invalid_this[i]);
+ } catch (e) {
+ exception = true;
+ assertEquals(msg + invalid_this[i], e.message);
+ }
+ assertTrue(exception);
+}
diff --git a/src/v8/test/mjsunit/regress/regress-20070207.js b/src/v8/test/mjsunit/regress/regress-20070207.js
new file mode 100644
index 0000000..701a079
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-20070207.js
@@ -0,0 +1,41 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// The following regression test illustrates a problem in using the
+// value of setting a property in the arguments object.
+
+function f(s) {
+ arguments.length;
+ return (s += 10) < 0;
+}
+
+assertTrue(f(-100));
+assertTrue(f(-20));
+assertFalse(f(-10));
+assertFalse(f(-5));
+assertFalse(f(0));
+assertFalse(f(10));
diff --git a/src/v8/test/mjsunit/regress/regress-201.js b/src/v8/test/mjsunit/regress/regress-201.js
new file mode 100644
index 0000000..8847fc0
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-201.js
@@ -0,0 +1,37 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// See http://code.google.com/p/v8/issues/detail?id=201.
+
+function testsort(n) {
+ n=1*n;
+ var numbers=new Array(n);
+ for (var i=0;i<n;i++) numbers[i]=i;
+ numbers.sort();
+}
+
+testsort("5001")
diff --git a/src/v8/test/mjsunit/regress/regress-201590.js b/src/v8/test/mjsunit/regress/regress-201590.js
new file mode 100644
index 0000000..0e7ba57
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-201590.js
@@ -0,0 +1,66 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var gdpRatio = 16/9;
+
+function Foo(initialX, initialY, initialScale, initialMapHeight) {
+ this.ORIGIN = { x: initialX, y: initialY };
+ this.scale = initialScale;
+ this.mapHeight = initialMapHeight;
+}
+
+Foo.prototype.bar = function (x, y, xOffset, yOffset) {
+ var tileHeight = 64 * 0.25 * this.scale,
+ tileWidth = 128 * 0.25 * this.scale,
+ xOffset = xOffset * 0.5 || 0,
+ yOffset = yOffset * 0.5 || 0;
+ var xPos = ((xOffset) * gdpRatio) + this.ORIGIN.x * this.scale -
+ ((y * tileWidth ) * gdpRatio) + ((x * tileWidth ) * gdpRatio);
+ var yPos = ((yOffset) * gdpRatio) + this.ORIGIN.y * this.scale +
+ ((y * tileHeight) * gdpRatio) + ((x * tileHeight) * gdpRatio);
+ xPos = xPos - Math.round(((tileWidth) * gdpRatio)) +
+ this.mapHeight * Math.round(((tileWidth) * gdpRatio));
+ return {
+ x: Math.floor(xPos),
+ y: Math.floor(yPos)
+ };
+}
+
+var f = new Foo(10, 20, 2.5, 400);
+
+function baz() {
+ var b = f.bar(1.1, 2.2, 3.3, 4.4);
+ assertEquals(56529, b.x);
+ assertEquals(288, b.y);
+}
+
+baz();
+baz();
+%OptimizeFunctionOnNextCall(Foo.prototype.bar);
+baz();
diff --git a/src/v8/test/mjsunit/regress/regress-2027.js b/src/v8/test/mjsunit/regress/regress-2027.js
new file mode 100644
index 0000000..3f2062b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2027.js
@@ -0,0 +1,47 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var d = new Date(2010, 1, 1);
+
+function Check(time) {
+ assertEquals(d.getTime(), time);
+}
+
+Check(d.setMilliseconds(10));
+Check(d.setSeconds(10));
+Check(d.setMinutes(10));
+Check(d.setHours(10));
+Check(d.setDate(10));
+Check(d.setMonth(10));
+Check(d.setFullYear(2010));
+Check(d.setUTCMilliseconds(10));
+Check(d.setUTCSeconds(10));
+Check(d.setUTCMinutes(10));
+Check(d.setUTCHours(10));
+Check(d.setUTCDate(10));
+Check(d.setUTCMonth(10));
+Check(d.setUTCFullYear(2010));
diff --git a/src/v8/test/mjsunit/regress/regress-2030.js b/src/v8/test/mjsunit/regress/regress-2030.js
new file mode 100644
index 0000000..fb5a3d0
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2030.js
@@ -0,0 +1,53 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function a() {
+ this.x = 1;
+}
+var aa = new a();
+%DebugPrint(aa);
+
+function b() {
+ this.z = 23;
+ this.x = 2;
+}
+var bb = new b();
+%DebugPrint(bb);
+
+function f(o) {
+ return o.x;
+}
+
+assertSame(1, f(aa));
+assertSame(1, f(aa));
+assertSame(2, f(bb));
+assertSame(2, f(bb));
+%OptimizeFunctionOnNextCall(f);
+assertSame(1, f(aa));
+assertSame(2, f(bb));
diff --git a/src/v8/test/mjsunit/regress/regress-2032.js b/src/v8/test/mjsunit/regress/regress-2032.js
new file mode 100644
index 0000000..ad6408d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2032.js
@@ -0,0 +1,64 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// See: http://code.google.com/p/v8/issues/detail?id=2032
+
+// Case independent regexp that ends on the first character in a block.
+assertTrue(/[@-A]/i.test("a"));
+assertTrue(/[@-A]/i.test("A"));
+assertTrue(/[@-A]/i.test("@"));
+
+assertFalse(/[@-A]/.test("a"));
+assertTrue(/[@-A]/.test("A"));
+assertTrue(/[@-A]/.test("@"));
+
+assertFalse(/[¿-À]/i.test('¾'));
+assertTrue(/[¿-À]/i.test('¿'));
+assertTrue(/[¿-À]/i.test('À'));
+assertTrue(/[¿-À]/i.test('à'));
+assertFalse(/[¿-À]/i.test('á'));
+assertFalse(/[¿-À]/i.test('Á'));
+
+assertFalse(/[¿-À]/.test('¾'));
+assertTrue(/[¿-À]/.test('¿'));
+assertTrue(/[¿-À]/.test('À'));
+assertFalse(/[¿-À]/.test('à'));
+assertFalse(/[¿-À]/.test('á'));
+assertFalse(/[¿-À]/.test('á'));
+assertFalse(/[¿-À]/i.test('Á'));
+
+assertFalse(/[Ö-×]/i.test('Õ'));
+assertTrue(/[Ö-×]/i.test('Ö'));
+assertTrue(/[Ö-×]/i.test('ö'));
+assertTrue(/[Ö-×]/i.test('×'));
+assertFalse(/[Ö-×]/i.test('Ø'));
+
+assertFalse(/[Ö-×]/.test('Õ'));
+assertTrue(/[Ö-×]/.test('Ö'));
+assertFalse(/[Ö-×]/.test('ö'));
+assertTrue(/[Ö-×]/.test('×'));
+assertFalse(/[Ö-×]/.test('Ø'));
diff --git a/src/v8/test/mjsunit/regress/regress-2045.js b/src/v8/test/mjsunit/regress/regress-2045.js
new file mode 100644
index 0000000..822ee1f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2045.js
@@ -0,0 +1,49 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function foo() {
+ assertEquals(2, arguments.length);
+}
+
+function bar() {
+ G.x;
+ return foo.apply(this, arguments);
+}
+
+function baz() {
+ return bar(1, 2);
+}
+
+G = {x: 0};
+baz();
+baz();
+%OptimizeFunctionOnNextCall(baz);
+baz();
+delete G.x;
+baz();
diff --git a/src/v8/test/mjsunit/regress/regress-2054.js b/src/v8/test/mjsunit/regress/regress-2054.js
new file mode 100644
index 0000000..97b989c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2054.js
@@ -0,0 +1,34 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test that we can correctly optimize top level code that contains a
+// throw (or return) as it's last statement.
+
+var N = 1e5; // Number of iterations that trigger optimization.
+for (var i = 0; i < N; i++) {
+ if (i > N) throw new Error;
+}
diff --git a/src/v8/test/mjsunit/regress/regress-2055.js b/src/v8/test/mjsunit/regress/regress-2055.js
new file mode 100644
index 0000000..1eaf62c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2055.js
@@ -0,0 +1,48 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test that array literal boilerplate objects can be transitioned while
+// existing un-transitioned clones are still being populated.
+
+function test1(depth) {
+ if (--depth < 0) {
+ return [];
+ } else {
+ return [ 0, test1(depth) ];
+ }
+}
+assertEquals([0,[0,[]]], test1(2));
+
+function test2(depth) {
+ if (--depth < 0) {
+ return [];
+ } else {
+ var o = [ 0, test2(depth) ];
+ return (depth == 0) ? 0.5 : o;
+ }
+}
+assertEquals([0,0.5], test2(2));
diff --git a/src/v8/test/mjsunit/regress/regress-2056.js b/src/v8/test/mjsunit/regress/regress-2056.js
new file mode 100644
index 0000000..d34a750
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2056.js
@@ -0,0 +1,66 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var cases = [
+ [0.0, 0.0, 0.0, 0,0],
+ [undefined, 0.0, NaN, NaN],
+ [0.0, undefined, NaN, NaN],
+ [NaN, 0.0, NaN, NaN],
+ [0.0, NaN, NaN, NaN],
+ [-NaN, 0.0, NaN, NaN],
+ [0.0, -NaN, NaN, NaN],
+ [Infinity, 0.0, Infinity, 0.0],
+ [0.0, Infinity, Infinity, 0.0],
+ [-Infinity, 0.0, 0.0, -Infinity],
+ [0.0, -Infinity, 0.0, -Infinity]
+];
+
+function do_min(a, b) {
+ return Math.min(a, b);
+}
+
+function do_max(a, b) {
+ return Math.max(a, b);
+}
+
+// Make sure that non-crankshaft results match expectations.
+for (i = 0; i < cases.length; ++i) {
+ var c = cases[i];
+ assertEquals(c[3], do_min(c[0], c[1]));
+ assertEquals(c[2], do_max(c[0], c[1]));
+}
+
+// Make sure that crankshaft results match expectations.
+for (i = 0; i < cases.length; ++i) {
+ var c = cases[i];
+ %OptimizeFunctionOnNextCall(do_min);
+ %OptimizeFunctionOnNextCall(do_max);
+ assertEquals(c[3], do_min(c[0], c[1]));
+ assertEquals(c[2], do_max(c[0], c[1]));
+}
diff --git a/src/v8/test/mjsunit/regress/regress-2058.js b/src/v8/test/mjsunit/regress/regress-2058.js
new file mode 100644
index 0000000..9a69ea1
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2058.js
@@ -0,0 +1,37 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+// See http://code.google.com/p/v8/issues/detail?id=2058
+
+// A match after a replace with a function argument needs to reset
+// the flag that determines whether we are using indices or substrings
+// to indicate the last match.
+"Now is the".replace(/Now (\w+) the/g, function() {
+ "foo bar".match(/( )/);
+ assertEquals(RegExp.$1, " ");
+})
diff --git a/src/v8/test/mjsunit/regress/regress-2071.js b/src/v8/test/mjsunit/regress/regress-2071.js
new file mode 100644
index 0000000..91ae2a7
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2071.js
@@ -0,0 +1,79 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+a = {};
+
+a.b = 42;
+
+with(a) {
+ a.f = (function f1() {
+ function f2() {
+ return b;
+ };
+ return f2;
+ })();
+}
+
+for(var i = 0; i < 10000; i++) {
+ assertEquals(42, a.f());
+}
+
+with(a) {
+ a.g = (function f1() {
+ function f2() {
+ function f3() {
+ return b;
+ }
+ return f3;
+ };
+ return f2();
+ })();
+}
+
+for(var i = 0; i < 10000; i++) {
+ assertEquals(42, a.g());
+}
+
+function outer() {
+ with(a) {
+ a.h = (function f1() {
+ function f2() {
+ function f3() {
+ return b;
+ }
+ return f3;
+ };
+ return f2();
+ })();
+ }
+};
+
+outer();
+
+for(var i = 0; i < 10000; i++) {
+ assertEquals(42, a.h());
+}
diff --git a/src/v8/test/mjsunit/regress/regress-2073.js b/src/v8/test/mjsunit/regress/regress-2073.js
new file mode 100644
index 0000000..4e40b04
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2073.js
@@ -0,0 +1,99 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Running this test with --trace_gc will show heap size growth due to
+// leaking objects via embedded maps in optimized code.
+
+var counter = 0;
+
+function nextid() {
+ counter += 1;
+ return counter;
+}
+
+function Scope() {
+ this.id = nextid();
+ this.parent = null;
+ this.left = null;
+ this.right = null;
+ this.head = null;
+ this.tail = null;
+ this.counter = 0;
+}
+
+Scope.prototype = {
+ new: function() {
+ var Child,
+ child;
+ Child = function() {};
+ Child.prototype = this;
+ child = new Child();
+ child.id = nextid();
+ child.parent = this;
+ child.left = this.last;
+ child.right = null;
+ child.head = null;
+ child.tail = null;
+ child.counter = 0;
+ if (this.head) {
+ this.tail.right = child;
+ this.tail = child;
+ } else {
+ this.head = this.tail = child;
+ }
+ return child;
+ },
+
+ destroy: function() {
+ if ($root == this) return;
+ var parent = this.parent;
+ if (parent.head == this) parent.head = this.right;
+ if (parent.tail == this) parent.tail = this.left;
+ if (this.left) this.left.right = this.right;
+ if (this.right) this.right.left = this.left;
+ }
+};
+
+function inc(scope) {
+ scope.counter = scope.counter + 1;
+}
+
+var $root = new Scope();
+
+n = 100000;
+m = 10;
+
+function doit() {
+ var a = $root.new();
+ var b = a.new();
+ inc(b);
+ if (i > m) $root.head.destroy();
+}
+
+for (var i = 0; i < n; i++) {
+ doit();
+}
diff --git a/src/v8/test/mjsunit/regress/regress-2110.js b/src/v8/test/mjsunit/regress/regress-2110.js
new file mode 100644
index 0000000..d7f78d2
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2110.js
@@ -0,0 +1,53 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var uint8 = new Uint8Array(1);
+
+function test() {
+ uint8[0] = 0x800000aa;
+ assertEquals(0xaa, uint8[0]);
+}
+
+test();
+test();
+test();
+%OptimizeFunctionOnNextCall(test);
+test();
+
+var uint32 = new Uint32Array(1);
+
+function test2() {
+ uint32[0] = 0x80123456789abcde;
+ assertEquals(0x789ac000, uint32[0]);
+}
+
+test2();
+test2();
+%OptimizeFunctionOnNextCall(test2);
+test2();
diff --git a/src/v8/test/mjsunit/regress/regress-2119.js b/src/v8/test/mjsunit/regress/regress-2119.js
new file mode 100644
index 0000000..b735ddf
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2119.js
@@ -0,0 +1,35 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --nouse-ic
+
+function strict_function() {
+ "use strict"
+ undeclared = 1;
+}
+
+assertThrows(strict_function);
diff --git a/src/v8/test/mjsunit/regress/regress-2132.js b/src/v8/test/mjsunit/regress/regress-2132.js
new file mode 100644
index 0000000..c2f6c29
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2132.js
@@ -0,0 +1,48 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax --opt --no-always-opt
+
+function mul(x, y) {
+ return (x * y) | 0;
+}
+
+mul(0, 0);
+mul(0, 0);
+%OptimizeFunctionOnNextCall(mul);
+assertEquals(0, mul(0, -1));
+assertOptimized(mul);
+
+function div(x, y) {
+ return (x / y) | 0;
+}
+
+div(4, 2);
+div(4, 2);
+%OptimizeFunctionOnNextCall(div);
+assertEquals(1, div(5, 3));
+assertOptimized(div);
diff --git a/src/v8/test/mjsunit/regress/regress-2153.js b/src/v8/test/mjsunit/regress/regress-2153.js
new file mode 100644
index 0000000..3170042
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2153.js
@@ -0,0 +1,32 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var o = {};
+o.__defineGetter__('foo', function () { return null; });
+var o = {};
+o.foo = 42;
+assertEquals(42, o.foo);
diff --git a/src/v8/test/mjsunit/regress/regress-2163.js b/src/v8/test/mjsunit/regress/regress-2163.js
new file mode 100644
index 0000000..bfce9ff
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2163.js
@@ -0,0 +1,70 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-gc
+
+// Handy abbreviation.
+var dp = Object.defineProperty;
+
+function getter() { return 111; }
+function setter(x) { print(222); }
+function anotherGetter() { return 333; }
+function anotherSetter(x) { print(444); }
+var obj1, obj2;
+
+// obj1 and obj2 share the getter accessor.
+obj1 = {};
+dp(obj1, "alpha", { get: getter, set: setter });
+obj2 = {}
+dp(obj2, "alpha", { get: getter });
+obj1 = {};
+assertEquals(111, obj2.alpha);
+gc();
+assertEquals(111, obj2.alpha);
+
+// obj1, obj2, and obj3 share the getter accessor.
+obj1 = {};
+dp(obj1, "alpha", { get: getter, set: setter });
+obj2 = {}
+dp(obj2, "alpha", { get: getter });
+obj1 = {};
+gc();
+obj3 = {}
+dp(obj3, "alpha", { get: getter });
+
+
+// obj1 and obj2 share the getter and setter accessor.
+obj1 = {};
+dp(obj1, "alpha", { get: getter, set: setter });
+obj1.beta = 10;
+obj2 = {}
+dp(obj2, "alpha", { get: getter, set: setter });
+obj1 = {};
+assertEquals(111, obj2.alpha);
+gc();
+obj2.alpha = 100
+assertEquals(111, obj2.alpha);
diff --git a/src/v8/test/mjsunit/regress/regress-2170.js b/src/v8/test/mjsunit/regress/regress-2170.js
new file mode 100644
index 0000000..99f432d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2170.js
@@ -0,0 +1,57 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function array_fun() {
+ for (var i = 0; i < 2; i++) {
+ var a = [1.1, 1.2, 1.3, 1.4, 1.5, 1.6, 1.7, 1.8];
+ var x = new Array();
+ x.fixed$length = true;
+ for (var j = 0; j < a.length; j++) {
+ x.push(a[j]);
+ }
+ for(var j = 0; j < x.length; j++) {
+ if (typeof x[j] != 'number') {
+ throw "foo";
+ }
+ x[j] = x[j];
+ }
+ }
+}
+
+try {
+ for (var i = 0; i < 10; ++i) {
+ array_fun();
+ }
+ %OptimizeFunctionOnNextCall(array_fun);
+ for (var i = 0; i < 10; ++i) {
+ array_fun();
+ }
+} catch (e) {
+ assertUnreachable();
+}
diff --git a/src/v8/test/mjsunit/regress/regress-2172.js b/src/v8/test/mjsunit/regress/regress-2172.js
new file mode 100644
index 0000000..6d93845
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2172.js
@@ -0,0 +1,34 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+for (var i = 0; i < 10000; i++){
+ (i + "\0").split(/(.)\1/i);
+}
+
+for (var i = 0; i < 10000; i++){
+ (i + "\u1234\0").split(/(.)\1/i);
+}
diff --git a/src/v8/test/mjsunit/regress/regress-2185-2.js b/src/v8/test/mjsunit/regress/regress-2185-2.js
new file mode 100644
index 0000000..b1eedb9
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2185-2.js
@@ -0,0 +1,145 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// These tests used to time out before this was fixed.
+
+var LEN = 2e4;
+
+function short() {
+ var sum = 0;
+ for (var i = 0; i < 1000; i++) {
+ var a = [1, 4, 34, 23, 6, 123, 3, 2, 11, 515, 4, 33, 22, 2, 2, 1, 0, 123,
+ 23, 42, 43, 1002, 44, 43, 101, 23, 55, 11, 101, 102, 45, 11, 404,
+ 31415, 34, 53, 453, 45, 34, 5, 2, 35, 5, 345, 36, 45, 345, 3, 45,
+ 3, 5, 5, 2, 2342344, 2234, 23, 2718, 1500, 2, 19, 22, 43, 41, 0,
+ -1, 33, 45, 78];
+ a.sort(function(a, b) { return a - b; });
+ sum += a[0];
+ }
+ return sum;
+}
+
+function short_bench(name, array) {
+ var start = new Date();
+ short();
+ var end = new Date();
+ var ms = end - start;
+ print("Short " + Math.floor(ms) + "ms");
+}
+
+function sawseq(a, tooth) {
+ var count = 0;
+ while (true) {
+ for (var i = 0; i < tooth; i++) {
+ a.push(i);
+ if (++count >= LEN) return a;
+ }
+ }
+}
+
+function sawseq2(a, tooth) {
+ var count = 0;
+ while (true) {
+ for (var i = 0; i < tooth; i++) {
+ a.push(i);
+ if (++count >= LEN) return a;
+ }
+ for (var i = 0; i < tooth; i++) {
+ a.push(tooth - i);
+ if (++count >= LEN) return a;
+ }
+ }
+}
+
+function sawseq3(a, tooth) {
+ var count = 0;
+ while (true) {
+ for (var i = 0; i < tooth; i++) {
+ a.push(tooth - i);
+ if (++count >= LEN) return a;
+ }
+ }
+}
+
+function up(a) {
+ for (var i = 0; i < LEN; i++) {
+ a.push(i);
+ }
+ return a;
+}
+
+function down(a) {
+ for (var i = 0; i < LEN; i++) {
+ a.push(LEN - i);
+ }
+ return a;
+}
+
+function ran(a) {
+ for (var i = 0; i < LEN; i++) {
+ a.push(Math.floor(Math.random() * LEN));
+ }
+ return a;
+}
+
+var random = ran([]);
+var asc = up([]);
+var desc = down([]);
+var asc_desc = down(up([]));
+var desc_asc = up(down([]));
+var asc_asc = up(up([]));
+var desc_desc = down(down([]));
+var saw1 = sawseq([], 1000);
+var saw2 = sawseq([], 500);
+var saw3 = sawseq([], 200);
+var saw4 = sawseq2([], 200);
+var saw5 = sawseq3([], 200);
+
+function bench(name, array) {
+ var start = new Date();
+ array.sort(function(a, b) { return a - b; });
+ var end = new Date();
+ for (var i = 0; i < array.length - 1; i++) {
+ if (array[i] > array[i + 1]) throw name + " " + i;
+ }
+ var ms = end - start;
+ print(name + " " + Math.floor(ms) + "ms");
+}
+
+short_bench();
+bench("random", random);
+bench("up", asc);
+bench("down", desc);
+bench("saw 1000", saw1);
+bench("saw 500", saw2);
+bench("saw 200", saw3);
+bench("saw 200 symmetric", saw4);
+bench("saw 200 down", saw4);
+bench("up, down", asc_desc);
+bench("up, up", asc_asc);
+bench("down, down", desc_desc);
+bench("down, up", desc_asc);
diff --git a/src/v8/test/mjsunit/regress/regress-2185.js b/src/v8/test/mjsunit/regress/regress-2185.js
new file mode 100644
index 0000000..9b91066
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2185.js
@@ -0,0 +1,38 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --noenable-slow-asserts
+
+var a = [];
+
+for (var i = 0; i < 2; i++) {
+ for (var j = 0; j < 30000; j++) {
+ a.push(j);
+ }
+}
+
+a.sort(function(a, b) { return a - b; } );
diff --git a/src/v8/test/mjsunit/regress/regress-219.js b/src/v8/test/mjsunit/regress/regress-219.js
new file mode 100644
index 0000000..b751f0f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-219.js
@@ -0,0 +1,148 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Tests handling of flags for regexps.
+
+// We should now allow duplicates of flags.
+// (See http://code.google.com/p/v8/issues/detail?id=219)
+
+// This has been reversed by issue 1628, since other browsers have also
+// tightened their syntax.
+// (See http://code.google.com/p/v8/issues/detail?id=1628)
+
+// Base tests: we recognize the basic flags
+
+function assertFlags(re, global, multiline, ignoreCase) {
+ var name = re + " flag: ";
+ (global ? assertTrue : assertFalse)(re.global, name + "g");
+ (multiline ? assertTrue : assertFalse)(re.multiline, name + "m");
+ (ignoreCase ? assertTrue : assertFalse)(re.ignoreCase, name + "i");
+}
+
+var re = /a/;
+assertFlags(re, false, false, false)
+
+re = /a/gim;
+assertFlags(re, true, true, true)
+
+re = RegExp("a","");
+assertFlags(re, false, false, false)
+
+re = RegExp("a", "gim");
+assertFlags(re, true, true, true)
+
+// Double i's
+
+assertThrows("/a/ii");
+
+assertThrows("/a/gii");
+
+assertThrows("/a/igi");
+
+assertThrows("/a/iig");
+
+assertThrows("/a/gimi");
+
+assertThrows("/a/giim");
+
+assertThrows("/a/igim");
+
+assertThrows(function(){ return RegExp("a", "ii"); })
+
+assertThrows(function(){ return RegExp("a", "gii"); })
+
+assertThrows(function(){ return RegExp("a", "igi"); })
+
+assertThrows(function(){ return RegExp("a", "iig"); })
+
+assertThrows(function(){ return RegExp("a", "gimi"); })
+
+assertThrows(function(){ return RegExp("a", "giim"); })
+
+assertThrows(function(){ return RegExp("a", "igim"); })
+
+// Tripple i's
+
+assertThrows("/a/iii");
+
+assertThrows("/a/giii");
+
+assertThrows("/a/igii");
+
+assertThrows("/a/iigi");
+
+assertThrows("/a/iiig");
+
+assertThrows("/a/miiig");
+
+assertThrows(function(){ return RegExp("a", "iii"); })
+
+assertThrows(function(){ return RegExp("a", "giii"); })
+
+assertThrows(function(){ return RegExp("a", "igii"); })
+
+assertThrows(function(){ return RegExp("a", "iigi"); })
+
+assertThrows(function(){ return RegExp("a", "iiig"); })
+
+assertThrows(function(){ return RegExp("a", "miiig"); })
+
+// Illegal flags - valid flags late in string.
+
+assertThrows("/a/arglebargleglopglyf");
+
+assertThrows("/a/arglebargleglopglif");
+
+assertThrows("/a/arglebargleglopglym");
+
+assertThrows("/a/arglebargleglopglim");
+
+// Case of flags still matters.
+
+var re = /a/gmi;
+assertFlags(re, true, true, true)
+
+assertThrows("/a/Gmi");
+
+assertThrows("/a/gMi");
+
+assertThrows("/a/gmI");
+
+assertThrows("/a/GMi");
+
+assertThrows("/a/GmI");
+
+assertThrows("/a/gMI");
+
+assertThrows("/a/GMI");
+
+// Unicode escape sequences are not interpreted.
+
+assertThrows("/a/\\u0067");
+assertThrows("/a/\\u0069");
+assertThrows("/a/\\u006d");
+assertThrows("/a/\\u006D");
diff --git a/src/v8/test/mjsunit/regress/regress-2193.js b/src/v8/test/mjsunit/regress/regress-2193.js
new file mode 100644
index 0000000..4ec050e
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2193.js
@@ -0,0 +1,58 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function bozo() {};
+function MakeClosure() {
+ return function f(use_literals) {
+ if (use_literals) {
+ return [1,2,3,3,4,5,6,7,8,9,bozo];
+ } else {
+ return 0;
+ }
+ }
+}
+
+// Create two closures that share the same literal boilerplates.
+var closure1 = MakeClosure();
+var closure2 = MakeClosure();
+var expected = [1,2,3,3,4,5,6,7,8,9,bozo];
+
+// Make sure we generate optimized code for the first closure after
+// warming it up properly so that the literals boilerplate is generated
+// and the optimized code uses CreateArrayLiteralShallow runtime call.
+assertEquals(0, closure1(false));
+assertEquals(expected, closure1(true));
+%OptimizeFunctionOnNextCall(closure1);
+assertEquals(expected, closure1(true));
+
+// Optimize the second closure, which should reuse the optimized code
+// from the first closure with the same literal boilerplates.
+assertEquals(0, closure2(false));
+%OptimizeFunctionOnNextCall(closure2);
+assertEquals(expected, closure2(true));
diff --git a/src/v8/test/mjsunit/regress/regress-2226.js b/src/v8/test/mjsunit/regress/regress-2226.js
new file mode 100644
index 0000000..1ac3d30
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2226.js
@@ -0,0 +1,36 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var foo = function() { 0; /* foo function */ };
+var bar = function() { 1; /* bar function */ };
+var baz = function() { 2; /* baz function */ };
+
+var test = foo.test = bar.test = baz;
+
+assertEquals(baz, test);
+assertEquals(baz, foo.test);
+assertEquals(baz, bar.test);
diff --git a/src/v8/test/mjsunit/regress/regress-2234.js b/src/v8/test/mjsunit/regress/regress-2234.js
new file mode 100644
index 0000000..8da513e
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2234.js
@@ -0,0 +1,41 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function test(i) {
+ // Overwrite random parts of the transcendental cache.
+ Math.sin(i / 1779 * Math.PI);
+ // Check whether the first cache line has been accidentally overwritten
+ // with incorrect key.
+ assertEquals(0, Math.sin(0));
+}
+
+for (i = 0; i < 10000; ++i) {
+ test(i);
+ if (i == 0) %OptimizeFunctionOnNextCall(test);
+}
diff --git a/src/v8/test/mjsunit/regress/regress-2249.js b/src/v8/test/mjsunit/regress/regress-2249.js
new file mode 100644
index 0000000..07d687d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2249.js
@@ -0,0 +1,33 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --gc-interval=10 --stress-compaction
+
+var o = {};
+o[Math.pow(2,30)-1] = 0;
+o[Math.pow(2,31)-1] = 0;
+o[1] = 0;
diff --git a/src/v8/test/mjsunit/regress/regress-2249423.js b/src/v8/test/mjsunit/regress/regress-2249423.js
new file mode 100644
index 0000000..a590f33
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2249423.js
@@ -0,0 +1,40 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// See http://code.google.com/p/chromium/issues/detail?id=27227
+// Regression test for stack corruption issue.
+
+function top() {
+ function g(a, b) {}
+ function t() {
+ for (var i=0; i<1; ++i) {
+ g(32768, g());
+ }
+ }
+ t();
+}
+top();
diff --git a/src/v8/test/mjsunit/regress/regress-225.js b/src/v8/test/mjsunit/regress/regress-225.js
new file mode 100644
index 0000000..e101ca0
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-225.js
@@ -0,0 +1,32 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// See http://code.google.com/p/v8/issues/detail?id=225
+
+assertEquals("foo", "foo".replace(/(?:)/g, function() { return ""; }));
+
+assertEquals("foo", "foo".replace(/(?:)/g, ""));
diff --git a/src/v8/test/mjsunit/regress/regress-2250.js b/src/v8/test/mjsunit/regress/regress-2250.js
new file mode 100644
index 0000000..e2ce546
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2250.js
@@ -0,0 +1,67 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax --opt
+
+// The original problem from the bug: In the example below SMI check for b
+// generated for inlining of equals invocation (marked with (*)) will be hoisted
+// out of the loop across the typeof b === "object" condition and cause an
+// immediate deopt. Another problem here is that no matter how many time we
+// deopt and reopt we will continue to produce the wrong code.
+//
+// The fix is to notice when a deopt and subsequent reopt doesn't find
+// additional type information, indicating that optimistic LICM should be
+// disabled during compilation.
+
+function eq(a, b) {
+ if (typeof b === "object") {
+ return b.equals(a); // (*)
+ }
+ return a === b;
+}
+
+Object.prototype.equals = function (other) {
+ return (this === other);
+};
+
+function test() {
+ for (var i = 0; !eq(i, 10); i++)
+ ;
+}
+
+eq({}, {});
+eq({}, {});
+eq(1, 1);
+eq(1, 1);
+test();
+%OptimizeFunctionOnNextCall(test);
+test();
+%OptimizeFunctionOnNextCall(test);
+// Second compilation should have noticed that LICM wasn't a good idea, and now
+// function should no longer deopt when called.
+test();
+assertOptimized(test);
diff --git a/src/v8/test/mjsunit/regress/regress-2261.js b/src/v8/test/mjsunit/regress/regress-2261.js
new file mode 100644
index 0000000..000e07d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2261.js
@@ -0,0 +1,113 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// Test materialization of the arguments object when deoptimizing a
+// strict mode closure after modifying an argument.
+
+(function () {
+ var forceDeopt = 0;
+ function inner(x) {
+ "use strict";
+ x = 2;
+ // Do not remove this %DebugPrint as it makes sure the deopt happens
+ // after the assignment and is not hoisted above the assignment.
+ %DebugPrint(arguments[0]);
+ forceDeopt + 1;
+ return arguments[0];
+ }
+
+ assertEquals(1, inner(1));
+ assertEquals(1, inner(1));
+ %OptimizeFunctionOnNextCall(inner);
+ assertEquals(1, inner(1));
+ forceDeopt = "not a number";
+ assertEquals(1, inner(1));
+})();
+
+
+// Test materialization of the arguments object when deoptimizing an
+// inlined strict mode closure after modifying an argument.
+
+(function () {
+ var forceDeopt = 0;
+ function inner(x) {
+ "use strict";
+ x = 2;
+ // Do not remove this %DebugPrint as it makes sure the deopt happens
+ // after the assignment and is not hoisted above the assignment.
+ %DebugPrint(arguments[0]);
+ forceDeopt + 1;
+ return arguments[0];
+ }
+
+ function outer(x) {
+ return inner(x);
+ }
+
+ assertEquals(1, outer(1));
+ assertEquals(1, outer(1));
+ %OptimizeFunctionOnNextCall(outer);
+ assertEquals(1, outer(1));
+ forceDeopt = "not a number";
+ assertEquals(1, outer(1));
+})();
+
+
+// Test materialization of the multiple arguments objects when
+// deoptimizing several inlined closure after modifying an argument.
+
+(function () {
+ var forceDeopt = 0;
+ function inner(x,y,z) {
+ "use strict";
+ x = 3;
+ // Do not remove this %DebugPrint as it makes sure the deopt happens
+ // after the assignment and is not hoisted above the assignment.
+ %DebugPrint(arguments[0]);
+ forceDeopt + 1;
+ return arguments[0];
+ }
+
+ function middle(x) {
+ "use strict";
+ x = 2;
+ return inner(10*x, 20*x, 30*x) + arguments[0];
+ }
+
+ function outer(x) {
+ return middle(x);
+ }
+
+ assertEquals(21, outer(1));
+ assertEquals(21, outer(1));
+ %OptimizeFunctionOnNextCall(outer);
+ assertEquals(21, outer(1));
+ forceDeopt = "not a number";
+ assertEquals(21, outer(1));
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-2263.js b/src/v8/test/mjsunit/regress/regress-2263.js
new file mode 100644
index 0000000..9e4b079
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2263.js
@@ -0,0 +1,54 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+assertThrows = function assertThrows(code, type_opt, cause_opt) {
+ var threwException = true;
+ try {
+ if (typeof code === 'function') {
+ code();
+ } else {
+ eval(code);
+ }
+ threwException = false;
+ } catch (e) {
+ if (typeof type_opt === 'function') {
+ assertInstanceof(e, type_opt);
+ } else if (type_opt !== void 0) {
+ failWithMessage("invalid use of assertThrows, maybe you want assertThrowsEquals");
+ }
+ if (arguments.length >= 3) {
+ assertEquals(e.type, cause_opt);
+ }
+ // Success.
+ return;
+ }
+ failWithMessage("Did not throw exception");
+};
+
+var obj = { length: { valueOf: function(){ throw { type: "length" }}}};
+var sep = { toString: function(){ throw { type: "toString" }}};
+assertThrows("Array.prototype.join.call(obj, sep)", undefined, "length");
diff --git a/src/v8/test/mjsunit/regress/regress-227.js b/src/v8/test/mjsunit/regress/regress-227.js
new file mode 100644
index 0000000..ebb4627
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-227.js
@@ -0,0 +1,33 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var re = /\u23a1|x/;
+var res = re.exec("!");
+assertEquals(null, res, "Throwing away high bits on ASCII string");
+
+res = re.exec("!x");
+assertEquals(["x"], res, "Throwing away high bits on ASCII string");
diff --git a/src/v8/test/mjsunit/regress/regress-2273.js b/src/v8/test/mjsunit/regress/regress-2273.js
new file mode 100644
index 0000000..76b5ab6
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2273.js
@@ -0,0 +1,103 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var CheckStringReceiver = function() {
+ "use strict";
+ // Receivers of strict functions are not coerced.
+ assertEquals("string", typeof this);
+};
+
+var CheckNumberReceiver = function() {
+ "use strict";
+ // Receivers of strict functions are not coerced.
+ assertEquals("number", typeof this);
+};
+
+var CheckUndefinedReceiver = function() {
+ "use strict";
+ // Receivers of strict functions are not coerced.
+ assertEquals("undefined", String(this));
+};
+
+var CheckNullReceiver = function() {
+ "use strict";
+ // Receivers of strict functions are not coerced.
+ assertEquals("null", String(this));
+};
+
+var CheckCoersion = function() {
+ // Receivers of non-strict functions are coerced to objects.
+ assertEquals("object", typeof this);
+};
+
+
+function strict_mode() {
+ "use strict";
+ CheckStringReceiver.call("foo");
+ CheckNumberReceiver.call(42);
+ CheckUndefinedReceiver.call(undefined);
+ CheckNullReceiver.call(null);
+ [1].forEach(CheckStringReceiver, "foo");
+ [2].every(CheckStringReceiver, "foo");
+ [3].filter(CheckStringReceiver, "foo");
+ [4].some(CheckNumberReceiver, 42);
+ [5].map(CheckNumberReceiver, 42);
+
+ CheckCoersion.call("foo");
+ CheckCoersion.call(42);
+ CheckCoersion.call(undefined);
+ CheckCoersion.call(null);
+ [1].forEach(CheckCoersion, "foo");
+ [2].every(CheckCoersion, "foo");
+ [3].filter(CheckCoersion, "foo");
+ [4].some(CheckCoersion, 42);
+ [5].map(CheckCoersion, 42);
+};
+strict_mode();
+
+function sloppy_mode() {
+ CheckStringReceiver.call("foo");
+ CheckNumberReceiver.call(42);
+ CheckUndefinedReceiver.call(undefined);
+ CheckNullReceiver.call(null);
+ [1].forEach(CheckStringReceiver, "foo");
+ [2].every(CheckStringReceiver, "foo");
+ [3].filter(CheckStringReceiver, "foo");
+ [4].some(CheckNumberReceiver, 42);
+ [5].map(CheckNumberReceiver, 42);
+
+ CheckCoersion.call("foo");
+ CheckCoersion.call(42);
+ CheckCoersion.call(undefined);
+ CheckCoersion.call(null);
+ [1].forEach(CheckCoersion, "foo");
+ [2].every(CheckCoersion, "foo");
+ [3].filter(CheckCoersion, "foo");
+ [4].some(CheckCoersion, 42);
+ [5].map(CheckCoersion, 42);
+};
+sloppy_mode();
diff --git a/src/v8/test/mjsunit/regress/regress-2284.js b/src/v8/test/mjsunit/regress/regress-2284.js
new file mode 100644
index 0000000..24bf58e
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2284.js
@@ -0,0 +1,32 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+assertThrows("%foobar();", Error);
+assertThrows("%constructor();", Error);
+assertThrows("%constructor(23);", Error);
diff --git a/src/v8/test/mjsunit/regress/regress-2286.js b/src/v8/test/mjsunit/regress/regress-2286.js
new file mode 100644
index 0000000..0264900
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2286.js
@@ -0,0 +1,32 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+assertThrows("f()", ReferenceError);
+assertThrows("%f()", Error);
+assertThrows("%_f()", SyntaxError);
diff --git a/src/v8/test/mjsunit/regress/regress-2289.js b/src/v8/test/mjsunit/regress/regress-2289.js
new file mode 100644
index 0000000..d860bbb
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2289.js
@@ -0,0 +1,32 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var foo = "a";
+for (var i = 0; i < 12; i++) foo += foo;
+foo = foo + 'b' + foo;
+
+foo.replace(/b/, "a");
diff --git a/src/v8/test/mjsunit/regress/regress-2291.js b/src/v8/test/mjsunit/regress/regress-2291.js
new file mode 100644
index 0000000..96627fc
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2291.js
@@ -0,0 +1,36 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function StrictCompare(x) { return x === Object(x); }
+
+var obj = new Object();
+var obj2 = new Object();
+obj == obj; // Populate IC cache with non-strict comparison.
+
+StrictCompare(obj); // Set IC in StrictCompare from IC cache.
+
+assertFalse(StrictCompare('foo')); // Use == stub for === operation.
diff --git a/src/v8/test/mjsunit/regress/regress-2294.js b/src/v8/test/mjsunit/regress/regress-2294.js
new file mode 100644
index 0000000..43ba10d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2294.js
@@ -0,0 +1,70 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var clampedArray = new Uint8ClampedArray(10);
+
+function test() {
+ clampedArray[0] = 0.499;
+ assertEquals(0, clampedArray[0]);
+ clampedArray[0] = 0.5;
+ assertEquals(0, clampedArray[0]);
+ clampedArray[0] = 0.501;
+ assertEquals(1, clampedArray[0]);
+ clampedArray[0] = 1.499;
+ assertEquals(1, clampedArray[0]);
+ clampedArray[0] = 1.5;
+ assertEquals(2, clampedArray[0]);
+ clampedArray[0] = 1.501;
+ assertEquals(2, clampedArray[0]);
+ clampedArray[0] = 2.5;
+ assertEquals(2, clampedArray[0]);
+ clampedArray[0] = 3.5;
+ assertEquals(4, clampedArray[0]);
+ clampedArray[0] = 252.5;
+ assertEquals(252, clampedArray[0]);
+ clampedArray[0] = 253.5;
+ assertEquals(254, clampedArray[0]);
+ clampedArray[0] = 254.5;
+ assertEquals(254, clampedArray[0]);
+ clampedArray[0] = 256.5;
+ assertEquals(255, clampedArray[0]);
+ clampedArray[0] = -0.5;
+ assertEquals(0, clampedArray[0]);
+ clampedArray[0] = -1.5;
+ assertEquals(0, clampedArray[0]);
+ clampedArray[0] = 1000000000000;
+ assertEquals(255, clampedArray[0]);
+ clampedArray[0] = -1000000000000;
+ assertEquals(0, clampedArray[0]);
+}
+
+test();
+test();
+%OptimizeFunctionOnNextCall(test);
+test();
diff --git a/src/v8/test/mjsunit/regress/regress-231.js b/src/v8/test/mjsunit/regress/regress-231.js
new file mode 100644
index 0000000..bce0500
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-231.js
@@ -0,0 +1,92 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// See issue 231 <URL: http://code.google.com/p/v8/issues/detail?id=231 >
+// A stack growth during a look-ahead could restore a pointer to the old stack.
+// (Test derived from crash at ibs.blumex.com).
+
+var re = /Ggcy\b[^D]*D((?:(?=([^G]+))\2|G(?!gcy\b[^D]*D))*?)GIgcyD/;
+
+var str = 'GgcyDGgcy.saaaa.aDGaaa.aynaaaaaaaaacaaaaagcaaaaaaaancaDGgnayr' +
+ '.aryycnaaaataaaa.aryyacnaaataaaa.aaaaraaaaa.aaagaaaaaaaaDGgaaaaDGga' +
+ '.aaagaaaaaaaaDGga.nyataaaaragraa.anyataaagaca.agayraaarataga.aaacaa' +
+ '.aaagaa.aaacaaaDGaaa.aynaaaaaaaaacaaaaagcaaaaaacaagaa.agayraaaGgaaa' +
+ '.trgaaaaaagaatGanyara.caagaaGaD.araaaa_aat_aayDDaaDGaaa.aynaaaaaaaa' +
+ 'acaaaaagcaaaaaacaaaaa.agayraaaGgaaa.trgaaaaaaatGanyaraDDaaDGacna.ay' +
+ 'naaaaaaaaacaaaaagcaaaaaacaaaraGgaaa.naaaaagaaaaaaraynaaGanyaraDDaaD' +
+ 'aGgaaa.saaangaaaaraaaGgaaa.trgaaaragaaaarGanyaraDDDaGIacnaDGIaaaDGI' +
+ 'aaaDGIgaDGga.anyataaagaca.agayraaaaagaa.aaaaa.cnaaaata.aca.aca.aca.' +
+ 'acaaaDGgnayr.aaaaraaaaa.aaagaaaaaaaaDGgaaaaDGgaDGga.aayacnaaaaa.ayn' +
+ 'aaaaaaaaacaaaaagcaaaaaanaraDGaDacaaaaag_anaraGIaDGIgaDGIgaDGgaDGga.' +
+ 'aayacnaaaaa.aaagaaaaaaaaDGaa.aaagaaaaaaaa.aaaraaaa.aaaanaraaaa.IDGI' +
+ 'gaDGIgaDGgaDGga.aynaaaaaaaaacaaaaagcaaaaaaaraaaa.anyataaagacaDaGgaa' +
+ 'a.trgGragaaaacgGaaaaaaaG_aaaaa_Gaaaaaaaaa,.aGanar.anaraDDaaGIgaDGga' +
+ '.aynaaaaaaaaacaaaaagcaaaaaaanyara.anyataaagacaDGaDaaaaag_caaaaag_an' +
+ 'araGIaDGIgaDGIgaDGgaDGga.aynaaaaaaaaacaaaaagcaaaaaaaraaaa.anyataaag' +
+ 'acaDaGgaaa.trgGragaaaacgGaaaaaaaG_aaaaa_aaaaaa,.aaaaacaDDaaGIgaDGga' +
+ '.aynaaaaaaaaacaaaaagcaaaaaaanyara.anyataaagacaDGaDataaac_araaaaGIaD' +
+ 'GIgaDGIgaDaagcyaaGgaDGga.aayacnaaaaa.aaagaaaaaaaaDGaa.aaagaaaaaaaa.' +
+ 'aaaraaaa.aaaanaraaaa.IDGIgaDGIgaDGgcy.asaadanyaga.aa.aaaDGgaDGga.ay' +
+ 'naaaaaaaaacaaaaagcaaaaaaaraaaa.anyataaagacaDaGgaaa.trgGragaaaacgGaa' +
+ 'aaaaaG_aaaaa_DaaaaGaa,.aDanyagaaDDaaGIgaDGga.aynaaaaaaaaacaaaaagcaa' +
+ 'aaaaanyara.anyataaagacaDGaDadanyagaaGIaDGIgaDGIgaDGIgcyDGgcy.asaaga' +
+ 'cras.agra_yratga.aa.aaaarsaaraa.aa.agra_yratga.aa.aaaDGgaDGga.aynaa' +
+ 'aaaaaaacaaaaagcaaaaaaaraaaa.anyataaagacaDaGgaaa.trgGragaaaacgGaaaaa' +
+ 'aaG_aaaaa_aGaaaaaaGaa,.aaratgaaDDaaGIgaDGga.aynaaaaaaaaacaaaaagcaaa' +
+ 'aaaanyara.anyataaagacaDGaDaagra_yratgaaGIaDGIgaDGIgaDGIgcyDGgcy.asa' +
+ 'agacras.aratag.aa.aaaarsaaraa.aa.aratag.aa.aaaDGgaDGga.aynaaaaaaaaa' +
+ 'caaaaagcaaaaaaaraaaa.anyataaagacaDaGgaaa.trgGragaaaacgGaaaaaaaG_aaa' +
+ 'aa_aaaaaGa,.aaratagaDDaaGIgaDGga.aynaaaaaaaaacaaaaagcaaaaaaanyara.a' +
+ 'nyataaagacaDGaDaaratagaGIaDGIgaDGIgaDGIgcyDGgcy.asaagacras.gaaax_ar' +
+ 'atag.aa.aaaarsaaraa.aa.gaaax_aratag.aa.aaaDGgaDGga.aynaaaaaaaaacaaa' +
+ 'aagcaaaaaaaraaaa.anyataaagacaDaGgaaa.trgGragaaaacgGaaaaaaaG_aaaaa_G' +
+ 'aaaaaaaaaGa,.aaratagaDDaaGIgaDGga.aynaaaaaaaaacaaaaagcaaaaaaanyara.' +
+ 'anyataaagacaDGaDagaaax_aratagaGIaDGIgaDGIgaDGIgcyDGgcy.asaagacras.c' +
+ 'ag_aaar.aa.aaaarsaaraa.aa.cag_aaar.aa.aaaDGgaDGga.aynaaaaaaaaacaaaa' +
+ 'agcaaaaaaaraaaa.anyataaagacaDaGgaaa.trgGragaaaacgGaaaaaaaG_aaaaa_aa' +
+ 'Gaaaaa,.aaagaaaraDDaaGIgaDGga.aynaaaaaaaaacaaaaagcaaaaaaanyara.anya' +
+ 'taaagacaDGaDacag_aaaraGIaDGIgaDGIgaDGIgcyDGgcy.asaagacras.aaggaata_' +
+ 'aa_cynaga_cc.aa.aaaarsaaraa.aa.aaggaata_aa_cynaga_cc.aa.aaaDGgaDGga' +
+ '.aynaaaaaaaaacaaaaagcaaaaaaaraaaa.anyataaagacaDaGgaaa.trgGragaaaacg' +
+ 'GaaaaaaaG_aaaaa_aaGGaaaa_aa_aaaaGa_aaa,.aaynagaIcagaDDaaGIgaDGga.ay' +
+ 'naaaaaaaaacaaaaagcaaaaaaanyara.anyataaagacaDGaDaaaggaata_aa_cynaga_' +
+ 'ccaGIaDGIgaDGIgaDGIgcyDGgcy.asaagacras.syaara_aanargra.aa.aaaarsaar' +
+ 'aa.aa.syaara_aanargra.aa.aaaDGgaDGga.aynaaaaaaaaacaaaaagcaaaaaaaraa' +
+ 'aa.anyataaagacaDaGgaaa.trgGragaaaacgGaaaaaaaG_aaaaa_aaaaaaaaaaaGaaa' +
+ ',.aaanargraaDDaaGIgaDGga.aynaaaaaaaaacaaaaagcaaaaaaanyara.anyataaag' +
+ 'acaDGaDasyaara_aanargraaGIaDGIgaDGIgaDGIgcyDGgcy.asaagacras.cynag_a' +
+ 'anargra.aa.aaaarsaaraa.aa.cynag_aanargra.aa.aaaDGgaDGga.aynaaaaaaaa' +
+ 'acaaaaagcaaaaaaaraaaa.anyataaagacaDaGgaaa.trgGragaaaacgGaaaaaaaG_aa' +
+ 'aaa_aaaaGaaaaaGaaa,.aaanargraaDDaaGIgaDGga.aynaaaaaaaaacaaaaagcaaaa' +
+ 'aaanyara.anyataaagacaDGaDacynag_aanargraaGIaDGIgaDGIgaDGIgcyDGgaDGg' +
+ 'a.aynaaaaaaaaacaaaaagcaaaaaaaraaaa.anyataaagacaDaGgaaa.trgGragaaaac' +
+ 'gGaaaaaaaG';
+
+//Shouldn't crash.
+
+var res = re.test(str);
+assertTrue(res);
diff --git a/src/v8/test/mjsunit/regress/regress-2315.js b/src/v8/test/mjsunit/regress/regress-2315.js
new file mode 100644
index 0000000..9e40d0d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2315.js
@@ -0,0 +1,39 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax --opt
+
+var foo = (function() {
+ return eval("(function bar() { return 1; })");
+})();
+
+foo();
+foo();
+%OptimizeFunctionOnNextCall(foo);
+foo();
+
+assertOptimized(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-2326.js b/src/v8/test/mjsunit/regress/regress-2326.js
new file mode 100644
index 0000000..d2edf2b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2326.js
@@ -0,0 +1,54 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// This tests that we do not share optimized code across closures that
+// were optimized using OSR (for a particular OSR entry AST id) even if
+// caching of optimized code kicks in.
+
+function makeClosure() {
+ function f(mode, iterations) {
+ var accumulator = 0;
+ if (mode == 1) {
+ while (--iterations > 0) accumulator = Math.ceil(accumulator);
+ return 1;
+ } else {
+ while (--iterations > 0) accumulator = Math.floor(accumulator);
+ return 2;
+ }
+ }
+ return f;
+}
+
+// Generate two closures sharing the same underlying function literal.
+var f1 = makeClosure();
+var f2 = makeClosure();
+
+// This function should be optimized via OSR in the first tight loop.
+assertSame(1, f1(1, 100000));
+
+// This function should be optimized via OSR in the second tight loop.
+assertSame(2, f2(2, 100000));
diff --git a/src/v8/test/mjsunit/regress/regress-233.js b/src/v8/test/mjsunit/regress/regress-233.js
new file mode 100644
index 0000000..8723679
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-233.js
@@ -0,0 +1,39 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// See issue 233 <URL: http://code.google.com/p/v8/issues/detail?id=233 >
+// A stack overflow detected by a global regexp match wasn't handled correctly.
+
+// This code shouldn't segmentation fault.
+function loop(s) {
+ loop(s.replace(/\s/g, ""));
+}
+try {
+ loop("No");
+} catch(e) {
+ // Stack overflow caught.
+}
diff --git a/src/v8/test/mjsunit/regress/regress-2339.js b/src/v8/test/mjsunit/regress/regress-2339.js
new file mode 100644
index 0000000..d7d2bb3
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2339.js
@@ -0,0 +1,45 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax --expose-gc --opt
+
+function simple() {
+ return simple_two_args(0, undefined);
+}
+
+function simple_two_args(always_zero, always_undefined) {
+ var always_five = always_undefined || 5;
+ return always_zero * always_five * .5;
+}
+
+
+simple();
+simple();
+%OptimizeFunctionOnNextCall(simple);
+simple();
+assertOptimized(simple);
+gc();
diff --git a/src/v8/test/mjsunit/regress/regress-234101.js b/src/v8/test/mjsunit/regress/regress-234101.js
new file mode 100644
index 0000000..74228df
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-234101.js
@@ -0,0 +1,42 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// Currently, the gap resolver doesn't handle moves from a ConstantOperand to a
+// DoubleRegister, but these kind of moves appeared when HConstant::EmitAtUses
+// was changed to allow special double values (-0, NaN, hole). So we should
+// either enhance the gap resolver or make sure that such moves don't happen.
+
+function foo(x) {
+ return (x ? NaN : 0.2) + 0.1;
+}
+
+foo(false);
+foo(false);
+%OptimizeFunctionOnNextCall(foo);
+foo(false);
diff --git a/src/v8/test/mjsunit/regress/regress-2346.js b/src/v8/test/mjsunit/regress/regress-2346.js
new file mode 100644
index 0000000..4c88b3e
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2346.js
@@ -0,0 +1,123 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// This file only tests very simple descriptors that always have
+// configurable, enumerable, and writable set to true.
+// A range of more elaborate tests are performed in
+// object-define-property.js
+
+// Flags: --stress-runs=5
+
+function get() { return x; }
+function set(x) { this.x = x; }
+
+var obj = {x: 1};
+obj.__defineGetter__("accessor", get);
+obj.__defineSetter__("accessor", set);
+var a = new Array();
+a[1] = 42;
+obj[1] = 42;
+
+var descIsData = Object.getOwnPropertyDescriptor(obj, 'x');
+assertTrue(descIsData.enumerable);
+assertTrue(descIsData.writable);
+assertTrue(descIsData.configurable);
+
+var descIsAccessor = Object.getOwnPropertyDescriptor(obj, 'accessor');
+assertTrue(descIsAccessor.enumerable);
+assertTrue(descIsAccessor.configurable);
+assertTrue(descIsAccessor.get == get);
+assertTrue(descIsAccessor.set == set);
+
+var descIsNotData = Object.getOwnPropertyDescriptor(obj, 'not-x');
+assertTrue(descIsNotData == undefined);
+
+var descIsNotAccessor = Object.getOwnPropertyDescriptor(obj, 'not-accessor');
+assertTrue(descIsNotAccessor == undefined);
+
+var descArray = Object.getOwnPropertyDescriptor(a, '1');
+assertTrue(descArray.enumerable);
+assertTrue(descArray.configurable);
+assertTrue(descArray.writable);
+assertEquals(descArray.value, 42);
+
+var descObjectElement = Object.getOwnPropertyDescriptor(obj, '1');
+assertTrue(descObjectElement.enumerable);
+assertTrue(descObjectElement.configurable);
+assertTrue(descObjectElement.writable);
+assertEquals(descObjectElement.value, 42);
+
+// String objects.
+var a = new String('foobar');
+for (var i = 0; i < a.length; i++) {
+ var descStringObject = Object.getOwnPropertyDescriptor(a, i);
+ assertTrue(descStringObject.enumerable);
+ assertFalse(descStringObject.configurable);
+ assertFalse(descStringObject.writable);
+ assertEquals(descStringObject.value, a.substring(i, i+1));
+}
+
+// Support for additional attributes on string objects.
+a.x = 42;
+a[10] = 'foo';
+var descStringProperty = Object.getOwnPropertyDescriptor(a, 'x');
+assertTrue(descStringProperty.enumerable);
+assertTrue(descStringProperty.configurable);
+assertTrue(descStringProperty.writable);
+assertEquals(descStringProperty.value, 42);
+
+var descStringElement = Object.getOwnPropertyDescriptor(a, '10');
+assertTrue(descStringElement.enumerable);
+assertTrue(descStringElement.configurable);
+assertTrue(descStringElement.writable);
+assertEquals(descStringElement.value, 'foo');
+
+// Test that elements in the prototype chain is not returned.
+var proto = {};
+proto[10] = 42;
+
+var objWithProto = new Array();
+objWithProto.prototype = proto;
+objWithProto[0] = 'bar';
+var descWithProto = Object.getOwnPropertyDescriptor(objWithProto, '10');
+assertEquals(undefined, descWithProto);
+
+// Test elements on global proxy object.
+var global = (function() { return this; })();
+
+global[42] = 42;
+
+function el_getter() { return 239; };
+function el_setter() {};
+Object.defineProperty(global, '239', {get: el_getter, set: el_setter});
+
+var descRegularElement = Object.getOwnPropertyDescriptor(global, '42');
+assertEquals(42, descRegularElement.value);
+
+var descAccessorElement = Object.getOwnPropertyDescriptor(global, '239');
+assertEquals(el_getter, descAccessorElement.get);
+assertEquals(el_setter, descAccessorElement.set);
diff --git a/src/v8/test/mjsunit/regress/regress-235311.js b/src/v8/test/mjsunit/regress/regress-235311.js
new file mode 100644
index 0000000..3007147
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-235311.js
@@ -0,0 +1,32 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var new_space_string = "";
+for (var i = 0; i < 12800; ++i) {
+ new_space_string +=
+ String.fromCharCode(Math.random() * 26 + (4294967295) | 0);
+}
diff --git a/src/v8/test/mjsunit/regress/regress-2373.js b/src/v8/test/mjsunit/regress/regress-2373.js
new file mode 100644
index 0000000..16a87ec
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2373.js
@@ -0,0 +1,29 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var o = JSON.parse('{"a":2600753951}');
+assertEquals(2600753951, o.a);
diff --git a/src/v8/test/mjsunit/regress/regress-2374.js b/src/v8/test/mjsunit/regress/regress-2374.js
new file mode 100644
index 0000000..f379cc5
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2374.js
@@ -0,0 +1,34 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var msg = '{"result":{"profile":{"head":{"functionName":"(root)","url":"","lineNumber":0,"totalTime":495.7243772462511,"selfTime":0,"numberOfCalls":0,"visible":true,"callUID":2771605942,"children":[{"functionName":"(program)","url":"","lineNumber":0,"totalTime":495.7243772462511,"selfTime":495.7243772462511,"numberOfCalls":0,"visible":true,"callUID":1902715303,"children":[]}]},"bottomUpHead":{"functionName":"(root)","url":"","lineNumber":0,"totalTime":495.7243772462511,"selfTime":0,"numberOfCalls":0,"visible":true,"callUID":2771605942,"children":[{"functionName":"(program)","url":"","lineNumber":0,"totalTime":495.7243772462511,"selfTime":495.7243772462511,"numberOfCalls":0,"visible":true,"callUID":1902715303,"children":[]}]}}},"id":41}';
+
+var obj = JSON.parse(msg);
+var obj2 = JSON.parse(msg);
+
+assertEquals(JSON.stringify(obj), JSON.stringify(obj2));
+assertEquals(JSON.stringify(obj, null, 0), JSON.stringify(obj2));
diff --git a/src/v8/test/mjsunit/regress/regress-237617.js b/src/v8/test/mjsunit/regress/regress-237617.js
new file mode 100644
index 0000000..7b7e50f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-237617.js
@@ -0,0 +1,42 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+"use strict"
+
+function f() {
+ throw new Error("test stack");
+}
+
+var error_stack = "";
+try {
+ f.call(null);
+} catch (e) {
+ error_stack = e.stack;
+}
+
+assertTrue(error_stack.indexOf("test stack") > 0);
+assertTrue(error_stack.indexOf("illegal") < 0);
diff --git a/src/v8/test/mjsunit/regress/regress-2398.js b/src/v8/test/mjsunit/regress/regress-2398.js
new file mode 100644
index 0000000..1c66e7f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2398.js
@@ -0,0 +1,41 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+"use strict";
+
+var observed = false;
+
+var object = { get toString() { observed = true; } };
+Object.defineProperty(object, "ro", { value: 1 });
+
+try {
+ object.ro = 2; // TypeError caused by trying to write to read-only.
+} catch (e) {
+ e.message; // Forces formatting of the message object.
+}
+
+assertFalse(observed);
diff --git a/src/v8/test/mjsunit/regress/regress-2410.js b/src/v8/test/mjsunit/regress/regress-2410.js
new file mode 100644
index 0000000..c16fd14
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2410.js
@@ -0,0 +1,36 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Object.prototype should be ignored in Object.getOwnPropertyNames
+//
+// See http://code.google.com/p/v8/issues/detail?id=2410 for details.
+
+Object.defineProperty(Object.prototype,
+ 'thrower',
+ { get: function() { throw Error('bug') } });
+var obj = { thrower: 'local' };
+assertEquals(['thrower'], Object.getOwnPropertyNames(obj));
diff --git a/src/v8/test/mjsunit/regress/regress-241344.js b/src/v8/test/mjsunit/regress/regress-241344.js
new file mode 100644
index 0000000..32a9dd3
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-241344.js
@@ -0,0 +1,40 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Create a JSON string for an object with indexed properties.
+// Parsing that string creates a sparse array that grows dense.
+
+var jsonstring = '{"0":0.1, "10000":0.4, ';
+for (var i = 1; i < 9999; i++) {
+ jsonstring += '"' + i + '":0.2, ';
+}
+jsonstring += '"9999":0.3}';
+
+var jsonobject = JSON.parse(jsonstring);
+for (var i = 1; i < 9999; i++) {
+ assertEquals(0.2, jsonobject[i]);
+}
diff --git a/src/v8/test/mjsunit/regress/regress-2416.js b/src/v8/test/mjsunit/regress/regress-2416.js
new file mode 100644
index 0000000..02afeb9
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2416.js
@@ -0,0 +1,75 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+assertFalse(2147483647 < -2147483648)
+assertFalse(2147483647 <= -2147483648)
+assertFalse(2147483647 == -2147483648)
+assertTrue(2147483647 >= -2147483648)
+assertTrue(2147483647 > -2147483648)
+
+assertTrue(-2147483648 < 2147483647)
+assertTrue(-2147483648 <= 2147483647)
+assertFalse(-2147483648 == 2147483647)
+assertFalse(-2147483648 >= 2147483647)
+assertFalse(-2147483648 > 2147483647)
+
+assertFalse(2147483647 < 2147483647)
+assertTrue(2147483647 <= 2147483647)
+assertTrue(2147483647 == 2147483647)
+assertTrue(2147483647 >= 2147483647)
+assertFalse(2147483647 > 2147483647)
+
+assertFalse(-2147483648 < -2147483648)
+assertTrue(-2147483648 <= -2147483648)
+assertTrue(-2147483648 == -2147483648)
+assertTrue(-2147483648 >= -2147483648)
+assertFalse(-2147483648 > -2147483648)
+
+
+assertFalse(1073741823 < -1073741824)
+assertFalse(1073741823 <= -1073741824)
+assertFalse(1073741823 == -1073741824)
+assertTrue(1073741823 >= -1073741824)
+assertTrue(1073741823 > -1073741824)
+
+assertTrue(-1073741824 < 1073741823)
+assertTrue(-1073741824 <= 1073741823)
+assertFalse(-1073741824 == 1073741823)
+assertFalse(-1073741824 >= 1073741823)
+assertFalse(-1073741824 > 1073741823)
+
+assertFalse(1073741823 < 1073741823)
+assertTrue(1073741823 <= 1073741823)
+assertTrue(1073741823 == 1073741823)
+assertTrue(1073741823 >= 1073741823)
+assertFalse(1073741823 > 1073741823)
+
+assertFalse(-1073741824 < -1073741824)
+assertTrue(-1073741824 <= -1073741824)
+assertTrue(-1073741824 == -1073741824)
+assertTrue(-1073741824 >= -1073741824)
+assertFalse(-1073741824 > -1073741824)
diff --git a/src/v8/test/mjsunit/regress/regress-2419.js b/src/v8/test/mjsunit/regress/regress-2419.js
new file mode 100644
index 0000000..612e6db
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2419.js
@@ -0,0 +1,36 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var a = [5, 4, 3, 2, 1, 0];
+Object.freeze(a);
+assertThrows(function() { a.sort(); });
+assertArrayEquals([5, 4, 3, 2, 1, 0], a);
+
+var b = {0: 5, 1: 4, 2: 3, 3: 2, 4: 1, 5: 0, length: 6};
+Object.freeze(b);
+assertThrows(function() { Array.prototype.sort.call(b); });
+assertPropertiesEqual({0: 5, 1: 4, 2: 3, 3: 2, 4: 1, 5: 0, length: 6}, b);
diff --git a/src/v8/test/mjsunit/regress/regress-2433.js b/src/v8/test/mjsunit/regress/regress-2433.js
new file mode 100644
index 0000000..dfe7131
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2433.js
@@ -0,0 +1,36 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Transitioning from a PackedSmi to PackedDouble should fill the destination
+// with holes.
+//
+// See http://code.google.com/p/v8/issues/detail?id=2433 for details.
+
+arr = [];
+arr[0] = 0;
+arr[0] = 1.1;
+assertEquals(undefined, arr[1]);
diff --git a/src/v8/test/mjsunit/regress/regress-2435.js b/src/v8/test/mjsunit/regress/regress-2435.js
new file mode 100644
index 0000000..05a4027
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2435.js
@@ -0,0 +1,25 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function arrayLikeToString(a) {
+ return String.fromCharCode.apply(this, a);
+}
+
+const klasses = [
+ Int8Array,
+ Uint8Array,
+ Uint8ClampedArray,
+ Int16Array,
+ Uint16Array,
+ Int32Array,
+ Uint32Array,
+ Float32Array,
+ Float64Array
+];
+const string = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789';
+
+for (const klass of klasses) {
+ const array = klass.from(string, s => s.charCodeAt(0));
+ assertEquals(string, arrayLikeToString(array));
+}
diff --git a/src/v8/test/mjsunit/regress/regress-2437.js b/src/v8/test/mjsunit/regress/regress-2437.js
new file mode 100644
index 0000000..d113079
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2437.js
@@ -0,0 +1,166 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Summary of the spec: lastIndex is reset to 0 if
+// - a global or sticky regexp fails to match.
+// - a global regexp is used in a function that returns multiple results,
+// such as String.prototype.replace or String.prototype.match, since it
+// repeats the regexp until it fails to match.
+// Otherwise lastIndex is only set when a global regexp matches, to the index
+// after the match.
+
+// Test Regexp.prototype.exec
+r = /a/;
+r.lastIndex = 1;
+r.exec("zzzz");
+assertEquals(1, r.lastIndex);
+
+// Test Regexp.prototype.test
+r = /a/;
+r.lastIndex = 1;
+r.test("zzzz");
+assertEquals(1, r.lastIndex);
+
+// Test String.prototype.match
+r = /a/;
+r.lastIndex = 1;
+"zzzz".match(r);
+assertEquals(1, r.lastIndex);
+
+// Test String.prototype.replace with atomic regexp and empty string.
+r = /a/;
+r.lastIndex = 1;
+"zzzz".replace(r, "");
+assertEquals(1, r.lastIndex);
+
+// Test String.prototype.replace with non-atomic regexp and empty string.
+r = /\d/;
+r.lastIndex = 1;
+"zzzz".replace(r, "");
+assertEquals(1, r.lastIndex);
+
+// Test String.prototype.replace with atomic regexp and non-empty string.
+r = /a/;
+r.lastIndex = 1;
+"zzzz".replace(r, "a");
+assertEquals(1, r.lastIndex);
+
+// Test String.prototype.replace with non-atomic regexp and non-empty string.
+r = /\d/;
+r.lastIndex = 1;
+"zzzz".replace(r, "a");
+assertEquals(1, r.lastIndex);
+
+// Test String.prototype.replace with replacement function
+r = /a/;
+r.lastIndex = 1;
+"zzzz".replace(r, function() { return ""; });
+assertEquals(1, r.lastIndex);
+
+// Regexp functions that returns multiple results:
+// A global regexp always resets lastIndex regardless of whether it matches.
+r = /a/g;
+r.lastIndex = -1;
+"0123abcd".replace(r, "x");
+assertEquals(0, r.lastIndex);
+
+r.lastIndex = -1;
+"01234567".replace(r, "x");
+assertEquals(0, r.lastIndex);
+
+r.lastIndex = -1;
+"0123abcd".match(r);
+assertEquals(0, r.lastIndex);
+
+r.lastIndex = -1;
+"01234567".match(r);
+assertEquals(0, r.lastIndex);
+
+// A non-global regexp resets lastIndex iff it is sticky.
+r = /a/;
+r.lastIndex = -1;
+"0123abcd".replace(r, "x");
+assertEquals(-1, r.lastIndex);
+
+r.lastIndex = -1;
+"01234567".replace(r, "x");
+assertEquals(-1, r.lastIndex);
+
+r.lastIndex = -1;
+"0123abcd".match(r);
+assertEquals(-1, r.lastIndex);
+
+r.lastIndex = -1;
+"01234567".match(r);
+assertEquals(-1, r.lastIndex);
+
+r = /a/y;
+r.lastIndex = -1;
+"0123abcd".replace(r, "x");
+assertEquals(0, r.lastIndex);
+
+r.lastIndex = -1;
+"01234567".replace(r, "x");
+assertEquals(0, r.lastIndex);
+
+
+// Also test RegExp.prototype.exec and RegExp.prototype.test
+r = /a/g;
+r.lastIndex = 1;
+r.exec("01234567");
+assertEquals(0, r.lastIndex);
+
+r.lastIndex = 1;
+r.exec("0123abcd");
+assertEquals(5, r.lastIndex);
+
+r = /a/;
+r.lastIndex = 1;
+r.exec("01234567");
+assertEquals(1, r.lastIndex);
+
+r.lastIndex = 1;
+r.exec("0123abcd");
+assertEquals(1, r.lastIndex);
+
+r = /a/g;
+r.lastIndex = 1;
+r.test("01234567");
+assertEquals(0, r.lastIndex);
+
+r.lastIndex = 1;
+r.test("0123abcd");
+assertEquals(5, r.lastIndex);
+
+r = /a/;
+r.lastIndex = 1;
+r.test("01234567");
+assertEquals(1, r.lastIndex);
+
+r.lastIndex = 1;
+r.test("0123abcd");
+assertEquals(1, r.lastIndex);
diff --git a/src/v8/test/mjsunit/regress/regress-2438.js b/src/v8/test/mjsunit/regress/regress-2438.js
new file mode 100644
index 0000000..b9d8875
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2438.js
@@ -0,0 +1,45 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function testSideEffects(subject, re) {
+ var counter = 0;
+ var side_effect_object = { valueOf: function() { return counter++; } };
+ re.lastIndex = side_effect_object;
+ re.exec(subject);
+
+ assertEquals(1, counter);
+
+ re.lastIndex = side_effect_object;
+ re.test(subject);
+
+ assertEquals(2, counter);
+}
+
+testSideEffects("zzzz", /a/);
+testSideEffects("zzzz", /a/g);
+testSideEffects("xaxa", /a/);
+testSideEffects("xaxa", /a/g);
diff --git a/src/v8/test/mjsunit/regress/regress-244.js b/src/v8/test/mjsunit/regress/regress-244.js
new file mode 100644
index 0000000..7503b15
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-244.js
@@ -0,0 +1,68 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var kLegalPairs = [
+ [0x00, '%00'],
+ [0x01, '%01'],
+ [0x7f, '%7F'],
+ [0x80, '%C2%80'],
+ [0x81, '%C2%81'],
+ [0x7ff, '%DF%BF'],
+ [0x800, '%E0%A0%80'],
+ [0x801, '%E0%A0%81'],
+ [0xd7ff, '%ED%9F%BF'],
+ [0xffff, '%EF%BF%BF']
+];
+
+var kIllegalEncoded = [
+ '%80', '%BF', '%80%BF', '%80%BF%80', '%C0%22', '%DF',
+ '%EF%BF', '%F7BFBF', '%FE', '%FF', '%FE%FE%FF%FF',
+ '%C0%AF', '%E0%9F%BF', '%F0%8F%BF%BF', '%C0%80',
+ '%E0%80%80'
+];
+
+function run() {
+ for (var i = 0; i < kLegalPairs.length; i++) {
+ var decoded = String.fromCharCode(kLegalPairs[i][0]);
+ var encoded = kLegalPairs[i][1];
+ assertEquals(decodeURI(encoded), decoded);
+ assertEquals(encodeURI(decoded), encoded);
+ }
+ for (var i = 0; i < kIllegalEncoded.length; i++) {
+ var value = kIllegalEncoded[i];
+ var exception = false;
+ try {
+ decodeURI(value);
+ } catch (e) {
+ exception = true;
+ assertInstanceof(e, URIError);
+ }
+ assertTrue(exception);
+ }
+}
+
+run();
diff --git a/src/v8/test/mjsunit/regress/regress-2441.js b/src/v8/test/mjsunit/regress/regress-2441.js
new file mode 100644
index 0000000..72ce248
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2441.js
@@ -0,0 +1,31 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var o = {};
+Object.preventExtensions(o);
+assertThrows("Object.defineProperty(o, 'foobarloo', {value:{}});", TypeError);
+assertThrows("Object.defineProperty(o, '__proto__', {value:{}});", TypeError);
diff --git a/src/v8/test/mjsunit/regress/regress-2443.js b/src/v8/test/mjsunit/regress/regress-2443.js
new file mode 100644
index 0000000..0800c45
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2443.js
@@ -0,0 +1,129 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Number.prototype methods on non-Numbers.
+
+assertThrows(function() { Number.prototype.toExponential.call({}) },
+ TypeError);
+
+assertThrows(function() { Number.prototype.toPrecision.call({}) },
+ TypeError);
+
+assertThrows(function() { Number.prototype.toFixed.call({}) },
+ TypeError);
+
+assertThrows(function() { Number.prototype.toString.call({}) },
+ TypeError);
+
+assertThrows(function() { Number.prototype.toLocaleString.call({}) },
+ TypeError);
+
+assertThrows(function() { Number.prototype.ValueOf.call({}) },
+ TypeError);
+
+
+// Call on Number objects with custom valueOf method.
+
+var x_obj = new Number(1);
+x_obj.valueOf = function() { assertUnreachable(); };
+
+assertEquals("1.00e+0",
+ Number.prototype.toExponential.call(x_obj, 2));
+
+assertEquals("1.0",
+ Number.prototype.toPrecision.call(x_obj, 2));
+
+assertEquals("1.00",
+ Number.prototype.toFixed.call(x_obj, 2));
+
+// Call on primitive numbers.
+assertEquals("1.00e+0",
+ Number.prototype.toExponential.call(1, 2));
+
+assertEquals("1.0",
+ Number.prototype.toPrecision.call(1, 2));
+
+assertEquals("1.00",
+ Number.prototype.toFixed.call(1, 2));
+
+
+// toExponential and toPrecision does following steps in order
+// 1) convert the argument using ToInteger
+// 2) check for non-finite receiver, on which it returns,
+// 3) check argument range and throw exception if out of range.
+// Note that the the last two steps are reversed for toFixed.
+// Luckily, the receiver is expected to be a number or number
+// wrapper, so that getting its value is not observable.
+
+var f_flag = false;
+var f_obj = { valueOf: function() { f_flag = true; return 1000; } };
+
+assertEquals("NaN",
+ Number.prototype.toExponential.call(NaN, f_obj));
+assertTrue(f_flag);
+
+f_flag = false;
+assertEquals("Infinity",
+ Number.prototype.toExponential.call(1/0, f_obj));
+assertTrue(f_flag);
+
+f_flag = false;
+assertEquals("-Infinity",
+ Number.prototype.toExponential.call(-1/0, f_obj));
+assertTrue(f_flag);
+
+f_flag = false;
+assertEquals("NaN",
+ Number.prototype.toPrecision.call(NaN, f_obj));
+assertTrue(f_flag);
+
+f_flag = false;
+assertEquals("Infinity",
+ Number.prototype.toPrecision.call(1/0, f_obj));
+assertTrue(f_flag);
+
+f_flag = false;
+assertEquals("-Infinity",
+ Number.prototype.toPrecision.call(-1/0, f_obj));
+assertTrue(f_flag);
+
+// The odd man out: toFixed.
+
+f_flag = false;
+assertThrows(function() { Number.prototype.toFixed.call(NaN, f_obj) },
+ RangeError);
+assertTrue(f_flag);
+
+f_flag = false;
+assertThrows(function() { Number.prototype.toFixed.call(1/0, f_obj) },
+ RangeError);
+assertTrue(f_flag);
+
+f_flag = false;
+assertThrows(function() { Number.prototype.toFixed.call(-1/0, f_obj) },
+ RangeError);
+assertTrue(f_flag);
diff --git a/src/v8/test/mjsunit/regress/regress-2444.js b/src/v8/test/mjsunit/regress/regress-2444.js
new file mode 100644
index 0000000..41b6a95
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2444.js
@@ -0,0 +1,118 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+var flags;
+
+function resetFlags(size) {
+ flags = Array(size);
+ while (size--) flags[size] = 0;
+}
+
+function assertFlags(array) {
+ assertArrayEquals(array, flags);
+}
+
+function object_factory(flag_index, value, expected_flags) {
+ var obj = {};
+ obj.valueOf = function() {
+ assertFlags(expected_flags);
+ flags[flag_index]++;
+ return value;
+ }
+ return obj;
+}
+
+
+assertEquals(-Infinity, Math.max());
+
+resetFlags(1);
+assertEquals(NaN,
+ Math.max(object_factory(0, NaN, [0])));
+assertFlags([1]);
+
+resetFlags(2);
+assertEquals(NaN,
+ Math.max(object_factory(0, NaN, [0, 0]),
+ object_factory(1, 0, [1, 0])));
+assertFlags([1, 1]);
+
+resetFlags(3);
+assertEquals(NaN,
+ Math.max(object_factory(0, NaN, [0, 0, 0]),
+ object_factory(1, 0, [1, 0, 0]),
+ object_factory(2, 1, [1, 1, 0])));
+assertFlags([1, 1, 1]);
+
+resetFlags(3);
+assertEquals(NaN,
+ Math.max(object_factory(0, 2, [0, 0, 0]),
+ object_factory(1, 0, [1, 0, 0]),
+ object_factory(2, NaN, [1, 1, 0])));
+assertFlags([1, 1, 1]);
+
+resetFlags(3);
+assertEquals(2,
+ Math.max(object_factory(0, 2, [0, 0, 0]),
+ object_factory(1, 0, [1, 0, 0]),
+ object_factory(2, 1, [1, 1, 0])));
+assertFlags([1, 1, 1]);
+
+
+assertEquals(+Infinity, Math.min());
+
+resetFlags(1);
+assertEquals(NaN,
+ Math.min(object_factory(0, NaN, [0])));
+assertFlags([1]);
+
+resetFlags(2);
+assertEquals(NaN,
+ Math.min(object_factory(0, NaN, [0, 0]),
+ object_factory(1, 0, [1, 0])));
+assertFlags([1, 1]);
+
+resetFlags(3);
+assertEquals(NaN,
+ Math.min(object_factory(0, NaN, [0, 0, 0]),
+ object_factory(1, 0, [1, 0, 0]),
+ object_factory(2, 1, [1, 1, 0])));
+assertFlags([1, 1, 1]);
+
+resetFlags(3);
+assertEquals(NaN,
+ Math.min(object_factory(0, 2, [0, 0, 0]),
+ object_factory(1, 0, [1, 0, 0]),
+ object_factory(2, NaN, [1, 1, 0])));
+assertFlags([1, 1, 1]);
+
+resetFlags(3);
+assertEquals(0,
+ Math.min(object_factory(0, 2, [0, 0, 0]),
+ object_factory(1, 0, [1, 0, 0]),
+ object_factory(2, 1, [1, 1, 0])));
+assertFlags([1, 1, 1]);
diff --git a/src/v8/test/mjsunit/regress/regress-2451.js b/src/v8/test/mjsunit/regress/regress-2451.js
new file mode 100644
index 0000000..08efda2
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2451.js
@@ -0,0 +1,40 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax --opt
+
+function f() {
+ assertEquals(-1.0, Math.round(-1.5));
+ assertEquals(-2.0, Math.round(-2.5));
+ assertEquals(-1.0, Math.round(-0.5000000000000001));
+}
+
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+f();
+assertOptimized(f);
diff --git a/src/v8/test/mjsunit/regress/regress-246.js b/src/v8/test/mjsunit/regress/regress-246.js
new file mode 100644
index 0000000..22e29fd
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-246.js
@@ -0,0 +1,31 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// See: http://code.google.com/p/v8/issues/detail?id=246
+
+assertTrue(/(?:text)/.test("text"));
+assertEquals(["text"], /(?:text)/.exec("text"));
diff --git a/src/v8/test/mjsunit/regress/regress-2470.js b/src/v8/test/mjsunit/regress/regress-2470.js
new file mode 100644
index 0000000..cba1b06
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2470.js
@@ -0,0 +1,49 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test whether the opening parenthesis can be eaten up by a comment.
+assertThrows('Function("/*", "*/){");', SyntaxError);
+
+// Test whether the function literal can be closed prematurely.
+assertThrows('Function("});(function(){");', SyntaxError);
+
+// Test whether block comments are handled correctly.
+assertDoesNotThrow('Function("/*", "*/", "/**/");');
+assertDoesNotThrow('Function("/*", "a", "*/", "/**/");');
+assertDoesNotThrow('Function("a", "/*", "*/", "/**/");');
+assertThrows('Function("a", "/*", "*/", "b", "/*", "*/", "/**/");', SyntaxError);
+
+// Test whether line comments are handled correctly.
+assertDoesNotThrow('Function("//", "//")');
+assertDoesNotThrow('Function("//", "//", "//")');
+assertDoesNotThrow('Function("a", "//", "//")');
+assertThrows('Function("a", "", "//", "//")', SyntaxError);
+
+// Some embedders rely on the string representation of the resulting
+// function in cases where no formal parameters are specified.
+var asString = Function("return 23").toString();
+assertSame("function anonymous() {\nreturn 23\n}", asString);
diff --git a/src/v8/test/mjsunit/regress/regress-247688.js b/src/v8/test/mjsunit/regress/regress-247688.js
new file mode 100644
index 0000000..80e2884
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-247688.js
@@ -0,0 +1,80 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var a = {};
+a.x = 1
+a.y = 1.5
+
+var b = {}
+b.x = 1.5;
+b.y = 1;
+
+var c = {}
+c.x = 1.5;
+
+var d = {}
+d.x = 1.5;
+
+var e = {}
+e.x = 1.5;
+
+var f = {}
+f.x = 1.5;
+
+var g = {}
+g.x = 1.5;
+
+var h = {}
+h.x = 1.5;
+
+var i = {}
+i.x = 1.5;
+
+var o = {}
+var p = {y : 10, z : 1}
+o.__proto__ = p;
+delete p.z
+
+function foo(v, w) {
+ // Make load via IC in optimized code. Its target will get overwritten by
+ // lazy deopt patch for the stack check.
+ v.y;
+ // Make store with transition to make this code dependent on the map.
+ w.y = 1;
+ return b.y;
+}
+
+foo(o, c);
+foo(o, d);
+foo(o, e);
+%OptimizeFunctionOnNextCall(foo);
+foo(b, f);
+foo(b, g);
+foo(b, h);
+foo(a, i);
diff --git a/src/v8/test/mjsunit/regress/regress-2489.js b/src/v8/test/mjsunit/regress/regress-2489.js
new file mode 100644
index 0000000..882c4f7
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2489.js
@@ -0,0 +1,50 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+"use strict";
+
+function f(a, b) {
+ return g("c", "d");
+}
+
+function g(a, b) {
+ g.constructor.apply(this, arguments);
+}
+
+g.constructor = function(a, b) {
+ assertEquals("c", a);
+ assertEquals("d", b);
+}
+
+f("a", "b");
+f("a", "b");
+%OptimizeFunctionOnNextCall(f);
+f("a", "b");
+g.x = "deopt";
+f("a", "b");
diff --git a/src/v8/test/mjsunit/regress/regress-2499.js b/src/v8/test/mjsunit/regress/regress-2499.js
new file mode 100644
index 0000000..52aad87
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2499.js
@@ -0,0 +1,40 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function foo(word, nBits) {
+ return (word[1] >>> nBits) | (word[0] << (32 - nBits));
+}
+
+word = [0x1001, 0];
+
+var expected = foo(word, 1);
+foo(word, 1);
+%OptimizeFunctionOnNextCall(foo);
+var optimized = foo(word, 1);
+assertEquals(expected, optimized)
diff --git a/src/v8/test/mjsunit/regress/regress-252797.js b/src/v8/test/mjsunit/regress/regress-252797.js
new file mode 100644
index 0000000..08b2217
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-252797.js
@@ -0,0 +1,64 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax --opt
+
+// The type feedback oracle had a bug when retrieving the map from an IC
+// starting with a negative lookup.
+
+// Create a holder in fast mode.
+var holder = Object.create({}, {
+ holderMethod: {value: function() {}}
+});
+assertTrue(%HasFastProperties(holder));
+
+// We assume dict usage for null prototype.
+var holder = Object.create(null, {
+ holderMethod: {value: function() {}}
+});
+assertFalse(%HasFastProperties(holder));
+
+// Create a receiver into dictionary mode.
+var receiver = Object.create(holder, {
+ killMe: {value: 0, configurable: true},
+ keepMe: {value: 0, configurable: true}
+});
+delete receiver.killMe;
+assertFalse(%HasFastProperties(receiver));
+
+// The actual function to test, triggering the retrieval of the wrong map.
+function callConstantFunctionOnPrototype(obj) {
+ obj.holderMethod();
+}
+
+callConstantFunctionOnPrototype(receiver);
+callConstantFunctionOnPrototype(receiver);
+%OptimizeFunctionOnNextCall(callConstantFunctionOnPrototype);
+callConstantFunctionOnPrototype(receiver);
+
+// Make sure that the function is still optimized.
+assertOptimized(callConstantFunctionOnPrototype);
diff --git a/src/v8/test/mjsunit/regress/regress-2529.js b/src/v8/test/mjsunit/regress/regress-2529.js
new file mode 100644
index 0000000..cec56a6
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2529.js
@@ -0,0 +1,43 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+// Regression test for v8 bug 2529.
+
+function makeScript(s) {
+ return 'while(true) { try { "try"; break } finally { "finally" }; ' + s + ' }';
+}
+
+var s1 = makeScript('');
+var s2 = makeScript('y = "done"');
+var s3 = makeScript('if (true) 2; else var x = 3;');
+var s4 = makeScript('if (true) 2; else 3;');
+
+assertEquals("try", eval(s1));
+assertEquals("try", eval(s2));
+assertEquals("try", eval(s3));
+assertEquals("try", eval(s4));
diff --git a/src/v8/test/mjsunit/regress/regress-253.js b/src/v8/test/mjsunit/regress/regress-253.js
new file mode 100644
index 0000000..72c5dc1
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-253.js
@@ -0,0 +1,31 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var x = 0;
+x[0] = 0;
+x[0] = 1;
+x[0] = 2;
diff --git a/src/v8/test/mjsunit/regress/regress-2537.js b/src/v8/test/mjsunit/regress/regress-2537.js
new file mode 100644
index 0000000..1a86000
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2537.js
@@ -0,0 +1,46 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var large_int = 0x40000000;
+
+function foo(x, expected) {
+ assertEquals(expected, x); // This succeeds.
+ x += 0; // Force int32 representation so that
+ // CompareNumericAndBranch is used.
+ if (3 != x) {
+ x += 0; // Poor man's "iDef".
+ // Fails due to Smi-tagging without overflow check.
+ assertEquals(expected, x);
+ }
+}
+
+foo(1, 1);
+foo(3, 3);
+%OptimizeFunctionOnNextCall(foo);
+foo(large_int, large_int);
diff --git a/src/v8/test/mjsunit/regress/regress-2539.js b/src/v8/test/mjsunit/regress/regress-2539.js
new file mode 100644
index 0000000..5d263f8
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2539.js
@@ -0,0 +1,55 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+"use strict";
+var dispatcher = {};
+dispatcher.func = C;
+
+function A() {
+ B(10, 11);
+}
+
+function B(x,y) {
+ x = 0; y = 0;
+ dispatcher.func.apply(this, arguments);
+ assertSame(2, arguments.length);
+ assertSame(10, arguments[0]);
+ assertSame(11, arguments[1]);
+}
+
+function C(x,y) {
+ assertSame(2, arguments.length);
+ assertSame(10, arguments[0]);
+ assertSame(11, arguments[1]);
+}
+
+A();
+A();
+%OptimizeFunctionOnNextCall(A);
+A();
diff --git a/src/v8/test/mjsunit/regress/regress-254.js b/src/v8/test/mjsunit/regress/regress-254.js
new file mode 100644
index 0000000..ec4b40a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-254.js
@@ -0,0 +1,58 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// See: http://code.google.com/p/v8/issues/detail?id=254
+
+// RegExp with global flag: exec and test updates lastIndex.
+var re = /x/g;
+
+assertEquals(0, re.lastIndex, "Global, initial lastIndex");
+
+assertTrue(re.test("x"), "Global, test 1");
+assertEquals(1, re.lastIndex, "Global, lastIndex after test 1");
+assertFalse(re.test("x"), "Global, test 2");
+assertEquals(0, re.lastIndex, "Global, lastIndex after test 2");
+
+assertEquals(["x"], re.exec("x"), "Global, exec 1");
+assertEquals(1, re.lastIndex, "Global, lastIndex after exec 1");
+assertEquals(null, re.exec("x"), "Global, exec 2");
+assertEquals(0, re.lastIndex, "Global, lastIndex after exec 2");
+
+// RegExp without global flag: exec and test leavs lastIndex at zero.
+var re2 = /x/;
+
+assertEquals(0, re2.lastIndex, "Non-global, initial lastIndex");
+
+assertTrue(re2.test("x"), "Non-global, test 1");
+assertEquals(0, re2.lastIndex, "Non-global, lastIndex after test 1");
+assertTrue(re2.test("x"), "Non-global, test 2");
+assertEquals(0, re2.lastIndex, "Non-global, lastIndex after test 2");
+
+assertEquals(["x"], re2.exec("x"), "Non-global, exec 1");
+assertEquals(0, re2.lastIndex, "Non-global, lastIndex after exec 1");
+assertEquals(["x"], re2.exec("x"), "Non-global, exec 2");
+assertEquals(0, re2.lastIndex, "Non-global, lastIndex after exec 2");
diff --git a/src/v8/test/mjsunit/regress/regress-2564.js b/src/v8/test/mjsunit/regress/regress-2564.js
new file mode 100644
index 0000000..21b40e0
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2564.js
@@ -0,0 +1,122 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var o = [ function f0() { throw new Error(); },
+ function f1() { o[0](); },
+ function f2() { o[1](); },
+ function f3() { o[2](); } ];
+
+Error.prepareStackTrace = function(error, frames) {
+ Error.prepareStackTrace = undefined; // Prevent recursion.
+ try {
+ assertEquals(5, frames.length);
+ // Don't check the last frame since that's the top-level code.
+ for (var i = 0; i < frames.length - 1; i++) {
+ assertEquals(o[i], frames[i].getFunction());
+ assertEquals(o, frames[i].getThis());
+ // Private fields are no longer accessible.
+ assertEquals(undefined, frames[i].receiver);
+ assertEquals(undefined, frames[i].fun);
+ assertEquals(undefined, frames[i].pos);
+ }
+ return "success";
+ } catch (e) {
+ return "fail";
+ }
+}
+
+try {
+ o[3]();
+} catch (e) {
+ assertEquals("success", e.stack);
+};
+
+
+var o = [ function f0() { throw new Error(); },
+ function f1() { o[0](); },
+ function f2() { "use strict"; o[1](); },
+ function f3() { o[2](); } ];
+
+Error.prepareStackTrace = function(error, frames) {
+ Error.prepareStackTrace = undefined; // Prevent recursion.
+ try {
+ assertEquals(5, frames.length);
+ for (var i = 0; i < 2; i++) {
+ // The first two frames are still sloppy mode.
+ assertEquals(o[i], frames[i].getFunction());
+ assertEquals(o, frames[i].getThis());
+ }
+ for (var i = 2; i < frames.length; i++) {
+ // The rest are poisoned by the first strict mode function.
+ assertEquals(undefined, frames[i].getFunction());
+ assertEquals(undefined, frames[i].getThis());
+ }
+ for (var i = 0; i < frames.length - 1; i++) {
+ // Function name remains accessible.
+ assertEquals("f"+i, frames[i].getFunctionName());
+ }
+ return "success";
+ } catch (e) {
+ return e;
+ }
+}
+
+try {
+ o[3]();
+} catch (e) {
+ assertEquals("success", e.stack);
+};
+
+
+var o = [ function f0() { "use strict"; throw new Error(); },
+ function f1() { o[0](); },
+ function f2() { o[1](); },
+ function f3() { o[2](); } ];
+
+Error.prepareStackTrace = function(error, frames) {
+ Error.prepareStackTrace = undefined; // Prevent recursion.
+ try {
+ assertEquals(5, frames.length);
+ for (var i = 0; i < frames.length; i++) {
+ // The rest are poisoned by the first strict mode function.
+ assertEquals(undefined, frames[i].getFunction());
+ assertEquals(undefined, frames[i].getThis());
+ if (i < frames.length - 1) { // Function name remains accessible.
+ assertEquals("f"+i, frames[i].getFunctionName());
+ }
+ }
+ return "success";
+ } catch (e) {
+ return e;
+ }
+}
+
+try {
+ o[3]();
+} catch (e) {
+ assertEquals("success", e.stack);
+};
diff --git a/src/v8/test/mjsunit/regress/regress-2565.js b/src/v8/test/mjsunit/regress/regress-2565.js
new file mode 100644
index 0000000..a77806a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2565.js
@@ -0,0 +1,32 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+Object.freeze(Object.prototype);
+var p = {};
+var o = Object.create(p);
+assertSame(p, o.__proto__);
+assertSame(p, Object.getPrototypeOf(o));
diff --git a/src/v8/test/mjsunit/regress/regress-2566.js b/src/v8/test/mjsunit/regress/regress-2566.js
new file mode 100644
index 0000000..582bad9
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2566.js
@@ -0,0 +1,34 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function setProp(obj, prop, val) {
+ obj[prop] = val;
+}
+var obj = [];
+setProp(obj, 'length', 1);
+setProp(obj, 0, 5);
+assertEquals(1, obj.length);
diff --git a/src/v8/test/mjsunit/regress/regress-2568.js b/src/v8/test/mjsunit/regress/regress-2568.js
new file mode 100644
index 0000000..7918e14
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2568.js
@@ -0,0 +1,46 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function pluck1(a, key) {
+ return a.map(function(item) { return item[key]; });
+};
+assertArrayEquals([2, 2], pluck1([[0, 0], [0, 0]], 'length'));
+assertArrayEquals([1, 3], pluck1([[1, 2], [3, 4]], '0'));
+
+function pluck2(a, key) {
+ return a.map(function(item) { return item[key]; });
+};
+assertArrayEquals([2, 2], pluck2(["ab", "cd"], 'length'));
+assertArrayEquals(["a", "c"], pluck2(["ab", "cd"], '0'));
+
+function pluck3(a, key) {
+ return a.map(function(item) { return item[key]; });
+};
+f = function() { 1 };
+f.prototype = g = function() { 2 };
+assertArrayEquals([g, g], pluck3([f, f], 'prototype'));
+assertArrayEquals([undefined, undefined], pluck3([f, f], '0'));
diff --git a/src/v8/test/mjsunit/regress/regress-2570.js b/src/v8/test/mjsunit/regress/regress-2570.js
new file mode 100644
index 0000000..f1331e8
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2570.js
@@ -0,0 +1,32 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var o = ["\u56e7", // Switch JSON stringifier to two-byte mode.
+ "\u00e6"]; // Latin-1 character.
+
+assertEquals('["\u56e7","\u00e6"]', JSON.stringify(o));
+assertEquals('["\u56e7","\u00e6"]', JSON.stringify(o, null, 0));
diff --git a/src/v8/test/mjsunit/regress/regress-259.js b/src/v8/test/mjsunit/regress/regress-259.js
new file mode 100644
index 0000000..f0476ff
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-259.js
@@ -0,0 +1,33 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test that we do not crash when compiling a try/finally with an
+// infinite loop (with no normal exits) in the try block.
+
+// See http://code.google.com/p/v8/issues/detail?id=259
+
+assertThrows("try { while (true) { throw 0; }} finally {}");
diff --git a/src/v8/test/mjsunit/regress/regress-2593.js b/src/v8/test/mjsunit/regress/regress-2593.js
new file mode 100644
index 0000000..b9e497f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2593.js
@@ -0,0 +1,61 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-gc
+
+p1 = { };
+p2 = { };
+p3 = { x : 1 };
+p2.__proto__ = p3
+p1.__proto__ = p2
+
+// Normalize p1.
+p1.z = 1
+delete p1.z
+
+// Make sure all objects are in old space.
+for (var i = 0; i < 10; i++) gc();
+
+function f2() {
+ p2.x;
+}
+
+function f1() {
+ return p1.x;
+}
+
+// Create load stub in p2.
+for (var i = 0; i < 10; i++) f2();
+
+// Create load stub in p2 for p1.
+for (var i = 0; i < 10; i++) f1();
+
+assertEquals(1, f1());
+
+p2.x = 2;
+
+assertEquals(2, f1());
diff --git a/src/v8/test/mjsunit/regress/regress-2594.js b/src/v8/test/mjsunit/regress/regress-2594.js
new file mode 100644
index 0000000..60720cb
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2594.js
@@ -0,0 +1,104 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// In the assertions but the first, the ES5 spec actually requires 0, but
+// that is arguably a spec bug, and other browsers return 1 like us.
+// In ES6, all of those will presumably result in a ReferenceError.
+// Our main concern with this test is that we do not crash, though.
+
+function f1() {
+ var XXX = 0
+ try { throw 1 } catch (XXX) {
+ eval("var h = function() { return XXX }")
+ }
+ return h()
+}
+assertEquals(1, f1())
+
+function f2() {
+ var XXX = 0
+ try { throw 1 } catch (XXX) {
+ eval("function h(){ return XXX }")
+ }
+ return h()
+}
+assertEquals(1, f2())
+
+function f3() {
+ var XXX = 0
+ try { throw 1 } catch (XXX) {
+ try { throw 2 } catch (y) {
+ eval("function h(){ return XXX }")
+ }
+ }
+ return h()
+}
+assertEquals(1, f3())
+
+function f4() {
+ var XXX = 0
+ try { throw 1 } catch (XXX) {
+ with ({}) {
+ eval("function h(){ return XXX }")
+ }
+ }
+ return h()
+}
+assertEquals(1, f4())
+
+function f5() {
+ var XXX = 0
+ try { throw 1 } catch (XXX) {
+ eval('eval("function h(){ return XXX }")')
+ }
+ return h()
+}
+assertEquals(1, f5())
+
+function f6() {
+ var XXX = 0
+ try { throw 1 } catch (XXX) {
+ eval("var h = (function() { function g(){ return XXX } return g })()")
+ }
+ return h()
+}
+assertEquals(1, f6())
+
+function f7() {
+ var XXX = 0
+ try { throw 1 } catch (XXX) {
+ eval("function h() { var XXX=2; function g(){ return XXX } return g }")
+ }
+ return h()()
+}
+assertEquals(2, f7()) // !
+
+var XXX = 0
+try { throw 1 } catch (XXX) {
+ eval("function h(){ return XXX }")
+}
+assertEquals(1, h())
diff --git a/src/v8/test/mjsunit/regress/regress-2595.js b/src/v8/test/mjsunit/regress/regress-2595.js
new file mode 100644
index 0000000..c7e9571
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2595.js
@@ -0,0 +1,57 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var p = { f: function () { return "p"; } };
+var o = Object.create(p);
+o.x = true;
+delete o.x; // slow case object
+
+var u = { x: 0, f: function () { return "u"; } }; // object with some other map
+
+function F(x) {
+ return x.f();
+}
+
+// First make CALL IC in F go MEGAMORPHIC and ensure that we put the stub
+// that calls p.f (guarded by a negative dictionary lookup on the receiver)
+// into the stub cache
+assertEquals("p", F(o));
+assertEquals("p", F(o));
+assertEquals("u", F(u));
+assertEquals("p", F(o));
+assertEquals("u", F(u));
+
+// Optimize F. We will inline p.f into F guarded by map checked against
+// receiver which does not work for slow case objects.
+%OptimizeFunctionOnNextCall(F);
+assertEquals("p", F(o));
+
+// Add f to o. o's map will *not* change.
+o.f = function () { return "o"; };
+assertEquals("o", F(o));
diff --git a/src/v8/test/mjsunit/regress/regress-2596.js b/src/v8/test/mjsunit/regress/regress-2596.js
new file mode 100644
index 0000000..6500988
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2596.js
@@ -0,0 +1,55 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var ab = new ArrayBuffer(8);
+var i_view = new Int32Array(ab);
+i_view[0] = %GetHoleNaNUpper()
+i_view[1] = %GetHoleNaNLower();
+var doubles = new Float64Array(ab); // kHoleNaN
+assertTrue(isNaN(doubles[0]));
+
+var prototype = [2.5, 2.5];
+var array = [3.5, 3.5];
+array.__proto__ = prototype;
+assertTrue(%HasDoubleElements(array));
+
+function boom(index) {
+ array[index] = doubles[0];
+ return array[index];
+}
+
+assertTrue(isNaN(boom(0)));
+assertTrue(isNaN(boom(0)));
+assertTrue(isNaN(boom(0)));
+
+// Test hydrogen
+%OptimizeFunctionOnNextCall(boom);
+assertTrue(isNaN(boom(0)));
+assertTrue(isNaN(boom(0)));
+assertTrue(isNaN(boom(0)));
diff --git a/src/v8/test/mjsunit/regress/regress-260.js b/src/v8/test/mjsunit/regress/regress-260.js
new file mode 100644
index 0000000..65242bc
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-260.js
@@ -0,0 +1,33 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// We should not compile the bodies of function literals in loop
+// conditions twice, even in cases where the loop condition is
+// compiled twice.
+
+function test() { eval("while(!function () { var x; });"); }
+test();
diff --git a/src/v8/test/mjsunit/regress/regress-2606.js b/src/v8/test/mjsunit/regress/regress-2606.js
new file mode 100644
index 0000000..b704f7d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2606.js
@@ -0,0 +1,61 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Check baseline for __proto__.
+var desc = Object.getOwnPropertyDescriptor(Object.prototype, "__proto__");
+assertFalse(desc.enumerable);
+assertTrue(desc.configurable);
+assertEquals("function", typeof desc.get);
+assertEquals("function", typeof desc.set);
+
+// Check redefining getter for __proto__.
+function replaced_get() {};
+Object.defineProperty(Object.prototype, "__proto__", { get:replaced_get });
+desc = Object.getOwnPropertyDescriptor(Object.prototype, "__proto__");
+assertFalse(desc.enumerable);
+assertTrue(desc.configurable);
+assertSame(replaced_get, desc.get);
+
+// Check redefining setter for __proto__.
+function replaced_set(x) {};
+Object.defineProperty(Object.prototype, "__proto__", { set:replaced_set });
+desc = Object.getOwnPropertyDescriptor(Object.prototype, "__proto__");
+assertFalse(desc.enumerable);
+assertTrue(desc.configurable);
+assertSame(replaced_set, desc.set);
+
+// Check changing configurability of __proto__.
+Object.defineProperty(Object.prototype, "__proto__", { configurable:false });
+desc = Object.getOwnPropertyDescriptor(Object.prototype, "__proto__");
+assertFalse(desc.enumerable);
+assertFalse(desc.configurable);
+assertSame(replaced_get, desc.get);
+assertSame(replaced_set, desc.set);
+
+// Check freezing Object.prototype completely.
+Object.freeze(Object.prototype);
+assertTrue(Object.isFrozen(Object.prototype));
diff --git a/src/v8/test/mjsunit/regress/regress-2612.js b/src/v8/test/mjsunit/regress/regress-2612.js
new file mode 100644
index 0000000..6008948
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2612.js
@@ -0,0 +1,74 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// Create a function to get a long series of removable simulates.
+// f() {
+// var _0 = <random>, _1 = <random>, ... _1000 = <random>,
+// _1001 = <random var> + <random var>,
+// _1002 = <random var> + <random var>,
+// ...
+// _99999 = <random var> + <random var>,
+// x = 1;
+// return _0;
+// }
+
+var seed = 1;
+
+function rand() {
+ seed = seed * 171 % 1337 + 17;
+ return (seed % 1000) / 1000;
+}
+
+function randi(max) {
+ seed = seed * 131 % 1773 + 13;
+ return seed % max;
+}
+
+function varname(i) {
+ return "_" + i;
+}
+
+var source = "var ";
+
+for (var i = 0; i < 750; i++) {
+ source += [varname(i), "=", rand(), ","].join("");
+}
+
+for (var i = 750; i < 3000; i++) {
+ source += [varname(i), "=",
+ varname(randi(i)), "+",
+ varname(randi(i)), ","].join("");
+}
+
+source += "x=1; return _0;"
+var f = new Function(source);
+
+f();
+%OptimizeFunctionOnNextCall(f);
+f();
diff --git a/src/v8/test/mjsunit/regress/regress-2615.js b/src/v8/test/mjsunit/regress/regress-2615.js
new file mode 100644
index 0000000..6b277e8
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2615.js
@@ -0,0 +1,96 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+a = [1];
+Object.defineProperty(a, "1", {writable:false, configurable:false, value: 100});
+assertThrows("a.unshift(4);", TypeError);
+assertEquals([1, 100, 100], a);
+var desc = Object.getOwnPropertyDescriptor(a, "1");
+assertEquals(false, desc.writable);
+assertEquals(false, desc.configurable);
+
+a = [1];
+var g = function() { return 100; };
+Object.defineProperty(a, "1", {get:g});
+assertThrows("a.unshift(0);", TypeError);
+assertEquals([1, 100, 100], a);
+desc = Object.getOwnPropertyDescriptor(a, "1");
+assertEquals(false, desc.configurable);
+assertEquals(g, desc.get);
+
+a = [1];
+var c = 0;
+var s = function(v) { c += 1; };
+Object.defineProperty(a, "1", {set:s});
+a.unshift(10);
+assertEquals([10, undefined, undefined], a);
+assertEquals(1, c);
+desc = Object.getOwnPropertyDescriptor(a, "1");
+assertEquals(false, desc.configurable);
+assertEquals(s, desc.set);
+
+a = [1];
+Object.defineProperty(a, "1", {configurable:false, value:10});
+assertThrows("a.splice(1,1);", TypeError);
+assertEquals([1, 10], a);
+desc = Object.getOwnPropertyDescriptor(a, "1");
+assertEquals(false, desc.configurable);
+
+a = [0,1,2,3,4,5,6];
+Object.defineProperty(a, "3", {configurable:false, writable:false, value:3});
+assertThrows("a.splice(1,4);", TypeError);
+assertEquals([0,5,6,3,,,,], a);
+desc = Object.getOwnPropertyDescriptor(a, "3");
+assertEquals(false, desc.configurable);
+assertEquals(false, desc.writable);
+
+a = [0,1,2,3,4,5,6];
+Object.defineProperty(a, "5", {configurable:false, value:5});
+assertThrows("a.splice(1,4);", TypeError);
+assertEquals([0,5,6,3,4,5,,], a);
+desc = Object.getOwnPropertyDescriptor(a, "5");
+assertEquals(false, desc.configurable);
+
+a = [1,2,3,,5];
+Object.defineProperty(a, "1", {configurable:false, writable:true, value:2});
+assertEquals(1, a.shift());
+assertEquals([2,3,,5], a);
+desc = Object.getOwnPropertyDescriptor(a, "1");
+assertEquals(false, desc.configurable);
+assertEquals(true, desc.writable);
+assertThrows("a.shift();", TypeError);
+assertEquals([3,3,,5], a);
+desc = Object.getOwnPropertyDescriptor(a, "1");
+assertEquals(false, desc.configurable);
+assertEquals(true, desc.writable);
+
+a = [1,2,3];
+Object.defineProperty(a, "2", {configurable:false, value:3});
+assertThrows("a.pop();", TypeError);
+assertEquals([1,2,3], a);
+desc = Object.getOwnPropertyDescriptor(a, "2");
+assertEquals(false, desc.configurable);
diff --git a/src/v8/test/mjsunit/regress/regress-2618.js b/src/v8/test/mjsunit/regress/regress-2618.js
new file mode 100644
index 0000000..437401e
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2618.js
@@ -0,0 +1,81 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --use-osr --allow-natives-syntax --ignition-osr --opt
+// Flags: --no-always-opt
+
+// Can't OSR with always-opt.
+assertFalse(isAlwaysOptimize());
+
+function f() {
+ do {
+ do {
+ for (var i = 0; i < 10; i++) %OptimizeOsr();
+ // Note: this check can't be wrapped in a function, because
+ // calling that function causes a deopt from lack of call
+ // feedback.
+ var opt_status = %GetOptimizationStatus(f);
+ assertTrue(
+ (opt_status & V8OptimizationStatus.kTopmostFrameIsTurboFanned) !== 0);
+ } while (false);
+ } while (false);
+}
+
+f();
+
+function g() {
+ for (var i = 0; i < 1; i++) { }
+
+ do {
+ do {
+ for (var i = 0; i < 1; i++) { }
+ } while (false);
+ } while (false);
+
+ do {
+ do {
+ do {
+ do {
+ do {
+ do {
+ do {
+ do {
+ for (var i = 0; i < 10; i++) %OptimizeOsr();
+ var opt_status = %GetOptimizationStatus(g);
+ assertTrue((opt_status
+ & V8OptimizationStatus.kTopmostFrameIsTurboFanned) !== 0);
+ } while (false);
+ } while (false);
+ } while (false);
+ } while (false);
+ } while (false);
+ } while (false);
+ } while (false);
+ } while (false);
+}
+
+g();
diff --git a/src/v8/test/mjsunit/regress/regress-2624.js b/src/v8/test/mjsunit/regress/regress-2624.js
new file mode 100644
index 0000000..fe94a10
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2624.js
@@ -0,0 +1,35 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --print-code
+
+var source = '"snowmen invasion " + "';
+for(var i = 0; i < 800; i++) {
+ source += '\u2603';
+}
+source += '"';
+eval(source);
diff --git a/src/v8/test/mjsunit/regress/regress-263.js b/src/v8/test/mjsunit/regress/regress-263.js
new file mode 100644
index 0000000..123bde6
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-263.js
@@ -0,0 +1,38 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Exits via return, break, or continue from within try/finally or
+// for/in should not crash or trigger a debug assert.
+
+// See http://code.google.com/p/v8/issues/detail?id=263
+
+function test0() { with({}) for(var x in {}) return; }
+test0();
+
+
+function test1() { with({}) try { } finally { with({}) return; } }
+test1();
diff --git a/src/v8/test/mjsunit/regress/regress-264203.js b/src/v8/test/mjsunit/regress/regress-264203.js
new file mode 100644
index 0000000..fa00756
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-264203.js
@@ -0,0 +1,44 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function foo(x) {
+ var a = [1, 2, 3, 4, 5, 6, 7, 8];
+ a[x + 5];
+ var result;
+ for (var i = 0; i < 3; i++) {
+ result = a[0 - x];
+ }
+ return result;
+}
+
+foo(0);
+foo(0);
+%OptimizeFunctionOnNextCall(foo);
+var r = foo(-2);
+assertEquals(3, r);
diff --git a/src/v8/test/mjsunit/regress/regress-2646.js b/src/v8/test/mjsunit/regress/regress-2646.js
new file mode 100644
index 0000000..c51a280
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2646.js
@@ -0,0 +1,37 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --heap-stats
+
+var expectedItemsCount = 10000,
+ itemSize = 5,
+ heap = new ArrayBuffer(expectedItemsCount * itemSize * 8),
+ storage = [];
+
+for (var i = 0; i < expectedItemsCount; i++) {
+ storage.push(new Float64Array(heap, 0, itemSize));
+}
diff --git a/src/v8/test/mjsunit/regress/regress-265.js b/src/v8/test/mjsunit/regress/regress-265.js
new file mode 100644
index 0000000..21ac1a6
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-265.js
@@ -0,0 +1,64 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// When returning or breaking out of a deeply nested try/finally, we
+// should not crash.
+
+// See http://code.google.com/p/v8/issues/detail?id=263
+
+function test0() {
+ try {
+ try {
+ return 0;
+ } finally {
+ try {
+ return 0;
+ } finally {
+ }
+ }
+ } finally {
+ }
+}
+
+test0();
+
+function test1() {
+L0:
+ try {
+ try {
+ break L0;
+ } finally {
+ try {
+ break L0;
+ } finally {
+ }
+ }
+ } finally {
+ }
+}
+
+test1();
diff --git a/src/v8/test/mjsunit/regress/regress-267.js b/src/v8/test/mjsunit/regress/regress-267.js
new file mode 100644
index 0000000..bb61606
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-267.js
@@ -0,0 +1,35 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// See http://code.google.com/p/v8/issues/detail?id=267
+
+var global = (function(){ return this; })();
+function taint(fn){var v = fn(); eval("taint"); return v; }
+function getThis(){ return this; }
+var obj = taint(getThis);
+
+assertEquals(global, obj, "Should be the global object.");
diff --git a/src/v8/test/mjsunit/regress/regress-2671-1.js b/src/v8/test/mjsunit/regress/regress-2671-1.js
new file mode 100644
index 0000000..7937d6a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2671-1.js
@@ -0,0 +1,44 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var y;
+function f() {
+ var a = [];
+ a[20] = 0;
+ y = 3;
+ var i = 7 * (y + -0);
+ a[i]++;
+ assertTrue(isNaN(a[i]));
+}
+
+f();
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+f();
diff --git a/src/v8/test/mjsunit/regress/regress-2671.js b/src/v8/test/mjsunit/regress/regress-2671.js
new file mode 100644
index 0000000..73a3098
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2671.js
@@ -0,0 +1,44 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var y;
+function f() {
+ var a = [];
+ a[20] = 0;
+ y = 3;
+ var i = 7 * (y + -0);
+ a[i] = 1/y;
+ assertFalse(isNaN(a[i]));
+}
+
+f();
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+f();
diff --git a/src/v8/test/mjsunit/regress/regress-2686.js b/src/v8/test/mjsunit/regress/regress-2686.js
new file mode 100644
index 0000000..bd6106f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2686.js
@@ -0,0 +1,32 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Check Function doesn't use String.prototype.indexOf.
+
+assertThrows(function() { Function('){ function foo(', '}') }, SyntaxError);
+String.prototype.indexOf = function () { return -1; }
+assertThrows(function() { Function('){ function foo(', '}') }, SyntaxError);
diff --git a/src/v8/test/mjsunit/regress/regress-2690.js b/src/v8/test/mjsunit/regress/regress-2690.js
new file mode 100644
index 0000000..0ed4c5c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2690.js
@@ -0,0 +1,28 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+assertTrue(/\1[a]/.test("\1a"));
diff --git a/src/v8/test/mjsunit/regress/regress-270142.js b/src/v8/test/mjsunit/regress/regress-270142.js
new file mode 100644
index 0000000..63f4d14
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-270142.js
@@ -0,0 +1,48 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Check that "name"'s property descriptor for non-strict and strict
+// functions correspond.
+
+function f(x) {
+ return x;
+}
+
+function g(x) {
+ "use strict";
+ return x;
+}
+
+function checkNameDescriptor(f) {
+ var descriptor = Object.getOwnPropertyDescriptor(f, "name");
+ assertTrue(descriptor.configurable);
+ assertFalse(descriptor.enumerable);
+ assertFalse(descriptor.writable);
+}
+
+checkNameDescriptor(f);
+checkNameDescriptor(g);
diff --git a/src/v8/test/mjsunit/regress/regress-2711.js b/src/v8/test/mjsunit/regress/regress-2711.js
new file mode 100644
index 0000000..d5ac2ba
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2711.js
@@ -0,0 +1,33 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test that frozen arrays don't let their length change
+var a = Object.freeze([1]);
+assertThrows(function() { a.push(2); }, TypeError);
+assertEquals(1, a.length);
+assertThrows(function() { a.push(2); }, TypeError);
+assertEquals(1, a.length);
diff --git a/src/v8/test/mjsunit/regress/regress-2717.js b/src/v8/test/mjsunit/regress/regress-2717.js
new file mode 100644
index 0000000..4f8f791
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2717.js
@@ -0,0 +1,51 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test re-initializing existing field which is already being tracked as
+// having double representation.
+(function() {
+ function test1(a) {
+ return { x: 1.5, x: a };
+ };
+
+ assertEquals({}, test1({}).x);
+})();
+
+// Test initializing new field which follows an existing transition to a
+// map that tracks it as having double representation.
+(function() {
+ function test1(a) {
+ return { y: a };
+ };
+
+ function test2(a) {
+ return { y: a };
+ };
+
+ assertEquals(1.5, test1(1.5).y);
+ assertEquals({}, test2({}).y);
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-2758.js b/src/v8/test/mjsunit/regress/regress-2758.js
new file mode 100644
index 0000000..ee78844
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2758.js
@@ -0,0 +1,49 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var functions = [
+ function() { var f = [].concat; f() },
+ function() { var f = [].push; f() },
+ function() { var f = [].shift; f() },
+ function() { (0, [].concat)() },
+ function() { (0, [].push)() },
+ function() { (0, [].shift)() }
+]
+
+for (var i = 0; i < 5; ++i) {
+ for (var j in functions) {
+ print(functions[i])
+ assertThrows(functions[j], TypeError)
+ }
+
+ if (i === 3) {
+ for (var j in functions)
+ %OptimizeFunctionOnNextCall(functions[j]);
+ }
+}
diff --git a/src/v8/test/mjsunit/regress/regress-279.js b/src/v8/test/mjsunit/regress/regress-279.js
new file mode 100644
index 0000000..e500dd6
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-279.js
@@ -0,0 +1,62 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function makeArrayInObject() {
+ return { foo: [] };
+}
+
+var a = makeArrayInObject();
+a.foo.push(5);
+var b = makeArrayInObject();
+assertEquals(0, b.foo.length, "Array in object");
+
+function makeObjectInObject() {
+ return { foo: {} };
+}
+
+a = makeObjectInObject();
+a.foo.bar = 1;
+b = makeObjectInObject();
+assertEquals('undefined', typeof(b.foo.bar), "Object in object");
+
+function makeObjectInArray() {
+ return [ {} ];
+}
+
+a = makeObjectInArray();
+a[0].bar = 1;
+b = makeObjectInArray();
+assertEquals('undefined', typeof(b[0].bar), "Object in array");
+
+function makeArrayInArray() {
+ return [ [] ];
+}
+
+a = makeArrayInArray();
+a[0].push(5);
+b = makeArrayInArray();
+assertEquals(0, b[0].length, "Array in array");
diff --git a/src/v8/test/mjsunit/regress/regress-2790.js b/src/v8/test/mjsunit/regress/regress-2790.js
new file mode 100644
index 0000000..ac79e64
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2790.js
@@ -0,0 +1,31 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test that we can create arrays of any size.
+for (var i = 1000; i < 1000000; i += 19703) {
+ new Array(i);
+}
diff --git a/src/v8/test/mjsunit/regress/regress-280531.js b/src/v8/test/mjsunit/regress/regress-280531.js
new file mode 100644
index 0000000..6799574
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-280531.js
@@ -0,0 +1,32 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var contextA = Realm.create();
+var date1 = Realm.eval(contextA, "new Date('Thu, 29 Aug 2013 00:00:00 UTC')");
+new Date('Thu, 29 Aug 2013 00:00:01 UTC');
+var date2 = Realm.eval(contextA, "new Date('Thu, 29 Aug 2013 00:00:00 UTC')");
+assertEquals(date1, date2);
diff --git a/src/v8/test/mjsunit/regress/regress-2813.js b/src/v8/test/mjsunit/regress/regress-2813.js
new file mode 100644
index 0000000..97ae43b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2813.js
@@ -0,0 +1,44 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function foo(x) {
+ var a = x + 1;
+ var b = x + 2;
+ if (x != 0) {
+ if (x > 0 & x < 100) {
+ return a;
+ }
+ }
+ return 0;
+}
+
+assertEquals(0, foo(0));
+assertEquals(0, foo(0));
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(3, foo(2));
diff --git a/src/v8/test/mjsunit/regress/regress-2836.js b/src/v8/test/mjsunit/regress/regress-2836.js
new file mode 100644
index 0000000..682cc5e
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2836.js
@@ -0,0 +1,38 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function f() {
+ var end = 1073741823; // 2^30 - 1
+ var start = end - 100000; // Run long enough to trigger OSR.
+ for (var i = start; i <= end; ++i) {
+ assertTrue(i >= start); // No overflow allowed!
+ }
+}
+
+f();
diff --git a/src/v8/test/mjsunit/regress/regress-284.js b/src/v8/test/mjsunit/regress/regress-284.js
new file mode 100644
index 0000000..ecfdeea
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-284.js
@@ -0,0 +1,50 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// See http://code.google.com/p/v8/issues/detail?id=284
+
+function continueWithinLoop() {
+ var result;
+ for (var key in [0]) {
+ result = "hopla";
+ continue;
+ }
+ return result;
+};
+
+assertEquals("hopla", continueWithinLoop());
+
+function breakWithinLoop() {
+ var result;
+ for (var key in [0]) {
+ result = "hopla";
+ break;
+ }
+ return result;
+};
+
+assertEquals("hopla", continueWithinLoop());
diff --git a/src/v8/test/mjsunit/regress/regress-2843.js b/src/v8/test/mjsunit/regress/regress-2843.js
new file mode 100644
index 0000000..5b28c2d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2843.js
@@ -0,0 +1,45 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function bailout() { throw "bailout"; }
+var global;
+
+function foo(x, fun) {
+ var a = x + 1;
+ var b = x + 2; // Need another Simulate to fold the first one into.
+ global = true; // Need a side effect to deopt to.
+ fun();
+ return a;
+}
+
+assertThrows("foo(1, bailout)");
+assertThrows("foo(1, bailout)");
+%OptimizeFunctionOnNextCall(foo);
+assertThrows("foo(1, bailout)");
+assertEquals(2, foo(1, function() {}));
diff --git a/src/v8/test/mjsunit/regress/regress-2855.js b/src/v8/test/mjsunit/regress/regress-2855.js
new file mode 100644
index 0000000..24ec452
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2855.js
@@ -0,0 +1,57 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function foo(a) {
+ for (var i = 0; i < 100; ++i)
+ a = new String(a);
+ return a;
+}
+
+var expected = "hello";
+for (var i = 0; i < 4; ++i) {
+ if (i == 2) {
+ String.prototype.valueOf = function() { return 42; }
+ expected = "42";
+ }
+ assertEquals(expected, "" + foo("hello"));
+}
+
+// Make sure we look up "valueOf" only once.
+var count = 0;
+var x = new String("foo");
+Object.defineProperty(x, "valueOf",
+ { get: function() {
+ count++;
+ return function() {
+ return 11;
+ }
+ }
+ });
+for (var i = 0; i < 3; i++) {
+ assertEquals("11", "" + x);
+ assertEquals(i + 1, count);
+}
diff --git a/src/v8/test/mjsunit/regress/regress-286.js b/src/v8/test/mjsunit/regress/regress-286.js
new file mode 100644
index 0000000..361b726
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-286.js
@@ -0,0 +1,36 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// See http://code.google.com/p/v8/issues/detail?id=286
+
+function test() {
+ var o = [1];
+ var a = o[o ^= 1];
+ return a;
+};
+
+assertEquals(1, test());
diff --git a/src/v8/test/mjsunit/regress/regress-2931.js b/src/v8/test/mjsunit/regress/regress-2931.js
new file mode 100644
index 0000000..a2ea912
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2931.js
@@ -0,0 +1,34 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Typed array constructors should be immune from changes to
+// value of ArrayBuffer on global object.
+// See http://code.google.com/p/v8/issues/detail?id=294
+
+this.ArrayBuffer = function() { throw Error('BAM'); };
+var u8 = new Uint8Array(100);
+assertSame(100, u8.byteLength);
diff --git a/src/v8/test/mjsunit/regress/regress-294.js b/src/v8/test/mjsunit/regress/regress-294.js
new file mode 100644
index 0000000..285b447
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-294.js
@@ -0,0 +1,43 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Should not crash.
+// See http://code.google.com/p/v8/issues/detail?id=294
+
+function f() { return false; }
+
+function test(x) {
+ var y = x;
+ if (x == "kat") x = "kat";
+ else {
+ x = "hund";
+ var z = f();
+ if (!z) x = "kat";
+ }
+}
+
+test("hund");
diff --git a/src/v8/test/mjsunit/regress/regress-2980.js b/src/v8/test/mjsunit/regress/regress-2980.js
new file mode 100644
index 0000000..071a733
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2980.js
@@ -0,0 +1,64 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+function test(expected, holder) {
+ assertEquals(expected, holder.property);
+}
+
+var holder = {}
+holder.__proto__ = null;
+holder.property = "foo";
+delete holder.property;
+test(undefined, holder);
+test(undefined, holder);
+test(undefined, holder);
+holder.property = "bar";
+test("bar", holder);
+test("bar", holder);
+
+// Now the same thing with a nontrivial prototype chain.
+
+function test2(expected, holder) {
+ assertEquals(expected, holder.prop2);
+}
+
+var holder2 = {}
+holder2.prop2 = "foo";
+holder2.__proto__ = null;
+function Receiver() {}
+Receiver.prototype = holder2;
+
+var rec2 = new Receiver();
+delete holder2.prop2;
+
+test2(undefined, rec2);
+test2(undefined, rec2);
+test2(undefined, rec2);
+holder2.prop2 = "bar";
+test2("bar", rec2);
+test2("bar", rec2);
diff --git a/src/v8/test/mjsunit/regress/regress-298269.js b/src/v8/test/mjsunit/regress/regress-298269.js
new file mode 100644
index 0000000..f6604df
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-298269.js
@@ -0,0 +1,45 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function Cb(a) {
+ var f, g;
+ for(f = a.length; f--;) {
+ g = a.charCodeAt(f);
+ // This will fail after OSR if Runtime_StringCharCodeAt is modified
+ // to iterates optimized frames and visit safepoint pointers.
+ }
+ return g;
+}
+
+var s1 = "long string to make cons string 1";
+var s2 = "long string to make cons string 2";
+Cb(s1 + s2);
+Cb(s1);
+var s3 = "string for triggering osr in Cb";
+for (var i = 0; i < 16; i++) s3 = s3 + s3;
+Cb(s3);
+Cb(s1 + s2);
diff --git a/src/v8/test/mjsunit/regress/regress-2984.js b/src/v8/test/mjsunit/regress/regress-2984.js
new file mode 100644
index 0000000..914409c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2984.js
@@ -0,0 +1,33 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+assertEquals("\u0178", "\xff".toUpperCase());
+assertEquals("abcdefghijklmn\xffopq",
+ ("ABCDEFGHIJKL" + "MN\u0178OPQ").toLowerCase());
+assertEquals("\xff", "\u0178".toLowerCase());
+assertEquals("ABCDEFGHIJKLMN\u0178OPQ",
+ ("abcdefghijk" + "lmn\xffopq").toUpperCase());
diff --git a/src/v8/test/mjsunit/regress/regress-2987.js b/src/v8/test/mjsunit/regress/regress-2987.js
new file mode 100644
index 0000000..02927e2
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2987.js
@@ -0,0 +1,57 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// This tests that stores on captured objects are correctly tracked even
+// when DCE is enabled. We cannot delete simulations of captured objects
+// that are still needed to replay the environment correctly.
+
+function constructor() {
+ this.x = 0;
+}
+
+var deopt = { deopt:false };
+function boogeyman(mode, value) {
+ var object = new constructor();
+ if (mode) {
+ object.x = 1;
+ } else {
+ object.x = 2;
+ }
+ deopt.deopt;
+ assertEquals(value, object.x);
+}
+
+boogeyman(true, 1);
+boogeyman(true, 1);
+boogeyman(false, 2);
+boogeyman(false, 2);
+%OptimizeFunctionOnNextCall(boogeyman);
+boogeyman(false, 2);
+delete deopt.deopt;
+boogeyman(false, 2);
diff --git a/src/v8/test/mjsunit/regress/regress-2988.js b/src/v8/test/mjsunit/regress/regress-2988.js
new file mode 100644
index 0000000..0311d2b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2988.js
@@ -0,0 +1,39 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax --gc-global --throws
+
+var f = eval("(function f() { throw 'kaboom'; })");
+
+// Prepare that next MessageHandler::MakeMessageObject will result in
+// reclamation of existing script wrapper while weak handle is used.
+%FunctionGetScript(f);
+%SetAllocationTimeout(1000, 2);
+
+// This call throws to the console but the --throws flag passed to this
+// test will make sure we don't count it as an actual failure.
+f();
diff --git a/src/v8/test/mjsunit/regress/regress-2989.js b/src/v8/test/mjsunit/regress/regress-2989.js
new file mode 100644
index 0000000..49c4a1c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-2989.js
@@ -0,0 +1,35 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Copyright (C) 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions
+// are met:
+// 1. Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright
+// notice, this list of conditions and the following disclaimer in the
+// documentation and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+// EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+// WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+// DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+// LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+// ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+// SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+(function ArgumentsObjectChange() {
+ function f(x) {
+ x = 42;
+ return f.arguments[0];
+ }
+
+ f(0);
+ %OptimizeFunctionOnNextCall(f);
+ assertEquals(42, f(0));
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-299979.js b/src/v8/test/mjsunit/regress/regress-299979.js
new file mode 100644
index 0000000..0afbcb3
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-299979.js
@@ -0,0 +1,34 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+(function(){
+ "use strict";
+ var list = Object.freeze([1, 2, 3]);
+ assertThrows(function() { list.unshift(4); }, TypeError);
+ assertThrows(function() { list.shift(); }, TypeError);
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-3006390.js b/src/v8/test/mjsunit/regress/regress-3006390.js
new file mode 100644
index 0000000..4f916ef
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-3006390.js
@@ -0,0 +1,33 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function X() { }
+X.prototype.valueOf = function () { return 7; }
+
+function f(x, y) { return x % y; }
+
+assertEquals(1, f(8, new X()));
diff --git a/src/v8/test/mjsunit/regress/regress-3010.js b/src/v8/test/mjsunit/regress/regress-3010.js
new file mode 100644
index 0000000..7aeec64
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-3010.js
@@ -0,0 +1,65 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+(function() {
+ function testOneSize(current_size) {
+ var eval_string = 'obj = {';
+ for (var current = 0; current <= current_size; ++current) {
+ eval_string += 'k' + current + ':' + current + ','
+ }
+ eval_string += '};';
+ eval(eval_string);
+ for (var i = 0; i <= current_size; i++) {
+ assertEquals(i, obj['k'+i]);
+ }
+ var current_number = 0;
+ for (var x in obj) {
+ assertEquals(current_number, obj[x]);
+ current_number++;
+ }
+ }
+
+ testOneSize(127);
+ testOneSize(128);
+ testOneSize(129);
+
+ testOneSize(255);
+ testOneSize(256);
+ testOneSize(257);
+
+ testOneSize(511);
+ testOneSize(512);
+ testOneSize(513);
+
+ testOneSize(1023);
+ testOneSize(1024);
+ testOneSize(1025);
+
+ testOneSize(2047);
+ testOneSize(2048);
+ testOneSize(2049);
+}())
diff --git a/src/v8/test/mjsunit/regress/regress-3025.js b/src/v8/test/mjsunit/regress/regress-3025.js
new file mode 100644
index 0000000..ccb3830
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-3025.js
@@ -0,0 +1,32 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var n = 0x8000000000000800;
+assertEquals(n, 9223372036854778000);
+var s = n.toString(5);
+var v = parseInt(s, 5);
+assertEquals(n, v);
diff --git a/src/v8/test/mjsunit/regress/regress-3026.js b/src/v8/test/mjsunit/regress/regress-3026.js
new file mode 100644
index 0000000..d25c88d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-3026.js
@@ -0,0 +1,28 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+assertEquals([], "abc".split(undefined, 0));
diff --git a/src/v8/test/mjsunit/regress/regress-3027.js b/src/v8/test/mjsunit/regress/regress-3027.js
new file mode 100644
index 0000000..6336594
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-3027.js
@@ -0,0 +1,42 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test to exceed the Page::MaxRegularHeapObjectSize with an array
+// constructor call taking many arguments.
+
+function boom() {
+ var args = [];
+ for (var i = 0; i < 125000; i++) {
+ args.push(i);
+ }
+ return Array.apply(Array, args);
+}
+
+var array = boom();
+
+assertEquals(125000, array.length);
+assertEquals(124999, array[124999]);
diff --git a/src/v8/test/mjsunit/regress/regress-3029.js b/src/v8/test/mjsunit/regress/regress-3029.js
new file mode 100644
index 0000000..ae412df
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-3029.js
@@ -0,0 +1,45 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function c(x) {
+ undefined.boom();
+}
+
+function f() {
+ return new c();
+}
+
+function g() {
+ f();
+}
+
+assertThrows("g()", TypeError);
+assertThrows("g()", TypeError);
+%OptimizeFunctionOnNextCall(g);
+assertThrows("g()", TypeError);
diff --git a/src/v8/test/mjsunit/regress/regress-3032.js b/src/v8/test/mjsunit/regress/regress-3032.js
new file mode 100644
index 0000000..9b18e14
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-3032.js
@@ -0,0 +1,32 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+for (var i = 0; i < 10; i++) { if (i == 5) %OptimizeOsr(); }
+var xl = 4096;
+var z = i % xl;
diff --git a/src/v8/test/mjsunit/regress/regress-3039.js b/src/v8/test/mjsunit/regress/regress-3039.js
new file mode 100644
index 0000000..3c7f62c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-3039.js
@@ -0,0 +1,41 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function do_div(x, y) {
+ return (x / y) | 0;
+}
+
+// Preparation.
+assertEquals(17, do_div(51, 3));
+assertEquals(13, do_div(65, 5));
+%OptimizeFunctionOnNextCall(do_div);
+assertEquals(11, do_div(77, 7));
+
+// The actual test. We should not trigger a floating point exception.
+assertEquals(-2147483648, do_div(-2147483648, -1));
diff --git a/src/v8/test/mjsunit/regress/regress-3116.js b/src/v8/test/mjsunit/regress/regress-3116.js
new file mode 100644
index 0000000..ca55ccc
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-3116.js
@@ -0,0 +1,314 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function timezone(tz) {
+ var str = (new Date(2014, 0, 10)).toString();
+ if (tz == "CET") {
+ return str == "Fri Jan 10 2014 00:00:00 GMT+0100 (CET)";
+ }
+ if (tz == "BRT") {
+ return str == "Fri Jan 10 2014 00:00:00 GMT-0200 (BRST)";
+ }
+ if (tz == "PST") {
+ return str == "Fri Jan 10 2014 00:00:00 GMT-0800 (PST)";
+ }
+ return false;
+}
+
+if (timezone("CET")) {
+ assertEquals("Sat Mar 29 2014 22:59:00 GMT+0100 (CET)",
+ (new Date(2014, 2, 29, 22, 59)).toString());
+ assertEquals("Sat, 29 Mar 2014 21:59:00 GMT",
+ (new Date(2014, 2, 29, 22, 59)).toUTCString());
+ assertEquals("Sat Mar 29 2014 23:00:00 GMT+0100 (CET)",
+ (new Date(2014, 2, 29, 23, 0)).toString());
+ assertEquals("Sat, 29 Mar 2014 22:00:00 GMT",
+ (new Date(2014, 2, 29, 23, 0)).toUTCString());
+ assertEquals("Sat Mar 29 2014 23:59:00 GMT+0100 (CET)",
+ (new Date(2014, 2, 29, 23, 59)).toString());
+ assertEquals("Sat, 29 Mar 2014 22:59:00 GMT",
+ (new Date(2014, 2, 29, 23, 59)).toUTCString());
+ assertEquals("Sun Mar 30 2014 00:00:00 GMT+0100 (CET)",
+ (new Date(2014, 2, 30, 0, 0)).toString());
+ assertEquals("Sat, 29 Mar 2014 23:00:00 GMT",
+ (new Date(2014, 2, 30, 0, 0)).toUTCString());
+ assertEquals("Sun Mar 30 2014 00:59:00 GMT+0100 (CET)",
+ (new Date(2014, 2, 30, 0, 59)).toString());
+ assertEquals("Sat, 29 Mar 2014 23:59:00 GMT",
+ (new Date(2014, 2, 30, 0, 59)).toUTCString());
+ assertEquals("Sun Mar 30 2014 01:00:00 GMT+0100 (CET)",
+ (new Date(2014, 2, 30, 1, 0)).toString());
+ assertEquals("Sun, 30 Mar 2014 00:00:00 GMT",
+ (new Date(2014, 2, 30, 1, 0)).toUTCString());
+ assertEquals("Sun Mar 30 2014 01:59:00 GMT+0100 (CET)",
+ (new Date(2014, 2, 30, 1, 59)).toString());
+ assertEquals("Sun, 30 Mar 2014 00:59:00 GMT",
+ (new Date(2014, 2, 30, 1, 59)).toUTCString());
+ assertEquals("Sun Mar 30 2014 03:00:00 GMT+0200 (CEST)",
+ (new Date(2014, 2, 30, 2, 0)).toString());
+ assertEquals("Sun, 30 Mar 2014 01:00:00 GMT",
+ (new Date(2014, 2, 30, 2, 0)).toUTCString());
+ assertEquals("Sun Mar 30 2014 03:59:00 GMT+0200 (CEST)",
+ (new Date(2014, 2, 30, 2, 59)).toString());
+ assertEquals("Sun, 30 Mar 2014 01:59:00 GMT",
+ (new Date(2014, 2, 30, 2, 59)).toUTCString());
+ assertEquals("Sun Mar 30 2014 03:00:00 GMT+0200 (CEST)",
+ (new Date(2014, 2, 30, 3, 0)).toString());
+ assertEquals("Sun, 30 Mar 2014 01:00:00 GMT",
+ (new Date(2014, 2, 30, 3, 0)).toUTCString());
+ assertEquals("Sun Mar 30 2014 03:59:00 GMT+0200 (CEST)",
+ (new Date(2014, 2, 30, 3, 59)).toString());
+ assertEquals("Sun, 30 Mar 2014 01:59:00 GMT",
+ (new Date(2014, 2, 30, 3, 59)).toUTCString());
+ assertEquals("Sun Mar 30 2014 04:00:00 GMT+0200 (CEST)",
+ (new Date(2014, 2, 30, 4, 0)).toString());
+ assertEquals("Sun, 30 Mar 2014 02:00:00 GMT",
+ (new Date(2014, 2, 30, 4, 0)).toUTCString());
+ assertEquals("Sat Oct 25 2014 22:59:00 GMT+0200 (CEST)",
+ (new Date(2014, 9, 25, 22, 59)).toString());
+ assertEquals("Sat, 25 Oct 2014 20:59:00 GMT",
+ (new Date(2014, 9, 25, 22, 59)).toUTCString());
+ assertEquals("Sat Oct 25 2014 23:00:00 GMT+0200 (CEST)",
+ (new Date(2014, 9, 25, 23, 0)).toString());
+ assertEquals("Sat, 25 Oct 2014 21:00:00 GMT",
+ (new Date(2014, 9, 25, 23, 0)).toUTCString());
+ assertEquals("Sat Oct 25 2014 23:59:00 GMT+0200 (CEST)",
+ (new Date(2014, 9, 25, 23, 59)).toString());
+ assertEquals("Sat, 25 Oct 2014 21:59:00 GMT",
+ (new Date(2014, 9, 25, 23, 59)).toUTCString());
+ assertEquals("Sun Oct 26 2014 00:00:00 GMT+0200 (CEST)",
+ (new Date(2014, 9, 26, 0, 0)).toString());
+ assertEquals("Sat, 25 Oct 2014 22:00:00 GMT",
+ (new Date(2014, 9, 26, 0, 0)).toUTCString());
+ assertEquals("Sun Oct 26 2014 00:59:00 GMT+0200 (CEST)",
+ (new Date(2014, 9, 26, 0, 59)).toString());
+ assertEquals("Sat, 25 Oct 2014 22:59:00 GMT",
+ (new Date(2014, 9, 26, 0, 59)).toUTCString());
+ assertEquals("Sun Oct 26 2014 01:00:00 GMT+0200 (CEST)",
+ (new Date(2014, 9, 26, 1, 0)).toString());
+ assertEquals("Sat, 25 Oct 2014 23:00:00 GMT",
+ (new Date(2014, 9, 26, 1, 0)).toUTCString());
+ assertEquals("Sun Oct 26 2014 01:59:00 GMT+0200 (CEST)",
+ (new Date(2014, 9, 26, 1, 59)).toString());
+ assertEquals("Sat, 25 Oct 2014 23:59:00 GMT",
+ (new Date(2014, 9, 26, 1, 59)).toUTCString());
+ assertEquals("Sun Oct 26 2014 02:00:00 GMT+0200 (CEST)",
+ (new Date(2014, 9, 26, 2, 0)).toString());
+ assertEquals("Sun, 26 Oct 2014 00:00:00 GMT",
+ (new Date(2014, 9, 26, 2, 0)).toUTCString());
+ assertEquals("Sun Oct 26 2014 02:59:00 GMT+0200 (CEST)",
+ (new Date(2014, 9, 26, 2, 59)).toString());
+ assertEquals("Sun, 26 Oct 2014 00:59:00 GMT",
+ (new Date(2014, 9, 26, 2, 59)).toUTCString());
+ assertEquals("Sun Oct 26 2014 03:00:00 GMT+0100 (CET)",
+ (new Date(2014, 9, 26, 3, 0)).toString());
+ assertEquals("Sun, 26 Oct 2014 02:00:00 GMT",
+ (new Date(2014, 9, 26, 3, 0)).toUTCString());
+ assertEquals("Sun Oct 26 2014 03:59:00 GMT+0100 (CET)",
+ (new Date(2014, 9, 26, 3, 59)).toString());
+ assertEquals("Sun, 26 Oct 2014 02:59:00 GMT",
+ (new Date(2014, 9, 26, 3, 59)).toUTCString());
+ assertEquals("Sun Oct 26 2014 04:00:00 GMT+0100 (CET)",
+ (new Date(2014, 9, 26, 4, 0)).toString());
+ assertEquals("Sun, 26 Oct 2014 03:00:00 GMT",
+ (new Date(2014, 9, 26, 4, 0)).toUTCString());
+}
+
+if (timezone("BRT")) {
+ assertEquals("Sat Oct 18 2014 22:59:00 GMT-0300 (BRT)",
+ (new Date(2014, 9, 18, 22, 59)).toString());
+ assertEquals("Sun, 19 Oct 2014 01:59:00 GMT",
+ (new Date(2014, 9, 18, 22, 59)).toUTCString());
+ assertEquals("Sat Oct 18 2014 23:00:00 GMT-0300 (BRT)",
+ (new Date(2014, 9, 18, 23, 0)).toString());
+ assertEquals("Sun, 19 Oct 2014 02:00:00 GMT",
+ (new Date(2014, 9, 18, 23, 0)).toUTCString());
+ assertEquals("Sat Oct 18 2014 23:59:00 GMT-0300 (BRT)",
+ (new Date(2014, 9, 18, 23, 59)).toString());
+ assertEquals("Sun, 19 Oct 2014 02:59:00 GMT",
+ (new Date(2014, 9, 18, 23, 59)).toUTCString());
+ assertEquals("Sun Oct 19 2014 01:00:00 GMT-0200 (BRST)",
+ (new Date(2014, 9, 19, 0, 0)).toString());
+ assertEquals("Sun, 19 Oct 2014 03:00:00 GMT",
+ (new Date(2014, 9, 19, 0, 0)).toUTCString());
+ assertEquals("Sun Oct 19 2014 01:59:00 GMT-0200 (BRST)",
+ (new Date(2014, 9, 19, 0, 59)).toString());
+ assertEquals("Sun, 19 Oct 2014 03:59:00 GMT",
+ (new Date(2014, 9, 19, 0, 59)).toUTCString());
+ assertEquals("Sun Oct 19 2014 01:00:00 GMT-0200 (BRST)",
+ (new Date(2014, 9, 19, 1, 0)).toString());
+ assertEquals("Sun, 19 Oct 2014 03:00:00 GMT",
+ (new Date(2014, 9, 19, 1, 0)).toUTCString());
+ assertEquals("Sun Oct 19 2014 01:59:00 GMT-0200 (BRST)",
+ (new Date(2014, 9, 19, 1, 59)).toString());
+ assertEquals("Sun, 19 Oct 2014 03:59:00 GMT",
+ (new Date(2014, 9, 19, 1, 59)).toUTCString());
+ assertEquals("Sun Oct 19 2014 02:00:00 GMT-0200 (BRST)",
+ (new Date(2014, 9, 19, 2, 0)).toString());
+ assertEquals("Sun, 19 Oct 2014 04:00:00 GMT",
+ (new Date(2014, 9, 19, 2, 0)).toUTCString());
+ assertEquals("Sun Oct 19 2014 02:59:00 GMT-0200 (BRST)",
+ (new Date(2014, 9, 19, 2, 59)).toString());
+ assertEquals("Sun, 19 Oct 2014 04:59:00 GMT",
+ (new Date(2014, 9, 19, 2, 59)).toUTCString());
+ assertEquals("Sun Oct 19 2014 03:00:00 GMT-0200 (BRST)",
+ (new Date(2014, 9, 19, 3, 0)).toString());
+ assertEquals("Sun, 19 Oct 2014 05:00:00 GMT",
+ (new Date(2014, 9, 19, 3, 0)).toUTCString());
+ assertEquals("Sun Oct 19 2014 03:59:00 GMT-0200 (BRST)",
+ (new Date(2014, 9, 19, 3, 59)).toString());
+ assertEquals("Sun, 19 Oct 2014 05:59:00 GMT",
+ (new Date(2014, 9, 19, 3, 59)).toUTCString());
+ assertEquals("Sun Oct 19 2014 04:00:00 GMT-0200 (BRST)",
+ (new Date(2014, 9, 19, 4, 0)).toString());
+ assertEquals("Sun, 19 Oct 2014 06:00:00 GMT",
+ (new Date(2014, 9, 19, 4, 0)).toUTCString());
+ assertEquals("Sat Feb 15 2014 22:59:00 GMT-0200 (BRST)",
+ (new Date(2014, 1, 15, 22, 59)).toString());
+ assertEquals("Sun, 16 Feb 2014 00:59:00 GMT",
+ (new Date(2014, 1, 15, 22, 59)).toUTCString());
+ assertEquals("Sat Feb 15 2014 23:00:00 GMT-0200 (BRST)",
+ (new Date(2014, 1, 15, 23, 0)).toString());
+ assertEquals("Sun, 16 Feb 2014 01:00:00 GMT",
+ (new Date(2014, 1, 15, 23, 0)).toUTCString());
+ assertEquals("Sat Feb 15 2014 23:59:00 GMT-0200 (BRST)",
+ (new Date(2014, 1, 15, 23, 59)).toString());
+ assertEquals("Sun, 16 Feb 2014 01:59:00 GMT",
+ (new Date(2014, 1, 15, 23, 59)).toUTCString());
+ assertEquals("Sun Feb 16 2014 00:00:00 GMT-0300 (BRT)",
+ (new Date(2014, 1, 16, 0, 0)).toString());
+ assertEquals("Sun, 16 Feb 2014 03:00:00 GMT",
+ (new Date(2014, 1, 16, 0, 0)).toUTCString());
+ assertEquals("Sun Feb 16 2014 00:59:00 GMT-0300 (BRT)",
+ (new Date(2014, 1, 16, 0, 59)).toString());
+ assertEquals("Sun, 16 Feb 2014 03:59:00 GMT",
+ (new Date(2014, 1, 16, 0, 59)).toUTCString());
+ assertEquals("Sun Feb 16 2014 01:00:00 GMT-0300 (BRT)",
+ (new Date(2014, 1, 16, 1, 0)).toString());
+ assertEquals("Sun, 16 Feb 2014 04:00:00 GMT",
+ (new Date(2014, 1, 16, 1, 0)).toUTCString());
+ assertEquals("Sun Feb 16 2014 01:59:00 GMT-0300 (BRT)",
+ (new Date(2014, 1, 16, 1, 59)).toString());
+ assertEquals("Sun, 16 Feb 2014 04:59:00 GMT",
+ (new Date(2014, 1, 16, 1, 59)).toUTCString());
+ assertEquals("Sun Feb 16 2014 02:00:00 GMT-0300 (BRT)",
+ (new Date(2014, 1, 16, 2, 0)).toString());
+ assertEquals("Sun, 16 Feb 2014 05:00:00 GMT",
+ (new Date(2014, 1, 16, 2, 0)).toUTCString());
+ assertEquals("Sun Feb 16 2014 02:59:00 GMT-0300 (BRT)",
+ (new Date(2014, 1, 16, 2, 59)).toString());
+ assertEquals("Sun, 16 Feb 2014 05:59:00 GMT",
+ (new Date(2014, 1, 16, 2, 59)).toUTCString());
+ assertEquals("Sun Feb 16 2014 03:00:00 GMT-0300 (BRT)",
+ (new Date(2014, 1, 16, 3, 0)).toString());
+ assertEquals("Sun, 16 Feb 2014 06:00:00 GMT",
+ (new Date(2014, 1, 16, 3, 0)).toUTCString());
+ assertEquals("Sun Feb 16 2014 03:59:00 GMT-0300 (BRT)",
+ (new Date(2014, 1, 16, 3, 59)).toString());
+ assertEquals("Sun, 16 Feb 2014 06:59:00 GMT",
+ (new Date(2014, 1, 16, 3, 59)).toUTCString());
+ assertEquals("Sun Feb 16 2014 04:00:00 GMT-0300 (BRT)",
+ (new Date(2014, 1, 16, 4, 0)).toString());
+ assertEquals("Sun, 16 Feb 2014 07:00:00 GMT",
+ (new Date(2014, 1, 16, 4, 0)).toUTCString());
+}
+
+if (timezone("PST")) {
+ assertEquals("Sat Mar 08 2014 22:59:00 GMT-0800 (PST)",
+ (new Date(2014, 2, 8, 22, 59)).toString());
+ assertEquals("Sun, 09 Mar 2014 06:59:00 GMT",
+ (new Date(2014, 2, 8, 22, 59)).toUTCString());
+ assertEquals("Sat Mar 08 2014 23:00:00 GMT-0800 (PST)",
+ (new Date(2014, 2, 8, 23, 0)).toString());
+ assertEquals("Sun, 09 Mar 2014 07:00:00 GMT",
+ (new Date(2014, 2, 8, 23, 0)).toUTCString());
+ assertEquals("Sat Mar 08 2014 23:59:00 GMT-0800 (PST)",
+ (new Date(2014, 2, 8, 23, 59)).toString());
+ assertEquals("Sun, 09 Mar 2014 07:59:00 GMT",
+ (new Date(2014, 2, 8, 23, 59)).toUTCString());
+ assertEquals("Sun Mar 09 2014 00:00:00 GMT-0800 (PST)",
+ (new Date(2014, 2, 9, 0, 0)).toString());
+ assertEquals("Sun, 09 Mar 2014 08:00:00 GMT",
+ (new Date(2014, 2, 9, 0, 0)).toUTCString());
+ assertEquals("Sun Mar 09 2014 00:59:00 GMT-0800 (PST)",
+ (new Date(2014, 2, 9, 0, 59)).toString());
+ assertEquals("Sun, 09 Mar 2014 08:59:00 GMT",
+ (new Date(2014, 2, 9, 0, 59)).toUTCString());
+ assertEquals("Sun Mar 09 2014 01:00:00 GMT-0800 (PST)",
+ (new Date(2014, 2, 9, 1, 0)).toString());
+ assertEquals("Sun, 09 Mar 2014 09:00:00 GMT",
+ (new Date(2014, 2, 9, 1, 0)).toUTCString());
+ assertEquals("Sun Mar 09 2014 01:59:00 GMT-0800 (PST)",
+ (new Date(2014, 2, 9, 1, 59)).toString());
+ assertEquals("Sun, 09 Mar 2014 09:59:00 GMT",
+ (new Date(2014, 2, 9, 1, 59)).toUTCString());
+ assertEquals("Sun Mar 09 2014 03:00:00 GMT-0700 (PDT)",
+ (new Date(2014, 2, 9, 2, 0)).toString());
+ assertEquals("Sun, 09 Mar 2014 10:00:00 GMT",
+ (new Date(2014, 2, 9, 2, 0)).toUTCString());
+ assertEquals("Sun Mar 09 2014 03:59:00 GMT-0700 (PDT)",
+ (new Date(2014, 2, 9, 2, 59)).toString());
+ assertEquals("Sun, 09 Mar 2014 10:59:00 GMT",
+ (new Date(2014, 2, 9, 2, 59)).toUTCString());
+ assertEquals("Sun Mar 09 2014 03:00:00 GMT-0700 (PDT)",
+ (new Date(2014, 2, 9, 3, 0)).toString());
+ assertEquals("Sun, 09 Mar 2014 10:00:00 GMT",
+ (new Date(2014, 2, 9, 3, 0)).toUTCString());
+ assertEquals("Sun Mar 09 2014 03:59:00 GMT-0700 (PDT)",
+ (new Date(2014, 2, 9, 3, 59)).toString());
+ assertEquals("Sun, 09 Mar 2014 10:59:00 GMT",
+ (new Date(2014, 2, 9, 3, 59)).toUTCString());
+ assertEquals("Sun Mar 09 2014 04:00:00 GMT-0700 (PDT)",
+ (new Date(2014, 2, 9, 4, 0)).toString());
+ assertEquals("Sun, 09 Mar 2014 11:00:00 GMT",
+ (new Date(2014, 2, 9, 4, 0)).toUTCString());
+ assertEquals("Sat Nov 01 2014 22:59:00 GMT-0700 (PDT)",
+ (new Date(2014, 10, 1, 22, 59)).toString());
+ assertEquals("Sun, 02 Nov 2014 05:59:00 GMT",
+ (new Date(2014, 10, 1, 22, 59)).toUTCString());
+ assertEquals("Sat Nov 01 2014 23:00:00 GMT-0700 (PDT)",
+ (new Date(2014, 10, 1, 23, 0)).toString());
+ assertEquals("Sun, 02 Nov 2014 06:00:00 GMT",
+ (new Date(2014, 10, 1, 23, 0)).toUTCString());
+ assertEquals("Sat Nov 01 2014 23:59:00 GMT-0700 (PDT)",
+ (new Date(2014, 10, 1, 23, 59)).toString());
+ assertEquals("Sun, 02 Nov 2014 06:59:00 GMT",
+ (new Date(2014, 10, 1, 23, 59)).toUTCString());
+ assertEquals("Sun Nov 02 2014 00:00:00 GMT-0700 (PDT)",
+ (new Date(2014, 10, 2, 0, 0)).toString());
+ assertEquals("Sun, 02 Nov 2014 07:00:00 GMT",
+ (new Date(2014, 10, 2, 0, 0)).toUTCString());
+ assertEquals("Sun Nov 02 2014 00:59:00 GMT-0700 (PDT)",
+ (new Date(2014, 10, 2, 0, 59)).toString());
+ assertEquals("Sun, 02 Nov 2014 07:59:00 GMT",
+ (new Date(2014, 10, 2, 0, 59)).toUTCString());
+ assertEquals("Sun Nov 02 2014 01:00:00 GMT-0700 (PDT)",
+ (new Date(2014, 10, 2, 1, 0)).toString());
+ assertEquals("Sun, 02 Nov 2014 08:00:00 GMT",
+ (new Date(2014, 10, 2, 1, 0)).toUTCString());
+ assertEquals("Sun Nov 02 2014 01:59:00 GMT-0700 (PDT)",
+ (new Date(2014, 10, 2, 1, 59)).toString());
+ assertEquals("Sun, 02 Nov 2014 08:59:00 GMT",
+ (new Date(2014, 10, 2, 1, 59)).toUTCString());
+ assertEquals("Sun Nov 02 2014 02:00:00 GMT-0800 (PST)",
+ (new Date(2014, 10, 2, 2, 0)).toString());
+ assertEquals("Sun, 02 Nov 2014 10:00:00 GMT",
+ (new Date(2014, 10, 2, 2, 0)).toUTCString());
+ assertEquals("Sun Nov 02 2014 02:59:00 GMT-0800 (PST)",
+ (new Date(2014, 10, 2, 2, 59)).toString());
+ assertEquals("Sun, 02 Nov 2014 10:59:00 GMT",
+ (new Date(2014, 10, 2, 2, 59)).toUTCString());
+ assertEquals("Sun Nov 02 2014 03:00:00 GMT-0800 (PST)",
+ (new Date(2014, 10, 2, 3, 0)).toString());
+ assertEquals("Sun, 02 Nov 2014 11:00:00 GMT",
+ (new Date(2014, 10, 2, 3, 0)).toUTCString());
+ assertEquals("Sun Nov 02 2014 03:59:00 GMT-0800 (PST)",
+ (new Date(2014, 10, 2, 3, 59)).toString());
+ assertEquals("Sun, 02 Nov 2014 11:59:00 GMT",
+ (new Date(2014, 10, 2, 3, 59)).toUTCString());
+ assertEquals("Sun Nov 02 2014 04:00:00 GMT-0800 (PST)",
+ (new Date(2014, 10, 2, 4, 0)).toString());
+ assertEquals("Sun, 02 Nov 2014 12:00:00 GMT",
+ (new Date(2014, 10, 2, 4, 0)).toUTCString());
+}
diff --git a/src/v8/test/mjsunit/regress/regress-312.js b/src/v8/test/mjsunit/regress/regress-312.js
new file mode 100644
index 0000000..0fb8c21
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-312.js
@@ -0,0 +1,31 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Should not trigger debug ASSERT.
+// See http://code.google.com/p/v8/issues/detail?id=312
+
+var o = { f: "x" ? function () {} : function () {} };
diff --git a/src/v8/test/mjsunit/regress/regress-3135.js b/src/v8/test/mjsunit/regress/regress-3135.js
new file mode 100644
index 0000000..f15c9a8
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-3135.js
@@ -0,0 +1,73 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Properties are serialized once.
+assertEquals('{"x":1}', JSON.stringify({ x : 1 }, ["x", 1, "x", 1]));
+assertEquals('{"1":1}', JSON.stringify({ 1 : 1 }, ["x", 1, "x", 1]));
+assertEquals('{"1":1}', JSON.stringify({ 1 : 1 }, ["1", 1, "1", 1]));
+assertEquals('{"1":1}', JSON.stringify({ 1 : 1 }, [1, "1", 1, "1"]));
+
+// Properties are visited at most once.
+var fired = 0;
+var getter_obj = { get x() { fired++; return 2; } };
+assertEquals('{"x":2}', JSON.stringify(getter_obj, ["x", "y", "x"]));
+assertEquals(1, fired);
+
+// Order of the replacer array is followed.
+assertEquals('{"y":4,"x":3}', JSON.stringify({ x : 3, y : 4}, ["y", "x"]));
+assertEquals('{"y":4,"1":2,"x":3}',
+ JSON.stringify({ x : 3, y : 4, 1 : 2 }, ["y", 1, "x"]));
+
+// With a replacer array the value of the property is retrieved using [[Get]]
+// ignoring own and enumerability.
+var a = { x : 8 };
+assertEquals('{"__proto__":{"__proto__":null},"x":8}',
+ JSON.stringify(a, ["__proto__", "x", "__proto__"]));
+a.__proto__ = { x : 7 };
+assertEquals('{"__proto__":{"__proto__":{"__proto__":null},"x":7},"x":8}',
+ JSON.stringify(a, ["__proto__", "x"]));
+var b = { __proto__: { x: 9 } };
+assertEquals('{}', JSON.stringify(b));
+assertEquals('{"x":9}', JSON.stringify(b, ["x"]));
+var c = {x: 10};
+Object.defineProperty(c, 'x', { enumerable: false });
+assertEquals('{}', JSON.stringify(c));
+assertEquals('{"x":10}', JSON.stringify(c, ["x"]));
+
+// Arrays are not affected by the replacer array.
+assertEquals("[9,8,7]", JSON.stringify([9, 8, 7], [1, 1]));
+var mixed_arr = [11,12,13];
+mixed_arr.x = 10;
+assertEquals('[11,12,13]', JSON.stringify(mixed_arr, [1, 0, 1]));
+
+// Array elements of objects are affected.
+var mixed_obj = { x : 3 };
+mixed_obj[0] = 6;
+mixed_obj[1] = 5;
+assertEquals('{"1":5,"0":6}', JSON.stringify(mixed_obj, [1, 0, 1]));
+
+// Nested object.
+assertEquals('{"z":{"x":3},"x":1}',
+ JSON.stringify({ x: 1, y:2, z: {x:3, b:4}}, ["z","x"]));
+
+// Objects in the replacer array are ignored.
+assertEquals('{}',
+ JSON.stringify({ x : 1, "1": 1 }, [{}]));
+assertEquals('{}',
+ JSON.stringify({ x : 1, "1": 1 }, [true, undefined, null]));
+assertEquals('{}',
+ JSON.stringify({ x : 1, "1": 1 },
+ [{ toString: function() { return "x";} }]));
+assertEquals('{}',
+ JSON.stringify({ x : 1, "1": 1 },
+ [{ valueOf: function() { return 1;} }]));
+
+// Make sure that property names that clash with the names of Object.prototype
+// still works.
+assertEquals('{"toString":42}', JSON.stringify({ toString: 42 }, ["toString"]));
+
+// Number wrappers and String wrappers should be unwrapped.
+assertEquals('{"1":1,"s":"s"}',
+ JSON.stringify({ 1: 1, s: "s" },
+ [new Number(1), new String("s")]));
diff --git a/src/v8/test/mjsunit/regress/regress-3138.js b/src/v8/test/mjsunit/regress/regress-3138.js
new file mode 100644
index 0000000..4f607ed
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-3138.js
@@ -0,0 +1,30 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(function f(){
+ assertEquals("function", typeof f);
+})();
+
+(function f(){
+ var f; // Variable shadows function name.
+ assertEquals("undefined", typeof f);
+})();
+
+(function f(){
+ var f;
+ assertEquals("undefined", typeof f);
+ with ({}); // Force context allocation of both variable and function name.
+})();
+
+assertEquals("undefined", typeof f);
+
+// var initialization is intercepted by with scope.
+(function() {
+ var o = { a: 1 };
+ with (o) {
+ var a = 2;
+ }
+ assertEquals("undefined", typeof a);
+ assertEquals(2, o.a);
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-3158.js b/src/v8/test/mjsunit/regress/regress-3158.js
new file mode 100644
index 0000000..c691273
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-3158.js
@@ -0,0 +1,24 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax
+
+Array.prototype[0] = 'a';
+delete Array.prototype[0];
+
+function foo(a, i) {
+ return a[i];
+}
+
+var a = new Array(100000);
+a[3] = 'x';
+
+foo(a, 3);
+foo(a, 3);
+foo(a, 3);
+%OptimizeFunctionOnNextCall(foo);
+foo(a, 3);
+Array.prototype[0] = 'a';
+var z = foo(a, 0);
+assertEquals('a', z);
diff --git a/src/v8/test/mjsunit/regress/regress-3159.js b/src/v8/test/mjsunit/regress/regress-3159.js
new file mode 100644
index 0000000..cfc8a39
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-3159.js
@@ -0,0 +1,10 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+try {
+ new Uint32Array(new ArrayBuffer(1), 2, 3);
+} catch (e) {
+ assertEquals("start offset of Uint32Array should be a multiple of 4",
+ e.message);
+}
diff --git a/src/v8/test/mjsunit/regress/regress-317.js b/src/v8/test/mjsunit/regress/regress-317.js
new file mode 100644
index 0000000..85f408b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-317.js
@@ -0,0 +1,30 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Ensure replacement with string allows $ in replacement string.
+
+assertEquals("a$ec", "abc".replace("b", "$e"), "$e isn't meaningful");
diff --git a/src/v8/test/mjsunit/regress/regress-3176.js b/src/v8/test/mjsunit/regress/regress-3176.js
new file mode 100644
index 0000000..dbfe821
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-3176.js
@@ -0,0 +1,28 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+function foo(a) {
+ var sum = 0;
+ for (var i = 0; i < 10; i++) {
+ sum += a[i];
+
+ if (i > 6) {
+ sum -= a[i - 4];
+ sum -= a[i - 5];
+ }
+ }
+ return sum;
+}
+
+var a = new Int32Array(10);
+
+foo(a);
+foo(a);
+%OptimizeFunctionOnNextCall(foo);
+foo(a);
+%OptimizeFunctionOnNextCall(foo);
+foo(a);
+assertOptimized(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-318.js b/src/v8/test/mjsunit/regress/regress-318.js
new file mode 100644
index 0000000..e94f1cb
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-318.js
@@ -0,0 +1,35 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Should not crash or raise an exception.
+
+function test(value) {
+ if (typeof(value) == 'boolean') value = value + '';
+ if (typeof(value) == 'number') value = value + '';
+}
+
+assertDoesNotThrow('test(0)');
diff --git a/src/v8/test/mjsunit/regress/regress-3183.js b/src/v8/test/mjsunit/regress/regress-3183.js
new file mode 100644
index 0000000..4551621
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-3183.js
@@ -0,0 +1,96 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+(function DeoptimizeArgCallFunctionGeneric() {
+ var a = [];
+
+ function f1(method, array, elem, deopt) {
+ assertEquals('push', method);
+ }
+
+ function f2() { }
+
+ function bar(x, deopt, f) {
+ f('push', a, [x], deopt + 0);
+ }
+
+ function foo() { return bar(arguments[0], arguments[1], arguments[2]); }
+ function baz(f, deopt) { return foo("x", deopt, f); }
+
+ baz(f1, 0);
+ baz(f2, 0);
+ %OptimizeFunctionOnNextCall(baz);
+ baz(f1, "deopt");
+})();
+
+
+(function DeoptimizeArgGlobalFunctionGeneric() {
+ var a = [];
+
+ var f1;
+
+ f1 = function(method, array, elem, deopt) {
+ assertEquals('push', method);
+ }
+
+ function bar(x, deopt, f) {
+ f1('push', a, [x], deopt + 0);
+ }
+
+ function foo() { return bar(arguments[0], arguments[1]); }
+ function baz(deopt) { return foo("x", deopt); }
+
+ baz(0);
+ baz(0);
+ %OptimizeFunctionOnNextCall(baz);
+ baz("deopt");
+})();
+
+
+(function DeoptimizeArgCallFunctionRuntime() {
+ var a = [];
+
+ var f1;
+
+ f1 = function(method, array, elem, deopt) {
+ assertEquals('push', method);
+ }
+
+ function bar(x, deopt) {
+ %_Call(f1, null, 'push', [x][0], ((deopt + 0), 1));
+ }
+
+ function foo() { return bar(arguments[0], arguments[1]); }
+ function baz(deopt) { return foo(0, deopt); }
+
+ baz(0);
+ baz(0);
+ %OptimizeFunctionOnNextCall(baz);
+ baz("deopt");
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-318420.js b/src/v8/test/mjsunit/regress/regress-318420.js
new file mode 100644
index 0000000..77bef10
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-318420.js
@@ -0,0 +1,46 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function bar(a, b) { with(a) {return a + b;} }
+
+var obj = {
+ functions: [bar, bar, bar, bar],
+ receivers: [bar, bar, undefined, null],
+ foo: function () {
+ for (var a = this.functions, e = this.receivers, c = a.length,
+ d = 0; d < c ; d++) {
+ a[d].apply(e[d], arguments)
+ }
+ }
+}
+
+obj.foo(1, 2, 3, 4);
+obj.foo(1, 2, 3, 4);
+%OptimizeFunctionOnNextCall(obj.foo);
+obj.foo(1, 2, 3, 4);
diff --git a/src/v8/test/mjsunit/regress/regress-3185905.js b/src/v8/test/mjsunit/regress/regress-3185905.js
new file mode 100644
index 0000000..bd611ab
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-3185905.js
@@ -0,0 +1,60 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function test1(x) {
+ var a = arguments.callee;
+ x = 1;
+ x = 2;
+ assertEquals(2, x);
+}
+test1(0)
+
+function test2(x) {
+ var a = arguments.callee;
+ x++;
+ x++;
+ assertEquals(2, x);
+}
+test2(0)
+
+function test3(x) {
+ var a = arguments.callee;
+ x += 1;
+ x += 1;
+ assertEquals(2, x);
+}
+test3(0)
+
+function test4(x) {
+ var arguments = { 0 : 3, 'x' : 4 };
+ x += 1;
+ x += 1;
+ assertEquals(2, x);
+ assertEquals(3, arguments[0])
+ assertEquals(4, arguments['x'])
+}
+test4(0)
diff --git a/src/v8/test/mjsunit/regress/regress-319722-ArrayBuffer.js b/src/v8/test/mjsunit/regress/regress-319722-ArrayBuffer.js
new file mode 100644
index 0000000..9a24fc5
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-319722-ArrayBuffer.js
@@ -0,0 +1,57 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --nostress-opt --allow-natives-syntax --mock-arraybuffer-allocator
+var maxSize = %_MaxSmi() + 1;
+var ab;
+
+// Allocate the largest ArrayBuffer we can on this architecture.
+for (k = 8; k >= 1 && ab == null; k = k/2) {
+ try {
+ ab = new ArrayBuffer(maxSize * k);
+ } catch (e) {
+ ab = null;
+ }
+}
+
+assertTrue(ab != null);
+
+function TestArray(constr) {
+ assertThrows(function() {
+ new constr(ab, 0, maxSize);
+ }, RangeError);
+}
+
+TestArray(Uint8Array);
+TestArray(Int8Array);
+TestArray(Uint16Array);
+TestArray(Int16Array);
+TestArray(Uint32Array);
+TestArray(Int32Array);
+TestArray(Float32Array);
+TestArray(Float64Array);
+TestArray(Uint8ClampedArray);
diff --git a/src/v8/test/mjsunit/regress/regress-319722-TypedArrays.js b/src/v8/test/mjsunit/regress/regress-319722-TypedArrays.js
new file mode 100644
index 0000000..e497aec
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-319722-TypedArrays.js
@@ -0,0 +1,45 @@
+
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --nostress-opt --allow-natives-syntax
+var maxSize = %_MaxSmi() + 1;
+function TestArray(constr) {
+ assertThrows(function() {
+ new constr(maxSize);
+ }, RangeError);
+}
+
+TestArray(Uint8Array);
+TestArray(Int8Array);
+TestArray(Uint16Array);
+TestArray(Int16Array);
+TestArray(Uint32Array);
+TestArray(Int32Array);
+TestArray(Float32Array);
+TestArray(Float64Array);
+TestArray(Uint8ClampedArray);
diff --git a/src/v8/test/mjsunit/regress/regress-3199913.js b/src/v8/test/mjsunit/regress/regress-3199913.js
new file mode 100644
index 0000000..e202af1
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-3199913.js
@@ -0,0 +1,44 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test that bailout during evaluation of the key for a keyed call works as
+// intended.
+
+var y = {
+ 'a' : function (x, y) { return 'called a(' + x + ', ' + y + ')' },
+ 'b' : function (x, y) { return 'called b(' + x + ', ' + y + ')' }
+}
+
+function C() {
+}
+
+C.prototype.f = function () {
+ return y[(this.a == 1 ? "a" : "b")](0, 1);
+}
+
+obj = new C()
+assertEquals('called b(0, 1)', obj.f())
diff --git a/src/v8/test/mjsunit/regress/regress-3204.js b/src/v8/test/mjsunit/regress/regress-3204.js
new file mode 100644
index 0000000..b3161be
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-3204.js
@@ -0,0 +1,42 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// -----------------------------------------------------------------------------
+
+function SmiTaggingCanOverflow(x) {
+ x = x | 0;
+ if (x == 0) return;
+ return x;
+}
+
+SmiTaggingCanOverflow(2147483647);
+SmiTaggingCanOverflow(2147483647);
+%OptimizeFunctionOnNextCall(SmiTaggingCanOverflow);
+assertEquals(2147483647, SmiTaggingCanOverflow(2147483647));
+
+// -----------------------------------------------------------------------------
+
+function ModILeftCanBeNegative() {
+ var x = 0;
+ for (var i = -1; i < 0; ++i) x = i % 2;
+ return x;
+}
+
+ModILeftCanBeNegative();
+%OptimizeFunctionOnNextCall(ModILeftCanBeNegative);
+assertEquals(-1, ModILeftCanBeNegative());
+
+// -----------------------------------------------------------------------------
+
+function ModIRightCanBeZero() {
+ var x = 0;
+ for (var i = -1; i <= 0; ++i) x = (2 % i) | 0;
+ return x;
+}
+
+ModIRightCanBeZero();
+%OptimizeFunctionOnNextCall(ModIRightCanBeZero);
+ModIRightCanBeZero();
diff --git a/src/v8/test/mjsunit/regress/regress-320532.js b/src/v8/test/mjsunit/regress/regress-320532.js
new file mode 100644
index 0000000..7559550
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-320532.js
@@ -0,0 +1,41 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+//
+// Flags: --allow-natives-syntax --expose-gc
+// Flags: --stress-runs=8 --send-idle-notification --gc-global
+
+
+function bar() { return new Array(); }
+bar();
+bar();
+%OptimizeFunctionOnNextCall(bar);
+a = bar();
+function foo(len) { return new Array(len); }
+foo(0);
+foo(0);
+%OptimizeFunctionOnNextCall(bar);
+foo(0);
diff --git a/src/v8/test/mjsunit/regress/regress-3218530.js b/src/v8/test/mjsunit/regress/regress-3218530.js
new file mode 100644
index 0000000..247f3df
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-3218530.js
@@ -0,0 +1,39 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// This tests that a global key values are preserved when used in
+// an expression which will bail out.
+
+var m = Math;
+var p = "floor";
+
+function test() {
+ var bignumber = 31363200000;
+ assertDoesNotThrow(assertEquals(m[p](Math.round(bignumber/864E5)/7)+1, 52));
+}
+
+test();
diff --git a/src/v8/test/mjsunit/regress/regress-3218915.js b/src/v8/test/mjsunit/regress/regress-3218915.js
new file mode 100644
index 0000000..4b08a6e
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-3218915.js
@@ -0,0 +1,46 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// Checks that comma expression in conditional context is processed correctly.
+
+function withCommaExpressionInConditional(x) {
+ if (x > 1000) { for (var i = 0; i < 10000; i++) { } }
+ var y;
+ if (y = x, y > 1) {
+ return 'big';
+ }
+ return (y = x + 1, y > 1) ? 'medium' : 'small';
+}
+
+for (var i = 0; i < 5; i++) {
+ withCommaExpressionInConditional(i);
+}
+%OptimizeFunctionOnNextCall(withCommaExpressionInConditional);
+withCommaExpressionInConditional(i);
+withCommaExpressionInConditional("1")
diff --git a/src/v8/test/mjsunit/regress/regress-3220.js b/src/v8/test/mjsunit/regress/regress-3220.js
new file mode 100644
index 0000000..6f8e8c8
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-3220.js
@@ -0,0 +1,30 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --use-strict
+
+String(new Date());
diff --git a/src/v8/test/mjsunit/regress/regress-3229.js b/src/v8/test/mjsunit/regress/regress-3229.js
new file mode 100644
index 0000000..53e14cd
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-3229.js
@@ -0,0 +1,25 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Escape '/'.
+function testEscapes(expected, regexp) {
+ assertEquals(expected, regexp.source);
+ assertEquals("/" + expected + "/", regexp.toString());
+}
+
+testEscapes("\\/", /\//);
+testEscapes("\\/\\/", /\/\//);
+testEscapes("\\/", new RegExp("/"));
+testEscapes("\\/", new RegExp("\\/"));
+testEscapes("\\\\\\/", new RegExp("\\\\/"));
+testEscapes("\\/\\/", new RegExp("\\/\\/"));
+testEscapes("\\/\\/\\/\\/", new RegExp("////"));
+testEscapes("\\/\\/\\/\\/", new RegExp("\\//\\//"));
+testEscapes("(?:)", new RegExp(""));
+
+// Read-only property.
+var r = /\/\//;
+testEscapes("\\/\\/", r);
+r.source = "garbage";
+testEscapes("\\/\\/", r);
diff --git a/src/v8/test/mjsunit/regress/regress-3230771.js b/src/v8/test/mjsunit/regress/regress-3230771.js
new file mode 100644
index 0000000..bd00798
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-3230771.js
@@ -0,0 +1,35 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Regression test for missing stack-overflow check in
+// VisitForStatement in hydrogen graph building.
+
+function f() {
+ for (var h = typeof arguments[0] == "object" ? 0 : arguments; false; ) { }
+}
+
+f();
diff --git a/src/v8/test/mjsunit/regress/regress-323845.js b/src/v8/test/mjsunit/regress/regress-323845.js
new file mode 100644
index 0000000..4e81657
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-323845.js
@@ -0,0 +1,47 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Regression test that breaks escape analysis because objects escape over
+// the arguments object.
+
+// Flags: --allow-natives-syntax
+
+function h() {
+ g.arguments;
+}
+
+function g(x) {
+ h();
+}
+
+function f() {
+ g({});
+}
+
+f(); f(); f();
+%OptimizeFunctionOnNextCall(f);
+f();
diff --git a/src/v8/test/mjsunit/regress/regress-324028.js b/src/v8/test/mjsunit/regress/regress-324028.js
new file mode 100644
index 0000000..7fe0fcd
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-324028.js
@@ -0,0 +1,38 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var badObj = { length : 1e40 };
+
+assertThrows(function() { new Uint8Array(badObj); }, RangeError);
+assertThrows(function() { new Uint8ClampedArray(badObj); }, RangeError);
+assertThrows(function() { new Int8Array(badObj); }, RangeError);
+assertThrows(function() { new Uint16Array(badObj); }, RangeError);
+assertThrows(function() { new Int16Array(badObj); }, RangeError);
+assertThrows(function() { new Uint32Array(badObj); }, RangeError);
+assertThrows(function() { new Int32Array(badObj); }, RangeError);
+assertThrows(function() { new Float32Array(badObj); }, RangeError);
+assertThrows(function() { new Float64Array(badObj); }, RangeError);
diff --git a/src/v8/test/mjsunit/regress/regress-3247124.js b/src/v8/test/mjsunit/regress/regress-3247124.js
new file mode 100644
index 0000000..fe4ec4e
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-3247124.js
@@ -0,0 +1,53 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var foo = unescape("%E0%E2%EA%F4%FB%E3%F5%E1%E9%ED%F3%FA%E7%FC%C0%C2%CA%D4%DB%C3%D5%C1%C9%CD%D3%DA%C7%DC");
+
+function bar(x) {
+ var s = new String(x);
+ var a = new String(foo);
+ var b = new String('aaeouaoaeioucuAAEOUAOAEIOUCU');
+
+ var i = new Number();
+ var j = new Number();
+ var c = new String();
+ var r = '';
+
+ for (i = 0; i < s.length; i++) {
+ c = s.substring(i, i + 1);
+ for (j = 0; j < a.length; j++) {
+ if (a.substring(j, j + 1) == c) {
+ c = b.substring(j, j + 1);
+ }
+ }
+ r += c;
+ }
+
+ return r.toLowerCase();
+}
+
+for (var i = 0; i < 100; i++) bar(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-3252443.js b/src/v8/test/mjsunit/regress/regress-3252443.js
new file mode 100644
index 0000000..cd7aa40
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-3252443.js
@@ -0,0 +1,45 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var document = new Object();
+document.getElementById = function(s) { return { style: {}}};
+function x(p0, p1, p2, p3) {
+ document.getElementById(p1+p0).style.display='';
+ document.getElementById(p1+''+p0).style.backgroundColor = "";
+ document.getElementById(p1+''+p0).style.color="";
+ document.getElementById(p1+''+p0).style.borderBottomColor = "";
+ for (var i = p3; i <= p2; ++i) {
+ if (i != p0) {
+ document.getElementById(p1+i).style.display='';
+ document.getElementById(p1+''+i).style.backgroundColor = "";
+ document.getElementById(p1+''+i).style.color="";
+ document.getElementById(p1+''+i).style.borderBottomColor = "";
+ }
+ }
+}
+
+x(1, "xxx", 10000, 1)
diff --git a/src/v8/test/mjsunit/regress/regress-3255.js b/src/v8/test/mjsunit/regress/regress-3255.js
new file mode 100644
index 0000000..0e77435
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-3255.js
@@ -0,0 +1,19 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --enable-slow-asserts
+
+var arr = [];
+var str = new String('x');
+
+function f(a,b) {
+ a[b] = 1;
+}
+
+f(arr, 0);
+f(str, 0);
+f(str, 0);
+
+// This is just to trigger elements validation, object already broken.
+%SetProperty(str, 1, 'y', 0);
diff --git a/src/v8/test/mjsunit/regress/regress-326.js b/src/v8/test/mjsunit/regress/regress-326.js
new file mode 100644
index 0000000..fcd102e
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-326.js
@@ -0,0 +1,40 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Should not crash or raise an exception.
+// Should sort non-array into equivalent of [37,42,undefined,,0]
+
+var nonArray = { length: 4, 0: 42, 2: 37, 3: undefined, 4: 0 };
+Array.prototype.sort.call(nonArray);
+
+assertEquals(4, nonArray.length, "preserve length");
+assertEquals(37, nonArray[0], "sort smallest first");
+assertEquals(42, nonArray[1], "sort largest last");
+assertTrue(2 in nonArray, "don't delete undefined");
+assertEquals(undefined, nonArray[2], "sort undefined after largest");
+assertFalse(3 in nonArray, "don't create non-existing");
+assertEquals(0, nonArray[4], "don't affect after length.");
diff --git a/src/v8/test/mjsunit/regress/regress-3294.js b/src/v8/test/mjsunit/regress/regress-3294.js
new file mode 100644
index 0000000..400e6b6
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-3294.js
@@ -0,0 +1,8 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var e = new Error('message');
+var keys = Object.keys(e);
+e.stack;
+assertEquals(keys, Object.keys(e));
diff --git a/src/v8/test/mjsunit/regress/regress-330046.js b/src/v8/test/mjsunit/regress/regress-330046.js
new file mode 100644
index 0000000..24557b4
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-330046.js
@@ -0,0 +1,61 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --use-osr --allow-natives-syntax --opt
+
+var o1 = {a : 10};
+var o2 = { };
+o2.__proto__ = o1;
+var o3 = { };
+o3.__proto__ = o2;
+
+function f(n, x, b) {
+ var sum = x.a;
+ for (var i = 0; i < n; i++) {
+ sum = 1.0 / i;
+ }
+ return sum;
+}
+
+f(10, o3);
+f(20, o3);
+f(30, o3);
+%OptimizeFunctionOnNextCall(f, "concurrent");
+f(100000, o3);
+// At this point OSR replaces already optimized code.
+// Check that it evicts old code from cache.
+
+// This causes all code for f to be lazily deopted.
+o2.a = 5;
+
+// If OSR did not evict the old code, it will be installed in f here.
+%OptimizeFunctionOnNextCall(f);
+f(10, o3);
+
+// The old code is already deoptimized, but f still points to it.
+// Disassembling it will crash.
+%DisassembleFunction(f);
diff --git a/src/v8/test/mjsunit/regress/regress-3307.js b/src/v8/test/mjsunit/regress/regress-3307.js
new file mode 100644
index 0000000..1fc770d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-3307.js
@@ -0,0 +1,24 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function p(x) {
+ this.x = x;
+}
+
+function f() {
+ var a = new p(1), b = new p(2);
+ for (var i = 0; i < 1; i++) {
+ a.x += b.x;
+ }
+ return a.x;
+}
+
+new p(0.1); // make 'x' mutable box double field in p.
+
+assertEquals(3, f());
+assertEquals(3, f());
+%OptimizeFunctionOnNextCall(f);
+assertEquals(3, f());
diff --git a/src/v8/test/mjsunit/regress/regress-331416.js b/src/v8/test/mjsunit/regress/regress-331416.js
new file mode 100644
index 0000000..0c60fce
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-331416.js
@@ -0,0 +1,52 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function load(a, i) {
+ return a[i];
+}
+load([1, 2, 3], "length");
+load(3);
+load([1, 2, 3], 3);
+load(0, 0);
+%OptimizeFunctionOnNextCall(load);
+assertEquals(2, load([1, 2, 3], 1));
+assertEquals(undefined, load(0, 0));
+
+function store(a, i, x) {
+ a[i] = x;
+}
+store([1, 2, 3], "length", 3);
+store(3);
+store([1, 2, 3], 3, 3);
+store(0, 0, 1);
+%OptimizeFunctionOnNextCall(store);
+var a = [1, 2, 3];
+store(a, 1, 1);
+assertEquals(1, a[1]);
+store(0, 0, 1);
diff --git a/src/v8/test/mjsunit/regress/regress-331444.js b/src/v8/test/mjsunit/regress/regress-331444.js
new file mode 100644
index 0000000..c78d6fb
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-331444.js
@@ -0,0 +1,44 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-gc
+
+function boom() {
+ var args = [];
+ for (var i = 0; i < 125000; i++)
+ args.push(i);
+ return Array.apply(Array, args);
+}
+var array = boom();
+function fib(n) {
+ var f0 = 0, f1 = 1;
+ for (; n > 0; n = n - 1) {
+ f0 + f1;
+ f0 = array;
+ }
+}
+fib(12);
diff --git a/src/v8/test/mjsunit/regress/regress-3334.js b/src/v8/test/mjsunit/regress/regress-3334.js
new file mode 100644
index 0000000..301155d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-3334.js
@@ -0,0 +1,13 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function foo(){}
+Object.defineProperty(foo, "prototype", { value: 2 });
+assertEquals(2, foo.prototype);
+
+function bar(){}
+Object.defineProperty(bar, "prototype", { value: 2, writable: false });
+assertEquals(2, bar.prototype);
+assertThrows(function() { "use strict"; bar.prototype = 10; }, TypeError);
+assertEquals(false, Object.getOwnPropertyDescriptor(bar,"prototype").writable);
diff --git a/src/v8/test/mjsunit/regress/regress-333594.js b/src/v8/test/mjsunit/regress/regress-333594.js
new file mode 100644
index 0000000..6f6dbaa
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-333594.js
@@ -0,0 +1,42 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var a = { x: 1.1 };
+a.x = 0;
+var G = a.x;
+var o = { x: {} };
+
+function func() {
+ return {x: G};
+}
+
+func();
+func();
+%OptimizeFunctionOnNextCall(func);
+assertEquals(0, func().x);
diff --git a/src/v8/test/mjsunit/regress/regress-334.js b/src/v8/test/mjsunit/regress/regress-334.js
new file mode 100644
index 0000000..c52c72a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-334.js
@@ -0,0 +1,90 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// Test for http://code.google.com/p/v8/issues/detail?id=334
+
+var READ_ONLY = 1;
+var DONT_ENUM = 2;
+var DONT_DELETE = 4;
+
+function func1(){}
+function func2(){}
+
+var object = {__proto__:{}};
+%AddNamedProperty(object, "foo", func1, DONT_ENUM | DONT_DELETE);
+%AddNamedProperty(object, "bar", func1, DONT_ENUM | READ_ONLY);
+%AddNamedProperty(object, "baz", func1, DONT_DELETE | READ_ONLY);
+%AddNamedProperty(object.__proto__, "bif", func1, DONT_ENUM | DONT_DELETE);
+object.bif = func2;
+
+function enumerable(obj) {
+ var res = [];
+ for (var i in obj) {
+ res.push(i);
+ }
+ res.sort();
+ return res;
+}
+
+// Sanity check: expected initial state.
+assertArrayEquals(["baz", "bif"], enumerable(object), "enum0");
+assertFalse(delete object.foo, "delete foo");
+assertFalse(delete object.baz, "delete baz");
+assertEquals(func1, object.foo, "read foo");
+assertEquals(func1, object.bar, "read bar");
+assertEquals(func1, object.baz, "read baz");
+assertEquals(func2, object.bif, "read bif");
+
+// Can't assign to READ_ONLY.
+object.bar = "NO WAY";
+assertEquals(func1, object.bar, "read bar 2");
+assertArrayEquals(["baz", "bif"], enumerable(object), "enum1");
+
+// Assignment to non-readonly. Assignment shouldn't change attributes!
+object.foo = func2;
+assertArrayEquals(["baz", "bif"], enumerable(object), "enum2");
+assertFalse(delete object.foo, "delete foo 2");
+
+// Delete should erase attributes if value set again.
+assertTrue(delete object.bar, "delete bar");
+assertFalse("bar" in object, "has bar");
+object.bar = func2;
+assertTrue("bar" in object, "has bar 2");
+assertEquals(func2, object.bar, "read bar 3");
+
+assertArrayEquals(["bar", "baz", "bif"], enumerable(object), "enum3");
+
+// Unshadowing a prototype property exposes its attributes.
+assertTrue(delete object.bif, "delete bif");
+assertArrayEquals(["bar", "baz"], enumerable(object), "enum4");
+assertEquals(func1, object.bif, "read bif 2");
+// Can't delete prototype property.
+assertTrue(delete object.bif, "delete bif 2");
+assertArrayEquals(["bar", "baz"], enumerable(object), "enum5");
+assertEquals(func1, object.bif, "read bif3");
diff --git a/src/v8/test/mjsunit/regress/regress-334708.js b/src/v8/test/mjsunit/regress/regress-334708.js
new file mode 100644
index 0000000..f0291bb
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-334708.js
@@ -0,0 +1,42 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function foo(x, y) {
+ return Math.floor(x / y);
+}
+
+function bar(x, y) {
+ return foo(x + 1, y + 1);
+}
+
+foo(16, "4");
+
+bar(64, 2);
+%OptimizeFunctionOnNextCall(bar);
+bar(64, 2);
diff --git a/src/v8/test/mjsunit/regress/regress-3359.js b/src/v8/test/mjsunit/regress/regress-3359.js
new file mode 100644
index 0000000..0973797
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-3359.js
@@ -0,0 +1,12 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f() {
+ return 1 >> Boolean.constructor + 1;
+}
+assertEquals(1, f());
+%OptimizeFunctionOnNextCall(f);
+assertEquals(1, f());
diff --git a/src/v8/test/mjsunit/regress/regress-336820.js b/src/v8/test/mjsunit/regress/regress-336820.js
new file mode 100644
index 0000000..56d8874
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-336820.js
@@ -0,0 +1,38 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --max-old-space-size=1600
+
+assertThrows((function() {
+ s = "Hello World!\n";
+ while (true) {
+ x = new Array();
+ x[0] = s;
+ x[1000] = s;
+ x[1000000] = s;
+ s = x.join("::");
+ }}), RangeError);
diff --git a/src/v8/test/mjsunit/regress/regress-3380.js b/src/v8/test/mjsunit/regress/regress-3380.js
new file mode 100644
index 0000000..2fae459
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-3380.js
@@ -0,0 +1,16 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(a) {
+ return (a[0] >>> 0) > 0;
+}
+
+var a = new Uint32Array([4]);
+var b = new Uint32Array([0x80000000]);
+assertTrue(foo(a));
+assertTrue(foo(a));
+%OptimizeFunctionOnNextCall(foo);
+assertTrue(foo(b))
diff --git a/src/v8/test/mjsunit/regress/regress-3392.js b/src/v8/test/mjsunit/regress/regress-3392.js
new file mode 100644
index 0000000..375f302
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-3392.js
@@ -0,0 +1,18 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo() {
+ var a = {b: -1.5};
+ for (var i = 0; i < 1; i++) {
+ a.b = 1;
+ }
+ assertTrue(0 <= a.b);
+}
+
+foo();
+foo();
+%OptimizeFunctionOnNextCall(foo);
+foo();
diff --git a/src/v8/test/mjsunit/regress/regress-340125.js b/src/v8/test/mjsunit/regress/regress-340125.js
new file mode 100644
index 0000000..a3e40a8
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-340125.js
@@ -0,0 +1,30 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+//
+var a = new Int8Array(2);
+var b = a.subarray(2, 4);
+assertThrows(function () { a.set(b, 1e10); }, RangeError);
diff --git a/src/v8/test/mjsunit/regress/regress-3404.js b/src/v8/test/mjsunit/regress/regress-3404.js
new file mode 100644
index 0000000..c4d280e
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-3404.js
@@ -0,0 +1,27 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function testError(error) {
+ // Reconfigure e.stack to be non-configurable
+ var desc1 = Object.getOwnPropertyDescriptor(error, "stack");
+ Object.defineProperty(error, "stack",
+ {get: desc1.get, set: desc1.set, configurable: false});
+
+ var desc2 = Object.getOwnPropertyDescriptor(error, "stack");
+ assertFalse(desc2.configurable);
+ assertEquals(desc1.get, desc2.get);
+ assertEquals(desc2.get, desc2.get);
+}
+
+function stackOverflow() {
+ function f() { f(); }
+ try { f() } catch (e) { return e; }
+}
+
+function referenceError() {
+ try { g() } catch (e) { return e; }
+}
+
+testError(referenceError());
+testError(stackOverflow());
diff --git a/src/v8/test/mjsunit/regress/regress-3408144.js b/src/v8/test/mjsunit/regress/regress-3408144.js
new file mode 100644
index 0000000..8bd7b20
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-3408144.js
@@ -0,0 +1,35 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test incorrect code generation for alternations on ARM.
+
+
+function foo() {
+ return (0 > ("10"||10) - 1);
+}
+
+assertFalse(foo());
diff --git a/src/v8/test/mjsunit/regress/regress-341.js b/src/v8/test/mjsunit/regress/regress-341.js
new file mode 100644
index 0000000..4db6bc6
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-341.js
@@ -0,0 +1,36 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Should not crash.
+// See http://code.google.com/p/v8/issues/detail?id=341
+
+function F() {}
+
+F.prototype = 1;
+var o = {};
+
+assertThrows("o instanceof F");
diff --git a/src/v8/test/mjsunit/regress/regress-343609.js b/src/v8/test/mjsunit/regress/regress-343609.js
new file mode 100644
index 0000000..520b54e
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-343609.js
@@ -0,0 +1,66 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --block-concurrent-recompilation
+// Flags: --expose-gc
+
+function Ctor() {
+ this.a = 1;
+}
+
+function get_closure() {
+ return function add_field(obj) {
+ obj.c = 3;
+ obj.a = obj.a + obj.c;
+ return obj.a;
+ }
+}
+function get_closure2() {
+ return function cc(obj) {
+ obj.c = 3;
+ obj.a = obj.a + obj.c;
+ }
+}
+
+function dummy() {
+ (function () {
+ var o = {c: 10};
+ var f1 = get_closure2();
+ f1(o);
+ f1(o);
+ %OptimizeFunctionOnNextCall(f1);
+ f1(o);
+ })();
+}
+
+var o = new Ctor();
+function opt() {
+ (function () {
+ var f1 = get_closure();
+ f1(new Ctor());
+ f1(new Ctor());
+ %OptimizeFunctionOnNextCall(f1);
+ f1(o);
+ })();
+}
+
+// Optimize add_field and install its code in optimized code cache.
+opt();
+opt();
+opt();
+
+// Optimize dummy function to remove the add_field from head of optimized
+// function list in the context.
+dummy();
+dummy();
+
+// Kill add_field in new space GC.
+for(var i = 0; i < 3; i++) gc(true);
+
+// Trigger deopt.
+o.c = 2.2;
+
+// Fetch optimized code of add_field from cache and crash.
+var f2 = get_closure();
+f2(new Ctor());
diff --git a/src/v8/test/mjsunit/regress/regress-345.js b/src/v8/test/mjsunit/regress/regress-345.js
new file mode 100644
index 0000000..f7f28a1
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-345.js
@@ -0,0 +1,51 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Escaping to the same target from both the try and catch blocks of
+// try...catch...finally should not fail at compile-time.
+//
+// Reported by nth10sd.
+// See http://code.google.com/p/v8/issues/detail?id=345
+
+do {
+ try {
+ continue;
+ } catch (e) {
+ continue;
+ } finally {
+ }
+} while (false);
+
+
+L: {
+ try {
+ break L;
+ } catch (e) {
+ break L;
+ } finally {
+ }
+}
diff --git a/src/v8/test/mjsunit/regress/regress-3456.js b/src/v8/test/mjsunit/regress/regress-3456.js
new file mode 100644
index 0000000..ac86339
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-3456.js
@@ -0,0 +1,11 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Arrow function parsing (commit r22366) changed the flags stored in
+// PreParserExpression, and IsValidReferenceExpression() would return
+// false for certain valid expressions. This case is the minimum amount
+// of code needed to validate that IsValidReferenceExpression() works
+// properly. If it does not, a ReferenceError is thrown during parsing.
+
+function f() { ++(this.foo) }
diff --git a/src/v8/test/mjsunit/regress/regress-3462.js b/src/v8/test/mjsunit/regress/regress-3462.js
new file mode 100644
index 0000000..5a33559
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-3462.js
@@ -0,0 +1,48 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+
+function TestFunctionPrototypeSetter() {
+ var f = function() {};
+ var o = {__proto__: f};
+ o.prototype = 42;
+ assertEquals(42, o.prototype);
+ assertTrue(o.hasOwnProperty('prototype'));
+}
+TestFunctionPrototypeSetter();
+
+
+function TestFunctionPrototypeSetterOnValue() {
+ var f = function() {};
+ var fp = f.prototype;
+ Number.prototype.__proto__ = f;
+ var n = 42;
+ var o = {};
+ n.prototype = o;
+ assertEquals(fp, n.prototype);
+ assertEquals(fp, f.prototype);
+ assertFalse(Number.prototype.hasOwnProperty('prototype'));
+}
+TestFunctionPrototypeSetterOnValue();
+
+
+function TestArrayLengthSetter() {
+ var a = [1];
+ var o = {__proto__: a};
+ o.length = 2;
+ assertEquals(2, o.length);
+ assertEquals(1, a.length);
+ assertTrue(o.hasOwnProperty('length'));
+}
+TestArrayLengthSetter();
+
+
+function TestArrayLengthSetterOnValue() {
+ Number.prototype.__proto__ = [1];
+ var n = 42;
+ n.length = 2;
+ assertEquals(1, n.length);
+ assertFalse(Number.prototype.hasOwnProperty('length'));
+}
+TestArrayLengthSetterOnValue();
diff --git a/src/v8/test/mjsunit/regress/regress-346343.js b/src/v8/test/mjsunit/regress/regress-346343.js
new file mode 100644
index 0000000..e4c1066
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-346343.js
@@ -0,0 +1,42 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function f(o) {
+ for (var i = 1; i < 2; ++i) {
+ var y = o.y;
+ }
+}
+f({y:1.1});
+f({y:1.1});
+
+function g(x) { f({z:x}); }
+g(1);
+g(2);
+%OptimizeFunctionOnNextCall(g);
+g(1);
diff --git a/src/v8/test/mjsunit/regress/regress-346587.js b/src/v8/test/mjsunit/regress/regress-346587.js
new file mode 100644
index 0000000..e907002
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-346587.js
@@ -0,0 +1,18 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function bar(obj) {
+ assertTrue(obj.x === 'baz');
+}
+
+function foo() {
+ bar({ x : 'baz' });
+}
+
+foo();
+foo();
+%OptimizeFunctionOnNextCall(foo);
+foo();
diff --git a/src/v8/test/mjsunit/regress/regress-347262.js b/src/v8/test/mjsunit/regress/regress-347262.js
new file mode 100644
index 0000000..76bc34a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-347262.js
@@ -0,0 +1,62 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+(function ArgumentsObjectWithOtherArgumentsInFrame() {
+ function g() {
+ return g.arguments;
+ }
+
+ function f(x) {
+ g();
+ return arguments[0];
+ }
+ f();
+ f();
+ %OptimizeFunctionOnNextCall(f);
+ f();
+})();
+
+
+(function ArgumentsObjectWithOtherArgumentsDeopt() {
+ function g(y) {
+ y.o2 = 2;
+ return g.arguments;
+ }
+
+ function f(x) {
+ var o1 = { o2 : 1 };
+ var a = g(o1);
+ o1.o2 = 3;
+ return arguments[0] + a[0].o2;
+ }
+ f(0);
+ f(0);
+ %OptimizeFunctionOnNextCall(f);
+ assertEquals(3, f(0));
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-347530.js b/src/v8/test/mjsunit/regress/regress-347530.js
new file mode 100644
index 0000000..330fda3
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-347530.js
@@ -0,0 +1,12 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc
+a = [];
+a[1000] = .1;
+a.length = 0;
+gc();
+gc();
+a[1000] = .1;
+assertEquals(.1, a[1000]);
diff --git a/src/v8/test/mjsunit/regress/regress-347542.js b/src/v8/test/mjsunit/regress/regress-347542.js
new file mode 100644
index 0000000..901d798
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-347542.js
@@ -0,0 +1,11 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo() {}
+foo();
+%OptimizeFunctionOnNextCall(foo);
+foo();
+%NeverOptimizeFunction(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-347543.js b/src/v8/test/mjsunit/regress/regress-347543.js
new file mode 100644
index 0000000..ddea23a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-347543.js
@@ -0,0 +1,19 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --debug-code
+
+function f(a) {
+ a[5000000] = 256;
+ assertEquals(256, a[5000000]);
+}
+
+var v1 = new Array(5000001);
+var v2 = new Array(10);
+f(v1);
+f(v2);
+f(v2);
+%OptimizeFunctionOnNextCall(f);
+f(v2);
+f(v1);
diff --git a/src/v8/test/mjsunit/regress/regress-3476.js b/src/v8/test/mjsunit/regress/regress-3476.js
new file mode 100644
index 0000000..f4333db
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-3476.js
@@ -0,0 +1,24 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function MyWrapper(v) {
+ return { valueOf: function() { return v } };
+}
+
+function f() {
+ assertEquals("truex", true + "x");
+ assertEquals("truey", true + new String("y"));
+ assertEquals("truez", true + new MyWrapper("z"));
+
+ assertEquals("xtrue", "x" + true);
+ assertEquals("ytrue", new String("y") + true);
+ assertEquals("ztrue", new MyWrapper("z") + true);
+}
+
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+f();
diff --git a/src/v8/test/mjsunit/regress/regress-347904.js b/src/v8/test/mjsunit/regress/regress-347904.js
new file mode 100644
index 0000000..1a27b05
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-347904.js
@@ -0,0 +1,12 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --stress-runs=2
+
+var v = /abc/;
+function f() {
+ v = 1578221999;
+};
+%OptimizeFunctionOnNextCall(f);
+f();
diff --git a/src/v8/test/mjsunit/regress/regress-347909.js b/src/v8/test/mjsunit/regress/regress-347909.js
new file mode 100644
index 0000000..90a8e6a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-347909.js
@@ -0,0 +1,19 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var a = {y:1.5};
+a.y = 0;
+var b = a.y;
+a.y = {};
+var d = 1;
+function f() {
+ d = 0;
+ return {y: b};
+}
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+f();
diff --git a/src/v8/test/mjsunit/regress/regress-347912.js b/src/v8/test/mjsunit/regress/regress-347912.js
new file mode 100644
index 0000000..b609e36
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-347912.js
@@ -0,0 +1,10 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var __v_4 = {};
+__v_2 = {};
+__v_2[1024] = 0;
+%DebugPrint(__v_4);
diff --git a/src/v8/test/mjsunit/regress/regress-347914.js b/src/v8/test/mjsunit/regress/regress-347914.js
new file mode 100644
index 0000000..170a4f8
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-347914.js
@@ -0,0 +1,91 @@
+ // Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --debug-code --gc-interval=201 --verify-heap
+// Flags: --max-inlined-bytecode-size=999999 --max-inlined-bytecode-size-cumulative=999999
+// Flags: --opt --no-always-opt
+
+// Begin stripped down and modified version of mjsunit.js for easy minimization in CF.
+function MjsUnitAssertionError(message) {}
+MjsUnitAssertionError.prototype.toString = function () { return this.message; };
+var assertSame;
+var assertEquals;
+var assertEqualsDelta;
+var assertArrayEquals;
+var assertPropertiesEqual;
+var assertToStringEquals;
+var assertTrue;
+var assertFalse;
+var triggerAssertFalse;
+var assertNull;
+var assertNotNull;
+var assertThrows;
+var assertDoesNotThrow;
+var assertInstanceof;
+var assertUnreachable;
+var assertOptimized;
+var assertUnoptimized;
+function classOf(object) { var string = Object.prototype.toString.call(object); return string.substring(8, string.length - 1); }
+function PrettyPrint(value) { return ""; }
+function PrettyPrintArrayElement(value, index, array) { return ""; }
+function fail(expectedText, found, name_opt) { }
+function deepObjectEquals(a, b) { var aProps = Object.keys(a); aProps.sort(); var bProps = Object.keys(b); bProps.sort(); if (!deepEquals(aProps, bProps)) { return false; } for (var i = 0; i < aProps.length; i++) { if (!deepEquals(a[aProps[i]], b[aProps[i]])) { return false; } } return true; }
+function deepEquals(a, b) { if (a === b) { if (a === 0) return (1 / a) === (1 / b); return true; } if (typeof a != typeof b) return false; if (typeof a == "number") return isNaN(a) && isNaN(b); if (typeof a !== "object" && typeof a !== "function") return false; var objectClass = classOf(a); if (objectClass !== classOf(b)) return false; if (objectClass === "RegExp") { return (a.toString() === b.toString()); } if (objectClass === "Function") return false; if (objectClass === "Array") { var elementCount = 0; if (a.length != b.length) { return false; } for (var i = 0; i < a.length; i++) { if (!deepEquals(a[i], b[i])) return false; } return true; } if (objectClass == "String" || objectClass == "Number" || objectClass == "Boolean" || objectClass == "Date") { if (a.valueOf() !== b.valueOf()) return false; } return deepObjectEquals(a, b); }
+assertSame = function assertSame(expected, found, name_opt) { if (found === expected) { if (expected !== 0 || (1 / expected) == (1 / found)) return; } else if ((expected !== expected) && (found !== found)) { return; } fail(PrettyPrint(expected), found, name_opt); }; assertEquals = function assertEquals(expected, found, name_opt) { if (!deepEquals(found, expected)) { fail(PrettyPrint(expected), found, name_opt); } };
+assertEqualsDelta = function assertEqualsDelta(expected, found, delta, name_opt) { assertTrue(Math.abs(expected - found) <= delta, name_opt); }; assertArrayEquals = function assertArrayEquals(expected, found, name_opt) { var start = ""; if (name_opt) { start = name_opt + " - "; } assertEquals(expected.length, found.length, start + "array length"); if (expected.length == found.length) { for (var i = 0; i < expected.length; ++i) { assertEquals(expected[i], found[i], start + "array element at index " + i); } } };
+assertPropertiesEqual = function assertPropertiesEqual(expected, found, name_opt) { if (!deepObjectEquals(expected, found)) { fail(expected, found, name_opt); } };
+assertToStringEquals = function assertToStringEquals(expected, found, name_opt) { if (expected != String(found)) { fail(expected, found, name_opt); } };
+assertTrue = function assertTrue(value, name_opt) { assertEquals(true, value, name_opt); };
+assertFalse = function assertFalse(value, name_opt) { assertEquals(false, value, name_opt); };
+
+assertNull = function assertNull(value, name_opt) { if (value !== null) { fail("null", value, name_opt); } };
+assertNotNull = function assertNotNull(value, name_opt) { if (value === null) { fail("not null", value, name_opt); } };
+as1sertThrows = function assertThrows(code, type_opt, cause_opt) { var threwException = true; try { if (typeof code == 'function') { code(); } else { eval(code); } threwException = false; } catch (e) { if (typeof type_opt == 'function') { assertInstanceof(e, type_opt); } if (arguments.length >= 3) { assertEquals(e.type, cause_opt); } return; } };
+assertInstanceof = function assertInstanceof(obj, type) { if (!(obj instanceof type)) { var actualTypeName = null; var actualConstructor = Object.getPrototypeOf(obj).constructor; if (typeof actualConstructor == "function") { actualTypeName = actualConstructor.name || String(actualConstructor); } fail("Object <" + PrettyPrint(obj) + "> is not an instance of <" + (type.name || type) + ">" + (actualTypeName ? " but of < " + actualTypeName + ">" : "")); } };
+assertDoesNotThrow = function assertDoesNotThrow(code, name_opt) { try { if (typeof code == 'function') { code(); } else { eval(code); } } catch (e) { fail("threw an exception: ", e.message || e, name_opt); } };
+assertUnreachable = function assertUnreachable(name_opt) { var message = "Fail" + "ure: unreachable"; if (name_opt) { message += " - " + name_opt; } };
+var OptimizationStatus;
+try { OptimizationStatus = new Function("fun", "sync", "return %GetOptimizationStatus(fun, sync);"); } catch (e) { OptimizationStatus = function() { } }
+assertUnoptimized = function assertUnoptimized(fun, sync_opt, name_opt) { if (sync_opt === undefined) sync_opt = ""; assertTrue(OptimizationStatus(fun, sync_opt) != 1, name_opt); }
+assertOptimized = function assertOptimized(fun, sync_opt, name_opt) { if (sync_opt === undefined) sync_opt = ""; assertTrue(OptimizationStatus(fun, sync_opt) != 2, name_opt); }
+triggerAssertFalse = function() { }
+// End stripped down and modified version of mjsunit.js.
+
+var __v_1 = {};
+var __v_2 = {};
+var __v_3 = {};
+var __v_4 = {};
+var __v_5 = {};
+var __v_6 = {};
+var __v_7 = {};
+var __v_8 = {};
+var __v_9 = {};
+var __v_10 = {};
+var __v_0 = 'fisk';
+assertEquals('fisk', __v_0);
+var __v_0;
+assertEquals('fisk', __v_0);
+var __v_6 = 'hest';
+assertEquals('hest', __v_0);
+this.bar = 'fisk';
+assertEquals('fisk', __v_1);
+__v_1;
+assertEquals('fisk', __v_1);
+__v_1 = 'hest';
+assertEquals('hest', __v_1);
+
+function __f_0(o) {
+ o.g();
+ if (!o.g()) {
+ assertTrue(false);
+ }
+}
+__v_4 = {};
+__v_4.size = function() { return 42; }
+__v_4.g = function() { return this.size(); };
+__f_0({g: __v_4.g, size:__v_4.size});
+for (var __v_0 = 0; __v_0 < 5; __v_0++) __f_0(__v_4);
+%OptimizeFunctionOnNextCall(__f_0);
+__f_0(__v_4);
+__f_0({g: __v_4.g, size:__v_4.size});
diff --git a/src/v8/test/mjsunit/regress/regress-348280.js b/src/v8/test/mjsunit/regress/regress-348280.js
new file mode 100644
index 0000000..319c270
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-348280.js
@@ -0,0 +1,16 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function baz(f) { f(); }
+function goo() {}
+baz(goo);
+baz(goo);
+
+function bar(p) { if (p == 0) baz(1); }
+bar(1);
+bar(1);
+%OptimizeFunctionOnNextCall(bar);
+bar(1);
diff --git a/src/v8/test/mjsunit/regress/regress-3483.js b/src/v8/test/mjsunit/regress/regress-3483.js
new file mode 100644
index 0000000..dec95c4
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-3483.js
@@ -0,0 +1,30 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+assertFalse(Object.prototype.isPrototypeOf.call());
+assertFalse(Object.prototype.isPrototypeOf.call(null, 1));
+assertFalse(Object.prototype.isPrototypeOf.call(undefined, 1));
diff --git a/src/v8/test/mjsunit/regress/regress-348512.js b/src/v8/test/mjsunit/regress/regress-348512.js
new file mode 100644
index 0000000..7d89666
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-348512.js
@@ -0,0 +1,37 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function h(y) { assertEquals(42, y.u); }
+function g() { h.apply(0, arguments); }
+function f(x) { g({ u : x }); }
+
+f(42);
+f(42);
+%OptimizeFunctionOnNextCall(f);
+f(42);
diff --git a/src/v8/test/mjsunit/regress/regress-349.js b/src/v8/test/mjsunit/regress/regress-349.js
new file mode 100644
index 0000000..1a60e3e
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-349.js
@@ -0,0 +1,32 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Should not crash.
+// See http://code.google.com/p/v8/issues/detail?id=349
+
+var str = "bbaabbbbbbbbabbaaaabbaaabbbaaaabbaaabbabaaabb";
+assertEquals(str, str.replace(/aabab/g, "foo"));
diff --git a/src/v8/test/mjsunit/regress/regress-349885.js b/src/v8/test/mjsunit/regress/regress-349885.js
new file mode 100644
index 0000000..dd3e795
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-349885.js
@@ -0,0 +1,15 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// The bug 349885
+
+function foo(a) {
+ a[292755462] = new Object();
+}
+foo(new Array(5));
+foo(new Array(5));
+%OptimizeFunctionOnNextCall(foo);
+foo(new Array(10));
diff --git a/src/v8/test/mjsunit/regress/regress-35.js b/src/v8/test/mjsunit/regress/regress-35.js
new file mode 100644
index 0000000..2fcdbe7
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-35.js
@@ -0,0 +1,33 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var result;
+eval("result = 42; while(true)break");
+assertEquals(42, result);
+
+eval("result = 87; while(false)continue");
+assertEquals(87, result);
diff --git a/src/v8/test/mjsunit/regress/regress-350863.js b/src/v8/test/mjsunit/regress/regress-350863.js
new file mode 100644
index 0000000..616792b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-350863.js
@@ -0,0 +1,45 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+//
+// Flags: --allow-natives-syntax
+
+var __v_7 = { };
+function __f_8(base, condition) {
+ __v_7[base + 3] = 0;
+ __v_7[base + 4] = 0;
+ if (condition) {
+ __v_7[base + 0] = 0;
+ __v_7[base + 5] = 0;
+ } else {
+ __v_7[base + 0] = 0;
+ __v_7[base + 18] = 0;
+ }
+}
+__f_8(1, true);
+__f_8(1, false);
+%OptimizeFunctionOnNextCall(__f_8);
+__f_8(5, false);
diff --git a/src/v8/test/mjsunit/regress/regress-350865.js b/src/v8/test/mjsunit/regress/regress-350865.js
new file mode 100644
index 0000000..74234db
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-350865.js
@@ -0,0 +1,17 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --stress-compaction --stack-size=150
+
+/\2/.test("1");
+
+function rec() {
+ try {
+ rec();
+ } catch(e) {
+ /\2/.test("1");
+ }
+}
+
+rec();
diff --git a/src/v8/test/mjsunit/regress/regress-350884.js b/src/v8/test/mjsunit/regress/regress-350884.js
new file mode 100644
index 0000000..8656853
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-350884.js
@@ -0,0 +1,15 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var obj = new Array(1);
+obj[0] = 0;
+obj[1] = 0;
+function foo(flag_index) {
+ obj[flag_index]++;
+}
+
+// Force dictionary properties on obj.
+obj[-8] = 3;
+foo(1);
+foo(2);
diff --git a/src/v8/test/mjsunit/regress/regress-350887.js b/src/v8/test/mjsunit/regress/regress-350887.js
new file mode 100644
index 0000000..638aa30
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-350887.js
@@ -0,0 +1,12 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var arr = [];
+assertSame(0, arr.length);
+assertSame(undefined, arr[0]);
+Object.defineProperty(arr, '2501866687', { value: 4, configurable: false });
+// 2501866688 is out of smi range.
+assertSame(2501866688, arr.length);
+assertSame(undefined, arr[0]);
+arr.length = 0;
diff --git a/src/v8/test/mjsunit/regress/regress-351.js b/src/v8/test/mjsunit/regress/regress-351.js
new file mode 100644
index 0000000..44470db
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-351.js
@@ -0,0 +1,31 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Should use index of 0 if provided index is negative.
+// See http://code.google.com/p/v8/issues/detail?id=351
+
+assertEquals(0, "test".lastIndexOf("test", -1));
diff --git a/src/v8/test/mjsunit/regress/regress-351261.js b/src/v8/test/mjsunit/regress/regress-351261.js
new file mode 100644
index 0000000..5a634fa
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-351261.js
@@ -0,0 +1,19 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function store(a) {
+ a[5000000] = 1;
+}
+
+function foo() {
+ var __v_8 = new Object;
+ var __v_7 = new Array(4999990);
+ store(__v_8);
+ store(__v_7);
+}
+foo();
+%OptimizeFunctionOnNextCall(foo);
+foo();
diff --git a/src/v8/test/mjsunit/regress/regress-351263.js b/src/v8/test/mjsunit/regress/regress-351263.js
new file mode 100644
index 0000000..28edbcd
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-351263.js
@@ -0,0 +1,37 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var __v_12 = {};
+function __f_30(x, sa) {
+ return (x >>> sa) | (x << (__v_12 - sa));
+}
+__f_30(1.4, 1);
+__f_30(1.4, 1);
+%OptimizeFunctionOnNextCall(__f_30);
+__f_30(1.4, 1);
diff --git a/src/v8/test/mjsunit/regress/regress-351319.js b/src/v8/test/mjsunit/regress/regress-351319.js
new file mode 100644
index 0000000..a2afbb6
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-351319.js
@@ -0,0 +1,39 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function __f_0(a, base) {
+ a[base] = 1;
+ a[base] = -1749557862;
+}
+var __v_0 = new Array(1024);
+var __v_1 = new Array(128);
+__f_0(__v_0, 1);
+__f_0(__v_1, -2);
+%OptimizeFunctionOnNextCall(__f_0);
+__f_0(__v_0, -2);
diff --git a/src/v8/test/mjsunit/regress/regress-351624.js b/src/v8/test/mjsunit/regress/regress-351624.js
new file mode 100644
index 0000000..fc3715b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-351624.js
@@ -0,0 +1,23 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var big = 1e10;
+var backup = new Float64Array(1);
+
+function mult0(val){
+ var prod = val * big;
+ backup[0] = prod;
+ var rounded = Math.round(prod);
+ assertEquals(prod, backup[0]);
+ return rounded;
+}
+
+var count = 5;
+for (var i = 0; i < count; i++) {
+ if (i == count - 1) %OptimizeFunctionOnNextCall(mult0);
+ var result = mult0(-1);
+ assertEquals(result, -big);
+}
diff --git a/src/v8/test/mjsunit/regress/regress-352059.js b/src/v8/test/mjsunit/regress/regress-352059.js
new file mode 100644
index 0000000..cd1a4c2
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-352059.js
@@ -0,0 +1,35 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var foo = false;
+
+function bar() {
+ foo = 2;
+ return 4 % foo;
+}
+
+bar();
diff --git a/src/v8/test/mjsunit/regress/regress-352982.js b/src/v8/test/mjsunit/regress/regress-352982.js
new file mode 100644
index 0000000..5d3ce1c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-352982.js
@@ -0,0 +1,51 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax --expose-gc
+
+function __f_4(i1) {
+ return __v_3[i1] * __v_3[0];
+}
+function __f_3(i1) {
+ __f_4(i1);
+ __f_4(i1 + 16);
+ __f_4(i1 + 32);
+ %OptimizeFunctionOnNextCall(__f_4);
+ var x = __f_4(i1 + 993);
+ return x;
+}
+function __f_5() {
+ __v_3[0] = +__v_3[0];
+ gc();
+ __f_3(0) | 0;
+ __v_3 = /\u23a1|x/;
+ return 0;
+}
+var __v_3 = new Float32Array(1000);
+__f_5();
+__f_5();
+__f_5();
diff --git a/src/v8/test/mjsunit/regress/regress-353004.js b/src/v8/test/mjsunit/regress/regress-353004.js
new file mode 100644
index 0000000..233a0f1
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-353004.js
@@ -0,0 +1,76 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var buffer1 = new ArrayBuffer(100 * 1024);
+
+var array1 = new Uint8Array(buffer1, {valueOf : function() {
+ %ArrayBufferNeuter(buffer1);
+ return 0;
+}});
+
+assertEquals(0, array1.length);
+
+var buffer2 = new ArrayBuffer(100 * 1024);
+
+assertThrows(function() {
+ var array2 = new Uint8Array(buffer2, 0, {valueOf : function() {
+ %ArrayBufferNeuter(buffer2);
+ return 100 * 1024;
+ }});
+}, RangeError);
+
+
+var buffer3 = new ArrayBuffer(100 * 1024 * 1024);
+var dataView1 = new DataView(buffer3, {valueOf : function() {
+ %ArrayBufferNeuter(buffer3);
+ return 0;
+}});
+
+assertEquals(0, dataView1.byteLength);
+
+var buffer4 = new ArrayBuffer(100 * 1024);
+assertThrows(function() {
+ var dataView2 = new DataView(buffer4, 0, {valueOf : function() {
+ %ArrayBufferNeuter(buffer4);
+ return 100 * 1024 * 1024;
+ }});
+}, RangeError);
+
+
+var buffer5 = new ArrayBuffer(100 * 1024);
+assertThrows(function() {
+ buffer5.slice({valueOf : function() {
+ %ArrayBufferNeuter(buffer5);
+ return 0;
+ }}, 100 * 1024 * 1024);
+}, TypeError);
+
+
+var buffer7 = new ArrayBuffer(100 * 1024 * 1024);
+assertThrows(function() {
+ buffer7.slice(0, {valueOf : function() {
+ %ArrayBufferNeuter(buffer7);
+ return 100 * 1024 * 1024;
+ }});
+}, TypeError);
+
+var buffer9 = new ArrayBuffer(1024);
+var array9 = new Uint8Array(buffer9);
+assertThrows(() =>
+ array9.subarray({valueOf : function() {
+ %ArrayBufferNeuter(buffer9);
+ return 0;
+ }}, 1024), TypeError);
+assertEquals(0, array9.length);
+
+var buffer11 = new ArrayBuffer(1024);
+var array11 = new Uint8Array(buffer11);
+assertThrows(() =>
+ array11.subarray(0, {valueOf : function() {
+ %ArrayBufferNeuter(buffer11);
+ return 1024;
+ }}), TypeError);
+assertEquals(0, array11.length);
diff --git a/src/v8/test/mjsunit/regress/regress-353058.js b/src/v8/test/mjsunit/regress/regress-353058.js
new file mode 100644
index 0000000..0fef246
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-353058.js
@@ -0,0 +1,27 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --stack-size=150
+// Requries ASAN.
+
+function runNearStackLimit(f) { function t() { try { t(); } catch(e) { f(); } }; try { t(); } catch(e) {} }
+function __f_0(
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x
+) { }
+runNearStackLimit(__f_0);
diff --git a/src/v8/test/mjsunit/regress/regress-353551.js b/src/v8/test/mjsunit/regress/regress-353551.js
new file mode 100644
index 0000000..973067b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-353551.js
@@ -0,0 +1,40 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var depth = 0;
+function __f_3(x) {
+ var __v_1 = arguments;
+ __v_1[1000] = 123;
+ depth++;
+ if (depth > 2200) return;
+ function __f_4() {
+ ++__v_1[0];
+ __f_3(0.5);
+ };
+ __f_4();
+}
+__f_3(0.5);
diff --git a/src/v8/test/mjsunit/regress/regress-354357.js b/src/v8/test/mjsunit/regress/regress-354357.js
new file mode 100644
index 0000000..84b7ebd
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-354357.js
@@ -0,0 +1,38 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --always-opt
+
+var v = {};
+function inlined() {
+ return !(v.bar++);
+}
+function outer() {
+ inlined();
+};
+
+outer();
diff --git a/src/v8/test/mjsunit/regress/regress-354433.js b/src/v8/test/mjsunit/regress/regress-354433.js
new file mode 100644
index 0000000..80ea286
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-354433.js
@@ -0,0 +1,54 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var __v_0 = {};
+var __v_5 = {};
+function __f_2() {
+ this.__defineGetter__('str', function() { return __f_2(this); });
+ this.str = "1";
+ this.toString = function() {
+ return this.str;
+ };
+};
+
+__v_5 = new __f_2();
+__v_0 = new __f_2();
+
+function __f_5(fun,a,b) {
+ __v_5.str = a;
+ __v_0.str = b;
+ fun(__v_5, __v_0);
+}
+
+function __f_8(a,b) { return a%b };
+
+__f_5(__f_8, 1 << 30, 1);
+__f_5(__f_8, 1, 1 << 30);
+%OptimizeFunctionOnNextCall(__f_8);
+__f_5(__f_8, 1, 1 << 30);
diff --git a/src/v8/test/mjsunit/regress/regress-355485.js b/src/v8/test/mjsunit/regress/regress-355485.js
new file mode 100644
index 0000000..3c66884
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-355485.js
@@ -0,0 +1,5 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertEquals("\u039c", "\u00b5".toUpperCase());
diff --git a/src/v8/test/mjsunit/regress/regress-355486.js b/src/v8/test/mjsunit/regress/regress-355486.js
new file mode 100644
index 0000000..55362a1
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-355486.js
@@ -0,0 +1,13 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f() { var v = arguments[0]; }
+function g() { f(); }
+
+g();
+g();
+%OptimizeFunctionOnNextCall(g);
+g();
diff --git a/src/v8/test/mjsunit/regress/regress-355523.js b/src/v8/test/mjsunit/regress/regress-355523.js
new file mode 100644
index 0000000..d61fe84
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-355523.js
@@ -0,0 +1,37 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+// This test requires ASAN.
+
+function __f_4(a, b) { }
+function __f_8(n) { return __f_4(arguments[13], arguments[-10]); }
+function __f_6(a) { return __f_8(0, a); }
+__f_8(0);
+__f_8(0);
+%OptimizeFunctionOnNextCall(__f_8);
+__f_8(0);
diff --git a/src/v8/test/mjsunit/regress/regress-356053.js b/src/v8/test/mjsunit/regress/regress-356053.js
new file mode 100644
index 0000000..8f0dbdd
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-356053.js
@@ -0,0 +1,9 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --noconcurrent-recompilation --expose-gc --allow-natives-syntax
+
+%SetFlags("--concurrent-recompilation --block-concurrent-recompilation");
+gc();
+try { %UnblockConcurrentRecompilation(); } catch (e) { }
diff --git a/src/v8/test/mjsunit/regress/regress-3564.js b/src/v8/test/mjsunit/regress/regress-3564.js
new file mode 100644
index 0000000..a0b9eb2
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-3564.js
@@ -0,0 +1,24 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function MyWrapper(v) {
+ return { valueOf: function() { return v } };
+}
+
+function f() {
+ assertTrue("a" < "x");
+ assertTrue("a" < new String("y"));
+ assertTrue("a" < new MyWrapper("z"));
+
+ assertFalse("a" > "x");
+ assertFalse("a" > new String("y"));
+ assertFalse("a" > new MyWrapper("z"));
+}
+
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+f();
diff --git a/src/v8/test/mjsunit/regress/regress-357054.js b/src/v8/test/mjsunit/regress/regress-357054.js
new file mode 100644
index 0000000..92a066e
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-357054.js
@@ -0,0 +1,10 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+[].__defineSetter__(0, function() { });
+function f(a,i,v) { a[i] = v; }
+a = [0,0,0];
+f(a,0,5);
+a = new Float32Array(5);
+f(a,2,5.5);
diff --git a/src/v8/test/mjsunit/regress/regress-357103.js b/src/v8/test/mjsunit/regress/regress-357103.js
new file mode 100644
index 0000000..692729d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-357103.js
@@ -0,0 +1,14 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+%SetFlags("--gc-interval=1");
+
+var key = "Huckleberry Finn" + "Tom Sawyer";
+var o = {};
+function f() { o[key] = "Adventures"; }
+
+f();
+f();
diff --git a/src/v8/test/mjsunit/regress/regress-357105.js b/src/v8/test/mjsunit/regress/regress-357105.js
new file mode 100644
index 0000000..d3eefd0
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-357105.js
@@ -0,0 +1,23 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --expose-gc
+
+var global = { };
+
+function do_nothing() { }
+
+function f(opt_gc) {
+ var x = new Array(3);
+ x[0] = 10;
+ opt_gc();
+ global[1] = 15.5;
+ return x;
+}
+
+gc();
+global = f(gc);
+global = f(do_nothing);
+%OptimizeFunctionOnNextCall(f);
+global = f(do_nothing);
diff --git a/src/v8/test/mjsunit/regress/regress-357108.js b/src/v8/test/mjsunit/regress/regress-357108.js
new file mode 100644
index 0000000..b20975b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-357108.js
@@ -0,0 +1,20 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --typed-array-max-size-in-heap=64
+
+function TestArray(constructor) {
+ function Check(a) {
+ a[0] = "";
+ assertEquals(0, a[0]);
+ a[0] = {};
+ assertEquals(0, a[0]);
+ a[0] = { valueOf : function() { return 27; } };
+ assertEquals(27, a[0]);
+ }
+ Check(new constructor(1));
+ Check(new constructor(100));
+}
+
+TestArray(Uint8Array);
diff --git a/src/v8/test/mjsunit/regress/regress-358057.js b/src/v8/test/mjsunit/regress/regress-358057.js
new file mode 100644
index 0000000..c5fe73a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-358057.js
@@ -0,0 +1,19 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+__v_0 = new Uint8ClampedArray(10);
+for (var i = 0; i < 10; i++) {
+ __v_0[i] = 0xAA;
+}
+function __f_12(__v_6) {
+ if (__v_6 < 0) {
+ __v_1 = __v_0[__v_6 + 10];
+ return __v_1;
+ }
+}
+
+assertEquals(0xAA, __f_12(-1));
+%OptimizeFunctionOnNextCall(__f_12);
+assertEquals(0xAA, __f_12(-1));
diff --git a/src/v8/test/mjsunit/regress/regress-358059.js b/src/v8/test/mjsunit/regress/regress-358059.js
new file mode 100644
index 0000000..30738f9
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-358059.js
@@ -0,0 +1,13 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f(a, b) { return b + (a.x++); }
+var o = {};
+o.__defineGetter__('x', function() { return 1; });
+assertEquals(4, f(o, 3));
+assertEquals(4, f(o, 3));
+%OptimizeFunctionOnNextCall(f);
+assertEquals(4, f(o, 3));
diff --git a/src/v8/test/mjsunit/regress/regress-358088.js b/src/v8/test/mjsunit/regress/regress-358088.js
new file mode 100644
index 0000000..222bba6
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-358088.js
@@ -0,0 +1,18 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function f(a) {
+ a[a.length] = 1;
+}
+
+function g(a, i, v) {
+ a[i] = v;
+}
+
+f([]); // f KeyedStoreIC goes to 1.GROW
+o = {};
+g(o); // We've added property "undefined" to o
+
+o = {}; // A transition on property "undefined" exists from {}
+f(o); // Store should go generic.
diff --git a/src/v8/test/mjsunit/regress/regress-358090.js b/src/v8/test/mjsunit/regress/regress-358090.js
new file mode 100644
index 0000000..d9c07e8
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-358090.js
@@ -0,0 +1,8 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var x = Array(100000);
+y = Array.apply(Array, x);
+y.unshift(4);
+y.shift();
diff --git a/src/v8/test/mjsunit/regress/regress-359441.js b/src/v8/test/mjsunit/regress/regress-359441.js
new file mode 100644
index 0000000..d96468c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-359441.js
@@ -0,0 +1,23 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function g() {
+ this.x = {};
+}
+
+function f() {
+ new g();
+}
+
+function deopt(x) {
+ %DeoptimizeFunction(f);
+}
+
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+Object.prototype.__defineSetter__('x', deopt);
+f();
diff --git a/src/v8/test/mjsunit/regress/regress-359491.js b/src/v8/test/mjsunit/regress/regress-359491.js
new file mode 100644
index 0000000..d72875a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-359491.js
@@ -0,0 +1,61 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function () {
+ function f(a, b, mode) {
+ if (mode) {
+ return a === b;
+ } else {
+ return a === b;
+ }
+ }
+
+ // Gather type feedback for both branches.
+ f("a", "b", 1);
+ f("c", "d", 1);
+ f("a", "b", 0);
+ f("c", "d", 0);
+
+ function g(mode) {
+ var x = 1e10 | 0;
+ f(x, x, mode);
+ }
+
+ // Gather type feedback for g, but only on one branch for f.
+ g(1);
+ g(1);
+ %OptimizeFunctionOnNextCall(g);
+ // Optimize g, which inlines f. Both branches in f will see the constant.
+ g(0);
+})();
+
+(function () {
+ function f(a, b, mode) {
+ if (mode) {
+ return a === b;
+ } else {
+ return a === b;
+ }
+ }
+
+ // Gather type feedback for both branches.
+ f({ a : 1}, {b : 1}, 1);
+ f({ c : 1}, {d : 1}, 1);
+ f({ a : 1}, {c : 1}, 0);
+ f({ b : 1}, {d : 1}, 0);
+
+ function g(mode) {
+ var x = 1e10 | 0;
+ f(x, x, mode);
+ }
+
+ // Gather type feedback for g, but only on one branch for f.
+ g(1);
+ g(1);
+ %OptimizeFunctionOnNextCall(g);
+ // Optimize g, which inlines f. Both branches in f will see the constant.
+ g(0);
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-359525.js b/src/v8/test/mjsunit/regress/regress-359525.js
new file mode 100644
index 0000000..6a82a38
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-359525.js
@@ -0,0 +1,44 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test BinaryOpICStub substract
+var a;
+for (var i = 0; i < 2; i++) {
+ var x = 42 + a - {};
+ print(x);
+ a = "";
+}
+
+// Test BinaryOpICStub add
+var b = 1.4;
+var val = 0;
+var o = {valueOf:function() { val++; return 10; }};
+for (var i = 0; i < 2; i++) {
+ var x = (b + i) + o;
+ b = "";
+}
+assertEquals(val, 2);
diff --git a/src/v8/test/mjsunit/regress/regress-360733.js b/src/v8/test/mjsunit/regress/regress-360733.js
new file mode 100644
index 0000000..d9abece
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-360733.js
@@ -0,0 +1,14 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --stack-size=150
+
+function f(a) {
+ f(a + 1);
+}
+
+Error.__defineGetter__('stackTraceLimit', function() { });
+try {
+ f(0);
+} catch (e) { }
diff --git a/src/v8/test/mjsunit/regress/regress-361025.js b/src/v8/test/mjsunit/regress/regress-361025.js
new file mode 100644
index 0000000..74f50d8
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-361025.js
@@ -0,0 +1,10 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc
+
+var x = new Object();
+x.__defineGetter__('a', function() { return 7 });
+JSON.parse('{"a":2600753951}');
+gc();
diff --git a/src/v8/test/mjsunit/regress/regress-3612.js b/src/v8/test/mjsunit/regress/regress-3612.js
new file mode 100644
index 0000000..8c30ebf
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-3612.js
@@ -0,0 +1,21 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var a = [1];
+var getterValue = 2;
+var endIndex = 0xffff;
+Object.defineProperty(a, endIndex, {
+ get: function() {
+ this[1] = 3;
+ return getterValue;
+ },
+ set: function(val) {
+ getterValue = val;
+ },
+ configurable: true,
+ enumerable: true
+});
+a.reverse();
+assertFalse(a.hasOwnProperty(1));
+assertEquals(3, a[endIndex-1]);
diff --git a/src/v8/test/mjsunit/regress/regress-361608.js b/src/v8/test/mjsunit/regress/regress-361608.js
new file mode 100644
index 0000000..b3cc90c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-361608.js
@@ -0,0 +1,20 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f() {};
+int_array = [1];
+
+function foo() {
+ var x;
+ for (var i = -1; i < 0; i++) {
+ x = int_array[i + 1];
+ f(function() { x = i; });
+ }
+}
+
+foo();
+%OptimizeFunctionOnNextCall(foo);
+foo();
diff --git a/src/v8/test/mjsunit/regress/regress-3621.js b/src/v8/test/mjsunit/regress/regress-3621.js
new file mode 100644
index 0000000..16ddde1
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-3621.js
@@ -0,0 +1,11 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var a = [];
+var endIndex = 0xffff;
+a[endIndex] = 3;
+Object.defineProperty(a, 0, { get: function() { this[1] = 2; return 1; } });
+assertEquals('123', a.join(''));
+delete a[1]; // reset the array
+assertEquals('1,2,', a.join().slice(0, 4));
diff --git a/src/v8/test/mjsunit/regress/regress-362128.js b/src/v8/test/mjsunit/regress/regress-362128.js
new file mode 100644
index 0000000..18ac5db
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-362128.js
@@ -0,0 +1,37 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+// Flags: --allow-natives-syntax
+
+function genM() {
+ "use strict";
+ return function () {
+ return this.field;
+ };
+}
+
+function genR() {
+ var x = {
+ field: 10
+ }
+ return x;
+}
+
+method = {};
+receiver = {};
+
+method = genM("A");
+receiver = genR("A");
+
+var foo = (function () {
+ return function suspect (name) {
+ "use strict";
+ return method.apply(receiver, arguments);
+ }
+})();
+
+foo("a", "b", "c");
+foo("a", "b", "c");
+foo("a", "b", "c");
+%OptimizeFunctionOnNextCall(foo);
+foo("a", "b", "c");
diff --git a/src/v8/test/mjsunit/regress/regress-362870.js b/src/v8/test/mjsunit/regress/regress-362870.js
new file mode 100644
index 0000000..c8d3fe7
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-362870.js
@@ -0,0 +1,18 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Adding a property via Object.defineProperty should not be taken as hint that
+// we construct a dictionary, quite the opposite.
+var obj = {};
+
+for (var i = 0; i < 100; i++) {
+ Object.defineProperty(obj, "x" + i, { value: 31415 });
+ Object.defineProperty(obj, "y" + i, {
+ get: function() { return 42; },
+ set: function(value) { }
+ });
+ assertTrue(%HasFastProperties(obj));
+}
diff --git a/src/v8/test/mjsunit/regress/regress-363956.js b/src/v8/test/mjsunit/regress/regress-363956.js
new file mode 100644
index 0000000..76d6728
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-363956.js
@@ -0,0 +1,12 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function Fuu() { this.x = this.x.x; }
+Fuu.prototype.x = {x: 1}
+new Fuu();
+new Fuu();
+%OptimizeFunctionOnNextCall(Fuu);
+new Fuu();
diff --git a/src/v8/test/mjsunit/regress/regress-3641.js b/src/v8/test/mjsunit/regress/regress-3641.js
new file mode 100644
index 0000000..9aff8c8
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-3641.js
@@ -0,0 +1,56 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// If a Promise's then method is overridden, that should be respected
+// even if the promise is already resolved. x's resolution function is
+// only called by Promise.resolve(); there shouldn't be a resolution
+// check before when calling x.then.
+
+
+// Async assert framework copied from mjsunit/es6/promises.js
+
+var asyncAssertsExpected = 0;
+
+function assertAsyncRan() { ++asyncAssertsExpected }
+
+function assertLater(f, name) {
+ assertFalse(f()); // should not be true synchronously
+ ++asyncAssertsExpected;
+ var iterations = 0;
+ function runAssertion() {
+ if (f()) {
+ print(name, "succeeded");
+ --asyncAssertsExpected;
+ } else if (iterations++ < 10) {
+ %EnqueueMicrotask(runAssertion);
+ } else {
+ %AbortJS(name + " FAILED!");
+ }
+ }
+ %EnqueueMicrotask(runAssertion);
+}
+
+function assertAsyncDone(iteration) {
+ var iteration = iteration || 0;
+ %EnqueueMicrotask(function() {
+ if (asyncAssertsExpected === 0)
+ assertAsync(true, "all")
+ else if (iteration > 10) // Shouldn't take more.
+ assertAsync(false, "all... " + asyncAssertsExpected)
+ else
+ assertAsyncDone(iteration + 1)
+ });
+}
+
+// End async assert framework
+
+var y;
+var x = Promise.resolve();
+x.then = () => { y = true; }
+Promise.resolve().then(() => x);
+assertLater(() => y === true, "y === true");
+
+assertAsyncDone();
diff --git a/src/v8/test/mjsunit/regress/regress-3643.js b/src/v8/test/mjsunit/regress/regress-3643.js
new file mode 100644
index 0000000..bbc94fd
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-3643.js
@@ -0,0 +1,30 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function newArrayWithGetter() {
+ var arr = [1, 2, 3];
+ Object.defineProperty(arr, '1', {
+ get: function() { delete this[1]; return undefined; },
+ configurable: true
+ });
+ return arr;
+}
+
+var a = newArrayWithGetter();
+var s = a.slice(1);
+assertTrue('0' in s);
+
+// Sparse case should hit the same code as above due to presence of the getter.
+a = newArrayWithGetter();
+a[0xffff] = 4;
+s = a.slice(1);
+assertTrue('0' in s);
+
+a = newArrayWithGetter();
+a.shift();
+assertTrue('0' in a);
+
+a = newArrayWithGetter();
+a.unshift(0);
+assertTrue('2' in a);
diff --git a/src/v8/test/mjsunit/regress/regress-3650-1.js b/src/v8/test/mjsunit/regress/regress-3650-1.js
new file mode 100644
index 0000000..f5aad4f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-3650-1.js
@@ -0,0 +1,21 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --deopt-every-n-times=55
+
+function f(t) {
+ var result = [];
+ for (var i in t) {
+ for (var j in t) {
+ result.push(i + j + t[i] + t[j]);
+ continue;
+ }
+ }
+ return result.join('');
+}
+
+var t = {a: "1", b: "2"};
+assertEquals("aa11ab12ba21bb22", f(t));
+%OptimizeFunctionOnNextCall(f);
+assertEquals("aa11ab12ba21bb22", f(t));
diff --git a/src/v8/test/mjsunit/regress/regress-3650-2.js b/src/v8/test/mjsunit/regress/regress-3650-2.js
new file mode 100644
index 0000000..aaa6d55
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-3650-2.js
@@ -0,0 +1,23 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var a = {}
+var b = {}
+a.x = 1;
+a.y = 1;
+b.x = 1;
+
+function foo(c) {
+ var s = 0;
+ for (var p in c) { s++; }
+ return s;
+}
+
+assertEquals(2, foo(a));
+assertEquals(1, foo(b));
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(2, foo(a));
+assertEquals(1, foo(b));
diff --git a/src/v8/test/mjsunit/regress/regress-3650-3.js b/src/v8/test/mjsunit/regress/regress-3650-3.js
new file mode 100644
index 0000000..6195b12
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-3650-3.js
@@ -0,0 +1,17 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+function foo(a) {
+ for (var d in a) {
+ delete a[1];
+ }
+}
+
+foo([1,2,3]);
+foo([2,3,4]);
+%OptimizeFunctionOnNextCall(foo);
+foo([1,2,3]);
+assertOptimized(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-365172-1.js b/src/v8/test/mjsunit/regress/regress-365172-1.js
new file mode 100644
index 0000000..ea68285
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-365172-1.js
@@ -0,0 +1,13 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --track-field-types
+
+var b1 = {d: 1}; var b2 = {d: 2};
+var f1 = {x: 1}; var f2 = {x: 2};
+f1.b = b1;
+f2.x = {};
+b2.d = 4.2;
+f2.b = b2;
+var x = f1.x;
diff --git a/src/v8/test/mjsunit/regress/regress-365172-2.js b/src/v8/test/mjsunit/regress/regress-365172-2.js
new file mode 100644
index 0000000..265901c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-365172-2.js
@@ -0,0 +1,13 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --track-field-types
+
+var b1 = {d: 1}; var b2 = {d: 2};
+var f1 = {x: 1}; var f2 = {x: 2};
+f1.b = b1;
+f2.x = {};
+b2.d = 4.2;
+f2.b = b2;
+%TryMigrateInstance(f1);
diff --git a/src/v8/test/mjsunit/regress/regress-365172-3.js b/src/v8/test/mjsunit/regress/regress-365172-3.js
new file mode 100644
index 0000000..103d3d0
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-365172-3.js
@@ -0,0 +1,14 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc --track-field-types
+
+function f1(a) { return {x:a, v:''}; }
+function f2(a) { return {x:{v:a}, v:''}; }
+function f3(a) { return {x:[], v:{v:''}}; }
+f3([0]);
+a = f1(1);
+a.__defineGetter__('v', function() { gc(); return f2(this); });
+a.v;
+f3(1);
diff --git a/src/v8/test/mjsunit/regress/regress-368243.js b/src/v8/test/mjsunit/regress/regress-368243.js
new file mode 100644
index 0000000..6647d12
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-368243.js
@@ -0,0 +1,25 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(a, c){
+ for(var f in c) {
+ if ("object" === typeof c[f]) {
+ a[f] = c[f];
+ foo(a[f], c[f]);
+ }
+ }
+};
+
+c = {
+ "one" : { x : 1},
+ "two" : { x : 2},
+ "thr" : { x : 3, z : 4},
+};
+
+foo({}, c);
+foo({}, c);
+%OptimizeFunctionOnNextCall(foo);
+foo({}, c);
diff --git a/src/v8/test/mjsunit/regress/regress-3687.js b/src/v8/test/mjsunit/regress/regress-3687.js
new file mode 100644
index 0000000..e1df1b4
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-3687.js
@@ -0,0 +1,22 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var t1 = { f1: 0 };
+var t2 = { f2: 0 };
+
+var z = {
+ x: {
+ x: t1,
+ y: {
+ x: {},
+ z1: {
+ x: t2,
+ y: 1
+ }
+ }
+ },
+ z2: 0
+};
diff --git a/src/v8/test/mjsunit/regress/regress-369450.js b/src/v8/test/mjsunit/regress/regress-369450.js
new file mode 100644
index 0000000..e452361
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-369450.js
@@ -0,0 +1,15 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --enable-slow-asserts
+
+var v = [1.3];
+v.length = 0;
+
+var json = JSON.stringify(v);
+assertEquals("[]", json);
+
+Array.prototype[0] = 5.5;
+var arr = [].concat(v, [{}], [2.3]);
+assertEquals([{}, 2.3], arr);
diff --git a/src/v8/test/mjsunit/regress/regress-370384.js b/src/v8/test/mjsunit/regress/regress-370384.js
new file mode 100644
index 0000000..e07cc06
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-370384.js
@@ -0,0 +1,16 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --deopt-every-n-times=1 --no-enable-sse4-1
+
+function g(f, x, name) {
+ var v2 = f(x);
+ for (var i = 0; i < 13000; i++) {
+ f(i);
+ }
+ var v1 = f(x);
+ assertEquals(v1, v2);
+}
+
+g(Math.sin, 6.283185307179586, "Math.sin");
diff --git a/src/v8/test/mjsunit/regress/regress-370827.js b/src/v8/test/mjsunit/regress/regress-370827.js
new file mode 100644
index 0000000..5536d51
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-370827.js
@@ -0,0 +1,21 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --expose-gc --heap-stats
+
+function g(dummy, x) {
+ var start = "";
+ if (x) { start = x + " - "; }
+ start = start + "array length";
+};
+
+function f() {
+ gc();
+ g([0.1]);
+}
+
+f();
+%OptimizeFunctionOnNextCall(f);
+f();
+f();
diff --git a/src/v8/test/mjsunit/regress/regress-3709.js b/src/v8/test/mjsunit/regress/regress-3709.js
new file mode 100644
index 0000000..ecb906a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-3709.js
@@ -0,0 +1,28 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt --no-always-opt
+
+function getobj() {
+ return { bar : function() { return 0}};
+}
+
+function foo() {
+ var obj = getobj();
+ var length = arguments.length;
+ if (length == 0) {
+ obj.bar();
+ } else {
+ obj.bar.apply(obj, arguments);
+ }
+}
+
+foo();
+foo();
+%OptimizeFunctionOnNextCall(foo);
+foo();
+assertOptimized(foo);
+foo(10);
+assertUnoptimized(foo);
+%ClearFunctionFeedback(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-3718.js b/src/v8/test/mjsunit/regress/regress-3718.js
new file mode 100644
index 0000000..ec180bc
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-3718.js
@@ -0,0 +1,22 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+
+function getTypeName(receiver) {
+ Error.prepareStackTrace = function(e, stack) { return stack; }
+ var stack = (function() { return new Error().stack; }).call(receiver);
+ Error.prepareStackTrace = undefined;
+ return stack[0].getTypeName();
+}
+
+assertNull(getTypeName(undefined));
+assertNull(getTypeName(null));
+assertEquals("Number", getTypeName(1));
+assertEquals("String", getTypeName(""));
+assertEquals("Boolean", getTypeName(false));
+assertEquals("Object", getTypeName({}));
+assertEquals("Array", getTypeName([]));
+assertEquals("Proxy", getTypeName(new Proxy({},{})));
+assertEquals("Custom", getTypeName(new (function Custom(){})()));
diff --git a/src/v8/test/mjsunit/regress/regress-373283.js b/src/v8/test/mjsunit/regress/regress-373283.js
new file mode 100644
index 0000000..20cee4d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-373283.js
@@ -0,0 +1,18 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --deopt-every-n-times=1
+
+function __f_0() {
+ var x = [];
+ x[21] = 1;
+ x[21] + 0;
+}
+
+for (var i = 0; i < 3; i++) __f_0();
+%OptimizeFunctionOnNextCall(__f_0);
+for (var i = 0; i < 10; i++) __f_0();
+%OptimizeFunctionOnNextCall(__f_0);
+__f_0();
+%GetScript("foo");
diff --git a/src/v8/test/mjsunit/regress/regress-3756.js b/src/v8/test/mjsunit/regress/regress-3756.js
new file mode 100644
index 0000000..6b1f029
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-3756.js
@@ -0,0 +1,74 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(function TestIdentityEscapes() {
+ // \u not followed by 4 hex digits is treated as an identity escape.
+ var r0 = /\u/;
+ assertTrue(r0.test("u"));
+
+ r0 = RegExp("\\u");
+ assertTrue(r0.test("u"));
+
+ var r1 = /\usecond/;
+ assertTrue(r1.test("usecond"));
+
+ r1 = RegExp("\\usecond");
+ assertTrue(r1.test("usecond"));
+
+ var r2 = /first\u/;
+ assertTrue(r2.test("firstu"));
+ // This used to return true (which was a bug).
+ assertFalse(r2.test("first\\u"));
+
+ r2 = RegExp("first\\u");
+ assertTrue(r2.test("firstu"));
+ // This used to return true (which was a bug).
+ assertFalse(r2.test("first\\u"));
+
+ var r3 = /first\usecond/;
+ assertTrue(r3.test("firstusecond"));
+ assertFalse(r3.test("first\\usecond"));
+
+ r3 = RegExp("first\\usecond");
+ assertTrue(r3.test("firstusecond"));
+ assertFalse(r3.test("first\\usecond"));
+
+ var r4 = /first\u123second/;
+ assertTrue(r4.test("firstu123second"));
+ assertFalse(r4.test("first\\u123second"));
+
+ r4 = RegExp("first\\u123second");
+ assertTrue(r4.test("firstu123second"));
+ assertFalse(r4.test("first\\u123second"));
+
+ // \X where X is not a legal escape character is treated as identity escape
+ // too.
+ var r5 = /\a/;
+ assertTrue(r5.test("a"));
+
+ r5 = RegExp("\\a");
+ assertTrue(r5.test("a"));
+
+ var r6 = /\asecond/;
+ assertTrue(r6.test("asecond"));
+
+ r6 = RegExp("\\asecond");
+ assertTrue(r6.test("asecond"));
+
+ var r7 = /first\a/;
+ assertTrue(r7.test("firsta"));
+ assertFalse(r7.test("first\\a"));
+
+ r7 = RegExp("first\\a");
+ assertTrue(r7.test("firsta"));
+ assertFalse(r7.test("first\\a"));
+
+ var r8 = /first\asecond/;
+ assertTrue(r8.test("firstasecond"));
+ assertFalse(r8.test("first\\asecond"));
+
+ r8 = RegExp("first\\asecond");
+ assertTrue(r8.test("firstasecond"));
+ assertFalse(r8.test("first\\asecond"));
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-377290.js b/src/v8/test/mjsunit/regress/regress-377290.js
new file mode 100644
index 0000000..23e31e7
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-377290.js
@@ -0,0 +1,17 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc
+
+Object.prototype.__defineGetter__('constructor', function() { throw 42; });
+__v_7 = [
+ function() { [].push() },
+];
+for (var __v_6 = 0; __v_6 < 5; ++__v_6) {
+ for (var __v_8 in __v_7) {
+ print(__v_8, " -> ", __v_7[__v_8]);
+ gc();
+ try { __v_7[__v_8](); } catch (e) {};
+ }
+}
diff --git a/src/v8/test/mjsunit/regress/regress-379770.js b/src/v8/test/mjsunit/regress/regress-379770.js
new file mode 100644
index 0000000..ab1b339
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-379770.js
@@ -0,0 +1,24 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+// Flags: --allow-natives-syntax --nostress-opt
+// Flags: --nouse-osr
+
+function foo(obj) {
+ var counter = 1;
+ for (var i = 0; i < obj.length; i++) %OptimizeOsr();
+ counter += obj;
+ return counter;
+}
+
+function bar() {
+ var a = [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12];
+ for (var i = 0; i < 100; i++ ) {
+ foo(a);
+ }
+}
+
+try {
+ bar();
+} catch (e) {
+}
diff --git a/src/v8/test/mjsunit/regress/regress-380092.js b/src/v8/test/mjsunit/regress/regress-380092.js
new file mode 100644
index 0000000..fe6b0b7
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-380092.js
@@ -0,0 +1,22 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function many_hoist(o, index) {
+ return o[index + 33554427];
+}
+
+var obj = {};
+many_hoist(obj, 0);
+%OptimizeFunctionOnNextCall(many_hoist);
+many_hoist(obj, 5);
+
+function constant_too_large(o, index) {
+ return o[index + 1033554433];
+}
+
+constant_too_large(obj, 0);
+%OptimizeFunctionOnNextCall(constant_too_large);
+constant_too_large(obj, 5);
diff --git a/src/v8/test/mjsunit/regress/regress-381313.js b/src/v8/test/mjsunit/regress/regress-381313.js
new file mode 100644
index 0000000..d2b9d7c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-381313.js
@@ -0,0 +1,42 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var g = 0;
+
+function f(x, deopt) {
+ var a0 = x;
+ var a1 = 2 * x;
+ var a2 = 3 * x;
+ var a3 = 4 * x;
+ var a4 = 5 * x;
+ var a5 = 6 * x;
+ var a6 = 7 * x;
+ var a7 = 8 * x;
+ var a8 = 9 * x;
+ var a9 = 10 * x;
+ var a10 = 11 * x;
+ var a11 = 12 * x;
+ var a12 = 13 * x;
+ var a13 = 14 * x;
+ var a14 = 15 * x;
+ var a15 = 16 * x;
+ var a16 = 17 * x;
+ var a17 = 18 * x;
+ var a18 = 19 * x;
+ var a19 = 20 * x;
+
+ g = 1;
+
+ deopt + 0;
+
+ return a0 + a1 + a2 + a3 + a4 + a5 + a6 + a7 + a8 + a9 +
+ a10 + a11 + a12 + a13 + a14 + a15 + a16 + a17 + a18 + a19;
+}
+
+f(0.5, 0);
+f(0.5, 0);
+%OptimizeFunctionOnNextCall(f);
+print(f(0.5, ""));
diff --git a/src/v8/test/mjsunit/regress/regress-385054.js b/src/v8/test/mjsunit/regress/regress-385054.js
new file mode 100644
index 0000000..115bca0
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-385054.js
@@ -0,0 +1,16 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f(x) {
+ var a = [1, 2];
+ a[x];
+ return a[0 - x];
+}
+
+f(0);
+f(0);
+%OptimizeFunctionOnNextCall(f);
+assertEquals(undefined, f(1));
diff --git a/src/v8/test/mjsunit/regress/regress-385565.js b/src/v8/test/mjsunit/regress/regress-385565.js
new file mode 100644
index 0000000..541e461
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-385565.js
@@ -0,0 +1,70 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax --opt --no-always-opt
+
+var calls = 0;
+
+function callsFReceiver(o) {
+ return [].f.call(new Number(o.m), 1, 2, 3);
+}
+
+// For the HConstant
+Array.prototype.f = function() {
+ calls++;
+ return +this;
+};
+
+
+var o1 = {m: 1};
+var o2 = {a: 0, m:1};
+
+var r1 = callsFReceiver(o1);
+callsFReceiver(o1);
+%OptimizeFunctionOnNextCall(callsFReceiver);
+var r2 = callsFReceiver(o1);
+assertOptimized(callsFReceiver);
+callsFReceiver(o2);
+assertUnoptimized(callsFReceiver);
+var r3 = callsFReceiver(o1);
+
+assertEquals(1, r1);
+assertTrue(r1 === r2);
+assertTrue(r2 === r3);
+
+r1 = callsFReceiver(o1);
+callsFReceiver(o1);
+%OptimizeFunctionOnNextCall(callsFReceiver);
+r2 = callsFReceiver(o1);
+callsFReceiver(o2);
+r3 = callsFReceiver(o1);
+
+assertEquals(1, r1);
+assertTrue(r1 === r2);
+assertTrue(r2 === r3);
+
+assertEquals(10, calls);
diff --git a/src/v8/test/mjsunit/regress/regress-3859.js b/src/v8/test/mjsunit/regress/regress-3859.js
new file mode 100644
index 0000000..3248ef1
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-3859.js
@@ -0,0 +1,6 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertEquals(1, new Set([NaN, NaN, NaN]).size);
+assertEquals(42, new Map([[NaN, 42]]).get(NaN));
diff --git a/src/v8/test/mjsunit/regress/regress-386.js b/src/v8/test/mjsunit/regress/regress-386.js
new file mode 100644
index 0000000..06e4b8e
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-386.js
@@ -0,0 +1,47 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+// Test for http://code.google.com/p/v8/issues/detail?id=386
+// This test creates enough properties in A so that adding i as
+// a constant function, in the first call to the constructor, leaves
+// the object's map in the fast case and adds a constant function map
+// transition.
+// Adding i in the second call to the constructor creates a real property,
+// and simultaneously converts the object from fast case to slow case
+// and changes i from a map transition to a real property. There was
+// a flaw in the code that handled this combination of events.
+
+function A() {
+ for (var i = 0; i < 13; i++) {
+ this['a' + i] = i;
+ }
+ this.i = function(){};
+};
+
+new A();
+new A();
diff --git a/src/v8/test/mjsunit/regress/regress-386034.js b/src/v8/test/mjsunit/regress/regress-386034.js
new file mode 100644
index 0000000..d770ce9
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-386034.js
@@ -0,0 +1,19 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f(x) {
+ var v = x;
+ for (i = 0; i < 1; i++) {
+ v.apply(this, arguments);
+ }
+}
+
+function g() {}
+
+f(g);
+f(g);
+%OptimizeFunctionOnNextCall(f);
+assertThrows(function() { f('----'); }, TypeError);
diff --git a/src/v8/test/mjsunit/regress/regress-3865.js b/src/v8/test/mjsunit/regress/regress-3865.js
new file mode 100644
index 0000000..0d1d02f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-3865.js
@@ -0,0 +1,14 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function bar() {
+ var radix = 10;
+ return 21 / radix | 0;
+}
+assertEquals(2, bar());
+assertEquals(2, bar());
+%OptimizeFunctionOnNextCall(bar);
+assertEquals(2, bar());
diff --git a/src/v8/test/mjsunit/regress/regress-3884.js b/src/v8/test/mjsunit/regress/regress-3884.js
new file mode 100644
index 0000000..ecd000f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-3884.js
@@ -0,0 +1,27 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --expose-gc
+
+function f(x) {
+ // TurboFan will hoist the CompareIC for x === 'some_string' and spill it.
+ if (x === 'some_other_string_1' || x === 'some_string') {
+ gc();
+ }
+ if (x === 'some_other_string_2' || x === 'some_string') {
+ gc();
+ }
+ // TurboFan will hoist the CompareIC for x === 1.4 and spill it.
+ if (x === 1.7 || x === 1.4) {
+ gc();
+ }
+ if (x === 1.9 || x === 1.4) {
+ gc();
+ }
+}
+
+%OptimizeFunctionOnNextCall(f);
+
+f('some_other_string_1');
+f(1.7);
diff --git a/src/v8/test/mjsunit/regress/regress-392.js b/src/v8/test/mjsunit/regress/regress-392.js
new file mode 100644
index 0000000..3cabcac
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-392.js
@@ -0,0 +1,34 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Regression test for issue 392 reported by nth10sd; see
+// http://code.google.com/p/v8/issues/detail?id=392
+
+assertTrue(isNaN((function(){return arguments++})()));
+assertTrue(isNaN((function(){return ++arguments})()));
+assertTrue(isNaN((function(){return arguments--})()));
+assertTrue(isNaN((function(){return --arguments})()));
diff --git a/src/v8/test/mjsunit/regress/regress-3926.js b/src/v8/test/mjsunit/regress/regress-3926.js
new file mode 100644
index 0000000..4d9b298
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-3926.js
@@ -0,0 +1,85 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// See: http://code.google.com/p/v8/issues/detail?id=3926
+
+// Switch statements should disable hole check elimination
+
+// Ensure that both reads and writes encounter the hole check
+// FullCodeGen had an issue on reads; TurboFan had an issue on writes
+function f(x) {
+ var z;
+ switch (x) {
+ case 1:
+ let y = 1;
+ case 2:
+ y = 2;
+ case 3:
+ z = y;
+ }
+ return z;
+}
+assertEquals(2, f(1));
+assertThrows(function() {f(2)}, ReferenceError);
+assertThrows(function() {f(3)}, ReferenceError);
+
+// Ensure that hole checks are done even in subordinate scopes
+assertThrows(function() {
+ switch (1) {
+ case 0:
+ let x = 2;
+ case 1:
+ { // this block, plus the let below, adds another linear lexical scope
+ let y = 3;
+ x;
+ }
+ }
+}, ReferenceError);
+
+// Ensure that inner functions and eval don't skip hole checks
+
+function g(x) {
+ switch (x) {
+ case 1:
+ let z;
+ case 2:
+ return function() { z = 1; }
+ case 3:
+ return function() { return z; }
+ case 4:
+ return eval("z = 1");
+ case 5:
+ return eval("z");
+ }
+}
+
+assertEquals(undefined, g(1)());
+assertThrows(g(2), ReferenceError);
+assertThrows(g(3), ReferenceError);
+assertThrows(function () {g(4)}, ReferenceError);
+assertThrows(function () {g(5)}, ReferenceError);
+
+// Ensure the same in strict mode, with different eval and function semantics
+
+function h(x) {
+ 'use strict'
+ switch (x) {
+ case 1:
+ let z;
+ case 2:
+ return function() { z = 1; }
+ case 3:
+ return function() { return z; }
+ case 4:
+ return eval("z = 1");
+ case 5:
+ return eval("z");
+ }
+}
+
+assertEquals(undefined, h(1)());
+assertThrows(h(2), ReferenceError);
+assertThrows(h(3), ReferenceError);
+assertThrows(function () {h(4)}, ReferenceError);
+assertThrows(function () {h(5)}, ReferenceError);
diff --git a/src/v8/test/mjsunit/regress/regress-394.js b/src/v8/test/mjsunit/regress/regress-394.js
new file mode 100644
index 0000000..1537483
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-394.js
@@ -0,0 +1,47 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// See <URL:http://code.google.com/p/v8/issues/detail?id=394>
+
+function setx(){
+ x=1;
+}
+
+function getx(){
+ return x;
+}
+
+setx()
+setx()
+this.__defineSetter__('x',function(){});
+this.__defineGetter__('x',function(){return 2;});
+setx()
+assertEquals(2, x);
+
+assertEquals(2, getx());
+assertEquals(2, getx());
+assertEquals(2, getx());
diff --git a/src/v8/test/mjsunit/regress/regress-396.js b/src/v8/test/mjsunit/regress/regress-396.js
new file mode 100644
index 0000000..e6f2ce3
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-396.js
@@ -0,0 +1,39 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// http://code.google.com/p/v8/issues/detail?id=396
+
+function DateYear(date) {
+ var string = date.getYear() + '';
+ if (string.length < 4) {
+ string = '' + (string - 0 + 1900);
+ }
+ return string;
+}
+
+assertEquals('1995', DateYear(new Date('Dec 25, 1995')));
+assertEquals('2005', DateYear(new Date('Dec 25, 2005')));
diff --git a/src/v8/test/mjsunit/regress/regress-3969.js b/src/v8/test/mjsunit/regress/regress-3969.js
new file mode 100644
index 0000000..4659e1c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-3969.js
@@ -0,0 +1,36 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function Inner() {
+ this.property = "OK";
+ this.o2 = 1;
+}
+
+function Outer(inner) {
+ this.inner = inner;
+}
+
+var inner = new Inner();
+var outer = new Outer(inner);
+
+Outer.prototype.boom = function() {
+ return this.inner.property;
+}
+
+assertEquals("OK", outer.boom());
+assertEquals("OK", outer.boom());
+%OptimizeFunctionOnNextCall(Outer.prototype.boom);
+assertEquals("OK", outer.boom());
+
+inner = undefined;
+%SetAllocationTimeout(0 /*interval*/, 2 /*timeout*/);
+// Call something that will do GC while holding a handle to outer's map.
+// The key is that this lets inner's map die while keeping outer's map alive.
+delete outer.inner;
+
+outer = new Outer({field: 1.51, property: "OK"});
+
+assertEquals("OK", outer.boom());
diff --git a/src/v8/test/mjsunit/regress/regress-397.js b/src/v8/test/mjsunit/regress/regress-397.js
new file mode 100644
index 0000000..0e4143d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-397.js
@@ -0,0 +1,43 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+// See http://code.google.com/p/v8/issues/detail?id=397
+
+
+function test() {
+ assertEquals("Infinity", String(Math.pow(Infinity, 0.5)));
+ assertEquals(0, Math.pow(Infinity, -0.5));
+
+ assertEquals("Infinity", String(Math.pow(-Infinity, 0.5)));
+ assertEquals(0, Math.pow(-Infinity, -0.5));
+}
+
+test();
+test();
+%OptimizeFunctionOnNextCall(test);
+test();
diff --git a/src/v8/test/mjsunit/regress/regress-3976.js b/src/v8/test/mjsunit/regress/regress-3976.js
new file mode 100644
index 0000000..efa3ac0
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-3976.js
@@ -0,0 +1,80 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --max-old-space-size=60 --check-handle-count
+
+table = [];
+
+for (var i = 0; i < 32; i++) {
+ table[i] = String.fromCharCode(i + 0x410);
+}
+
+
+var random = (function() {
+ var seed = 10;
+ return function() {
+ seed = (seed * 1009) % 8831;
+ return seed;
+ };
+})();
+
+
+function key(length) {
+ var s = "";
+ for (var i = 0; i < length; i++) {
+ s += table[random() % 32];
+ }
+ return '"' + s + '"';
+}
+
+
+function value() {
+ return '[{' + '"field1" : ' + random() + ', "field2" : ' + random() + '}]';
+}
+
+
+function generate(n) {
+ var s = '{';
+ for (var i = 0; i < n; i++) {
+ if (i > 0) s += ', ';
+ s += key(random() % 10 + 7);
+ s += ':';
+ s += value();
+ }
+ s += '}';
+ return s;
+}
+
+
+print("generating");
+
+var str = generate(50000);
+
+print("parsing " + str.length);
+JSON.parse(str);
+
+print("done");
diff --git a/src/v8/test/mjsunit/regress/regress-3985.js b/src/v8/test/mjsunit/regress/regress-3985.js
new file mode 100644
index 0000000..6dbc4bd
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-3985.js
@@ -0,0 +1,45 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var shouldThrow = false;
+
+function h() {
+ try { // Prevent inlining in Crankshaft.
+ } catch(e) { }
+ var res = g.arguments[0].x;
+ if (shouldThrow) {
+ throw res;
+ }
+ return res;
+}
+
+function g(o) { h(); }
+
+function f1() {
+ var o = { x : 1 };
+ g(o);
+ return o.x;
+}
+
+function f2() {
+ var o = { x : 2 };
+ g(o);
+ return o.x;
+}
+
+f1();
+f2();
+f1();
+f2();
+%OptimizeFunctionOnNextCall(f1);
+%OptimizeFunctionOnNextCall(f2);
+shouldThrow = true;
+try { f1(); } catch(e) {
+ assertEquals(e, 1);
+}
+try { f2(); } catch(e) {
+ assertEquals(e, 2);
+}
diff --git a/src/v8/test/mjsunit/regress/regress-399.js b/src/v8/test/mjsunit/regress/regress-399.js
new file mode 100644
index 0000000..6c8eab5
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-399.js
@@ -0,0 +1,32 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// See http://code.google.com/p/v8/issues/detail?id=399
+
+var date = new Date(1.009804e12);
+var year = Number(String(date).match(/.*(200\d)/)[1]);
+assertEquals(year, date.getFullYear());
diff --git a/src/v8/test/mjsunit/regress/regress-4023.js b/src/v8/test/mjsunit/regress/regress-4023.js
new file mode 100644
index 0000000..902741f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-4023.js
@@ -0,0 +1,67 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --expose-gc --block-concurrent-recompilation
+
+function Inner() {
+ this.property = "OK";
+ this.prop2 = 1;
+}
+
+function Outer() {
+ this.o = "u";
+}
+function KeepMapAlive(o) {
+ return o.o;
+}
+function SetInner(o, i) {
+ o.inner_field = i;
+}
+function Crash(o) {
+ return o.inner_field.property;
+}
+
+var inner = new Inner();
+var outer = new Outer();
+
+// Collect type feedback.
+SetInner(new Outer(), inner);
+SetInner(outer, inner);
+
+// This function's only purpose is to stash away a Handle that keeps
+// outer's map alive during the gc() call below. We store this handle
+// on the compiler thread :-)
+KeepMapAlive(outer);
+KeepMapAlive(outer);
+%OptimizeFunctionOnNextCall(KeepMapAlive, "concurrent");
+KeepMapAlive(outer);
+
+// So far, all is well. Collect type feedback and optimize.
+print(Crash(outer));
+print(Crash(outer));
+%OptimizeFunctionOnNextCall(Crash);
+print(Crash(outer));
+
+// Null out references and perform GC. This will keep outer's map alive
+// (due to the handle created above), but will let inner's map die. Hence,
+// inner_field's field type stored in outer's map will get cleared.
+inner = undefined;
+outer = undefined;
+gc();
+
+// We could unblock the compiler thread now. But why bother?
+
+// Now optimize SetInner while inner_field's type is still cleared!
+// This will generate optimized code that stores arbitrary objects
+// into inner_field without checking their type against the field type.
+%OptimizeFunctionOnNextCall(SetInner);
+
+// Use the optimized code to store an arbitrary object into
+// o2's inner_field, without triggering any dependent code deopts...
+var o2 = new Outer();
+SetInner(o2, { invalid: 1.51, property: "OK" });
+// ...and then use the existing code expecting an Inner-class object to
+// read invalid data (in this case, a raw double).
+// We crash trying to convert the raw double into a printable string.
+print(Crash(o2));
diff --git a/src/v8/test/mjsunit/regress/regress-4027.js b/src/v8/test/mjsunit/regress/regress-4027.js
new file mode 100644
index 0000000..3a5d11b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-4027.js
@@ -0,0 +1,60 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --expose-gc
+
+function Inner() {
+ this.inner_name = "inner";
+}
+
+function Boom() {
+ this.boom = "boom";
+}
+
+function Outer() {
+ this.outer_name = "outer";
+}
+
+function SetInner(inner, value) {
+ inner.prop = value;
+}
+
+function SetOuter(outer, value) {
+ outer.inner = value;
+}
+
+var inner1 = new Inner();
+var inner2 = new Inner();
+
+SetInner(inner1, 10);
+SetInner(inner2, 10);
+
+var outer1 = new Outer();
+var outer2 = new Outer();
+var outer3 = new Outer();
+
+SetOuter(outer1, inner1);
+SetOuter(outer1, inner1);
+SetOuter(outer1, inner1);
+
+SetOuter(outer2, inner2);
+SetOuter(outer2, inner2);
+SetOuter(outer2, inner2);
+
+SetOuter(outer3, inner2);
+SetOuter(outer3, inner2);
+SetOuter(outer3, inner2);
+
+
+SetInner(inner2, 6.5);
+
+outer1 = null;
+inner1 = null;
+
+gc();
+
+var boom = new Boom();
+SetOuter(outer2, boom);
+
+gc();
diff --git a/src/v8/test/mjsunit/regress/regress-404981.js b/src/v8/test/mjsunit/regress/regress-404981.js
new file mode 100644
index 0000000..5508d6f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-404981.js
@@ -0,0 +1,6 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var large_object = new Array(5000001);
+large_object.length = 23;
diff --git a/src/v8/test/mjsunit/regress/regress-406.js b/src/v8/test/mjsunit/regress/regress-406.js
new file mode 100644
index 0000000..f48a5de
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-406.js
@@ -0,0 +1,69 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test of constant folding of boolean-valued expressions.
+
+// See http://code.google.com/p/v8/issues/detail?id=406
+
+assertFalse(typeof(0) == "zero");
+assertTrue(typeof(0) != "zero");
+
+// The and and or truth tables with both operands constant.
+assertFalse(typeof(0) == "zero" && typeof(0) == "zero");
+assertFalse(typeof(0) == "zero" && typeof(0) != "zero");
+assertFalse(typeof(0) != "zero" && typeof(0) == "zero");
+assertTrue(typeof(0) != "zero" && typeof(0) != "zero");
+
+assertFalse(typeof(0) == "zero" || typeof(0) == "zero");
+assertTrue(typeof(0) == "zero" || typeof(0) != "zero");
+assertTrue(typeof(0) != "zero" || typeof(0) == "zero");
+assertTrue(typeof(0) != "zero" || typeof(0) != "zero");
+
+// Same with just the left operand constant.
+// Helper function to prevent simple constant folding.
+function one() { return 1; }
+
+assertFalse(typeof(0) == "zero" && one() < 0);
+assertFalse(typeof(0) == "zero" && one() > 0);
+assertFalse(typeof(0) != "zero" && one() < 0);
+assertTrue(typeof(0) != "zero" && one() > 0);
+
+assertFalse(typeof(0) == "zero" || one() < 0);
+assertTrue(typeof(0) == "zero" || one() > 0);
+assertTrue(typeof(0) != "zero" || one() < 0);
+assertTrue(typeof(0) != "zero" || one() > 0);
+
+// Same with just the right operand constant.
+assertFalse(one() < 0 && typeof(0) == "zero");
+assertFalse(one() < 0 && typeof(0) != "zero");
+assertFalse(one() > 0 && typeof(0) == "zero");
+assertTrue(one() > 0 && typeof(0) != "zero");
+
+assertFalse(one() < 0 || typeof(0) == "zero");
+assertTrue(one() < 0 || typeof(0) != "zero");
+assertTrue(one() > 0 || typeof(0) == "zero");
+assertTrue(one() > 0 || typeof(0) != "zero");
diff --git a/src/v8/test/mjsunit/regress/regress-408036.js b/src/v8/test/mjsunit/regress/regress-408036.js
new file mode 100644
index 0000000..a4dfade
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-408036.js
@@ -0,0 +1,5 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-natives-as 1
diff --git a/src/v8/test/mjsunit/regress/regress-410030.js b/src/v8/test/mjsunit/regress/regress-410030.js
new file mode 100644
index 0000000..efd4b1e
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-410030.js
@@ -0,0 +1,43 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+try {
+ throw 0;
+} catch(e) {
+ assertSame(3, eval("delete x; const x=3; x"));
+}
+
+
+try {
+ throw 0;
+} catch(e) {
+ assertSame(3, (1,eval)("delete x1; const x1=3; x1"));
+}
+
+
+try {
+ throw 0;
+} catch(e) {
+ with({}) {
+ assertSame(3, eval("delete x2; const x2=3; x2"));
+ }
+}
+
+
+(function f() {
+ try {
+ throw 0;
+ } catch(e) {
+ assertSame(3, eval("delete x; const x=3; x"));
+ }
+}());
+
+
+(function f() {
+ try {
+ throw 0;
+ } catch(e) {
+ assertSame(3, (1,eval)("delete x4; const x4=3; x4"));
+ }
+}());
diff --git a/src/v8/test/mjsunit/regress/regress-410912.js b/src/v8/test/mjsunit/regress/regress-410912.js
new file mode 100644
index 0000000..9a2e46d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-410912.js
@@ -0,0 +1,206 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --expose-gc --opt --no-always-opt
+
+var assertDoesNotThrow;
+var assertInstanceof;
+var assertUnreachable;
+var assertOptimized;
+var assertUnoptimized;
+function classOf(object) { var string = Object.prototype.toString.call(object); return string.substring(8, string.length - 1); }
+function PrettyPrint(value) { return ""; }
+function PrettyPrintArrayElement(value, index, array) { return ""; }
+function fail(expectedText, found, name_opt) { }
+function deepObjectEquals(a, b) { var aProps = Object.keys(a); aProps.sort(); var bProps = Object.keys(b); bProps.sort(); if (!deepEquals(aProps, bProps)) { return false; } for (var i = 0; i < aProps.length; i++) { if (!deepEquals(a[aProps[i]], b[aProps[i]])) { return false; } } return true; }
+function deepEquals(a, b) { if (a === b) { if (a === 0) return (1 / a) === (1 / b); return true; } if (typeof a != typeof b) return false; if (typeof a == "number") return isNaN(a) && isNaN(b); if (typeof a !== "object" && typeof a !== "function") return false; var objectClass = classOf(a); if (objectClass !== classOf(b)) return false; if (objectClass === "RegExp") { return (a.toString() === b.toString()); } if (objectClass === "Function") return false; if (objectClass === "Array") { var elementCount = 0; if (a.length != b.length) { return false; } for (var i = 0; i < a.length; i++) { if (!deepEquals(a[i], b[i])) return false; } return true; } if (objectClass == "String" || objectClass == "Number" || objectClass == "Boolean" || objectClass == "Date") { if (a.valueOf() !== b.valueOf()) return false; } return deepObjectEquals(a, b); }
+assertSame = function assertSame(expected, found, name_opt) { if (found === expected) { if (expected !== 0 || (1 / expected) == (1 / found)) return; } else if ((expected !== expected) && (found !== found)) { return; } fail(PrettyPrint(expected), found, name_opt); }; assertEquals = function assertEquals(expected, found, name_opt) { if (!deepEquals(found, expected)) { fail(PrettyPrint(expected), found, name_opt); } };
+assertEqualsDelta = function assertEqualsDelta(expected, found, delta, name_opt) { assertTrue(Math.abs(expected - found) <= delta, name_opt); };
+assertArrayEquals = function assertArrayEquals(expected, found, name_opt) { var start = ""; if (name_opt) { start = name_opt + " - "; } assertEquals(expected.length, found.length, start + "array length"); if (expected.length == found.length) { for (var i = 0; i < expected.length; ++i) { assertEquals(expected[i], found[i], start + "array element at index " + i); } } };
+assertPropertiesEqual = function assertPropertiesEqual(expected, found, name_opt) { if (!deepObjectEquals(expected, found)) { fail(expected, found, name_opt); } };
+assertToStringEquals = function assertToStringEquals(expected, found, name_opt) { if (expected != String(found)) { fail(expected, found, name_opt); } };
+assertTrue = function assertTrue(value, name_opt) { assertEquals(true, value, name_opt); };
+assertFalse = function assertFalse(value, name_opt) { assertEquals(false, value, name_opt); };
+assertNull = function assertNull(value, name_opt) { if (value !== null) { fail("null", value, name_opt); } };
+assertNotNull = function assertNotNull(value, name_opt) { if (value === null) { fail("not null", value, name_opt); } };
+var __v_39 = {};
+var __v_40 = {};
+var __v_41 = {};
+var __v_42 = {};
+var __v_43 = {};
+var __v_44 = {};
+try {
+__v_0 = [1.5,,1.7];
+__v_1 = {__v_0:1.8};
+} catch(e) { print("Caught: " + e); }
+function __f_0(__v_1,__v_0,i) {
+ __v_1.a = __v_0[i];
+ gc();
+}
+try {
+__f_0(__v_1,__v_0,0);
+__f_0(__v_1,__v_0,0);
+%OptimizeFunctionOnNextCall(__f_0);
+__f_0(__v_1,__v_0,1);
+assertEquals(undefined, __v_1.a);
+__v_0 = [1,,3];
+__v_1 = {ab:5};
+} catch(e) { print("Caught: " + e); }
+function __f_1(__v_1,__v_0,i) {
+ __v_1.ab = __v_0[i];
+}
+try {
+__f_1(__v_1,__v_0,1);
+} catch(e) { print("Caught: " + e); }
+function __f_5(x) {
+ return ~x;
+}
+try {
+__f_5(42);
+assertEquals(~12, __f_5(12.45));
+assertEquals(~46, __f_5(42.87));
+__v_2 = 1, __v_4 = 2, __v_3 = 4, __v_6 = 8;
+} catch(e) { print("Caught: " + e); }
+function __f_4() {
+ return __v_2 | (__v_4 | (__v_3 | __v_6));
+}
+try {
+__f_4();
+__v_3 = "16";
+assertEquals(17 | -13 | 0 | -5, __f_4());
+} catch(e) { print("Caught: " + e); }
+function __f_6() {
+ return __f_4();
+}
+try {
+assertEquals(1 | 2 | 16 | 8, __f_6());
+__f_4 = function() { return 42; };
+assertEquals(42, __f_6());
+__v_5 = {};
+__v_5.__f_4 = __f_4;
+} catch(e) { print("Caught: " + e); }
+function __f_7(o) {
+ return o.__f_4();
+}
+try {
+for (var __v_7 = 0; __v_7 < 5; __v_7++) __f_7(__v_5);
+%OptimizeFunctionOnNextCall(__f_7);
+__f_7(__v_5);
+assertEquals(42, __f_7(__v_5));
+assertEquals(87, __f_7({__f_4: function() { return 87; }}));
+} catch(e) { print("Caught: " + e); }
+function __f_8(x,y) {
+ x = 42;
+ y = 1;
+ y = y << "0";
+ return x | y;
+}
+try {
+assertEquals(43, __f_8(0,0));
+} catch(e) { print("Caught: " + e); }
+function __f_2(x) {
+ return 'lit[' + (x + ']');
+}
+try {
+assertEquals('lit[-87]', __f_2(-87));
+assertEquals('lit[0]', __f_2(0));
+assertEquals('lit[42]', __f_2(42));
+__v_9 = "abc";
+gc();
+var __v_8;
+} catch(e) { print("Caught: " + e); }
+function __f_9(n) { return __v_9.charAt(n); }
+try {
+for (var __v_7 = 0; __v_7 < 5; __v_7++) {
+ __v_8 = __f_9(0);
+}
+%OptimizeFunctionOnNextCall(__f_9);
+__v_8 = __f_9(0);
+} catch(e) { print("Caught: " + e); }
+function __f_3(__v_2,__v_4,__v_3,__v_6) {
+ return __v_2+__v_4+__v_3+__v_6;
+}
+try {
+assertEquals(0x40000003, __f_3(1,1,2,0x3fffffff));
+} catch(e) { print("Caught: " + e); }
+try {
+__v_19 = {
+ fast_smi_only : 'fast smi only elements',
+ fast : 'fast elements',
+ fast_double : 'fast double elements',
+ dictionary : 'dictionary elements',
+ external_int32 : 'external int8 elements',
+ external_uint8 : 'external uint8 elements',
+ external_int16 : 'external int16 elements',
+ external_uint16 : 'external uint16 elements',
+ external_int32 : 'external int32 elements',
+ external_uint32 : 'external uint32 elements',
+ external_float32 : 'external float32 elements',
+ external_float64 : 'external float64 elements',
+ external_uint8_clamped : 'external uint8_clamped elements',
+ fixed_int32 : 'fixed int8 elements',
+ fixed_uint8 : 'fixed uint8 elements',
+ fixed_int16 : 'fixed int16 elements',
+ fixed_uint16 : 'fixed uint16 elements',
+ fixed_int32 : 'fixed int32 elements',
+ fixed_uint32 : 'fixed uint32 elements',
+ fixed_float32 : 'fixed float32 elements',
+ fixed_float64 : 'fixed float64 elements',
+ fixed_uint8_clamped : 'fixed uint8_clamped elements'
+}
+} catch(e) { print("Caught: " + e); }
+function __f_12() {
+}
+__v_10 = {};
+__v_10.dance = 0xD15C0;
+__v_10.drink = 0xC0C0A;
+__f_12(__v_19.fast, __v_10);
+__v_24 = [1,2,3];
+__f_12(__v_19.fast_smi_only, __v_24);
+__v_24.dance = 0xD15C0;
+__v_24.drink = 0xC0C0A;
+__f_12(__v_19.fast_smi_only, __v_24);
+function __f_18() {
+ var __v_27 = new Array();
+ __f_12(__v_19.fast_smi_only, __v_27);
+ for (var __v_18 = 0; __v_18 < 1337; __v_18++) {
+ var __v_16 = __v_18;
+ if (__v_18 == 1336) {
+ __f_12(__v_19.fast_smi_only, __v_27);
+ __v_16 = new Object();
+ }
+ __v_27[__v_18] = __v_16;
+ }
+ __f_12(__v_19.fast, __v_27);
+ var __v_15 = [];
+ __v_15[912570] = 7;
+ __f_12(__v_19.dictionary, __v_15);
+ var __v_26 = new Array(912561);
+ %SetAllocationTimeout(100000000, 10000000);
+ for (var __v_18 = 0; __v_18 < 0x20000; __v_18++) {
+ __v_26[0] = __v_18 / 2;
+ }
+ __f_12(__v_19.fixed_int8, new Int8Array(007));
+ __f_12(__v_19.fixed_uint8, new Uint8Array(007));
+ __f_12(__v_19.fixed_int16, new Int16Array(666));
+ __f_12(__v_19.fixed_uint16, new Uint16Array(42));
+ __f_12(__v_19.fixed_int32, new Int32Array(0xF));
+ __f_12(__v_19.fixed_uint32, new Uint32Array(23));
+ __f_12(__v_19.fixed_float32, new Float32Array(7));
+ __f_12(__v_19.fixed_float64, new Float64Array(0));
+ __f_12(__v_19.fixed_uint8_clamped, new Uint8ClampedArray(512));
+ var __v_13 = new ArrayBuffer(128);
+ __f_12(__v_19.external_int8, new Int8Array(__v_13));
+ __f_12(__v_37.external_uint8, new Uint8Array(__v_13));
+ __f_12(__v_19.external_int16, new Int16Array(__v_13));
+ __f_12(__v_19.external_uint16, new Uint16Array(__v_13));
+ __f_12(__v_19.external_int32, new Int32Array(__v_13));
+ __f_12(__v_19.external_uint32, new Uint32Array(__v_13));
+ __f_12(__v_19.external_float32, new Float32Array(__v_13));
+ __f_12(__v_19.external_float64, new Float64Array(__v_13));
+ __f_12(__v_19.external_uint8_clamped, new Uint8ClampedArray(__v_13));
+}
+try {
+__f_18();
+} catch(e) { }
diff --git a/src/v8/test/mjsunit/regress/regress-411210.js b/src/v8/test/mjsunit/regress/regress-411210.js
new file mode 100644
index 0000000..2dbc5ff
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-411210.js
@@ -0,0 +1,22 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --gc-interval=439 --random-seed=-423594851
+
+var __v_3;
+function __f_2() {
+ var __v_1 = new Array(3);
+ __v_1[0] = 10;
+ __v_1[1] = 15.5;
+ __v_3 = __f_2();
+ __v_1[2] = 20;
+ return __v_1;
+}
+
+try {
+ for (var __v_2 = 0; __v_2 < 3; ++__v_2) {
+ __v_3 = __f_2();
+ }
+}
+catch (e) { }
diff --git a/src/v8/test/mjsunit/regress/regress-4121.js b/src/v8/test/mjsunit/regress/regress-4121.js
new file mode 100644
index 0000000..0f03e79
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-4121.js
@@ -0,0 +1,42 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-always-opt
+
+function literals_sharing_test(warmup, optimize) {
+ function closure() {
+ // Ensure small array literals start in specific element kind mode.
+ assertTrue(%HasSmiElements([]));
+ assertTrue(%HasSmiElements([1]));
+ assertTrue(%HasSmiElements([1,2]));
+ assertTrue(%HasDoubleElements([1.1]));
+ assertTrue(%HasDoubleElements([1.1,2]));
+
+ var a = [1, 2, 3];
+ if (warmup) {
+ // Transition elements kind during warmup...
+ assertTrue(%HasSmiElements(a));
+ assertEquals(4, a.push(1.3));
+ }
+ // ... and ensure that the information about transitioning is
+ // propagated to the next closure.
+ assertTrue(%HasDoubleElements(a));
+ };
+ if (optimize) %OptimizeFunctionOnNextCall(closure);
+ closure();
+}
+
+
+function test() {
+ var warmup = true;
+ for (var i = 0; i < 3; i++) {
+ print("iter: " + i + ", warmup: "+ warmup);
+ literals_sharing_test(warmup, false);
+ warmup = false;
+ }
+ print("iter: " + i + ", opt: true");
+ literals_sharing_test(warmup, true);
+}
+
+test();
diff --git a/src/v8/test/mjsunit/regress/regress-412162.js b/src/v8/test/mjsunit/regress/regress-412162.js
new file mode 100644
index 0000000..6a7ad0c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-412162.js
@@ -0,0 +1,14 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function test() {
+ Math.abs(-NaN).toString();
+}
+
+test();
+test();
+%OptimizeFunctionOnNextCall(test);
+test();
diff --git a/src/v8/test/mjsunit/regress/regress-416.js b/src/v8/test/mjsunit/regress/regress-416.js
new file mode 100644
index 0000000..d204bd3
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-416.js
@@ -0,0 +1,38 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test of invalid Date construction, and TimeClip function.
+
+// See http://code.google.com/p/v8/issues/detail?id=416
+
+assertTrue(isNaN(new Date(1e81).getTime()), "new Date(1e81)");
+assertTrue(isNaN(new Date(-1e81).getTime()), "new Date(-1e81)");
+assertTrue(isNaN(new Date(1e81, "").getTime()), "new Date(1e81, \"\")");
+assertTrue(isNaN(new Date(-1e81, "").getTime()), "new Date(-1e81, \"\")");
+assertTrue(isNaN(new Date(Number.NaN).getTime()), "new Date(Number.NaN)");
+assertTrue(isNaN(new Date(Number.NaN, "").getTime()),
+ "new Date(Number.NaN, \"\")");
diff --git a/src/v8/test/mjsunit/regress/regress-416416.js b/src/v8/test/mjsunit/regress/regress-416416.js
new file mode 100644
index 0000000..66e882e
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-416416.js
@@ -0,0 +1,14 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function foo() {
+ try {
+ String.prototype.length.x();
+ } catch (e) {
+ }
+}
+
+foo();
+foo();
+foo();
diff --git a/src/v8/test/mjsunit/regress/regress-416730.js b/src/v8/test/mjsunit/regress/regress-416730.js
new file mode 100644
index 0000000..8d7f207
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-416730.js
@@ -0,0 +1,24 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var d = {x: undefined, y: undefined};
+
+function Crash(left, right) {
+ var c = {
+ x: right.x - left.x,
+ y: right.y - left.y
+ };
+ return c.x * c.y;
+}
+
+var a = {x: 0.5, y: 0};
+var b = {x: 1, y: 0};
+
+for (var i = 0; i < 3; i++) Crash(a, b);
+%OptimizeFunctionOnNextCall(Crash);
+Crash(a, b);
+
+Crash({x: 0, y: 0.5}, b);
diff --git a/src/v8/test/mjsunit/regress/regress-4169.js b/src/v8/test/mjsunit/regress/regress-4169.js
new file mode 100644
index 0000000..df2de03
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-4169.js
@@ -0,0 +1,9 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+with ({}) {
+ eval("var x = 23");
+ assertEquals(23, x);
+}
+assertEquals(23, x);
diff --git a/src/v8/test/mjsunit/regress/regress-4173.js b/src/v8/test/mjsunit/regress/regress-4173.js
new file mode 100644
index 0000000..9aa49be
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-4173.js
@@ -0,0 +1,58 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function Migrator(o) {
+ return o.foo;
+}
+function Loader(o) {
+ return o[0];
+}
+
+var first_smi_array = [1];
+var second_smi_array = [2];
+var first_object_array = ["first"];
+var second_object_array = ["string"];
+
+assertTrue(%HasSmiElements(first_smi_array));
+assertTrue(%HasSmiElements(second_smi_array));
+assertTrue(%HasObjectElements(first_object_array));
+assertTrue(%HasObjectElements(second_object_array));
+
+// Prepare identical transition chains for smi and object arrays.
+first_smi_array.foo = 0;
+second_smi_array.foo = 0;
+first_object_array.foo = 0;
+second_object_array.foo = 0;
+
+// Collect type feedback for not-yet-deprecated original object array map.
+for (var i = 0; i < 3; i++) Migrator(second_object_array);
+
+// Blaze a migration trail for smi array maps.
+// This marks the migrated smi array map as a migration target.
+first_smi_array.foo = 0.5;
+print(second_smi_array.foo);
+
+// Deprecate original object array map.
+// Use TryMigrate from deferred optimized code to migrate second object array.
+first_object_array.foo = 0.5;
+%OptimizeFunctionOnNextCall(Migrator);
+Migrator(second_object_array);
+
+// |second_object_array| now erroneously has a smi map.
+// Optimized code assuming smi elements will expose this.
+
+for (var i = 0; i < 3; i++) Loader(second_smi_array);
+%OptimizeFunctionOnNextCall(Loader);
+assertEquals("string", Loader(second_object_array));
+
+// Any of the following checks will also fail:
+assertTrue(%HasObjectElements(second_object_array));
+assertFalse(%HasSmiElements(second_object_array));
+assertTrue(%HaveSameMap(first_object_array, second_object_array));
+assertFalse(%HaveSameMap(first_smi_array, second_object_array));
+
+%ClearFunctionFeedback(Loader);
+%ClearFunctionFeedback(Migrator);
diff --git a/src/v8/test/mjsunit/regress/regress-4214.js b/src/v8/test/mjsunit/regress/regress-4214.js
new file mode 100644
index 0000000..7c28104
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-4214.js
@@ -0,0 +1,6 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var o = { eval: function() { return this; } }
+with (o) assertSame(o, eval());
diff --git a/src/v8/test/mjsunit/regress/regress-423633.js b/src/v8/test/mjsunit/regress/regress-423633.js
new file mode 100644
index 0000000..12d2483
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-423633.js
@@ -0,0 +1,18 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+Object.defineProperty(Array.prototype, '0', {
+ get: function() { return false; },
+});
+var a = [1, 2, 3];
+assertEquals(a, a.slice());
+assertEquals([3], a.splice(2, 1));
+
+a = [1, 2, 3];
+a[0xffff] = 4;
+// nulling the prototype lets us stay in the sparse case; otherwise the
+// getter on Array.prototype would force us into the non-sparse code.
+a.__proto__ = null;
+assertEquals(a, Array.prototype.slice.call(a));
+assertEquals([3], Array.prototype.splice.call(a, 2, 1));
diff --git a/src/v8/test/mjsunit/regress/regress-4255-1.js b/src/v8/test/mjsunit/regress/regress-4255-1.js
new file mode 100644
index 0000000..78fe860
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-4255-1.js
@@ -0,0 +1,26 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// comments to trigger lazy compilation comments to trigger lazy compilation
+// comments to trigger lazy compilation comments to trigger lazy compilation
+// comments to trigger lazy compilation comments to trigger lazy compilation
+// comments to trigger lazy compilation comments to trigger lazy compilation
+// comments to trigger lazy compilation comments to trigger lazy compilation
+// comments to trigger lazy compilation comments to trigger lazy compilation
+// comments to trigger lazy compilation comments to trigger lazy compilation
+// comments to trigger lazy compilation comments to trigger lazy compilation
+// comments to trigger lazy compilation comments to trigger lazy compilation
+// comments to trigger lazy compilation comments to trigger lazy compilation
+// comments to trigger lazy compilation comments to trigger lazy compilation
+// comments to trigger lazy compilation comments to trigger lazy compilation
+// comments to trigger lazy compilation comments to trigger lazy compilation
+// comments to trigger lazy compilation comments to trigger lazy compilation
+// comments to trigger lazy compilation comments to trigger lazy compilation
+
+'use strict';
+{
+ let x = function() {};
+ // Trigger OSR.
+ for (var i = 0; i < 1000000; i++);
+}
diff --git a/src/v8/test/mjsunit/regress/regress-4255-2.js b/src/v8/test/mjsunit/regress/regress-4255-2.js
new file mode 100644
index 0000000..bae82be
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-4255-2.js
@@ -0,0 +1,24 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// comments to trigger lazy compilation comments to trigger lazy compilation
+// comments to trigger lazy compilation comments to trigger lazy compilation
+// comments to trigger lazy compilation comments to trigger lazy compilation
+// comments to trigger lazy compilation comments to trigger lazy compilation
+// comments to trigger lazy compilation comments to trigger lazy compilation
+// comments to trigger lazy compilation comments to trigger lazy compilation
+// comments to trigger lazy compilation comments to trigger lazy compilation
+// comments to trigger lazy compilation comments to trigger lazy compilation
+// comments to trigger lazy compilation comments to trigger lazy compilation
+// comments to trigger lazy compilation comments to trigger lazy compilation
+// comments to trigger lazy compilation comments to trigger lazy compilation
+// comments to trigger lazy compilation comments to trigger lazy compilation
+// comments to trigger lazy compilation comments to trigger lazy compilation
+// comments to trigger lazy compilation comments to trigger lazy compilation
+// comments to trigger lazy compilation comments to trigger lazy compilation
+
+'use strict';
+for (let i = function f() {}; !i;);
+ // Trigger OSR.
+for (var i = 0; i < 1000000; i++);
diff --git a/src/v8/test/mjsunit/regress/regress-4255-3.js b/src/v8/test/mjsunit/regress/regress-4255-3.js
new file mode 100644
index 0000000..531d0a3
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-4255-3.js
@@ -0,0 +1,24 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// comments to trigger lazy compilation comments to trigger lazy compilation
+// comments to trigger lazy compilation comments to trigger lazy compilation
+// comments to trigger lazy compilation comments to trigger lazy compilation
+// comments to trigger lazy compilation comments to trigger lazy compilation
+// comments to trigger lazy compilation comments to trigger lazy compilation
+// comments to trigger lazy compilation comments to trigger lazy compilation
+// comments to trigger lazy compilation comments to trigger lazy compilation
+// comments to trigger lazy compilation comments to trigger lazy compilation
+// comments to trigger lazy compilation comments to trigger lazy compilation
+// comments to trigger lazy compilation comments to trigger lazy compilation
+// comments to trigger lazy compilation comments to trigger lazy compilation
+// comments to trigger lazy compilation comments to trigger lazy compilation
+// comments to trigger lazy compilation comments to trigger lazy compilation
+// comments to trigger lazy compilation comments to trigger lazy compilation
+// comments to trigger lazy compilation comments to trigger lazy compilation
+
+'use strict';
+for (let i in [1, 2, 3]) { function f() {} }
+// Trigger OSR.
+for (var i = 0; i < 1000000; i++);
diff --git a/src/v8/test/mjsunit/regress/regress-4255-4.js b/src/v8/test/mjsunit/regress/regress-4255-4.js
new file mode 100644
index 0000000..4de62d9
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-4255-4.js
@@ -0,0 +1,24 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// comments to trigger lazy compilation comments to trigger lazy compilation
+// comments to trigger lazy compilation comments to trigger lazy compilation
+// comments to trigger lazy compilation comments to trigger lazy compilation
+// comments to trigger lazy compilation comments to trigger lazy compilation
+// comments to trigger lazy compilation comments to trigger lazy compilation
+// comments to trigger lazy compilation comments to trigger lazy compilation
+// comments to trigger lazy compilation comments to trigger lazy compilation
+// comments to trigger lazy compilation comments to trigger lazy compilation
+// comments to trigger lazy compilation comments to trigger lazy compilation
+// comments to trigger lazy compilation comments to trigger lazy compilation
+// comments to trigger lazy compilation comments to trigger lazy compilation
+// comments to trigger lazy compilation comments to trigger lazy compilation
+// comments to trigger lazy compilation comments to trigger lazy compilation
+// comments to trigger lazy compilation comments to trigger lazy compilation
+// comments to trigger lazy compilation comments to trigger lazy compilation
+
+'use strict';
+class C { constructor() {} }
+// Trigger OSR
+for (var i = 0; i < 1000000; i++);
diff --git a/src/v8/test/mjsunit/regress/regress-425551.js b/src/v8/test/mjsunit/regress/regress-425551.js
new file mode 100644
index 0000000..eee5e32
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-425551.js
@@ -0,0 +1,7 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var array = new Int8Array(10);
+array[/\u007d\u00fc\u0043/] = 1.499
+assertEquals(1.499, array[/\u007d\u00fc\u0043/]);
diff --git a/src/v8/test/mjsunit/regress/regress-4266.js b/src/v8/test/mjsunit/regress/regress-4266.js
new file mode 100644
index 0000000..f886250
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-4266.js
@@ -0,0 +1,17 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --turbo-filter=test --allow-natives-syntax
+
+function test() {
+ try {
+ [].foo();
+ } catch (e) {
+ return e.message;
+ }
+}
+
+assertEquals("[].foo is not a function", test());
+%OptimizeFunctionOnNextCall(test);
+assertEquals("[].foo is not a function", test());
diff --git a/src/v8/test/mjsunit/regress/regress-4267.js b/src/v8/test/mjsunit/regress/regress-4267.js
new file mode 100644
index 0000000..f8cf746
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-4267.js
@@ -0,0 +1,16 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+"use strict";
+
+var a = [];
+Object.defineProperty(a, "0", {configurable: false, value: 10});
+assertEquals(1, a.length);
+var setter = ()=>{ a.length = 0; };
+assertThrows(setter);
+assertThrows(setter);
+%OptimizeFunctionOnNextCall(setter);
+assertThrows(setter);
diff --git a/src/v8/test/mjsunit/regress/regress-4271.js b/src/v8/test/mjsunit/regress/regress-4271.js
new file mode 100644
index 0000000..bc18771
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-4271.js
@@ -0,0 +1,24 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+if (this.Worker) {
+ // Throw rather than overflow internal field index
+ assertThrows(function() {
+ Worker.prototype.terminate();
+ });
+
+ assertThrows(function() {
+ Worker.prototype.getMessage();
+ });
+
+ assertThrows(function() {
+ Worker.prototype.postMessage({});
+ });
+
+ // Don't throw for real worker
+ var worker = new Worker('');
+ worker.getMessage();
+ worker.postMessage({});
+ worker.terminate();
+}
diff --git a/src/v8/test/mjsunit/regress/regress-4279.js b/src/v8/test/mjsunit/regress/regress-4279.js
new file mode 100644
index 0000000..64ef967
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-4279.js
@@ -0,0 +1,11 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+if (this.Worker && this.quit) {
+ try {
+ new Function(new Worker("55"));
+ } catch(err) {}
+
+ quit();
+}
diff --git a/src/v8/test/mjsunit/regress/regress-4296.js b/src/v8/test/mjsunit/regress/regress-4296.js
new file mode 100644
index 0000000..5774952
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-4296.js
@@ -0,0 +1,40 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(function () {
+ var o = new String("ab");
+ function store(o, i, v) { o[i] = v; }
+ function load(o, i) { return o[i]; }
+
+ // Initialize the IC.
+ store(o, 2, 10);
+ load(o, 2);
+
+ store(o, 0, 100);
+ assertEquals("a", load(o, 0));
+})();
+
+(function () {
+ var o = {__proto__: new String("ab")};
+ function store(o, i, v) { o[i] = v; }
+ function load(o, i) { return o[i]; }
+
+ // Initialize the IC.
+ store(o, 2, 10);
+ load(o, 2);
+
+ store(o, 0, 100);
+ assertEquals("a", load(o, 0));
+})();
+
+(function () {
+ "use strict";
+ var o = {__proto__: {}};
+ function store(o, i, v) { o[i] = v; }
+
+ // Initialize the IC.
+ store(o, 0, 100);
+ o.__proto__.__proto__ = new String("bla");
+ assertThrows(function () { store(o, 1, 100) });
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-430201.js b/src/v8/test/mjsunit/regress/regress-430201.js
new file mode 100644
index 0000000..dfd1346
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-430201.js
@@ -0,0 +1,41 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax --expose-gc --nostress-incremental-marking
+
+var array_1 = [];
+
+%SetFlags("--stress-compaction");
+for (var a = 0; a < 10000; a++) { array_1[a * 100] = 0; }
+
+gc();
+gc();
+
+var array_2 = [];
+for (var i = 0; i < 321361; i++) {
+ array_2[i] = String.fromCharCode(i)[0];
+}
diff --git a/src/v8/test/mjsunit/regress/regress-430201b.js b/src/v8/test/mjsunit/regress/regress-430201b.js
new file mode 100644
index 0000000..056504d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-430201b.js
@@ -0,0 +1,43 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax --expose-gc
+
+(function() {
+ var array_1 = [];
+
+ %SetFlags("--stress-compaction");
+ for (var a = 0; a < 10000; a++) { array_1[a * 100] = 0; }
+
+ gc();
+ gc();
+
+ var array_2 = [];
+ for (var i = 0; i < 321361; i++) {
+ array_2[i] = String.fromCharCode(i)[0];
+ }
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-4325.js b/src/v8/test/mjsunit/regress/regress-4325.js
new file mode 100644
index 0000000..e88bdd3
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-4325.js
@@ -0,0 +1,48 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --expose-gc
+
+function Inner() {
+ this.p1 = 0;
+ this.p2 = 3;
+}
+
+function Outer() {
+ this.p3 = 0;
+}
+
+var i1 = new Inner();
+var i2 = new Inner();
+var o1 = new Outer();
+o1.inner = i1;
+// o1.map now thinks "inner" has type Inner.map1.
+// Deprecate Inner.map1:
+i1.p1 = 0.5;
+// Let Inner.map1 die by migrating i2 to Inner.map2:
+print(i2.p1);
+gc();
+// o1.map's descriptor for "inner" is now a cleared WeakCell;
+// o1.inner's actual map is Inner.map2.
+// Prepare Inner.map3, deprecating Inner.map2.
+i2.p2 = 0.5;
+// Deprecate o1's map.
+var o2 = new Outer();
+o2.p3 = 0.5;
+o2.inner = i2;
+// o2.map (Outer.map2) now says that o2.inner's type is Inner.map3.
+// Migrate o1 to Outer.map2.
+print(o1.p3);
+// o1.map now thinks that o1.inner has map Inner.map3 just like o2.inner,
+// but in fact o1.inner.map is still Inner.map2!
+
+function loader(o) {
+ return o.inner.p2;
+}
+loader(o2);
+loader(o2);
+%OptimizeFunctionOnNextCall(loader);
+assertEquals(0.5, loader(o2));
+assertEquals(3, loader(o1));
+gc(); // Crashes with --verify-heap.
diff --git a/src/v8/test/mjsunit/regress/regress-435073.js b/src/v8/test/mjsunit/regress/regress-435073.js
new file mode 100644
index 0000000..dbaa612
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-435073.js
@@ -0,0 +1,12 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --verify-heap
+
+function test(x) { [x,,]; }
+
+test(0);
+test(0);
+%OptimizeFunctionOnNextCall(test);
+test(0);
diff --git a/src/v8/test/mjsunit/regress/regress-435477.js b/src/v8/test/mjsunit/regress/regress-435477.js
new file mode 100644
index 0000000..0a15000
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-435477.js
@@ -0,0 +1,16 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+var a = new Array(128);
+
+function f(a, base) {
+ a[base] = 2;
+}
+
+f(a, undefined);
+f("r12", undefined);
+f(a, 0);
+%OptimizeFunctionOnNextCall(f);
+f(a, 0);
diff --git a/src/v8/test/mjsunit/regress/regress-436893.js b/src/v8/test/mjsunit/regress/regress-436893.js
new file mode 100644
index 0000000..38e7b5f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-436893.js
@@ -0,0 +1,37 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var x = 11;
+function foo() {
+ return 42;
+}
+// Test passing null or undefined as receiver.
+function g() { return foo.apply(null, x()++); }
+%OptimizeFunctionOnNextCall(g);
+assertThrows(g);
diff --git a/src/v8/test/mjsunit/regress/regress-4374.js b/src/v8/test/mjsunit/regress/regress-4374.js
new file mode 100644
index 0000000..afae71c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-4374.js
@@ -0,0 +1,15 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --function-context-specialization
+// Flags: --turbo-filter=f --turbo-inlining
+
+var f = (function() {
+ var max = Math.max;
+ return function f() { return max(0, -1); };
+})();
+
+assertEquals(0, f());
+%OptimizeFunctionOnNextCall(f);
+assertEquals(0, f());
diff --git a/src/v8/test/mjsunit/regress/regress-4376-1.js b/src/v8/test/mjsunit/regress/regress-4376-1.js
new file mode 100644
index 0000000..edb97ee
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-4376-1.js
@@ -0,0 +1,12 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function Bar() { }
+function Baz() { }
+Baz.prototype = { __proto__: new Bar() }
+var x = new Baz();
+function foo(y) { return y instanceof Bar; }
+assertTrue(foo(x));
+Baz.prototype.__proto__ = null;
+assertFalse(foo(x));
diff --git a/src/v8/test/mjsunit/regress/regress-4376-2.js b/src/v8/test/mjsunit/regress/regress-4376-2.js
new file mode 100644
index 0000000..2a37204
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-4376-2.js
@@ -0,0 +1,9 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function Foo() {}
+var x = new Foo();
+Foo.prototype = 1;
+function foo() { return x instanceof Foo; }
+assertThrows(foo, TypeError);
diff --git a/src/v8/test/mjsunit/regress/regress-4376-3.js b/src/v8/test/mjsunit/regress/regress-4376-3.js
new file mode 100644
index 0000000..3240cf0
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-4376-3.js
@@ -0,0 +1,10 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function Foo() {}
+var x = new Foo();
+function foo() { return x instanceof Foo; }
+assertTrue(foo());
+Foo.prototype = 1;
+assertThrows(foo, TypeError);
diff --git a/src/v8/test/mjsunit/regress/regress-4377.js b/src/v8/test/mjsunit/regress/regress-4377.js
new file mode 100644
index 0000000..3c4278a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-4377.js
@@ -0,0 +1,45 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// See: http://code.google.com/p/v8/issues/detail?id=4377
+
+// Switch statements should introduce their own lexical scope
+
+'use strict';
+
+switch (1) { case 1: let x = 2; }
+
+assertThrows(function() { return x; }, ReferenceError);
+
+{
+ let result;
+ let x = 1;
+ switch (x) {
+ case 1:
+ let x = 2;
+ result = x;
+ break;
+ default:
+ result = 0;
+ break;
+ }
+ assertEquals(1, x);
+ assertEquals(2, result);
+}
+
+{
+ let result;
+ let x = 1;
+ switch (eval('x')) {
+ case 1:
+ let x = 2;
+ result = x;
+ break;
+ default:
+ result = 0;
+ break;
+ }
+ assertEquals(1, x);
+ assertEquals(2, result);
+}
diff --git a/src/v8/test/mjsunit/regress/regress-437713.js b/src/v8/test/mjsunit/regress/regress-437713.js
new file mode 100644
index 0000000..704dd3e
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-437713.js
@@ -0,0 +1,26 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --enable-slow-asserts
+
+var o1 = {
+ a00:0, a01:0, a02:0, a03:0, a04:0, a05:0, a06:0, a07:0, a08:0, a09:0, a0a:0, a0b:0, a0c:0, a0d:0, a0e:0, a0f:0,
+ a10:0, a11:0, a12:0, a13:0, a14:0, a15:0, a16:0, a17:0, a18:0, a19:0, a1a:0, a1b:0, a1c:0, a1d:0, a1e:0, a1f:0,
+
+ dbl: 0.1,
+
+ some_double: 2.13,
+};
+
+var o2 = {
+ a00:0, a01:0, a02:0, a03:0, a04:0, a05:0, a06:0, a07:0, a08:0, a09:0, a0a:0, a0b:0, a0c:0, a0d:0, a0e:0, a0f:0,
+ a10:0, a11:0, a12:0, a13:0, a14:0, a15:0, a16:0, a17:0, a18:0, a19:0, a1a:0, a1b:0, a1c:0, a1d:0, a1e:0, a1f:0,
+
+ dbl: 0.1,
+
+ boom: [],
+};
+
+o2.boom.push(42);
+assertEquals(42, o2.boom[0]);
diff --git a/src/v8/test/mjsunit/regress/regress-437765.js b/src/v8/test/mjsunit/regress/regress-437765.js
new file mode 100644
index 0000000..698c39d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-437765.js
@@ -0,0 +1,22 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(x, y) {
+ return Math.floor(x / y);
+}
+
+function bar(x, y) {
+ return foo(x + 1, y + 1);
+}
+
+function baz() {
+ bar(64, 2);
+}
+
+baz();
+baz();
+%OptimizeFunctionOnNextCall(baz);
+baz();
diff --git a/src/v8/test/mjsunit/regress/regress-4380.js b/src/v8/test/mjsunit/regress/regress-4380.js
new file mode 100644
index 0000000..06a6479
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-4380.js
@@ -0,0 +1,20 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+function bar(a) {
+ var x = a[0];
+ return x == undefined;
+}
+
+// Make the keyed load be polymorphic on holey smi and holey fast.
+bar([, 2, 3]);
+bar([, 'two', 'three']);
+bar([, 2, 3]);
+
+%OptimizeFunctionOnNextCall(bar);
+bar([, 2, 3]);
+// Verify that loading the hole doesn't cause deoptimization.
+assertOptimized(bar);
diff --git a/src/v8/test/mjsunit/regress/regress-4388.js b/src/v8/test/mjsunit/regress/regress-4388.js
new file mode 100644
index 0000000..908bccc
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-4388.js
@@ -0,0 +1,35 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turbo-filter=test*
+
+// Tests that TurboFan emits a dynamic hole-check for the temporal dead zone at
+// a non-initializing assignments to a {let} variable.
+function test_hole_check_for_let(a) {
+ 'use strict';
+ { switch (a) {
+ case 0: let x;
+ case 1: x = 9;
+ }
+ }
+}
+assertDoesNotThrow("test_hole_check_for_let(0)");
+assertThrows("test_hole_check_for_let(1)", ReferenceError);
+%OptimizeFunctionOnNextCall(test_hole_check_for_let)
+assertThrows("test_hole_check_for_let(1)", ReferenceError);
+
+// Tests that TurboFan emits a dynamic hole-check for the temporal dead zone at
+// a non-initializing assignments to a {const} variable.
+function test_hole_check_for_const(a) {
+ 'use strict';
+ { switch (a) {
+ case 0: const x = 3;
+ case 1: x = 2;
+ }
+ }
+}
+assertThrows("test_hole_check_for_const(0)", TypeError);
+assertThrows("test_hole_check_for_const(1)", ReferenceError);
+%OptimizeFunctionOnNextCall(test_hole_check_for_const)
+assertThrows("test_hole_check_for_const(1)", ReferenceError);
diff --git a/src/v8/test/mjsunit/regress/regress-4399-01.js b/src/v8/test/mjsunit/regress/regress-4399-01.js
new file mode 100644
index 0000000..c76c0c8
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-4399-01.js
@@ -0,0 +1,17 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Test that switch has the appropriate 'eval' value
+
+assertEquals("foo", eval('switch(1) { case 1: "foo" }'));
+assertEquals("foo", eval('{ switch(1) { case 1: "foo" } }'));
+assertEquals("foo", eval('switch(1) { case 1: { "foo" } }'));
+assertEquals("foo", eval('switch(1) { case 1: "foo"; break; case 2: "bar"; break }'));
+assertEquals("bar", eval('switch(2) { case 1: "foo"; break; case 2: "bar"; break }'));
+assertEquals("bar", eval('switch(1) { case 1: "foo"; case 2: "bar"; break }'));
+
+// The tag is not the value, if there's no value
+
+assertEquals(undefined, eval('switch (1) {}'));
+assertEquals(undefined, eval('switch (1) { case 1: {} }'));
diff --git a/src/v8/test/mjsunit/regress/regress-4399-02.js b/src/v8/test/mjsunit/regress/regress-4399-02.js
new file mode 100644
index 0000000..a8fdab7
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-4399-02.js
@@ -0,0 +1,8 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+
+if (this.Worker) {
+ assertThrows(function() { Worker.prototype.constructor("55"); });
+}
diff --git a/src/v8/test/mjsunit/regress/regress-441099.js b/src/v8/test/mjsunit/regress/regress-441099.js
new file mode 100644
index 0000000..63aecfd
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-441099.js
@@ -0,0 +1,53 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var Module;
+if (!Module) Module = eval('(function() { try { return Module || {} } catch(e) { return {} } })()');
+else if (ENVIRONMENT_IS_SHELL) {
+}
+var Runtime = {
+ stackSave: function () {
+ },
+ alignMemory: function (quantum) { var ret = size = Math.ceil()*(quantum ? quantum : 8); return ret; }}
+function allocate() {
+}
+function callRuntimeCallbacks(callbacks) {
+ var callback = callbacks.shift();
+ var func = callback.func;
+ if (typeof func === 'number') {
+ } else {
+ func();
+ }
+}
+var __ATINIT__ = []; // functions called during startup
+function ensureInitRuntime() {
+ callRuntimeCallbacks(__ATINIT__);
+}
+/* global initializers */ __ATINIT__.push({ func: function() { runPostSets() } });
+ function __formatString() {
+ switch (next) {
+ }
+ }
+ var Browser={mainLoop:{queue:[],pause:function () {
+ }},moduleContextCreatedCallbacks:[],workers:[],init:function () {
+ }};
+var asm = (function() {
+ 'use asm';
+function setThrew() {
+}
+function runPostSets() {
+}
+function _main() {
+}
+function _free() {
+}
+ return { runPostSets: runPostSets};
+})
+();
+var runPostSets = Module["runPostSets"] = asm["runPostSets"];
+var i64Math = (function() { // Emscripten wrapper
+ /**
+ */
+})();
+ ensureInitRuntime();
diff --git a/src/v8/test/mjsunit/regress/regress-444805.js b/src/v8/test/mjsunit/regress/regress-444805.js
new file mode 100644
index 0000000..5a533ac
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-444805.js
@@ -0,0 +1,8 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+try {
+ load("test/mjsunit/regress/regress-444805.js-script");
+} catch (e) {
+}
diff --git a/src/v8/test/mjsunit/regress/regress-444805.js-script b/src/v8/test/mjsunit/regress/regress-444805.js-script
new file mode 100644
index 0000000..17b233b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-444805.js-script
@@ -0,0 +1,11 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+Error.prepareStackTrace = function(dummyObject, v8StackTrace)
+{
+ throw new Error('boom');
+};
+
+
+throw new Error('just error');
diff --git a/src/v8/test/mjsunit/regress/regress-4450.js b/src/v8/test/mjsunit/regress/regress-4450.js
new file mode 100644
index 0000000..31ff4f1
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-4450.js
@@ -0,0 +1,8 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+({})['foobar\u2653'.slice(0, 6)] = null;
+var x;
+eval('x = function foobar() { return foobar };');
+x();
diff --git a/src/v8/test/mjsunit/regress/regress-446389.js b/src/v8/test/mjsunit/regress/regress-446389.js
new file mode 100644
index 0000000..d600638
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-446389.js
@@ -0,0 +1,12 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function runNearStackLimit(f) { function t() { try { t(); } catch(e) { f(); } }; try { t(); } catch(e) {} }
+%OptimizeFunctionOnNextCall(__f_3);
+function __f_3() {
+ var __v_5 = a[0];
+}
+runNearStackLimit(function() { __f_3(); });
diff --git a/src/v8/test/mjsunit/regress/regress-447526.js b/src/v8/test/mjsunit/regress/regress-447526.js
new file mode 100644
index 0000000..9f9396f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-447526.js
@@ -0,0 +1,25 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function bar() {
+ throw "done";
+}
+
+function foo() {
+ var i;
+ while (i) {
+ while (i) {
+}
+ i++;
+ }
+ while (true) {
+ bar();
+ }
+}
+
+
+%OptimizeFunctionOnNextCall(foo);
+assertThrows(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-447561.js b/src/v8/test/mjsunit/regress/regress-447561.js
new file mode 100644
index 0000000..e1a5ba5
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-447561.js
@@ -0,0 +1,10 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+__proto__ = /foo/gi;
+assertThrows(function() { source });
+assertThrows(function() { global });
+assertThrows(function() { ignoreCase });
+assertThrows(function() { multiline });
+assertEquals(0, lastIndex);
diff --git a/src/v8/test/mjsunit/regress/regress-447756.js b/src/v8/test/mjsunit/regress/regress-447756.js
new file mode 100644
index 0000000..1fc7518
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-447756.js
@@ -0,0 +1,48 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax
+
+function TestConstructor(c) {
+ var a = new c(-0);
+ assertSame(Infinity, 1 / a.length);
+ assertSame(Infinity, 1 / a.byteLength);
+
+ var ab = new ArrayBuffer(-0);
+ assertSame(Infinity, 1 / ab.byteLength);
+
+ var a1 = new c(ab, -0, -0);
+ assertSame(Infinity, 1 / a1.length);
+ assertSame(Infinity, 1 / a1.byteLength);
+ assertSame(Infinity, 1 / a1.byteOffset);
+}
+
+var constructors =
+ [ Uint8Array, Int8Array, Uint8ClampedArray,
+ Uint16Array, Int16Array,
+ Uint32Array, Int32Array,
+ Float32Array, Float64Array ];
+for (var i = 0; i < constructors.length; i++) {
+ TestConstructor(constructors[i]);
+}
+
+
+function TestOptimizedCode() {
+ var a = new Uint8Array(-0);
+ assertSame(Infinity, 1 / a.length);
+ assertSame(Infinity, 1 / a.byteLength);
+
+ var ab = new ArrayBuffer(-0);
+ assertSame(Infinity, 1 / ab.byteLength);
+
+ var a1 = new Uint8Array(ab, -0, -0);
+ assertSame(Infinity, 1 / a1.length);
+ assertSame(Infinity, 1 / a1.byteLength);
+ assertSame(Infinity, 1 / a1.byteOffset);
+}
+
+%OptimizeFunctionOnNextCall(Uint8Array);
+for (var i = 0; i < 1000; i++) {
+ TestOptimizedCode();
+}
diff --git a/src/v8/test/mjsunit/regress/regress-448711.js b/src/v8/test/mjsunit/regress/regress-448711.js
new file mode 100644
index 0000000..b7628ab
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-448711.js
@@ -0,0 +1,15 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax
+
+function f() {
+ this.a = { text: "Hello!" };
+}
+var v4 = new f();
+var v7 = new f();
+v7.b = {};
+Object.defineProperty(v4, '2', {});
+var v6 = new f();
+v6.a = {};
diff --git a/src/v8/test/mjsunit/regress/regress-449291.js b/src/v8/test/mjsunit/regress/regress-449291.js
new file mode 100644
index 0000000..fb56027
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-449291.js
@@ -0,0 +1,19 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+a = {y:1.5};
+a.y = 1093445778;
+b = a.y;
+c = {y:{}};
+
+function f() {
+ return {y: b};
+}
+
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+assertEquals(f().y, 1093445778);
diff --git a/src/v8/test/mjsunit/regress/regress-4493-1.js b/src/v8/test/mjsunit/regress/regress-4493-1.js
new file mode 100644
index 0000000..a24c8b0
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-4493-1.js
@@ -0,0 +1,16 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function baz(x, f) { return x.length; };
+
+function bar(x, y) {
+ if (y) {}
+ baz(x, function() { return x; });
+};
+
+function foo(x) { bar(x, ''); }
+%OptimizeFunctionOnNextCall(foo);
+foo(['a']);
diff --git a/src/v8/test/mjsunit/regress/regress-4495.js b/src/v8/test/mjsunit/regress/regress-4495.js
new file mode 100644
index 0000000..2af5bc2
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-4495.js
@@ -0,0 +1,11 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function foo(a, s) { a[s] = 35; }
+var x = { bilbo: 3 };
+var y = { frodo: 3, bilbo: 'hi' };
+foo(x, "bilbo");
+foo(x, "bilbo");
+// Without the fix for 4495, this will crash on ia32:
+foo(y, "bilbo");
diff --git a/src/v8/test/mjsunit/regress/regress-4507.js b/src/v8/test/mjsunit/regress/regress-4507.js
new file mode 100644
index 0000000..a3fe510
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-4507.js
@@ -0,0 +1,19 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function broken(value) {
+ return Math.floor(value/65536);
+}
+function toUnsigned(i) {
+ return i >>> 0;
+}
+function outer(i) {
+ return broken(toUnsigned(i));
+}
+for (var i = 0; i < 5; i++) outer(0);
+broken(0x80000000); // Spice things up with a sprinkling of type feedback.
+%OptimizeFunctionOnNextCall(outer);
+assertEquals(32768, outer(0x80000000));
diff --git a/src/v8/test/mjsunit/regress/regress-450895.js b/src/v8/test/mjsunit/regress/regress-450895.js
new file mode 100644
index 0000000..48aa00d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-450895.js
@@ -0,0 +1,9 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var v = new Array();
+Object.freeze(v);
+v = v.concat(0.5);
diff --git a/src/v8/test/mjsunit/regress/regress-4509-Class-constructor-typeerror-realm.js b/src/v8/test/mjsunit/regress/regress-4509-Class-constructor-typeerror-realm.js
new file mode 100644
index 0000000..bc83a11
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-4509-Class-constructor-typeerror-realm.js
@@ -0,0 +1,25 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+var realm = Realm.create();
+var OtherTypeError = Realm.eval(realm, 'TypeError');
+
+class Derived extends Object {
+ constructor() {
+ return null;
+ }
+}
+
+assertThrows(() => { new Derived() }, TypeError);
+
+var OtherDerived = Realm.eval(realm,
+ "'use strict';" +
+ "class Derived extends Object {" +
+ "constructor() {" +
+ "return null;" +
+ "}};");
+
+// Before throwing the TypeError we have to switch to the caller context.
+assertThrows(() => { new OtherDerived() }, TypeError);
diff --git a/src/v8/test/mjsunit/regress/regress-451322.js b/src/v8/test/mjsunit/regress/regress-451322.js
new file mode 100644
index 0000000..b7794f5
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-451322.js
@@ -0,0 +1,17 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var foo = 0;
+
+function bar() {
+ var baz = 0 - {};
+ if (foo > 24) return baz * 0;
+}
+
+bar();
+bar();
+%OptimizeFunctionOnNextCall(bar);
+bar();
diff --git a/src/v8/test/mjsunit/regress/regress-4515.js b/src/v8/test/mjsunit/regress/regress-4515.js
new file mode 100644
index 0000000..81610f0
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-4515.js
@@ -0,0 +1,17 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turbo-filter=f
+
+function f(array) {
+ return array.length >>> 0;
+}
+
+var a = new Array();
+a[4000000000] = "A";
+
+assertEquals(4000000001, f(a));
+assertEquals(4000000001, f(a));
+%OptimizeFunctionOnNextCall(f);
+assertEquals(4000000001, f(a));
diff --git a/src/v8/test/mjsunit/regress/regress-451958.js b/src/v8/test/mjsunit/regress/regress-451958.js
new file mode 100644
index 0000000..33695f2
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-451958.js
@@ -0,0 +1,31 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function k() { throw "e"; }
+var a = true;
+var a = false;
+function foo(a) {
+ var i, j;
+ if (a) {
+ for (i = 0; i < 1; j++) ;
+ for (i = 0; i < 1; k()) ;
+ for (i = 0; i < 1; i++) ;
+ }
+}
+%OptimizeFunctionOnNextCall(foo);
+foo();
+
+function bar() {
+var __v_45;
+ for (__v_45 = 0; __v_45 < 64; __v_63++) {
+ }
+ for (__v_45 = 0; __v_45 < 128; __v_36++) {
+ }
+ for (__v_45 = 128; __v_45 < 256; __v_45++) {
+ }
+}
+%OptimizeFunctionOnNextCall(bar);
+assertThrows(bar);
diff --git a/src/v8/test/mjsunit/regress/regress-4521.js b/src/v8/test/mjsunit/regress/regress-4521.js
new file mode 100644
index 0000000..f9bdafc
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-4521.js
@@ -0,0 +1,20 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+"use strict";
+
+class B {
+ foo() { return 23 }
+}
+
+class C extends B {
+ bar() { return super[%DeoptimizeFunction(C.prototype.bar), "foo"]() }
+}
+
+assertEquals(23, new C().bar());
+assertEquals(23, new C().bar());
+%OptimizeFunctionOnNextCall(C.prototype.bar);
+assertEquals(23, new C().bar());
diff --git a/src/v8/test/mjsunit/regress/regress-4525.js b/src/v8/test/mjsunit/regress/regress-4525.js
new file mode 100644
index 0000000..b962dc0
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-4525.js
@@ -0,0 +1,37 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function receiver() {
+ return this;
+}
+
+function construct(f) {
+ "use strict";
+ class B {}
+ class C extends B {
+ bar() { return super.foo() }
+ }
+ B.prototype.foo = f;
+ return new C();
+}
+
+function check(x, value, type) {
+ assertEquals("object", typeof x);
+ assertInstanceof(x, type);
+ assertEquals(value, x);
+}
+
+var o = construct(receiver);
+check(o.bar.call(123), Object(123), Number);
+check(o.bar.call("a"), Object("a"), String);
+check(o.bar.call(undefined), this, Object);
+check(o.bar.call(null), this, Object);
+
+%OptimizeFunctionOnNextCall(o.bar);
+check(o.bar.call(456), Object(456), Number);
+check(o.bar.call("b"), Object("b"), String);
+check(o.bar.call(undefined), this, Object);
+check(o.bar.call(null), this, Object);
diff --git a/src/v8/test/mjsunit/regress/regress-4534.js b/src/v8/test/mjsunit/regress/regress-4534.js
new file mode 100644
index 0000000..7042958
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-4534.js
@@ -0,0 +1,17 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --expose-gc
+
+var dp = Object.defineProperty;
+function getter() { return 111; }
+function setter(x) { print(222); }
+obj1 = {};
+dp(obj1, "golf", { get: getter, configurable: true });
+dp(obj1, "golf", { set: setter, configurable: true });
+gc();
+obj2 = {};
+dp(obj2, "golf", { get: getter, configurable: true });
+dp(obj2, "golf", { set: setter, configurable: true });
+assertTrue(%HaveSameMap(obj1, obj2));
diff --git a/src/v8/test/mjsunit/regress/regress-453481.js b/src/v8/test/mjsunit/regress/regress-453481.js
new file mode 100644
index 0000000..2bc9e46
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-453481.js
@@ -0,0 +1,127 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --always-opt
+
+var __v_0 = "";
+var __v_1 = {};
+var __v_2 = {};
+var __v_3 = {};
+var __v_4 = {};
+var __v_5 = {};
+var __v_6 = {};
+var __v_7 = {};
+var __v_8 = {};
+var __v_10 = {};
+var __v_13 = {};
+var __v_15 = {};
+var __v_16 = /abc/;
+var __v_17 = {};
+var __v_18 = function() {};
+var __v_19 = this;
+var __v_20 = {};
+var __v_21 = this;
+
+function __f_5(s) {
+ return __f_11(__f_3(__f_7(s), s.length * 8));
+}
+function __f_3(x, len) {
+ var __v_3 = 1732584193;
+ var __v_6 = -271733879;
+ var __v_5 = -1732584194;
+ var __v_7 = 271733892;
+
+ for (var i = 0; i < 1; i++) {
+ var __v_11 = __v_3;
+ var __v_14 = __v_6;
+ var __v_13 = __v_5;
+ var __v_15 = __v_7;
+
+ __v_3 = __f_10(__v_3, __v_6, __v_5, __v_7, x[__v_8+ 0], 6 , -198630844);
+ __v_7 = __f_10(__v_7, __v_3, __v_6, __v_5, x[__v_8+ 7], 10, 1126891415);
+ __v_5 = __f_10(__v_5, __v_7, __v_3, __v_6, x[__v_8+14], 15, -1416354905);
+ __v_6 = __f_10(__v_6, __v_5, __v_7, __v_3, x[__v_8+ 5], 21, -57434055);
+ __v_3 = __f_10(__v_3, __v_6, __v_5, __v_7, x[__v_8+12], 6 , 1700485571);
+ __v_7 = __f_10(__v_7, __v_3, __v_6, __v_5, x[__v_8+ 3], 10, -1894986606);
+ __v_5 = __f_10(__v_5, __v_7, __v_3, __v_6, x[__v_8+10], 15, -1051523);
+ __v_6 = __f_10(__v_6, __v_5, __v_7, __v_3, x[__v_8+ 1], 21, -2054922799);
+ __v_3 = __f_10(__v_3, __v_6, __v_5, __v_7, x[__v_8+ 8], 6 , 1873313359);
+ __v_7 = __f_10(__v_7, __v_3, __v_6, __v_5, x[__v_8+15], 10, -30611744);
+ __v_5 = __f_10(__v_5, __v_7, __v_3, __v_6, x[__v_8+ 22], 14, -1560198371);
+ __v_3 = __f_10(__v_3, __v_6, __v_5, __v_7, x[__v_8+ 4], 6 , -145523070);
+ __v_7 = __f_10(__v_7, __v_3, __v_6, __v_5, x[__v_8+11], 10, -1120210379);
+ __v_5 = __f_10(__v_5, __v_7, __v_3, __v_6, x[__v_8+ 2], 15, 718787259);
+ __v_6 = __f_10(__v_13, __v_5, __v_7, __v_3, x[__v_8+ 9], 21, -343485551);
+ __v_3 = __f_6(__v_3, __v_11);
+ __v_6 = __f_6(__v_6, __v_14);
+ __v_5 = __f_6(__v_5, __v_13);
+ __v_7 = __f_6(__v_7, __v_15);
+
+ }
+
+ return Array(__v_3, __v_13, __v_4, __v_19);
+}
+function __f_4(q, __v_3, __v_6, x, s, t) {
+ return __f_6(__f_12(__f_6(__f_6(__v_3, q), __f_6(x, t)), s),__v_6);
+}
+function __f_13(__v_3, __v_6, __v_5, __v_7, x, s, t) {
+ return __f_4((__v_6 & __v_5) | ((~__v_6) & __v_7), __v_3, __v_6, x, s, t);
+}
+function __f_8(__v_3, __v_6, __v_5, __v_7, x, s, t) {
+ return __f_4((__v_6 & __v_7) | (__v_5 & (~__v_7)), __v_3, __v_6, x, s, t);
+}
+function __f_9(__v_3, __v_6, __v_5, __v_7, x, s, t) {
+ return __f_4(__v_6 ^ __v_5 ^ __v_7, __v_3, __v_6, x, s, t);
+}
+function __f_10(__v_3, __v_6, __v_5, __v_7, x, s, t) {
+ return __f_4(__v_5 ^ (__v_6 | (~__v_7)), __v_3, __v_6, x, s, t);
+}
+function __f_6(x, y) {
+ var __v_12 = (x & 0xFFFF) + (y & 0xFFFF);
+ var __v_18 = (x >> 16) + (y >> 16) + (__v_12 >> 16);
+ return (__v_18 << 16) | (__v_12 & 0xFFFF);
+}
+function __f_12(num, cnt) {
+ return (num << cnt) | (num >>> (32 - cnt));
+}
+function __f_7(__v_16) {
+ var __v_4 = Array();
+ var __v_9 = (1 << 8) - 1;
+ for(var __v_8 = 0; __v_8 < __v_16.length * 8; __v_8 += 8)
+ __v_4[__v_8>>5] |= (__v_16.charCodeAt(__v_8 / 8) & __v_9) << (__v_8%32);
+ return __v_4;
+}
+
+function __f_11(binarray) { return __v_16; }
+
+try {
+__v_10 = "Rebellious subjects, enemies to peace,\n\
+Profaners of this neighbour-stained steel,--\n\
+Will they not hear? What, ho! you men, you beasts,\n\
+That quench the fire of your pernicious rage\n\
+With purple fountains issuing from your veins,\n\
+On pain of torture, from those bloody hands\n\
+Throw your mistemper'__v_7 weapons to the ground,\n\
+And hear the sentence of your moved prince.\n\
+Three civil brawls, bred of an airy word,\n\
+By thee, old Capulet, and Montague,\n\
+Have thrice disturb'__v_7 the quiet of our streets,\n\
+And made Verona's ancient citizens\n\
+Cast by their grave beseeming ornaments,\n\
+To wield old partisans, in hands as old,\n\
+Canker'__v_7 with peace, to part your canker'__v_7 hate:\n\
+If ever you disturb our streets again,\n\
+Your lives shall pay the forfeit of the peace.\n\
+For this time, all the rest depart away:\n\
+You Capulet; shall go along with me:\n\
+And, Montague, come you this afternoon,\n\
+To know our further pleasure in this case,\n\
+To old Free-town, our common judgment-place.\n\
+Once more, on pain of death, all men depart.\n"
+ function assertEquals(a, b) { }
+for (var __v_8 = 0; __v_8 < 11; ++__v_8) {
+ assertEquals(__f_5(__v_10), "1b8719c72d5d8bfd06e096ef6c6288c5");
+}
+
+} catch(e) { print("Caught: " + e); }
diff --git a/src/v8/test/mjsunit/regress/regress-45469.js b/src/v8/test/mjsunit/regress/regress-45469.js
new file mode 100644
index 0000000..1abe0f9
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-45469.js
@@ -0,0 +1,44 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test that global regexps capture and fail in the correct cyclic way.
+
+var re = /x/g;
+
+for (var i = 0; i < 15; i++) {
+ assertEquals(i % 3, re.lastIndex, "preindex" + i);
+ var res = re.exec("xx");
+ assertEquals(i % 3 == 2 ? null : ["x"], res, "res" + i);
+}
+
+re = /x/g;
+
+for (var i = 0; i < 15; i++) {
+ assertEquals(i % 3, re.lastIndex, "testpreindex" + i);
+ var res = re.test("xx");
+ assertEquals(i % 3 != 2, res, "testres" + i);
+}
diff --git a/src/v8/test/mjsunit/regress/regress-454725.js b/src/v8/test/mjsunit/regress/regress-454725.js
new file mode 100644
index 0000000..a2469d1
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-454725.js
@@ -0,0 +1,42 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --expose-gc
+
+var __v_9 = {};
+var depth = 15;
+var current = 0;
+
+function __f_15(__v_3) {
+ if ((__v_3 % 50) != 0) {
+ return __v_3;
+ } else {
+ return __v_9 + 0.5;
+ }
+}
+function __f_13(a) {
+ a[100000 - 2] = 1;
+ for (var __v_3= 0; __v_3 < 70000; ++__v_3 ) {
+ a[__v_3] = __f_15(__v_3);
+ }
+}
+function __f_2(size) {
+
+}
+var tmp;
+function __f_18(allocator) {
+ current++;
+ if (current == depth) return;
+ var __v_7 = new allocator(100000);
+ __f_13(__v_7);
+ var __v_4 = 6;
+ for (var __v_3= 0; __v_3 < 70000; __v_3 += 501 ) {
+ tmp += __v_3;
+ }
+ __f_18(Array);
+ current--;
+}
+
+gc();
+__f_18(__f_2);
diff --git a/src/v8/test/mjsunit/regress/regress-455207.js b/src/v8/test/mjsunit/regress/regress-455207.js
new file mode 100644
index 0000000..88fec4a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-455207.js
@@ -0,0 +1,12 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+var s = "";
+for (var i = 16; i < 1085; i++) {
+ s += ("var a" + i + " = " + i + ";");
+}
+s += "const x = 10;" +
+ "assertEquals(10, x); x = 11; assertEquals(11, x)";
+assertThrows(function() { eval(s); });
diff --git a/src/v8/test/mjsunit/regress/regress-455212.js b/src/v8/test/mjsunit/regress/regress-455212.js
new file mode 100644
index 0000000..f2fd033
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-455212.js
@@ -0,0 +1,33 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Typeof expression must resolve to 'undefined' when it used on a
+// non-existing property. It is *not* allowed to throw a
+// ReferenceError.
+
+// eval("\u0060\u005c") is an unterminated template string (\u0060)
+assertThrows("\u0060\u005c", SyntaxError);
diff --git a/src/v8/test/mjsunit/regress/regress-4577.js b/src/v8/test/mjsunit/regress/regress-4577.js
new file mode 100644
index 0000000..ea46fdd
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-4577.js
@@ -0,0 +1,21 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function f(...arguments) {
+ return Array.isArray(arguments);
+}
+assertTrue(f());
+
+function g({arguments}) {
+ return arguments === 42;
+}
+assertTrue(g({arguments: 42}));
+
+function foo() {
+ let arguments = 2;
+ return arguments;
+}
+assertEquals(2, foo());
+
+assertThrows(function(x = arguments, arguments) {}, ReferenceError);
diff --git a/src/v8/test/mjsunit/regress/regress-457935.js b/src/v8/test/mjsunit/regress/regress-457935.js
new file mode 100644
index 0000000..d34db05
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-457935.js
@@ -0,0 +1,26 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function dummy(x) { };
+
+function g() {
+ return g.arguments;
+}
+
+function f(limit) {
+ var i = 0;
+ var o = {};
+ for (; i < limit; i++) {
+ o.y = +o.y;
+ g();
+ }
+}
+
+f(1);
+f(1);
+%OptimizeFunctionOnNextCall(f);
+dummy(f(1));
+dummy(f(2));
diff --git a/src/v8/test/mjsunit/regress/regress-458876.js b/src/v8/test/mjsunit/regress/regress-458876.js
new file mode 100644
index 0000000..7df0615
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-458876.js
@@ -0,0 +1,16 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function module() {
+ "use asm";
+ function foo() {
+ do ; while (foo ? 0 : 1) ;
+ return -1 > 0 ? -1 : 0;
+ }
+ return foo;
+}
+
+var foo = module();
+assertEquals(0, foo());
+assertEquals(0, foo());
diff --git a/src/v8/test/mjsunit/regress/regress-458987.js b/src/v8/test/mjsunit/regress/regress-458987.js
new file mode 100644
index 0000000..f7a7edc
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-458987.js
@@ -0,0 +1,16 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(function () {
+ "use asm";
+
+ function g() {}
+
+ runNearStackLimit(g);
+})();
+
+function runNearStackLimit(f) {
+ function g() { try { g(); } catch(e) { f(); } };
+ g();
+}
diff --git a/src/v8/test/mjsunit/regress/regress-4595.js b/src/v8/test/mjsunit/regress/regress-4595.js
new file mode 100644
index 0000000..53b759a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-4595.js
@@ -0,0 +1,10008 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Should parse quickly and successfully (and not run out of memory).
+var obj = {
+foo0: () => {},
+foo1: () => {},
+foo2: () => {},
+foo3: () => {},
+foo4: () => {},
+foo5: () => {},
+foo6: () => {},
+foo7: () => {},
+foo8: () => {},
+foo9: () => {},
+foo10: () => {},
+foo11: () => {},
+foo12: () => {},
+foo13: () => {},
+foo14: () => {},
+foo15: () => {},
+foo16: () => {},
+foo17: () => {},
+foo18: () => {},
+foo19: () => {},
+foo20: () => {},
+foo21: () => {},
+foo22: () => {},
+foo23: () => {},
+foo24: () => {},
+foo25: () => {},
+foo26: () => {},
+foo27: () => {},
+foo28: () => {},
+foo29: () => {},
+foo30: () => {},
+foo31: () => {},
+foo32: () => {},
+foo33: () => {},
+foo34: () => {},
+foo35: () => {},
+foo36: () => {},
+foo37: () => {},
+foo38: () => {},
+foo39: () => {},
+foo40: () => {},
+foo41: () => {},
+foo42: () => {},
+foo43: () => {},
+foo44: () => {},
+foo45: () => {},
+foo46: () => {},
+foo47: () => {},
+foo48: () => {},
+foo49: () => {},
+foo50: () => {},
+foo51: () => {},
+foo52: () => {},
+foo53: () => {},
+foo54: () => {},
+foo55: () => {},
+foo56: () => {},
+foo57: () => {},
+foo58: () => {},
+foo59: () => {},
+foo60: () => {},
+foo61: () => {},
+foo62: () => {},
+foo63: () => {},
+foo64: () => {},
+foo65: () => {},
+foo66: () => {},
+foo67: () => {},
+foo68: () => {},
+foo69: () => {},
+foo70: () => {},
+foo71: () => {},
+foo72: () => {},
+foo73: () => {},
+foo74: () => {},
+foo75: () => {},
+foo76: () => {},
+foo77: () => {},
+foo78: () => {},
+foo79: () => {},
+foo80: () => {},
+foo81: () => {},
+foo82: () => {},
+foo83: () => {},
+foo84: () => {},
+foo85: () => {},
+foo86: () => {},
+foo87: () => {},
+foo88: () => {},
+foo89: () => {},
+foo90: () => {},
+foo91: () => {},
+foo92: () => {},
+foo93: () => {},
+foo94: () => {},
+foo95: () => {},
+foo96: () => {},
+foo97: () => {},
+foo98: () => {},
+foo99: () => {},
+foo100: () => {},
+foo101: () => {},
+foo102: () => {},
+foo103: () => {},
+foo104: () => {},
+foo105: () => {},
+foo106: () => {},
+foo107: () => {},
+foo108: () => {},
+foo109: () => {},
+foo110: () => {},
+foo111: () => {},
+foo112: () => {},
+foo113: () => {},
+foo114: () => {},
+foo115: () => {},
+foo116: () => {},
+foo117: () => {},
+foo118: () => {},
+foo119: () => {},
+foo120: () => {},
+foo121: () => {},
+foo122: () => {},
+foo123: () => {},
+foo124: () => {},
+foo125: () => {},
+foo126: () => {},
+foo127: () => {},
+foo128: () => {},
+foo129: () => {},
+foo130: () => {},
+foo131: () => {},
+foo132: () => {},
+foo133: () => {},
+foo134: () => {},
+foo135: () => {},
+foo136: () => {},
+foo137: () => {},
+foo138: () => {},
+foo139: () => {},
+foo140: () => {},
+foo141: () => {},
+foo142: () => {},
+foo143: () => {},
+foo144: () => {},
+foo145: () => {},
+foo146: () => {},
+foo147: () => {},
+foo148: () => {},
+foo149: () => {},
+foo150: () => {},
+foo151: () => {},
+foo152: () => {},
+foo153: () => {},
+foo154: () => {},
+foo155: () => {},
+foo156: () => {},
+foo157: () => {},
+foo158: () => {},
+foo159: () => {},
+foo160: () => {},
+foo161: () => {},
+foo162: () => {},
+foo163: () => {},
+foo164: () => {},
+foo165: () => {},
+foo166: () => {},
+foo167: () => {},
+foo168: () => {},
+foo169: () => {},
+foo170: () => {},
+foo171: () => {},
+foo172: () => {},
+foo173: () => {},
+foo174: () => {},
+foo175: () => {},
+foo176: () => {},
+foo177: () => {},
+foo178: () => {},
+foo179: () => {},
+foo180: () => {},
+foo181: () => {},
+foo182: () => {},
+foo183: () => {},
+foo184: () => {},
+foo185: () => {},
+foo186: () => {},
+foo187: () => {},
+foo188: () => {},
+foo189: () => {},
+foo190: () => {},
+foo191: () => {},
+foo192: () => {},
+foo193: () => {},
+foo194: () => {},
+foo195: () => {},
+foo196: () => {},
+foo197: () => {},
+foo198: () => {},
+foo199: () => {},
+foo200: () => {},
+foo201: () => {},
+foo202: () => {},
+foo203: () => {},
+foo204: () => {},
+foo205: () => {},
+foo206: () => {},
+foo207: () => {},
+foo208: () => {},
+foo209: () => {},
+foo210: () => {},
+foo211: () => {},
+foo212: () => {},
+foo213: () => {},
+foo214: () => {},
+foo215: () => {},
+foo216: () => {},
+foo217: () => {},
+foo218: () => {},
+foo219: () => {},
+foo220: () => {},
+foo221: () => {},
+foo222: () => {},
+foo223: () => {},
+foo224: () => {},
+foo225: () => {},
+foo226: () => {},
+foo227: () => {},
+foo228: () => {},
+foo229: () => {},
+foo230: () => {},
+foo231: () => {},
+foo232: () => {},
+foo233: () => {},
+foo234: () => {},
+foo235: () => {},
+foo236: () => {},
+foo237: () => {},
+foo238: () => {},
+foo239: () => {},
+foo240: () => {},
+foo241: () => {},
+foo242: () => {},
+foo243: () => {},
+foo244: () => {},
+foo245: () => {},
+foo246: () => {},
+foo247: () => {},
+foo248: () => {},
+foo249: () => {},
+foo250: () => {},
+foo251: () => {},
+foo252: () => {},
+foo253: () => {},
+foo254: () => {},
+foo255: () => {},
+foo256: () => {},
+foo257: () => {},
+foo258: () => {},
+foo259: () => {},
+foo260: () => {},
+foo261: () => {},
+foo262: () => {},
+foo263: () => {},
+foo264: () => {},
+foo265: () => {},
+foo266: () => {},
+foo267: () => {},
+foo268: () => {},
+foo269: () => {},
+foo270: () => {},
+foo271: () => {},
+foo272: () => {},
+foo273: () => {},
+foo274: () => {},
+foo275: () => {},
+foo276: () => {},
+foo277: () => {},
+foo278: () => {},
+foo279: () => {},
+foo280: () => {},
+foo281: () => {},
+foo282: () => {},
+foo283: () => {},
+foo284: () => {},
+foo285: () => {},
+foo286: () => {},
+foo287: () => {},
+foo288: () => {},
+foo289: () => {},
+foo290: () => {},
+foo291: () => {},
+foo292: () => {},
+foo293: () => {},
+foo294: () => {},
+foo295: () => {},
+foo296: () => {},
+foo297: () => {},
+foo298: () => {},
+foo299: () => {},
+foo300: () => {},
+foo301: () => {},
+foo302: () => {},
+foo303: () => {},
+foo304: () => {},
+foo305: () => {},
+foo306: () => {},
+foo307: () => {},
+foo308: () => {},
+foo309: () => {},
+foo310: () => {},
+foo311: () => {},
+foo312: () => {},
+foo313: () => {},
+foo314: () => {},
+foo315: () => {},
+foo316: () => {},
+foo317: () => {},
+foo318: () => {},
+foo319: () => {},
+foo320: () => {},
+foo321: () => {},
+foo322: () => {},
+foo323: () => {},
+foo324: () => {},
+foo325: () => {},
+foo326: () => {},
+foo327: () => {},
+foo328: () => {},
+foo329: () => {},
+foo330: () => {},
+foo331: () => {},
+foo332: () => {},
+foo333: () => {},
+foo334: () => {},
+foo335: () => {},
+foo336: () => {},
+foo337: () => {},
+foo338: () => {},
+foo339: () => {},
+foo340: () => {},
+foo341: () => {},
+foo342: () => {},
+foo343: () => {},
+foo344: () => {},
+foo345: () => {},
+foo346: () => {},
+foo347: () => {},
+foo348: () => {},
+foo349: () => {},
+foo350: () => {},
+foo351: () => {},
+foo352: () => {},
+foo353: () => {},
+foo354: () => {},
+foo355: () => {},
+foo356: () => {},
+foo357: () => {},
+foo358: () => {},
+foo359: () => {},
+foo360: () => {},
+foo361: () => {},
+foo362: () => {},
+foo363: () => {},
+foo364: () => {},
+foo365: () => {},
+foo366: () => {},
+foo367: () => {},
+foo368: () => {},
+foo369: () => {},
+foo370: () => {},
+foo371: () => {},
+foo372: () => {},
+foo373: () => {},
+foo374: () => {},
+foo375: () => {},
+foo376: () => {},
+foo377: () => {},
+foo378: () => {},
+foo379: () => {},
+foo380: () => {},
+foo381: () => {},
+foo382: () => {},
+foo383: () => {},
+foo384: () => {},
+foo385: () => {},
+foo386: () => {},
+foo387: () => {},
+foo388: () => {},
+foo389: () => {},
+foo390: () => {},
+foo391: () => {},
+foo392: () => {},
+foo393: () => {},
+foo394: () => {},
+foo395: () => {},
+foo396: () => {},
+foo397: () => {},
+foo398: () => {},
+foo399: () => {},
+foo400: () => {},
+foo401: () => {},
+foo402: () => {},
+foo403: () => {},
+foo404: () => {},
+foo405: () => {},
+foo406: () => {},
+foo407: () => {},
+foo408: () => {},
+foo409: () => {},
+foo410: () => {},
+foo411: () => {},
+foo412: () => {},
+foo413: () => {},
+foo414: () => {},
+foo415: () => {},
+foo416: () => {},
+foo417: () => {},
+foo418: () => {},
+foo419: () => {},
+foo420: () => {},
+foo421: () => {},
+foo422: () => {},
+foo423: () => {},
+foo424: () => {},
+foo425: () => {},
+foo426: () => {},
+foo427: () => {},
+foo428: () => {},
+foo429: () => {},
+foo430: () => {},
+foo431: () => {},
+foo432: () => {},
+foo433: () => {},
+foo434: () => {},
+foo435: () => {},
+foo436: () => {},
+foo437: () => {},
+foo438: () => {},
+foo439: () => {},
+foo440: () => {},
+foo441: () => {},
+foo442: () => {},
+foo443: () => {},
+foo444: () => {},
+foo445: () => {},
+foo446: () => {},
+foo447: () => {},
+foo448: () => {},
+foo449: () => {},
+foo450: () => {},
+foo451: () => {},
+foo452: () => {},
+foo453: () => {},
+foo454: () => {},
+foo455: () => {},
+foo456: () => {},
+foo457: () => {},
+foo458: () => {},
+foo459: () => {},
+foo460: () => {},
+foo461: () => {},
+foo462: () => {},
+foo463: () => {},
+foo464: () => {},
+foo465: () => {},
+foo466: () => {},
+foo467: () => {},
+foo468: () => {},
+foo469: () => {},
+foo470: () => {},
+foo471: () => {},
+foo472: () => {},
+foo473: () => {},
+foo474: () => {},
+foo475: () => {},
+foo476: () => {},
+foo477: () => {},
+foo478: () => {},
+foo479: () => {},
+foo480: () => {},
+foo481: () => {},
+foo482: () => {},
+foo483: () => {},
+foo484: () => {},
+foo485: () => {},
+foo486: () => {},
+foo487: () => {},
+foo488: () => {},
+foo489: () => {},
+foo490: () => {},
+foo491: () => {},
+foo492: () => {},
+foo493: () => {},
+foo494: () => {},
+foo495: () => {},
+foo496: () => {},
+foo497: () => {},
+foo498: () => {},
+foo499: () => {},
+foo500: () => {},
+foo501: () => {},
+foo502: () => {},
+foo503: () => {},
+foo504: () => {},
+foo505: () => {},
+foo506: () => {},
+foo507: () => {},
+foo508: () => {},
+foo509: () => {},
+foo510: () => {},
+foo511: () => {},
+foo512: () => {},
+foo513: () => {},
+foo514: () => {},
+foo515: () => {},
+foo516: () => {},
+foo517: () => {},
+foo518: () => {},
+foo519: () => {},
+foo520: () => {},
+foo521: () => {},
+foo522: () => {},
+foo523: () => {},
+foo524: () => {},
+foo525: () => {},
+foo526: () => {},
+foo527: () => {},
+foo528: () => {},
+foo529: () => {},
+foo530: () => {},
+foo531: () => {},
+foo532: () => {},
+foo533: () => {},
+foo534: () => {},
+foo535: () => {},
+foo536: () => {},
+foo537: () => {},
+foo538: () => {},
+foo539: () => {},
+foo540: () => {},
+foo541: () => {},
+foo542: () => {},
+foo543: () => {},
+foo544: () => {},
+foo545: () => {},
+foo546: () => {},
+foo547: () => {},
+foo548: () => {},
+foo549: () => {},
+foo550: () => {},
+foo551: () => {},
+foo552: () => {},
+foo553: () => {},
+foo554: () => {},
+foo555: () => {},
+foo556: () => {},
+foo557: () => {},
+foo558: () => {},
+foo559: () => {},
+foo560: () => {},
+foo561: () => {},
+foo562: () => {},
+foo563: () => {},
+foo564: () => {},
+foo565: () => {},
+foo566: () => {},
+foo567: () => {},
+foo568: () => {},
+foo569: () => {},
+foo570: () => {},
+foo571: () => {},
+foo572: () => {},
+foo573: () => {},
+foo574: () => {},
+foo575: () => {},
+foo576: () => {},
+foo577: () => {},
+foo578: () => {},
+foo579: () => {},
+foo580: () => {},
+foo581: () => {},
+foo582: () => {},
+foo583: () => {},
+foo584: () => {},
+foo585: () => {},
+foo586: () => {},
+foo587: () => {},
+foo588: () => {},
+foo589: () => {},
+foo590: () => {},
+foo591: () => {},
+foo592: () => {},
+foo593: () => {},
+foo594: () => {},
+foo595: () => {},
+foo596: () => {},
+foo597: () => {},
+foo598: () => {},
+foo599: () => {},
+foo600: () => {},
+foo601: () => {},
+foo602: () => {},
+foo603: () => {},
+foo604: () => {},
+foo605: () => {},
+foo606: () => {},
+foo607: () => {},
+foo608: () => {},
+foo609: () => {},
+foo610: () => {},
+foo611: () => {},
+foo612: () => {},
+foo613: () => {},
+foo614: () => {},
+foo615: () => {},
+foo616: () => {},
+foo617: () => {},
+foo618: () => {},
+foo619: () => {},
+foo620: () => {},
+foo621: () => {},
+foo622: () => {},
+foo623: () => {},
+foo624: () => {},
+foo625: () => {},
+foo626: () => {},
+foo627: () => {},
+foo628: () => {},
+foo629: () => {},
+foo630: () => {},
+foo631: () => {},
+foo632: () => {},
+foo633: () => {},
+foo634: () => {},
+foo635: () => {},
+foo636: () => {},
+foo637: () => {},
+foo638: () => {},
+foo639: () => {},
+foo640: () => {},
+foo641: () => {},
+foo642: () => {},
+foo643: () => {},
+foo644: () => {},
+foo645: () => {},
+foo646: () => {},
+foo647: () => {},
+foo648: () => {},
+foo649: () => {},
+foo650: () => {},
+foo651: () => {},
+foo652: () => {},
+foo653: () => {},
+foo654: () => {},
+foo655: () => {},
+foo656: () => {},
+foo657: () => {},
+foo658: () => {},
+foo659: () => {},
+foo660: () => {},
+foo661: () => {},
+foo662: () => {},
+foo663: () => {},
+foo664: () => {},
+foo665: () => {},
+foo666: () => {},
+foo667: () => {},
+foo668: () => {},
+foo669: () => {},
+foo670: () => {},
+foo671: () => {},
+foo672: () => {},
+foo673: () => {},
+foo674: () => {},
+foo675: () => {},
+foo676: () => {},
+foo677: () => {},
+foo678: () => {},
+foo679: () => {},
+foo680: () => {},
+foo681: () => {},
+foo682: () => {},
+foo683: () => {},
+foo684: () => {},
+foo685: () => {},
+foo686: () => {},
+foo687: () => {},
+foo688: () => {},
+foo689: () => {},
+foo690: () => {},
+foo691: () => {},
+foo692: () => {},
+foo693: () => {},
+foo694: () => {},
+foo695: () => {},
+foo696: () => {},
+foo697: () => {},
+foo698: () => {},
+foo699: () => {},
+foo700: () => {},
+foo701: () => {},
+foo702: () => {},
+foo703: () => {},
+foo704: () => {},
+foo705: () => {},
+foo706: () => {},
+foo707: () => {},
+foo708: () => {},
+foo709: () => {},
+foo710: () => {},
+foo711: () => {},
+foo712: () => {},
+foo713: () => {},
+foo714: () => {},
+foo715: () => {},
+foo716: () => {},
+foo717: () => {},
+foo718: () => {},
+foo719: () => {},
+foo720: () => {},
+foo721: () => {},
+foo722: () => {},
+foo723: () => {},
+foo724: () => {},
+foo725: () => {},
+foo726: () => {},
+foo727: () => {},
+foo728: () => {},
+foo729: () => {},
+foo730: () => {},
+foo731: () => {},
+foo732: () => {},
+foo733: () => {},
+foo734: () => {},
+foo735: () => {},
+foo736: () => {},
+foo737: () => {},
+foo738: () => {},
+foo739: () => {},
+foo740: () => {},
+foo741: () => {},
+foo742: () => {},
+foo743: () => {},
+foo744: () => {},
+foo745: () => {},
+foo746: () => {},
+foo747: () => {},
+foo748: () => {},
+foo749: () => {},
+foo750: () => {},
+foo751: () => {},
+foo752: () => {},
+foo753: () => {},
+foo754: () => {},
+foo755: () => {},
+foo756: () => {},
+foo757: () => {},
+foo758: () => {},
+foo759: () => {},
+foo760: () => {},
+foo761: () => {},
+foo762: () => {},
+foo763: () => {},
+foo764: () => {},
+foo765: () => {},
+foo766: () => {},
+foo767: () => {},
+foo768: () => {},
+foo769: () => {},
+foo770: () => {},
+foo771: () => {},
+foo772: () => {},
+foo773: () => {},
+foo774: () => {},
+foo775: () => {},
+foo776: () => {},
+foo777: () => {},
+foo778: () => {},
+foo779: () => {},
+foo780: () => {},
+foo781: () => {},
+foo782: () => {},
+foo783: () => {},
+foo784: () => {},
+foo785: () => {},
+foo786: () => {},
+foo787: () => {},
+foo788: () => {},
+foo789: () => {},
+foo790: () => {},
+foo791: () => {},
+foo792: () => {},
+foo793: () => {},
+foo794: () => {},
+foo795: () => {},
+foo796: () => {},
+foo797: () => {},
+foo798: () => {},
+foo799: () => {},
+foo800: () => {},
+foo801: () => {},
+foo802: () => {},
+foo803: () => {},
+foo804: () => {},
+foo805: () => {},
+foo806: () => {},
+foo807: () => {},
+foo808: () => {},
+foo809: () => {},
+foo810: () => {},
+foo811: () => {},
+foo812: () => {},
+foo813: () => {},
+foo814: () => {},
+foo815: () => {},
+foo816: () => {},
+foo817: () => {},
+foo818: () => {},
+foo819: () => {},
+foo820: () => {},
+foo821: () => {},
+foo822: () => {},
+foo823: () => {},
+foo824: () => {},
+foo825: () => {},
+foo826: () => {},
+foo827: () => {},
+foo828: () => {},
+foo829: () => {},
+foo830: () => {},
+foo831: () => {},
+foo832: () => {},
+foo833: () => {},
+foo834: () => {},
+foo835: () => {},
+foo836: () => {},
+foo837: () => {},
+foo838: () => {},
+foo839: () => {},
+foo840: () => {},
+foo841: () => {},
+foo842: () => {},
+foo843: () => {},
+foo844: () => {},
+foo845: () => {},
+foo846: () => {},
+foo847: () => {},
+foo848: () => {},
+foo849: () => {},
+foo850: () => {},
+foo851: () => {},
+foo852: () => {},
+foo853: () => {},
+foo854: () => {},
+foo855: () => {},
+foo856: () => {},
+foo857: () => {},
+foo858: () => {},
+foo859: () => {},
+foo860: () => {},
+foo861: () => {},
+foo862: () => {},
+foo863: () => {},
+foo864: () => {},
+foo865: () => {},
+foo866: () => {},
+foo867: () => {},
+foo868: () => {},
+foo869: () => {},
+foo870: () => {},
+foo871: () => {},
+foo872: () => {},
+foo873: () => {},
+foo874: () => {},
+foo875: () => {},
+foo876: () => {},
+foo877: () => {},
+foo878: () => {},
+foo879: () => {},
+foo880: () => {},
+foo881: () => {},
+foo882: () => {},
+foo883: () => {},
+foo884: () => {},
+foo885: () => {},
+foo886: () => {},
+foo887: () => {},
+foo888: () => {},
+foo889: () => {},
+foo890: () => {},
+foo891: () => {},
+foo892: () => {},
+foo893: () => {},
+foo894: () => {},
+foo895: () => {},
+foo896: () => {},
+foo897: () => {},
+foo898: () => {},
+foo899: () => {},
+foo900: () => {},
+foo901: () => {},
+foo902: () => {},
+foo903: () => {},
+foo904: () => {},
+foo905: () => {},
+foo906: () => {},
+foo907: () => {},
+foo908: () => {},
+foo909: () => {},
+foo910: () => {},
+foo911: () => {},
+foo912: () => {},
+foo913: () => {},
+foo914: () => {},
+foo915: () => {},
+foo916: () => {},
+foo917: () => {},
+foo918: () => {},
+foo919: () => {},
+foo920: () => {},
+foo921: () => {},
+foo922: () => {},
+foo923: () => {},
+foo924: () => {},
+foo925: () => {},
+foo926: () => {},
+foo927: () => {},
+foo928: () => {},
+foo929: () => {},
+foo930: () => {},
+foo931: () => {},
+foo932: () => {},
+foo933: () => {},
+foo934: () => {},
+foo935: () => {},
+foo936: () => {},
+foo937: () => {},
+foo938: () => {},
+foo939: () => {},
+foo940: () => {},
+foo941: () => {},
+foo942: () => {},
+foo943: () => {},
+foo944: () => {},
+foo945: () => {},
+foo946: () => {},
+foo947: () => {},
+foo948: () => {},
+foo949: () => {},
+foo950: () => {},
+foo951: () => {},
+foo952: () => {},
+foo953: () => {},
+foo954: () => {},
+foo955: () => {},
+foo956: () => {},
+foo957: () => {},
+foo958: () => {},
+foo959: () => {},
+foo960: () => {},
+foo961: () => {},
+foo962: () => {},
+foo963: () => {},
+foo964: () => {},
+foo965: () => {},
+foo966: () => {},
+foo967: () => {},
+foo968: () => {},
+foo969: () => {},
+foo970: () => {},
+foo971: () => {},
+foo972: () => {},
+foo973: () => {},
+foo974: () => {},
+foo975: () => {},
+foo976: () => {},
+foo977: () => {},
+foo978: () => {},
+foo979: () => {},
+foo980: () => {},
+foo981: () => {},
+foo982: () => {},
+foo983: () => {},
+foo984: () => {},
+foo985: () => {},
+foo986: () => {},
+foo987: () => {},
+foo988: () => {},
+foo989: () => {},
+foo990: () => {},
+foo991: () => {},
+foo992: () => {},
+foo993: () => {},
+foo994: () => {},
+foo995: () => {},
+foo996: () => {},
+foo997: () => {},
+foo998: () => {},
+foo999: () => {},
+foo1000: () => {},
+foo1001: () => {},
+foo1002: () => {},
+foo1003: () => {},
+foo1004: () => {},
+foo1005: () => {},
+foo1006: () => {},
+foo1007: () => {},
+foo1008: () => {},
+foo1009: () => {},
+foo1010: () => {},
+foo1011: () => {},
+foo1012: () => {},
+foo1013: () => {},
+foo1014: () => {},
+foo1015: () => {},
+foo1016: () => {},
+foo1017: () => {},
+foo1018: () => {},
+foo1019: () => {},
+foo1020: () => {},
+foo1021: () => {},
+foo1022: () => {},
+foo1023: () => {},
+foo1024: () => {},
+foo1025: () => {},
+foo1026: () => {},
+foo1027: () => {},
+foo1028: () => {},
+foo1029: () => {},
+foo1030: () => {},
+foo1031: () => {},
+foo1032: () => {},
+foo1033: () => {},
+foo1034: () => {},
+foo1035: () => {},
+foo1036: () => {},
+foo1037: () => {},
+foo1038: () => {},
+foo1039: () => {},
+foo1040: () => {},
+foo1041: () => {},
+foo1042: () => {},
+foo1043: () => {},
+foo1044: () => {},
+foo1045: () => {},
+foo1046: () => {},
+foo1047: () => {},
+foo1048: () => {},
+foo1049: () => {},
+foo1050: () => {},
+foo1051: () => {},
+foo1052: () => {},
+foo1053: () => {},
+foo1054: () => {},
+foo1055: () => {},
+foo1056: () => {},
+foo1057: () => {},
+foo1058: () => {},
+foo1059: () => {},
+foo1060: () => {},
+foo1061: () => {},
+foo1062: () => {},
+foo1063: () => {},
+foo1064: () => {},
+foo1065: () => {},
+foo1066: () => {},
+foo1067: () => {},
+foo1068: () => {},
+foo1069: () => {},
+foo1070: () => {},
+foo1071: () => {},
+foo1072: () => {},
+foo1073: () => {},
+foo1074: () => {},
+foo1075: () => {},
+foo1076: () => {},
+foo1077: () => {},
+foo1078: () => {},
+foo1079: () => {},
+foo1080: () => {},
+foo1081: () => {},
+foo1082: () => {},
+foo1083: () => {},
+foo1084: () => {},
+foo1085: () => {},
+foo1086: () => {},
+foo1087: () => {},
+foo1088: () => {},
+foo1089: () => {},
+foo1090: () => {},
+foo1091: () => {},
+foo1092: () => {},
+foo1093: () => {},
+foo1094: () => {},
+foo1095: () => {},
+foo1096: () => {},
+foo1097: () => {},
+foo1098: () => {},
+foo1099: () => {},
+foo1100: () => {},
+foo1101: () => {},
+foo1102: () => {},
+foo1103: () => {},
+foo1104: () => {},
+foo1105: () => {},
+foo1106: () => {},
+foo1107: () => {},
+foo1108: () => {},
+foo1109: () => {},
+foo1110: () => {},
+foo1111: () => {},
+foo1112: () => {},
+foo1113: () => {},
+foo1114: () => {},
+foo1115: () => {},
+foo1116: () => {},
+foo1117: () => {},
+foo1118: () => {},
+foo1119: () => {},
+foo1120: () => {},
+foo1121: () => {},
+foo1122: () => {},
+foo1123: () => {},
+foo1124: () => {},
+foo1125: () => {},
+foo1126: () => {},
+foo1127: () => {},
+foo1128: () => {},
+foo1129: () => {},
+foo1130: () => {},
+foo1131: () => {},
+foo1132: () => {},
+foo1133: () => {},
+foo1134: () => {},
+foo1135: () => {},
+foo1136: () => {},
+foo1137: () => {},
+foo1138: () => {},
+foo1139: () => {},
+foo1140: () => {},
+foo1141: () => {},
+foo1142: () => {},
+foo1143: () => {},
+foo1144: () => {},
+foo1145: () => {},
+foo1146: () => {},
+foo1147: () => {},
+foo1148: () => {},
+foo1149: () => {},
+foo1150: () => {},
+foo1151: () => {},
+foo1152: () => {},
+foo1153: () => {},
+foo1154: () => {},
+foo1155: () => {},
+foo1156: () => {},
+foo1157: () => {},
+foo1158: () => {},
+foo1159: () => {},
+foo1160: () => {},
+foo1161: () => {},
+foo1162: () => {},
+foo1163: () => {},
+foo1164: () => {},
+foo1165: () => {},
+foo1166: () => {},
+foo1167: () => {},
+foo1168: () => {},
+foo1169: () => {},
+foo1170: () => {},
+foo1171: () => {},
+foo1172: () => {},
+foo1173: () => {},
+foo1174: () => {},
+foo1175: () => {},
+foo1176: () => {},
+foo1177: () => {},
+foo1178: () => {},
+foo1179: () => {},
+foo1180: () => {},
+foo1181: () => {},
+foo1182: () => {},
+foo1183: () => {},
+foo1184: () => {},
+foo1185: () => {},
+foo1186: () => {},
+foo1187: () => {},
+foo1188: () => {},
+foo1189: () => {},
+foo1190: () => {},
+foo1191: () => {},
+foo1192: () => {},
+foo1193: () => {},
+foo1194: () => {},
+foo1195: () => {},
+foo1196: () => {},
+foo1197: () => {},
+foo1198: () => {},
+foo1199: () => {},
+foo1200: () => {},
+foo1201: () => {},
+foo1202: () => {},
+foo1203: () => {},
+foo1204: () => {},
+foo1205: () => {},
+foo1206: () => {},
+foo1207: () => {},
+foo1208: () => {},
+foo1209: () => {},
+foo1210: () => {},
+foo1211: () => {},
+foo1212: () => {},
+foo1213: () => {},
+foo1214: () => {},
+foo1215: () => {},
+foo1216: () => {},
+foo1217: () => {},
+foo1218: () => {},
+foo1219: () => {},
+foo1220: () => {},
+foo1221: () => {},
+foo1222: () => {},
+foo1223: () => {},
+foo1224: () => {},
+foo1225: () => {},
+foo1226: () => {},
+foo1227: () => {},
+foo1228: () => {},
+foo1229: () => {},
+foo1230: () => {},
+foo1231: () => {},
+foo1232: () => {},
+foo1233: () => {},
+foo1234: () => {},
+foo1235: () => {},
+foo1236: () => {},
+foo1237: () => {},
+foo1238: () => {},
+foo1239: () => {},
+foo1240: () => {},
+foo1241: () => {},
+foo1242: () => {},
+foo1243: () => {},
+foo1244: () => {},
+foo1245: () => {},
+foo1246: () => {},
+foo1247: () => {},
+foo1248: () => {},
+foo1249: () => {},
+foo1250: () => {},
+foo1251: () => {},
+foo1252: () => {},
+foo1253: () => {},
+foo1254: () => {},
+foo1255: () => {},
+foo1256: () => {},
+foo1257: () => {},
+foo1258: () => {},
+foo1259: () => {},
+foo1260: () => {},
+foo1261: () => {},
+foo1262: () => {},
+foo1263: () => {},
+foo1264: () => {},
+foo1265: () => {},
+foo1266: () => {},
+foo1267: () => {},
+foo1268: () => {},
+foo1269: () => {},
+foo1270: () => {},
+foo1271: () => {},
+foo1272: () => {},
+foo1273: () => {},
+foo1274: () => {},
+foo1275: () => {},
+foo1276: () => {},
+foo1277: () => {},
+foo1278: () => {},
+foo1279: () => {},
+foo1280: () => {},
+foo1281: () => {},
+foo1282: () => {},
+foo1283: () => {},
+foo1284: () => {},
+foo1285: () => {},
+foo1286: () => {},
+foo1287: () => {},
+foo1288: () => {},
+foo1289: () => {},
+foo1290: () => {},
+foo1291: () => {},
+foo1292: () => {},
+foo1293: () => {},
+foo1294: () => {},
+foo1295: () => {},
+foo1296: () => {},
+foo1297: () => {},
+foo1298: () => {},
+foo1299: () => {},
+foo1300: () => {},
+foo1301: () => {},
+foo1302: () => {},
+foo1303: () => {},
+foo1304: () => {},
+foo1305: () => {},
+foo1306: () => {},
+foo1307: () => {},
+foo1308: () => {},
+foo1309: () => {},
+foo1310: () => {},
+foo1311: () => {},
+foo1312: () => {},
+foo1313: () => {},
+foo1314: () => {},
+foo1315: () => {},
+foo1316: () => {},
+foo1317: () => {},
+foo1318: () => {},
+foo1319: () => {},
+foo1320: () => {},
+foo1321: () => {},
+foo1322: () => {},
+foo1323: () => {},
+foo1324: () => {},
+foo1325: () => {},
+foo1326: () => {},
+foo1327: () => {},
+foo1328: () => {},
+foo1329: () => {},
+foo1330: () => {},
+foo1331: () => {},
+foo1332: () => {},
+foo1333: () => {},
+foo1334: () => {},
+foo1335: () => {},
+foo1336: () => {},
+foo1337: () => {},
+foo1338: () => {},
+foo1339: () => {},
+foo1340: () => {},
+foo1341: () => {},
+foo1342: () => {},
+foo1343: () => {},
+foo1344: () => {},
+foo1345: () => {},
+foo1346: () => {},
+foo1347: () => {},
+foo1348: () => {},
+foo1349: () => {},
+foo1350: () => {},
+foo1351: () => {},
+foo1352: () => {},
+foo1353: () => {},
+foo1354: () => {},
+foo1355: () => {},
+foo1356: () => {},
+foo1357: () => {},
+foo1358: () => {},
+foo1359: () => {},
+foo1360: () => {},
+foo1361: () => {},
+foo1362: () => {},
+foo1363: () => {},
+foo1364: () => {},
+foo1365: () => {},
+foo1366: () => {},
+foo1367: () => {},
+foo1368: () => {},
+foo1369: () => {},
+foo1370: () => {},
+foo1371: () => {},
+foo1372: () => {},
+foo1373: () => {},
+foo1374: () => {},
+foo1375: () => {},
+foo1376: () => {},
+foo1377: () => {},
+foo1378: () => {},
+foo1379: () => {},
+foo1380: () => {},
+foo1381: () => {},
+foo1382: () => {},
+foo1383: () => {},
+foo1384: () => {},
+foo1385: () => {},
+foo1386: () => {},
+foo1387: () => {},
+foo1388: () => {},
+foo1389: () => {},
+foo1390: () => {},
+foo1391: () => {},
+foo1392: () => {},
+foo1393: () => {},
+foo1394: () => {},
+foo1395: () => {},
+foo1396: () => {},
+foo1397: () => {},
+foo1398: () => {},
+foo1399: () => {},
+foo1400: () => {},
+foo1401: () => {},
+foo1402: () => {},
+foo1403: () => {},
+foo1404: () => {},
+foo1405: () => {},
+foo1406: () => {},
+foo1407: () => {},
+foo1408: () => {},
+foo1409: () => {},
+foo1410: () => {},
+foo1411: () => {},
+foo1412: () => {},
+foo1413: () => {},
+foo1414: () => {},
+foo1415: () => {},
+foo1416: () => {},
+foo1417: () => {},
+foo1418: () => {},
+foo1419: () => {},
+foo1420: () => {},
+foo1421: () => {},
+foo1422: () => {},
+foo1423: () => {},
+foo1424: () => {},
+foo1425: () => {},
+foo1426: () => {},
+foo1427: () => {},
+foo1428: () => {},
+foo1429: () => {},
+foo1430: () => {},
+foo1431: () => {},
+foo1432: () => {},
+foo1433: () => {},
+foo1434: () => {},
+foo1435: () => {},
+foo1436: () => {},
+foo1437: () => {},
+foo1438: () => {},
+foo1439: () => {},
+foo1440: () => {},
+foo1441: () => {},
+foo1442: () => {},
+foo1443: () => {},
+foo1444: () => {},
+foo1445: () => {},
+foo1446: () => {},
+foo1447: () => {},
+foo1448: () => {},
+foo1449: () => {},
+foo1450: () => {},
+foo1451: () => {},
+foo1452: () => {},
+foo1453: () => {},
+foo1454: () => {},
+foo1455: () => {},
+foo1456: () => {},
+foo1457: () => {},
+foo1458: () => {},
+foo1459: () => {},
+foo1460: () => {},
+foo1461: () => {},
+foo1462: () => {},
+foo1463: () => {},
+foo1464: () => {},
+foo1465: () => {},
+foo1466: () => {},
+foo1467: () => {},
+foo1468: () => {},
+foo1469: () => {},
+foo1470: () => {},
+foo1471: () => {},
+foo1472: () => {},
+foo1473: () => {},
+foo1474: () => {},
+foo1475: () => {},
+foo1476: () => {},
+foo1477: () => {},
+foo1478: () => {},
+foo1479: () => {},
+foo1480: () => {},
+foo1481: () => {},
+foo1482: () => {},
+foo1483: () => {},
+foo1484: () => {},
+foo1485: () => {},
+foo1486: () => {},
+foo1487: () => {},
+foo1488: () => {},
+foo1489: () => {},
+foo1490: () => {},
+foo1491: () => {},
+foo1492: () => {},
+foo1493: () => {},
+foo1494: () => {},
+foo1495: () => {},
+foo1496: () => {},
+foo1497: () => {},
+foo1498: () => {},
+foo1499: () => {},
+foo1500: () => {},
+foo1501: () => {},
+foo1502: () => {},
+foo1503: () => {},
+foo1504: () => {},
+foo1505: () => {},
+foo1506: () => {},
+foo1507: () => {},
+foo1508: () => {},
+foo1509: () => {},
+foo1510: () => {},
+foo1511: () => {},
+foo1512: () => {},
+foo1513: () => {},
+foo1514: () => {},
+foo1515: () => {},
+foo1516: () => {},
+foo1517: () => {},
+foo1518: () => {},
+foo1519: () => {},
+foo1520: () => {},
+foo1521: () => {},
+foo1522: () => {},
+foo1523: () => {},
+foo1524: () => {},
+foo1525: () => {},
+foo1526: () => {},
+foo1527: () => {},
+foo1528: () => {},
+foo1529: () => {},
+foo1530: () => {},
+foo1531: () => {},
+foo1532: () => {},
+foo1533: () => {},
+foo1534: () => {},
+foo1535: () => {},
+foo1536: () => {},
+foo1537: () => {},
+foo1538: () => {},
+foo1539: () => {},
+foo1540: () => {},
+foo1541: () => {},
+foo1542: () => {},
+foo1543: () => {},
+foo1544: () => {},
+foo1545: () => {},
+foo1546: () => {},
+foo1547: () => {},
+foo1548: () => {},
+foo1549: () => {},
+foo1550: () => {},
+foo1551: () => {},
+foo1552: () => {},
+foo1553: () => {},
+foo1554: () => {},
+foo1555: () => {},
+foo1556: () => {},
+foo1557: () => {},
+foo1558: () => {},
+foo1559: () => {},
+foo1560: () => {},
+foo1561: () => {},
+foo1562: () => {},
+foo1563: () => {},
+foo1564: () => {},
+foo1565: () => {},
+foo1566: () => {},
+foo1567: () => {},
+foo1568: () => {},
+foo1569: () => {},
+foo1570: () => {},
+foo1571: () => {},
+foo1572: () => {},
+foo1573: () => {},
+foo1574: () => {},
+foo1575: () => {},
+foo1576: () => {},
+foo1577: () => {},
+foo1578: () => {},
+foo1579: () => {},
+foo1580: () => {},
+foo1581: () => {},
+foo1582: () => {},
+foo1583: () => {},
+foo1584: () => {},
+foo1585: () => {},
+foo1586: () => {},
+foo1587: () => {},
+foo1588: () => {},
+foo1589: () => {},
+foo1590: () => {},
+foo1591: () => {},
+foo1592: () => {},
+foo1593: () => {},
+foo1594: () => {},
+foo1595: () => {},
+foo1596: () => {},
+foo1597: () => {},
+foo1598: () => {},
+foo1599: () => {},
+foo1600: () => {},
+foo1601: () => {},
+foo1602: () => {},
+foo1603: () => {},
+foo1604: () => {},
+foo1605: () => {},
+foo1606: () => {},
+foo1607: () => {},
+foo1608: () => {},
+foo1609: () => {},
+foo1610: () => {},
+foo1611: () => {},
+foo1612: () => {},
+foo1613: () => {},
+foo1614: () => {},
+foo1615: () => {},
+foo1616: () => {},
+foo1617: () => {},
+foo1618: () => {},
+foo1619: () => {},
+foo1620: () => {},
+foo1621: () => {},
+foo1622: () => {},
+foo1623: () => {},
+foo1624: () => {},
+foo1625: () => {},
+foo1626: () => {},
+foo1627: () => {},
+foo1628: () => {},
+foo1629: () => {},
+foo1630: () => {},
+foo1631: () => {},
+foo1632: () => {},
+foo1633: () => {},
+foo1634: () => {},
+foo1635: () => {},
+foo1636: () => {},
+foo1637: () => {},
+foo1638: () => {},
+foo1639: () => {},
+foo1640: () => {},
+foo1641: () => {},
+foo1642: () => {},
+foo1643: () => {},
+foo1644: () => {},
+foo1645: () => {},
+foo1646: () => {},
+foo1647: () => {},
+foo1648: () => {},
+foo1649: () => {},
+foo1650: () => {},
+foo1651: () => {},
+foo1652: () => {},
+foo1653: () => {},
+foo1654: () => {},
+foo1655: () => {},
+foo1656: () => {},
+foo1657: () => {},
+foo1658: () => {},
+foo1659: () => {},
+foo1660: () => {},
+foo1661: () => {},
+foo1662: () => {},
+foo1663: () => {},
+foo1664: () => {},
+foo1665: () => {},
+foo1666: () => {},
+foo1667: () => {},
+foo1668: () => {},
+foo1669: () => {},
+foo1670: () => {},
+foo1671: () => {},
+foo1672: () => {},
+foo1673: () => {},
+foo1674: () => {},
+foo1675: () => {},
+foo1676: () => {},
+foo1677: () => {},
+foo1678: () => {},
+foo1679: () => {},
+foo1680: () => {},
+foo1681: () => {},
+foo1682: () => {},
+foo1683: () => {},
+foo1684: () => {},
+foo1685: () => {},
+foo1686: () => {},
+foo1687: () => {},
+foo1688: () => {},
+foo1689: () => {},
+foo1690: () => {},
+foo1691: () => {},
+foo1692: () => {},
+foo1693: () => {},
+foo1694: () => {},
+foo1695: () => {},
+foo1696: () => {},
+foo1697: () => {},
+foo1698: () => {},
+foo1699: () => {},
+foo1700: () => {},
+foo1701: () => {},
+foo1702: () => {},
+foo1703: () => {},
+foo1704: () => {},
+foo1705: () => {},
+foo1706: () => {},
+foo1707: () => {},
+foo1708: () => {},
+foo1709: () => {},
+foo1710: () => {},
+foo1711: () => {},
+foo1712: () => {},
+foo1713: () => {},
+foo1714: () => {},
+foo1715: () => {},
+foo1716: () => {},
+foo1717: () => {},
+foo1718: () => {},
+foo1719: () => {},
+foo1720: () => {},
+foo1721: () => {},
+foo1722: () => {},
+foo1723: () => {},
+foo1724: () => {},
+foo1725: () => {},
+foo1726: () => {},
+foo1727: () => {},
+foo1728: () => {},
+foo1729: () => {},
+foo1730: () => {},
+foo1731: () => {},
+foo1732: () => {},
+foo1733: () => {},
+foo1734: () => {},
+foo1735: () => {},
+foo1736: () => {},
+foo1737: () => {},
+foo1738: () => {},
+foo1739: () => {},
+foo1740: () => {},
+foo1741: () => {},
+foo1742: () => {},
+foo1743: () => {},
+foo1744: () => {},
+foo1745: () => {},
+foo1746: () => {},
+foo1747: () => {},
+foo1748: () => {},
+foo1749: () => {},
+foo1750: () => {},
+foo1751: () => {},
+foo1752: () => {},
+foo1753: () => {},
+foo1754: () => {},
+foo1755: () => {},
+foo1756: () => {},
+foo1757: () => {},
+foo1758: () => {},
+foo1759: () => {},
+foo1760: () => {},
+foo1761: () => {},
+foo1762: () => {},
+foo1763: () => {},
+foo1764: () => {},
+foo1765: () => {},
+foo1766: () => {},
+foo1767: () => {},
+foo1768: () => {},
+foo1769: () => {},
+foo1770: () => {},
+foo1771: () => {},
+foo1772: () => {},
+foo1773: () => {},
+foo1774: () => {},
+foo1775: () => {},
+foo1776: () => {},
+foo1777: () => {},
+foo1778: () => {},
+foo1779: () => {},
+foo1780: () => {},
+foo1781: () => {},
+foo1782: () => {},
+foo1783: () => {},
+foo1784: () => {},
+foo1785: () => {},
+foo1786: () => {},
+foo1787: () => {},
+foo1788: () => {},
+foo1789: () => {},
+foo1790: () => {},
+foo1791: () => {},
+foo1792: () => {},
+foo1793: () => {},
+foo1794: () => {},
+foo1795: () => {},
+foo1796: () => {},
+foo1797: () => {},
+foo1798: () => {},
+foo1799: () => {},
+foo1800: () => {},
+foo1801: () => {},
+foo1802: () => {},
+foo1803: () => {},
+foo1804: () => {},
+foo1805: () => {},
+foo1806: () => {},
+foo1807: () => {},
+foo1808: () => {},
+foo1809: () => {},
+foo1810: () => {},
+foo1811: () => {},
+foo1812: () => {},
+foo1813: () => {},
+foo1814: () => {},
+foo1815: () => {},
+foo1816: () => {},
+foo1817: () => {},
+foo1818: () => {},
+foo1819: () => {},
+foo1820: () => {},
+foo1821: () => {},
+foo1822: () => {},
+foo1823: () => {},
+foo1824: () => {},
+foo1825: () => {},
+foo1826: () => {},
+foo1827: () => {},
+foo1828: () => {},
+foo1829: () => {},
+foo1830: () => {},
+foo1831: () => {},
+foo1832: () => {},
+foo1833: () => {},
+foo1834: () => {},
+foo1835: () => {},
+foo1836: () => {},
+foo1837: () => {},
+foo1838: () => {},
+foo1839: () => {},
+foo1840: () => {},
+foo1841: () => {},
+foo1842: () => {},
+foo1843: () => {},
+foo1844: () => {},
+foo1845: () => {},
+foo1846: () => {},
+foo1847: () => {},
+foo1848: () => {},
+foo1849: () => {},
+foo1850: () => {},
+foo1851: () => {},
+foo1852: () => {},
+foo1853: () => {},
+foo1854: () => {},
+foo1855: () => {},
+foo1856: () => {},
+foo1857: () => {},
+foo1858: () => {},
+foo1859: () => {},
+foo1860: () => {},
+foo1861: () => {},
+foo1862: () => {},
+foo1863: () => {},
+foo1864: () => {},
+foo1865: () => {},
+foo1866: () => {},
+foo1867: () => {},
+foo1868: () => {},
+foo1869: () => {},
+foo1870: () => {},
+foo1871: () => {},
+foo1872: () => {},
+foo1873: () => {},
+foo1874: () => {},
+foo1875: () => {},
+foo1876: () => {},
+foo1877: () => {},
+foo1878: () => {},
+foo1879: () => {},
+foo1880: () => {},
+foo1881: () => {},
+foo1882: () => {},
+foo1883: () => {},
+foo1884: () => {},
+foo1885: () => {},
+foo1886: () => {},
+foo1887: () => {},
+foo1888: () => {},
+foo1889: () => {},
+foo1890: () => {},
+foo1891: () => {},
+foo1892: () => {},
+foo1893: () => {},
+foo1894: () => {},
+foo1895: () => {},
+foo1896: () => {},
+foo1897: () => {},
+foo1898: () => {},
+foo1899: () => {},
+foo1900: () => {},
+foo1901: () => {},
+foo1902: () => {},
+foo1903: () => {},
+foo1904: () => {},
+foo1905: () => {},
+foo1906: () => {},
+foo1907: () => {},
+foo1908: () => {},
+foo1909: () => {},
+foo1910: () => {},
+foo1911: () => {},
+foo1912: () => {},
+foo1913: () => {},
+foo1914: () => {},
+foo1915: () => {},
+foo1916: () => {},
+foo1917: () => {},
+foo1918: () => {},
+foo1919: () => {},
+foo1920: () => {},
+foo1921: () => {},
+foo1922: () => {},
+foo1923: () => {},
+foo1924: () => {},
+foo1925: () => {},
+foo1926: () => {},
+foo1927: () => {},
+foo1928: () => {},
+foo1929: () => {},
+foo1930: () => {},
+foo1931: () => {},
+foo1932: () => {},
+foo1933: () => {},
+foo1934: () => {},
+foo1935: () => {},
+foo1936: () => {},
+foo1937: () => {},
+foo1938: () => {},
+foo1939: () => {},
+foo1940: () => {},
+foo1941: () => {},
+foo1942: () => {},
+foo1943: () => {},
+foo1944: () => {},
+foo1945: () => {},
+foo1946: () => {},
+foo1947: () => {},
+foo1948: () => {},
+foo1949: () => {},
+foo1950: () => {},
+foo1951: () => {},
+foo1952: () => {},
+foo1953: () => {},
+foo1954: () => {},
+foo1955: () => {},
+foo1956: () => {},
+foo1957: () => {},
+foo1958: () => {},
+foo1959: () => {},
+foo1960: () => {},
+foo1961: () => {},
+foo1962: () => {},
+foo1963: () => {},
+foo1964: () => {},
+foo1965: () => {},
+foo1966: () => {},
+foo1967: () => {},
+foo1968: () => {},
+foo1969: () => {},
+foo1970: () => {},
+foo1971: () => {},
+foo1972: () => {},
+foo1973: () => {},
+foo1974: () => {},
+foo1975: () => {},
+foo1976: () => {},
+foo1977: () => {},
+foo1978: () => {},
+foo1979: () => {},
+foo1980: () => {},
+foo1981: () => {},
+foo1982: () => {},
+foo1983: () => {},
+foo1984: () => {},
+foo1985: () => {},
+foo1986: () => {},
+foo1987: () => {},
+foo1988: () => {},
+foo1989: () => {},
+foo1990: () => {},
+foo1991: () => {},
+foo1992: () => {},
+foo1993: () => {},
+foo1994: () => {},
+foo1995: () => {},
+foo1996: () => {},
+foo1997: () => {},
+foo1998: () => {},
+foo1999: () => {},
+foo2000: () => {},
+foo2001: () => {},
+foo2002: () => {},
+foo2003: () => {},
+foo2004: () => {},
+foo2005: () => {},
+foo2006: () => {},
+foo2007: () => {},
+foo2008: () => {},
+foo2009: () => {},
+foo2010: () => {},
+foo2011: () => {},
+foo2012: () => {},
+foo2013: () => {},
+foo2014: () => {},
+foo2015: () => {},
+foo2016: () => {},
+foo2017: () => {},
+foo2018: () => {},
+foo2019: () => {},
+foo2020: () => {},
+foo2021: () => {},
+foo2022: () => {},
+foo2023: () => {},
+foo2024: () => {},
+foo2025: () => {},
+foo2026: () => {},
+foo2027: () => {},
+foo2028: () => {},
+foo2029: () => {},
+foo2030: () => {},
+foo2031: () => {},
+foo2032: () => {},
+foo2033: () => {},
+foo2034: () => {},
+foo2035: () => {},
+foo2036: () => {},
+foo2037: () => {},
+foo2038: () => {},
+foo2039: () => {},
+foo2040: () => {},
+foo2041: () => {},
+foo2042: () => {},
+foo2043: () => {},
+foo2044: () => {},
+foo2045: () => {},
+foo2046: () => {},
+foo2047: () => {},
+foo2048: () => {},
+foo2049: () => {},
+foo2050: () => {},
+foo2051: () => {},
+foo2052: () => {},
+foo2053: () => {},
+foo2054: () => {},
+foo2055: () => {},
+foo2056: () => {},
+foo2057: () => {},
+foo2058: () => {},
+foo2059: () => {},
+foo2060: () => {},
+foo2061: () => {},
+foo2062: () => {},
+foo2063: () => {},
+foo2064: () => {},
+foo2065: () => {},
+foo2066: () => {},
+foo2067: () => {},
+foo2068: () => {},
+foo2069: () => {},
+foo2070: () => {},
+foo2071: () => {},
+foo2072: () => {},
+foo2073: () => {},
+foo2074: () => {},
+foo2075: () => {},
+foo2076: () => {},
+foo2077: () => {},
+foo2078: () => {},
+foo2079: () => {},
+foo2080: () => {},
+foo2081: () => {},
+foo2082: () => {},
+foo2083: () => {},
+foo2084: () => {},
+foo2085: () => {},
+foo2086: () => {},
+foo2087: () => {},
+foo2088: () => {},
+foo2089: () => {},
+foo2090: () => {},
+foo2091: () => {},
+foo2092: () => {},
+foo2093: () => {},
+foo2094: () => {},
+foo2095: () => {},
+foo2096: () => {},
+foo2097: () => {},
+foo2098: () => {},
+foo2099: () => {},
+foo2100: () => {},
+foo2101: () => {},
+foo2102: () => {},
+foo2103: () => {},
+foo2104: () => {},
+foo2105: () => {},
+foo2106: () => {},
+foo2107: () => {},
+foo2108: () => {},
+foo2109: () => {},
+foo2110: () => {},
+foo2111: () => {},
+foo2112: () => {},
+foo2113: () => {},
+foo2114: () => {},
+foo2115: () => {},
+foo2116: () => {},
+foo2117: () => {},
+foo2118: () => {},
+foo2119: () => {},
+foo2120: () => {},
+foo2121: () => {},
+foo2122: () => {},
+foo2123: () => {},
+foo2124: () => {},
+foo2125: () => {},
+foo2126: () => {},
+foo2127: () => {},
+foo2128: () => {},
+foo2129: () => {},
+foo2130: () => {},
+foo2131: () => {},
+foo2132: () => {},
+foo2133: () => {},
+foo2134: () => {},
+foo2135: () => {},
+foo2136: () => {},
+foo2137: () => {},
+foo2138: () => {},
+foo2139: () => {},
+foo2140: () => {},
+foo2141: () => {},
+foo2142: () => {},
+foo2143: () => {},
+foo2144: () => {},
+foo2145: () => {},
+foo2146: () => {},
+foo2147: () => {},
+foo2148: () => {},
+foo2149: () => {},
+foo2150: () => {},
+foo2151: () => {},
+foo2152: () => {},
+foo2153: () => {},
+foo2154: () => {},
+foo2155: () => {},
+foo2156: () => {},
+foo2157: () => {},
+foo2158: () => {},
+foo2159: () => {},
+foo2160: () => {},
+foo2161: () => {},
+foo2162: () => {},
+foo2163: () => {},
+foo2164: () => {},
+foo2165: () => {},
+foo2166: () => {},
+foo2167: () => {},
+foo2168: () => {},
+foo2169: () => {},
+foo2170: () => {},
+foo2171: () => {},
+foo2172: () => {},
+foo2173: () => {},
+foo2174: () => {},
+foo2175: () => {},
+foo2176: () => {},
+foo2177: () => {},
+foo2178: () => {},
+foo2179: () => {},
+foo2180: () => {},
+foo2181: () => {},
+foo2182: () => {},
+foo2183: () => {},
+foo2184: () => {},
+foo2185: () => {},
+foo2186: () => {},
+foo2187: () => {},
+foo2188: () => {},
+foo2189: () => {},
+foo2190: () => {},
+foo2191: () => {},
+foo2192: () => {},
+foo2193: () => {},
+foo2194: () => {},
+foo2195: () => {},
+foo2196: () => {},
+foo2197: () => {},
+foo2198: () => {},
+foo2199: () => {},
+foo2200: () => {},
+foo2201: () => {},
+foo2202: () => {},
+foo2203: () => {},
+foo2204: () => {},
+foo2205: () => {},
+foo2206: () => {},
+foo2207: () => {},
+foo2208: () => {},
+foo2209: () => {},
+foo2210: () => {},
+foo2211: () => {},
+foo2212: () => {},
+foo2213: () => {},
+foo2214: () => {},
+foo2215: () => {},
+foo2216: () => {},
+foo2217: () => {},
+foo2218: () => {},
+foo2219: () => {},
+foo2220: () => {},
+foo2221: () => {},
+foo2222: () => {},
+foo2223: () => {},
+foo2224: () => {},
+foo2225: () => {},
+foo2226: () => {},
+foo2227: () => {},
+foo2228: () => {},
+foo2229: () => {},
+foo2230: () => {},
+foo2231: () => {},
+foo2232: () => {},
+foo2233: () => {},
+foo2234: () => {},
+foo2235: () => {},
+foo2236: () => {},
+foo2237: () => {},
+foo2238: () => {},
+foo2239: () => {},
+foo2240: () => {},
+foo2241: () => {},
+foo2242: () => {},
+foo2243: () => {},
+foo2244: () => {},
+foo2245: () => {},
+foo2246: () => {},
+foo2247: () => {},
+foo2248: () => {},
+foo2249: () => {},
+foo2250: () => {},
+foo2251: () => {},
+foo2252: () => {},
+foo2253: () => {},
+foo2254: () => {},
+foo2255: () => {},
+foo2256: () => {},
+foo2257: () => {},
+foo2258: () => {},
+foo2259: () => {},
+foo2260: () => {},
+foo2261: () => {},
+foo2262: () => {},
+foo2263: () => {},
+foo2264: () => {},
+foo2265: () => {},
+foo2266: () => {},
+foo2267: () => {},
+foo2268: () => {},
+foo2269: () => {},
+foo2270: () => {},
+foo2271: () => {},
+foo2272: () => {},
+foo2273: () => {},
+foo2274: () => {},
+foo2275: () => {},
+foo2276: () => {},
+foo2277: () => {},
+foo2278: () => {},
+foo2279: () => {},
+foo2280: () => {},
+foo2281: () => {},
+foo2282: () => {},
+foo2283: () => {},
+foo2284: () => {},
+foo2285: () => {},
+foo2286: () => {},
+foo2287: () => {},
+foo2288: () => {},
+foo2289: () => {},
+foo2290: () => {},
+foo2291: () => {},
+foo2292: () => {},
+foo2293: () => {},
+foo2294: () => {},
+foo2295: () => {},
+foo2296: () => {},
+foo2297: () => {},
+foo2298: () => {},
+foo2299: () => {},
+foo2300: () => {},
+foo2301: () => {},
+foo2302: () => {},
+foo2303: () => {},
+foo2304: () => {},
+foo2305: () => {},
+foo2306: () => {},
+foo2307: () => {},
+foo2308: () => {},
+foo2309: () => {},
+foo2310: () => {},
+foo2311: () => {},
+foo2312: () => {},
+foo2313: () => {},
+foo2314: () => {},
+foo2315: () => {},
+foo2316: () => {},
+foo2317: () => {},
+foo2318: () => {},
+foo2319: () => {},
+foo2320: () => {},
+foo2321: () => {},
+foo2322: () => {},
+foo2323: () => {},
+foo2324: () => {},
+foo2325: () => {},
+foo2326: () => {},
+foo2327: () => {},
+foo2328: () => {},
+foo2329: () => {},
+foo2330: () => {},
+foo2331: () => {},
+foo2332: () => {},
+foo2333: () => {},
+foo2334: () => {},
+foo2335: () => {},
+foo2336: () => {},
+foo2337: () => {},
+foo2338: () => {},
+foo2339: () => {},
+foo2340: () => {},
+foo2341: () => {},
+foo2342: () => {},
+foo2343: () => {},
+foo2344: () => {},
+foo2345: () => {},
+foo2346: () => {},
+foo2347: () => {},
+foo2348: () => {},
+foo2349: () => {},
+foo2350: () => {},
+foo2351: () => {},
+foo2352: () => {},
+foo2353: () => {},
+foo2354: () => {},
+foo2355: () => {},
+foo2356: () => {},
+foo2357: () => {},
+foo2358: () => {},
+foo2359: () => {},
+foo2360: () => {},
+foo2361: () => {},
+foo2362: () => {},
+foo2363: () => {},
+foo2364: () => {},
+foo2365: () => {},
+foo2366: () => {},
+foo2367: () => {},
+foo2368: () => {},
+foo2369: () => {},
+foo2370: () => {},
+foo2371: () => {},
+foo2372: () => {},
+foo2373: () => {},
+foo2374: () => {},
+foo2375: () => {},
+foo2376: () => {},
+foo2377: () => {},
+foo2378: () => {},
+foo2379: () => {},
+foo2380: () => {},
+foo2381: () => {},
+foo2382: () => {},
+foo2383: () => {},
+foo2384: () => {},
+foo2385: () => {},
+foo2386: () => {},
+foo2387: () => {},
+foo2388: () => {},
+foo2389: () => {},
+foo2390: () => {},
+foo2391: () => {},
+foo2392: () => {},
+foo2393: () => {},
+foo2394: () => {},
+foo2395: () => {},
+foo2396: () => {},
+foo2397: () => {},
+foo2398: () => {},
+foo2399: () => {},
+foo2400: () => {},
+foo2401: () => {},
+foo2402: () => {},
+foo2403: () => {},
+foo2404: () => {},
+foo2405: () => {},
+foo2406: () => {},
+foo2407: () => {},
+foo2408: () => {},
+foo2409: () => {},
+foo2410: () => {},
+foo2411: () => {},
+foo2412: () => {},
+foo2413: () => {},
+foo2414: () => {},
+foo2415: () => {},
+foo2416: () => {},
+foo2417: () => {},
+foo2418: () => {},
+foo2419: () => {},
+foo2420: () => {},
+foo2421: () => {},
+foo2422: () => {},
+foo2423: () => {},
+foo2424: () => {},
+foo2425: () => {},
+foo2426: () => {},
+foo2427: () => {},
+foo2428: () => {},
+foo2429: () => {},
+foo2430: () => {},
+foo2431: () => {},
+foo2432: () => {},
+foo2433: () => {},
+foo2434: () => {},
+foo2435: () => {},
+foo2436: () => {},
+foo2437: () => {},
+foo2438: () => {},
+foo2439: () => {},
+foo2440: () => {},
+foo2441: () => {},
+foo2442: () => {},
+foo2443: () => {},
+foo2444: () => {},
+foo2445: () => {},
+foo2446: () => {},
+foo2447: () => {},
+foo2448: () => {},
+foo2449: () => {},
+foo2450: () => {},
+foo2451: () => {},
+foo2452: () => {},
+foo2453: () => {},
+foo2454: () => {},
+foo2455: () => {},
+foo2456: () => {},
+foo2457: () => {},
+foo2458: () => {},
+foo2459: () => {},
+foo2460: () => {},
+foo2461: () => {},
+foo2462: () => {},
+foo2463: () => {},
+foo2464: () => {},
+foo2465: () => {},
+foo2466: () => {},
+foo2467: () => {},
+foo2468: () => {},
+foo2469: () => {},
+foo2470: () => {},
+foo2471: () => {},
+foo2472: () => {},
+foo2473: () => {},
+foo2474: () => {},
+foo2475: () => {},
+foo2476: () => {},
+foo2477: () => {},
+foo2478: () => {},
+foo2479: () => {},
+foo2480: () => {},
+foo2481: () => {},
+foo2482: () => {},
+foo2483: () => {},
+foo2484: () => {},
+foo2485: () => {},
+foo2486: () => {},
+foo2487: () => {},
+foo2488: () => {},
+foo2489: () => {},
+foo2490: () => {},
+foo2491: () => {},
+foo2492: () => {},
+foo2493: () => {},
+foo2494: () => {},
+foo2495: () => {},
+foo2496: () => {},
+foo2497: () => {},
+foo2498: () => {},
+foo2499: () => {},
+foo2500: () => {},
+foo2501: () => {},
+foo2502: () => {},
+foo2503: () => {},
+foo2504: () => {},
+foo2505: () => {},
+foo2506: () => {},
+foo2507: () => {},
+foo2508: () => {},
+foo2509: () => {},
+foo2510: () => {},
+foo2511: () => {},
+foo2512: () => {},
+foo2513: () => {},
+foo2514: () => {},
+foo2515: () => {},
+foo2516: () => {},
+foo2517: () => {},
+foo2518: () => {},
+foo2519: () => {},
+foo2520: () => {},
+foo2521: () => {},
+foo2522: () => {},
+foo2523: () => {},
+foo2524: () => {},
+foo2525: () => {},
+foo2526: () => {},
+foo2527: () => {},
+foo2528: () => {},
+foo2529: () => {},
+foo2530: () => {},
+foo2531: () => {},
+foo2532: () => {},
+foo2533: () => {},
+foo2534: () => {},
+foo2535: () => {},
+foo2536: () => {},
+foo2537: () => {},
+foo2538: () => {},
+foo2539: () => {},
+foo2540: () => {},
+foo2541: () => {},
+foo2542: () => {},
+foo2543: () => {},
+foo2544: () => {},
+foo2545: () => {},
+foo2546: () => {},
+foo2547: () => {},
+foo2548: () => {},
+foo2549: () => {},
+foo2550: () => {},
+foo2551: () => {},
+foo2552: () => {},
+foo2553: () => {},
+foo2554: () => {},
+foo2555: () => {},
+foo2556: () => {},
+foo2557: () => {},
+foo2558: () => {},
+foo2559: () => {},
+foo2560: () => {},
+foo2561: () => {},
+foo2562: () => {},
+foo2563: () => {},
+foo2564: () => {},
+foo2565: () => {},
+foo2566: () => {},
+foo2567: () => {},
+foo2568: () => {},
+foo2569: () => {},
+foo2570: () => {},
+foo2571: () => {},
+foo2572: () => {},
+foo2573: () => {},
+foo2574: () => {},
+foo2575: () => {},
+foo2576: () => {},
+foo2577: () => {},
+foo2578: () => {},
+foo2579: () => {},
+foo2580: () => {},
+foo2581: () => {},
+foo2582: () => {},
+foo2583: () => {},
+foo2584: () => {},
+foo2585: () => {},
+foo2586: () => {},
+foo2587: () => {},
+foo2588: () => {},
+foo2589: () => {},
+foo2590: () => {},
+foo2591: () => {},
+foo2592: () => {},
+foo2593: () => {},
+foo2594: () => {},
+foo2595: () => {},
+foo2596: () => {},
+foo2597: () => {},
+foo2598: () => {},
+foo2599: () => {},
+foo2600: () => {},
+foo2601: () => {},
+foo2602: () => {},
+foo2603: () => {},
+foo2604: () => {},
+foo2605: () => {},
+foo2606: () => {},
+foo2607: () => {},
+foo2608: () => {},
+foo2609: () => {},
+foo2610: () => {},
+foo2611: () => {},
+foo2612: () => {},
+foo2613: () => {},
+foo2614: () => {},
+foo2615: () => {},
+foo2616: () => {},
+foo2617: () => {},
+foo2618: () => {},
+foo2619: () => {},
+foo2620: () => {},
+foo2621: () => {},
+foo2622: () => {},
+foo2623: () => {},
+foo2624: () => {},
+foo2625: () => {},
+foo2626: () => {},
+foo2627: () => {},
+foo2628: () => {},
+foo2629: () => {},
+foo2630: () => {},
+foo2631: () => {},
+foo2632: () => {},
+foo2633: () => {},
+foo2634: () => {},
+foo2635: () => {},
+foo2636: () => {},
+foo2637: () => {},
+foo2638: () => {},
+foo2639: () => {},
+foo2640: () => {},
+foo2641: () => {},
+foo2642: () => {},
+foo2643: () => {},
+foo2644: () => {},
+foo2645: () => {},
+foo2646: () => {},
+foo2647: () => {},
+foo2648: () => {},
+foo2649: () => {},
+foo2650: () => {},
+foo2651: () => {},
+foo2652: () => {},
+foo2653: () => {},
+foo2654: () => {},
+foo2655: () => {},
+foo2656: () => {},
+foo2657: () => {},
+foo2658: () => {},
+foo2659: () => {},
+foo2660: () => {},
+foo2661: () => {},
+foo2662: () => {},
+foo2663: () => {},
+foo2664: () => {},
+foo2665: () => {},
+foo2666: () => {},
+foo2667: () => {},
+foo2668: () => {},
+foo2669: () => {},
+foo2670: () => {},
+foo2671: () => {},
+foo2672: () => {},
+foo2673: () => {},
+foo2674: () => {},
+foo2675: () => {},
+foo2676: () => {},
+foo2677: () => {},
+foo2678: () => {},
+foo2679: () => {},
+foo2680: () => {},
+foo2681: () => {},
+foo2682: () => {},
+foo2683: () => {},
+foo2684: () => {},
+foo2685: () => {},
+foo2686: () => {},
+foo2687: () => {},
+foo2688: () => {},
+foo2689: () => {},
+foo2690: () => {},
+foo2691: () => {},
+foo2692: () => {},
+foo2693: () => {},
+foo2694: () => {},
+foo2695: () => {},
+foo2696: () => {},
+foo2697: () => {},
+foo2698: () => {},
+foo2699: () => {},
+foo2700: () => {},
+foo2701: () => {},
+foo2702: () => {},
+foo2703: () => {},
+foo2704: () => {},
+foo2705: () => {},
+foo2706: () => {},
+foo2707: () => {},
+foo2708: () => {},
+foo2709: () => {},
+foo2710: () => {},
+foo2711: () => {},
+foo2712: () => {},
+foo2713: () => {},
+foo2714: () => {},
+foo2715: () => {},
+foo2716: () => {},
+foo2717: () => {},
+foo2718: () => {},
+foo2719: () => {},
+foo2720: () => {},
+foo2721: () => {},
+foo2722: () => {},
+foo2723: () => {},
+foo2724: () => {},
+foo2725: () => {},
+foo2726: () => {},
+foo2727: () => {},
+foo2728: () => {},
+foo2729: () => {},
+foo2730: () => {},
+foo2731: () => {},
+foo2732: () => {},
+foo2733: () => {},
+foo2734: () => {},
+foo2735: () => {},
+foo2736: () => {},
+foo2737: () => {},
+foo2738: () => {},
+foo2739: () => {},
+foo2740: () => {},
+foo2741: () => {},
+foo2742: () => {},
+foo2743: () => {},
+foo2744: () => {},
+foo2745: () => {},
+foo2746: () => {},
+foo2747: () => {},
+foo2748: () => {},
+foo2749: () => {},
+foo2750: () => {},
+foo2751: () => {},
+foo2752: () => {},
+foo2753: () => {},
+foo2754: () => {},
+foo2755: () => {},
+foo2756: () => {},
+foo2757: () => {},
+foo2758: () => {},
+foo2759: () => {},
+foo2760: () => {},
+foo2761: () => {},
+foo2762: () => {},
+foo2763: () => {},
+foo2764: () => {},
+foo2765: () => {},
+foo2766: () => {},
+foo2767: () => {},
+foo2768: () => {},
+foo2769: () => {},
+foo2770: () => {},
+foo2771: () => {},
+foo2772: () => {},
+foo2773: () => {},
+foo2774: () => {},
+foo2775: () => {},
+foo2776: () => {},
+foo2777: () => {},
+foo2778: () => {},
+foo2779: () => {},
+foo2780: () => {},
+foo2781: () => {},
+foo2782: () => {},
+foo2783: () => {},
+foo2784: () => {},
+foo2785: () => {},
+foo2786: () => {},
+foo2787: () => {},
+foo2788: () => {},
+foo2789: () => {},
+foo2790: () => {},
+foo2791: () => {},
+foo2792: () => {},
+foo2793: () => {},
+foo2794: () => {},
+foo2795: () => {},
+foo2796: () => {},
+foo2797: () => {},
+foo2798: () => {},
+foo2799: () => {},
+foo2800: () => {},
+foo2801: () => {},
+foo2802: () => {},
+foo2803: () => {},
+foo2804: () => {},
+foo2805: () => {},
+foo2806: () => {},
+foo2807: () => {},
+foo2808: () => {},
+foo2809: () => {},
+foo2810: () => {},
+foo2811: () => {},
+foo2812: () => {},
+foo2813: () => {},
+foo2814: () => {},
+foo2815: () => {},
+foo2816: () => {},
+foo2817: () => {},
+foo2818: () => {},
+foo2819: () => {},
+foo2820: () => {},
+foo2821: () => {},
+foo2822: () => {},
+foo2823: () => {},
+foo2824: () => {},
+foo2825: () => {},
+foo2826: () => {},
+foo2827: () => {},
+foo2828: () => {},
+foo2829: () => {},
+foo2830: () => {},
+foo2831: () => {},
+foo2832: () => {},
+foo2833: () => {},
+foo2834: () => {},
+foo2835: () => {},
+foo2836: () => {},
+foo2837: () => {},
+foo2838: () => {},
+foo2839: () => {},
+foo2840: () => {},
+foo2841: () => {},
+foo2842: () => {},
+foo2843: () => {},
+foo2844: () => {},
+foo2845: () => {},
+foo2846: () => {},
+foo2847: () => {},
+foo2848: () => {},
+foo2849: () => {},
+foo2850: () => {},
+foo2851: () => {},
+foo2852: () => {},
+foo2853: () => {},
+foo2854: () => {},
+foo2855: () => {},
+foo2856: () => {},
+foo2857: () => {},
+foo2858: () => {},
+foo2859: () => {},
+foo2860: () => {},
+foo2861: () => {},
+foo2862: () => {},
+foo2863: () => {},
+foo2864: () => {},
+foo2865: () => {},
+foo2866: () => {},
+foo2867: () => {},
+foo2868: () => {},
+foo2869: () => {},
+foo2870: () => {},
+foo2871: () => {},
+foo2872: () => {},
+foo2873: () => {},
+foo2874: () => {},
+foo2875: () => {},
+foo2876: () => {},
+foo2877: () => {},
+foo2878: () => {},
+foo2879: () => {},
+foo2880: () => {},
+foo2881: () => {},
+foo2882: () => {},
+foo2883: () => {},
+foo2884: () => {},
+foo2885: () => {},
+foo2886: () => {},
+foo2887: () => {},
+foo2888: () => {},
+foo2889: () => {},
+foo2890: () => {},
+foo2891: () => {},
+foo2892: () => {},
+foo2893: () => {},
+foo2894: () => {},
+foo2895: () => {},
+foo2896: () => {},
+foo2897: () => {},
+foo2898: () => {},
+foo2899: () => {},
+foo2900: () => {},
+foo2901: () => {},
+foo2902: () => {},
+foo2903: () => {},
+foo2904: () => {},
+foo2905: () => {},
+foo2906: () => {},
+foo2907: () => {},
+foo2908: () => {},
+foo2909: () => {},
+foo2910: () => {},
+foo2911: () => {},
+foo2912: () => {},
+foo2913: () => {},
+foo2914: () => {},
+foo2915: () => {},
+foo2916: () => {},
+foo2917: () => {},
+foo2918: () => {},
+foo2919: () => {},
+foo2920: () => {},
+foo2921: () => {},
+foo2922: () => {},
+foo2923: () => {},
+foo2924: () => {},
+foo2925: () => {},
+foo2926: () => {},
+foo2927: () => {},
+foo2928: () => {},
+foo2929: () => {},
+foo2930: () => {},
+foo2931: () => {},
+foo2932: () => {},
+foo2933: () => {},
+foo2934: () => {},
+foo2935: () => {},
+foo2936: () => {},
+foo2937: () => {},
+foo2938: () => {},
+foo2939: () => {},
+foo2940: () => {},
+foo2941: () => {},
+foo2942: () => {},
+foo2943: () => {},
+foo2944: () => {},
+foo2945: () => {},
+foo2946: () => {},
+foo2947: () => {},
+foo2948: () => {},
+foo2949: () => {},
+foo2950: () => {},
+foo2951: () => {},
+foo2952: () => {},
+foo2953: () => {},
+foo2954: () => {},
+foo2955: () => {},
+foo2956: () => {},
+foo2957: () => {},
+foo2958: () => {},
+foo2959: () => {},
+foo2960: () => {},
+foo2961: () => {},
+foo2962: () => {},
+foo2963: () => {},
+foo2964: () => {},
+foo2965: () => {},
+foo2966: () => {},
+foo2967: () => {},
+foo2968: () => {},
+foo2969: () => {},
+foo2970: () => {},
+foo2971: () => {},
+foo2972: () => {},
+foo2973: () => {},
+foo2974: () => {},
+foo2975: () => {},
+foo2976: () => {},
+foo2977: () => {},
+foo2978: () => {},
+foo2979: () => {},
+foo2980: () => {},
+foo2981: () => {},
+foo2982: () => {},
+foo2983: () => {},
+foo2984: () => {},
+foo2985: () => {},
+foo2986: () => {},
+foo2987: () => {},
+foo2988: () => {},
+foo2989: () => {},
+foo2990: () => {},
+foo2991: () => {},
+foo2992: () => {},
+foo2993: () => {},
+foo2994: () => {},
+foo2995: () => {},
+foo2996: () => {},
+foo2997: () => {},
+foo2998: () => {},
+foo2999: () => {},
+foo3000: () => {},
+foo3001: () => {},
+foo3002: () => {},
+foo3003: () => {},
+foo3004: () => {},
+foo3005: () => {},
+foo3006: () => {},
+foo3007: () => {},
+foo3008: () => {},
+foo3009: () => {},
+foo3010: () => {},
+foo3011: () => {},
+foo3012: () => {},
+foo3013: () => {},
+foo3014: () => {},
+foo3015: () => {},
+foo3016: () => {},
+foo3017: () => {},
+foo3018: () => {},
+foo3019: () => {},
+foo3020: () => {},
+foo3021: () => {},
+foo3022: () => {},
+foo3023: () => {},
+foo3024: () => {},
+foo3025: () => {},
+foo3026: () => {},
+foo3027: () => {},
+foo3028: () => {},
+foo3029: () => {},
+foo3030: () => {},
+foo3031: () => {},
+foo3032: () => {},
+foo3033: () => {},
+foo3034: () => {},
+foo3035: () => {},
+foo3036: () => {},
+foo3037: () => {},
+foo3038: () => {},
+foo3039: () => {},
+foo3040: () => {},
+foo3041: () => {},
+foo3042: () => {},
+foo3043: () => {},
+foo3044: () => {},
+foo3045: () => {},
+foo3046: () => {},
+foo3047: () => {},
+foo3048: () => {},
+foo3049: () => {},
+foo3050: () => {},
+foo3051: () => {},
+foo3052: () => {},
+foo3053: () => {},
+foo3054: () => {},
+foo3055: () => {},
+foo3056: () => {},
+foo3057: () => {},
+foo3058: () => {},
+foo3059: () => {},
+foo3060: () => {},
+foo3061: () => {},
+foo3062: () => {},
+foo3063: () => {},
+foo3064: () => {},
+foo3065: () => {},
+foo3066: () => {},
+foo3067: () => {},
+foo3068: () => {},
+foo3069: () => {},
+foo3070: () => {},
+foo3071: () => {},
+foo3072: () => {},
+foo3073: () => {},
+foo3074: () => {},
+foo3075: () => {},
+foo3076: () => {},
+foo3077: () => {},
+foo3078: () => {},
+foo3079: () => {},
+foo3080: () => {},
+foo3081: () => {},
+foo3082: () => {},
+foo3083: () => {},
+foo3084: () => {},
+foo3085: () => {},
+foo3086: () => {},
+foo3087: () => {},
+foo3088: () => {},
+foo3089: () => {},
+foo3090: () => {},
+foo3091: () => {},
+foo3092: () => {},
+foo3093: () => {},
+foo3094: () => {},
+foo3095: () => {},
+foo3096: () => {},
+foo3097: () => {},
+foo3098: () => {},
+foo3099: () => {},
+foo3100: () => {},
+foo3101: () => {},
+foo3102: () => {},
+foo3103: () => {},
+foo3104: () => {},
+foo3105: () => {},
+foo3106: () => {},
+foo3107: () => {},
+foo3108: () => {},
+foo3109: () => {},
+foo3110: () => {},
+foo3111: () => {},
+foo3112: () => {},
+foo3113: () => {},
+foo3114: () => {},
+foo3115: () => {},
+foo3116: () => {},
+foo3117: () => {},
+foo3118: () => {},
+foo3119: () => {},
+foo3120: () => {},
+foo3121: () => {},
+foo3122: () => {},
+foo3123: () => {},
+foo3124: () => {},
+foo3125: () => {},
+foo3126: () => {},
+foo3127: () => {},
+foo3128: () => {},
+foo3129: () => {},
+foo3130: () => {},
+foo3131: () => {},
+foo3132: () => {},
+foo3133: () => {},
+foo3134: () => {},
+foo3135: () => {},
+foo3136: () => {},
+foo3137: () => {},
+foo3138: () => {},
+foo3139: () => {},
+foo3140: () => {},
+foo3141: () => {},
+foo3142: () => {},
+foo3143: () => {},
+foo3144: () => {},
+foo3145: () => {},
+foo3146: () => {},
+foo3147: () => {},
+foo3148: () => {},
+foo3149: () => {},
+foo3150: () => {},
+foo3151: () => {},
+foo3152: () => {},
+foo3153: () => {},
+foo3154: () => {},
+foo3155: () => {},
+foo3156: () => {},
+foo3157: () => {},
+foo3158: () => {},
+foo3159: () => {},
+foo3160: () => {},
+foo3161: () => {},
+foo3162: () => {},
+foo3163: () => {},
+foo3164: () => {},
+foo3165: () => {},
+foo3166: () => {},
+foo3167: () => {},
+foo3168: () => {},
+foo3169: () => {},
+foo3170: () => {},
+foo3171: () => {},
+foo3172: () => {},
+foo3173: () => {},
+foo3174: () => {},
+foo3175: () => {},
+foo3176: () => {},
+foo3177: () => {},
+foo3178: () => {},
+foo3179: () => {},
+foo3180: () => {},
+foo3181: () => {},
+foo3182: () => {},
+foo3183: () => {},
+foo3184: () => {},
+foo3185: () => {},
+foo3186: () => {},
+foo3187: () => {},
+foo3188: () => {},
+foo3189: () => {},
+foo3190: () => {},
+foo3191: () => {},
+foo3192: () => {},
+foo3193: () => {},
+foo3194: () => {},
+foo3195: () => {},
+foo3196: () => {},
+foo3197: () => {},
+foo3198: () => {},
+foo3199: () => {},
+foo3200: () => {},
+foo3201: () => {},
+foo3202: () => {},
+foo3203: () => {},
+foo3204: () => {},
+foo3205: () => {},
+foo3206: () => {},
+foo3207: () => {},
+foo3208: () => {},
+foo3209: () => {},
+foo3210: () => {},
+foo3211: () => {},
+foo3212: () => {},
+foo3213: () => {},
+foo3214: () => {},
+foo3215: () => {},
+foo3216: () => {},
+foo3217: () => {},
+foo3218: () => {},
+foo3219: () => {},
+foo3220: () => {},
+foo3221: () => {},
+foo3222: () => {},
+foo3223: () => {},
+foo3224: () => {},
+foo3225: () => {},
+foo3226: () => {},
+foo3227: () => {},
+foo3228: () => {},
+foo3229: () => {},
+foo3230: () => {},
+foo3231: () => {},
+foo3232: () => {},
+foo3233: () => {},
+foo3234: () => {},
+foo3235: () => {},
+foo3236: () => {},
+foo3237: () => {},
+foo3238: () => {},
+foo3239: () => {},
+foo3240: () => {},
+foo3241: () => {},
+foo3242: () => {},
+foo3243: () => {},
+foo3244: () => {},
+foo3245: () => {},
+foo3246: () => {},
+foo3247: () => {},
+foo3248: () => {},
+foo3249: () => {},
+foo3250: () => {},
+foo3251: () => {},
+foo3252: () => {},
+foo3253: () => {},
+foo3254: () => {},
+foo3255: () => {},
+foo3256: () => {},
+foo3257: () => {},
+foo3258: () => {},
+foo3259: () => {},
+foo3260: () => {},
+foo3261: () => {},
+foo3262: () => {},
+foo3263: () => {},
+foo3264: () => {},
+foo3265: () => {},
+foo3266: () => {},
+foo3267: () => {},
+foo3268: () => {},
+foo3269: () => {},
+foo3270: () => {},
+foo3271: () => {},
+foo3272: () => {},
+foo3273: () => {},
+foo3274: () => {},
+foo3275: () => {},
+foo3276: () => {},
+foo3277: () => {},
+foo3278: () => {},
+foo3279: () => {},
+foo3280: () => {},
+foo3281: () => {},
+foo3282: () => {},
+foo3283: () => {},
+foo3284: () => {},
+foo3285: () => {},
+foo3286: () => {},
+foo3287: () => {},
+foo3288: () => {},
+foo3289: () => {},
+foo3290: () => {},
+foo3291: () => {},
+foo3292: () => {},
+foo3293: () => {},
+foo3294: () => {},
+foo3295: () => {},
+foo3296: () => {},
+foo3297: () => {},
+foo3298: () => {},
+foo3299: () => {},
+foo3300: () => {},
+foo3301: () => {},
+foo3302: () => {},
+foo3303: () => {},
+foo3304: () => {},
+foo3305: () => {},
+foo3306: () => {},
+foo3307: () => {},
+foo3308: () => {},
+foo3309: () => {},
+foo3310: () => {},
+foo3311: () => {},
+foo3312: () => {},
+foo3313: () => {},
+foo3314: () => {},
+foo3315: () => {},
+foo3316: () => {},
+foo3317: () => {},
+foo3318: () => {},
+foo3319: () => {},
+foo3320: () => {},
+foo3321: () => {},
+foo3322: () => {},
+foo3323: () => {},
+foo3324: () => {},
+foo3325: () => {},
+foo3326: () => {},
+foo3327: () => {},
+foo3328: () => {},
+foo3329: () => {},
+foo3330: () => {},
+foo3331: () => {},
+foo3332: () => {},
+foo3333: () => {},
+foo3334: () => {},
+foo3335: () => {},
+foo3336: () => {},
+foo3337: () => {},
+foo3338: () => {},
+foo3339: () => {},
+foo3340: () => {},
+foo3341: () => {},
+foo3342: () => {},
+foo3343: () => {},
+foo3344: () => {},
+foo3345: () => {},
+foo3346: () => {},
+foo3347: () => {},
+foo3348: () => {},
+foo3349: () => {},
+foo3350: () => {},
+foo3351: () => {},
+foo3352: () => {},
+foo3353: () => {},
+foo3354: () => {},
+foo3355: () => {},
+foo3356: () => {},
+foo3357: () => {},
+foo3358: () => {},
+foo3359: () => {},
+foo3360: () => {},
+foo3361: () => {},
+foo3362: () => {},
+foo3363: () => {},
+foo3364: () => {},
+foo3365: () => {},
+foo3366: () => {},
+foo3367: () => {},
+foo3368: () => {},
+foo3369: () => {},
+foo3370: () => {},
+foo3371: () => {},
+foo3372: () => {},
+foo3373: () => {},
+foo3374: () => {},
+foo3375: () => {},
+foo3376: () => {},
+foo3377: () => {},
+foo3378: () => {},
+foo3379: () => {},
+foo3380: () => {},
+foo3381: () => {},
+foo3382: () => {},
+foo3383: () => {},
+foo3384: () => {},
+foo3385: () => {},
+foo3386: () => {},
+foo3387: () => {},
+foo3388: () => {},
+foo3389: () => {},
+foo3390: () => {},
+foo3391: () => {},
+foo3392: () => {},
+foo3393: () => {},
+foo3394: () => {},
+foo3395: () => {},
+foo3396: () => {},
+foo3397: () => {},
+foo3398: () => {},
+foo3399: () => {},
+foo3400: () => {},
+foo3401: () => {},
+foo3402: () => {},
+foo3403: () => {},
+foo3404: () => {},
+foo3405: () => {},
+foo3406: () => {},
+foo3407: () => {},
+foo3408: () => {},
+foo3409: () => {},
+foo3410: () => {},
+foo3411: () => {},
+foo3412: () => {},
+foo3413: () => {},
+foo3414: () => {},
+foo3415: () => {},
+foo3416: () => {},
+foo3417: () => {},
+foo3418: () => {},
+foo3419: () => {},
+foo3420: () => {},
+foo3421: () => {},
+foo3422: () => {},
+foo3423: () => {},
+foo3424: () => {},
+foo3425: () => {},
+foo3426: () => {},
+foo3427: () => {},
+foo3428: () => {},
+foo3429: () => {},
+foo3430: () => {},
+foo3431: () => {},
+foo3432: () => {},
+foo3433: () => {},
+foo3434: () => {},
+foo3435: () => {},
+foo3436: () => {},
+foo3437: () => {},
+foo3438: () => {},
+foo3439: () => {},
+foo3440: () => {},
+foo3441: () => {},
+foo3442: () => {},
+foo3443: () => {},
+foo3444: () => {},
+foo3445: () => {},
+foo3446: () => {},
+foo3447: () => {},
+foo3448: () => {},
+foo3449: () => {},
+foo3450: () => {},
+foo3451: () => {},
+foo3452: () => {},
+foo3453: () => {},
+foo3454: () => {},
+foo3455: () => {},
+foo3456: () => {},
+foo3457: () => {},
+foo3458: () => {},
+foo3459: () => {},
+foo3460: () => {},
+foo3461: () => {},
+foo3462: () => {},
+foo3463: () => {},
+foo3464: () => {},
+foo3465: () => {},
+foo3466: () => {},
+foo3467: () => {},
+foo3468: () => {},
+foo3469: () => {},
+foo3470: () => {},
+foo3471: () => {},
+foo3472: () => {},
+foo3473: () => {},
+foo3474: () => {},
+foo3475: () => {},
+foo3476: () => {},
+foo3477: () => {},
+foo3478: () => {},
+foo3479: () => {},
+foo3480: () => {},
+foo3481: () => {},
+foo3482: () => {},
+foo3483: () => {},
+foo3484: () => {},
+foo3485: () => {},
+foo3486: () => {},
+foo3487: () => {},
+foo3488: () => {},
+foo3489: () => {},
+foo3490: () => {},
+foo3491: () => {},
+foo3492: () => {},
+foo3493: () => {},
+foo3494: () => {},
+foo3495: () => {},
+foo3496: () => {},
+foo3497: () => {},
+foo3498: () => {},
+foo3499: () => {},
+foo3500: () => {},
+foo3501: () => {},
+foo3502: () => {},
+foo3503: () => {},
+foo3504: () => {},
+foo3505: () => {},
+foo3506: () => {},
+foo3507: () => {},
+foo3508: () => {},
+foo3509: () => {},
+foo3510: () => {},
+foo3511: () => {},
+foo3512: () => {},
+foo3513: () => {},
+foo3514: () => {},
+foo3515: () => {},
+foo3516: () => {},
+foo3517: () => {},
+foo3518: () => {},
+foo3519: () => {},
+foo3520: () => {},
+foo3521: () => {},
+foo3522: () => {},
+foo3523: () => {},
+foo3524: () => {},
+foo3525: () => {},
+foo3526: () => {},
+foo3527: () => {},
+foo3528: () => {},
+foo3529: () => {},
+foo3530: () => {},
+foo3531: () => {},
+foo3532: () => {},
+foo3533: () => {},
+foo3534: () => {},
+foo3535: () => {},
+foo3536: () => {},
+foo3537: () => {},
+foo3538: () => {},
+foo3539: () => {},
+foo3540: () => {},
+foo3541: () => {},
+foo3542: () => {},
+foo3543: () => {},
+foo3544: () => {},
+foo3545: () => {},
+foo3546: () => {},
+foo3547: () => {},
+foo3548: () => {},
+foo3549: () => {},
+foo3550: () => {},
+foo3551: () => {},
+foo3552: () => {},
+foo3553: () => {},
+foo3554: () => {},
+foo3555: () => {},
+foo3556: () => {},
+foo3557: () => {},
+foo3558: () => {},
+foo3559: () => {},
+foo3560: () => {},
+foo3561: () => {},
+foo3562: () => {},
+foo3563: () => {},
+foo3564: () => {},
+foo3565: () => {},
+foo3566: () => {},
+foo3567: () => {},
+foo3568: () => {},
+foo3569: () => {},
+foo3570: () => {},
+foo3571: () => {},
+foo3572: () => {},
+foo3573: () => {},
+foo3574: () => {},
+foo3575: () => {},
+foo3576: () => {},
+foo3577: () => {},
+foo3578: () => {},
+foo3579: () => {},
+foo3580: () => {},
+foo3581: () => {},
+foo3582: () => {},
+foo3583: () => {},
+foo3584: () => {},
+foo3585: () => {},
+foo3586: () => {},
+foo3587: () => {},
+foo3588: () => {},
+foo3589: () => {},
+foo3590: () => {},
+foo3591: () => {},
+foo3592: () => {},
+foo3593: () => {},
+foo3594: () => {},
+foo3595: () => {},
+foo3596: () => {},
+foo3597: () => {},
+foo3598: () => {},
+foo3599: () => {},
+foo3600: () => {},
+foo3601: () => {},
+foo3602: () => {},
+foo3603: () => {},
+foo3604: () => {},
+foo3605: () => {},
+foo3606: () => {},
+foo3607: () => {},
+foo3608: () => {},
+foo3609: () => {},
+foo3610: () => {},
+foo3611: () => {},
+foo3612: () => {},
+foo3613: () => {},
+foo3614: () => {},
+foo3615: () => {},
+foo3616: () => {},
+foo3617: () => {},
+foo3618: () => {},
+foo3619: () => {},
+foo3620: () => {},
+foo3621: () => {},
+foo3622: () => {},
+foo3623: () => {},
+foo3624: () => {},
+foo3625: () => {},
+foo3626: () => {},
+foo3627: () => {},
+foo3628: () => {},
+foo3629: () => {},
+foo3630: () => {},
+foo3631: () => {},
+foo3632: () => {},
+foo3633: () => {},
+foo3634: () => {},
+foo3635: () => {},
+foo3636: () => {},
+foo3637: () => {},
+foo3638: () => {},
+foo3639: () => {},
+foo3640: () => {},
+foo3641: () => {},
+foo3642: () => {},
+foo3643: () => {},
+foo3644: () => {},
+foo3645: () => {},
+foo3646: () => {},
+foo3647: () => {},
+foo3648: () => {},
+foo3649: () => {},
+foo3650: () => {},
+foo3651: () => {},
+foo3652: () => {},
+foo3653: () => {},
+foo3654: () => {},
+foo3655: () => {},
+foo3656: () => {},
+foo3657: () => {},
+foo3658: () => {},
+foo3659: () => {},
+foo3660: () => {},
+foo3661: () => {},
+foo3662: () => {},
+foo3663: () => {},
+foo3664: () => {},
+foo3665: () => {},
+foo3666: () => {},
+foo3667: () => {},
+foo3668: () => {},
+foo3669: () => {},
+foo3670: () => {},
+foo3671: () => {},
+foo3672: () => {},
+foo3673: () => {},
+foo3674: () => {},
+foo3675: () => {},
+foo3676: () => {},
+foo3677: () => {},
+foo3678: () => {},
+foo3679: () => {},
+foo3680: () => {},
+foo3681: () => {},
+foo3682: () => {},
+foo3683: () => {},
+foo3684: () => {},
+foo3685: () => {},
+foo3686: () => {},
+foo3687: () => {},
+foo3688: () => {},
+foo3689: () => {},
+foo3690: () => {},
+foo3691: () => {},
+foo3692: () => {},
+foo3693: () => {},
+foo3694: () => {},
+foo3695: () => {},
+foo3696: () => {},
+foo3697: () => {},
+foo3698: () => {},
+foo3699: () => {},
+foo3700: () => {},
+foo3701: () => {},
+foo3702: () => {},
+foo3703: () => {},
+foo3704: () => {},
+foo3705: () => {},
+foo3706: () => {},
+foo3707: () => {},
+foo3708: () => {},
+foo3709: () => {},
+foo3710: () => {},
+foo3711: () => {},
+foo3712: () => {},
+foo3713: () => {},
+foo3714: () => {},
+foo3715: () => {},
+foo3716: () => {},
+foo3717: () => {},
+foo3718: () => {},
+foo3719: () => {},
+foo3720: () => {},
+foo3721: () => {},
+foo3722: () => {},
+foo3723: () => {},
+foo3724: () => {},
+foo3725: () => {},
+foo3726: () => {},
+foo3727: () => {},
+foo3728: () => {},
+foo3729: () => {},
+foo3730: () => {},
+foo3731: () => {},
+foo3732: () => {},
+foo3733: () => {},
+foo3734: () => {},
+foo3735: () => {},
+foo3736: () => {},
+foo3737: () => {},
+foo3738: () => {},
+foo3739: () => {},
+foo3740: () => {},
+foo3741: () => {},
+foo3742: () => {},
+foo3743: () => {},
+foo3744: () => {},
+foo3745: () => {},
+foo3746: () => {},
+foo3747: () => {},
+foo3748: () => {},
+foo3749: () => {},
+foo3750: () => {},
+foo3751: () => {},
+foo3752: () => {},
+foo3753: () => {},
+foo3754: () => {},
+foo3755: () => {},
+foo3756: () => {},
+foo3757: () => {},
+foo3758: () => {},
+foo3759: () => {},
+foo3760: () => {},
+foo3761: () => {},
+foo3762: () => {},
+foo3763: () => {},
+foo3764: () => {},
+foo3765: () => {},
+foo3766: () => {},
+foo3767: () => {},
+foo3768: () => {},
+foo3769: () => {},
+foo3770: () => {},
+foo3771: () => {},
+foo3772: () => {},
+foo3773: () => {},
+foo3774: () => {},
+foo3775: () => {},
+foo3776: () => {},
+foo3777: () => {},
+foo3778: () => {},
+foo3779: () => {},
+foo3780: () => {},
+foo3781: () => {},
+foo3782: () => {},
+foo3783: () => {},
+foo3784: () => {},
+foo3785: () => {},
+foo3786: () => {},
+foo3787: () => {},
+foo3788: () => {},
+foo3789: () => {},
+foo3790: () => {},
+foo3791: () => {},
+foo3792: () => {},
+foo3793: () => {},
+foo3794: () => {},
+foo3795: () => {},
+foo3796: () => {},
+foo3797: () => {},
+foo3798: () => {},
+foo3799: () => {},
+foo3800: () => {},
+foo3801: () => {},
+foo3802: () => {},
+foo3803: () => {},
+foo3804: () => {},
+foo3805: () => {},
+foo3806: () => {},
+foo3807: () => {},
+foo3808: () => {},
+foo3809: () => {},
+foo3810: () => {},
+foo3811: () => {},
+foo3812: () => {},
+foo3813: () => {},
+foo3814: () => {},
+foo3815: () => {},
+foo3816: () => {},
+foo3817: () => {},
+foo3818: () => {},
+foo3819: () => {},
+foo3820: () => {},
+foo3821: () => {},
+foo3822: () => {},
+foo3823: () => {},
+foo3824: () => {},
+foo3825: () => {},
+foo3826: () => {},
+foo3827: () => {},
+foo3828: () => {},
+foo3829: () => {},
+foo3830: () => {},
+foo3831: () => {},
+foo3832: () => {},
+foo3833: () => {},
+foo3834: () => {},
+foo3835: () => {},
+foo3836: () => {},
+foo3837: () => {},
+foo3838: () => {},
+foo3839: () => {},
+foo3840: () => {},
+foo3841: () => {},
+foo3842: () => {},
+foo3843: () => {},
+foo3844: () => {},
+foo3845: () => {},
+foo3846: () => {},
+foo3847: () => {},
+foo3848: () => {},
+foo3849: () => {},
+foo3850: () => {},
+foo3851: () => {},
+foo3852: () => {},
+foo3853: () => {},
+foo3854: () => {},
+foo3855: () => {},
+foo3856: () => {},
+foo3857: () => {},
+foo3858: () => {},
+foo3859: () => {},
+foo3860: () => {},
+foo3861: () => {},
+foo3862: () => {},
+foo3863: () => {},
+foo3864: () => {},
+foo3865: () => {},
+foo3866: () => {},
+foo3867: () => {},
+foo3868: () => {},
+foo3869: () => {},
+foo3870: () => {},
+foo3871: () => {},
+foo3872: () => {},
+foo3873: () => {},
+foo3874: () => {},
+foo3875: () => {},
+foo3876: () => {},
+foo3877: () => {},
+foo3878: () => {},
+foo3879: () => {},
+foo3880: () => {},
+foo3881: () => {},
+foo3882: () => {},
+foo3883: () => {},
+foo3884: () => {},
+foo3885: () => {},
+foo3886: () => {},
+foo3887: () => {},
+foo3888: () => {},
+foo3889: () => {},
+foo3890: () => {},
+foo3891: () => {},
+foo3892: () => {},
+foo3893: () => {},
+foo3894: () => {},
+foo3895: () => {},
+foo3896: () => {},
+foo3897: () => {},
+foo3898: () => {},
+foo3899: () => {},
+foo3900: () => {},
+foo3901: () => {},
+foo3902: () => {},
+foo3903: () => {},
+foo3904: () => {},
+foo3905: () => {},
+foo3906: () => {},
+foo3907: () => {},
+foo3908: () => {},
+foo3909: () => {},
+foo3910: () => {},
+foo3911: () => {},
+foo3912: () => {},
+foo3913: () => {},
+foo3914: () => {},
+foo3915: () => {},
+foo3916: () => {},
+foo3917: () => {},
+foo3918: () => {},
+foo3919: () => {},
+foo3920: () => {},
+foo3921: () => {},
+foo3922: () => {},
+foo3923: () => {},
+foo3924: () => {},
+foo3925: () => {},
+foo3926: () => {},
+foo3927: () => {},
+foo3928: () => {},
+foo3929: () => {},
+foo3930: () => {},
+foo3931: () => {},
+foo3932: () => {},
+foo3933: () => {},
+foo3934: () => {},
+foo3935: () => {},
+foo3936: () => {},
+foo3937: () => {},
+foo3938: () => {},
+foo3939: () => {},
+foo3940: () => {},
+foo3941: () => {},
+foo3942: () => {},
+foo3943: () => {},
+foo3944: () => {},
+foo3945: () => {},
+foo3946: () => {},
+foo3947: () => {},
+foo3948: () => {},
+foo3949: () => {},
+foo3950: () => {},
+foo3951: () => {},
+foo3952: () => {},
+foo3953: () => {},
+foo3954: () => {},
+foo3955: () => {},
+foo3956: () => {},
+foo3957: () => {},
+foo3958: () => {},
+foo3959: () => {},
+foo3960: () => {},
+foo3961: () => {},
+foo3962: () => {},
+foo3963: () => {},
+foo3964: () => {},
+foo3965: () => {},
+foo3966: () => {},
+foo3967: () => {},
+foo3968: () => {},
+foo3969: () => {},
+foo3970: () => {},
+foo3971: () => {},
+foo3972: () => {},
+foo3973: () => {},
+foo3974: () => {},
+foo3975: () => {},
+foo3976: () => {},
+foo3977: () => {},
+foo3978: () => {},
+foo3979: () => {},
+foo3980: () => {},
+foo3981: () => {},
+foo3982: () => {},
+foo3983: () => {},
+foo3984: () => {},
+foo3985: () => {},
+foo3986: () => {},
+foo3987: () => {},
+foo3988: () => {},
+foo3989: () => {},
+foo3990: () => {},
+foo3991: () => {},
+foo3992: () => {},
+foo3993: () => {},
+foo3994: () => {},
+foo3995: () => {},
+foo3996: () => {},
+foo3997: () => {},
+foo3998: () => {},
+foo3999: () => {},
+foo4000: () => {},
+foo4001: () => {},
+foo4002: () => {},
+foo4003: () => {},
+foo4004: () => {},
+foo4005: () => {},
+foo4006: () => {},
+foo4007: () => {},
+foo4008: () => {},
+foo4009: () => {},
+foo4010: () => {},
+foo4011: () => {},
+foo4012: () => {},
+foo4013: () => {},
+foo4014: () => {},
+foo4015: () => {},
+foo4016: () => {},
+foo4017: () => {},
+foo4018: () => {},
+foo4019: () => {},
+foo4020: () => {},
+foo4021: () => {},
+foo4022: () => {},
+foo4023: () => {},
+foo4024: () => {},
+foo4025: () => {},
+foo4026: () => {},
+foo4027: () => {},
+foo4028: () => {},
+foo4029: () => {},
+foo4030: () => {},
+foo4031: () => {},
+foo4032: () => {},
+foo4033: () => {},
+foo4034: () => {},
+foo4035: () => {},
+foo4036: () => {},
+foo4037: () => {},
+foo4038: () => {},
+foo4039: () => {},
+foo4040: () => {},
+foo4041: () => {},
+foo4042: () => {},
+foo4043: () => {},
+foo4044: () => {},
+foo4045: () => {},
+foo4046: () => {},
+foo4047: () => {},
+foo4048: () => {},
+foo4049: () => {},
+foo4050: () => {},
+foo4051: () => {},
+foo4052: () => {},
+foo4053: () => {},
+foo4054: () => {},
+foo4055: () => {},
+foo4056: () => {},
+foo4057: () => {},
+foo4058: () => {},
+foo4059: () => {},
+foo4060: () => {},
+foo4061: () => {},
+foo4062: () => {},
+foo4063: () => {},
+foo4064: () => {},
+foo4065: () => {},
+foo4066: () => {},
+foo4067: () => {},
+foo4068: () => {},
+foo4069: () => {},
+foo4070: () => {},
+foo4071: () => {},
+foo4072: () => {},
+foo4073: () => {},
+foo4074: () => {},
+foo4075: () => {},
+foo4076: () => {},
+foo4077: () => {},
+foo4078: () => {},
+foo4079: () => {},
+foo4080: () => {},
+foo4081: () => {},
+foo4082: () => {},
+foo4083: () => {},
+foo4084: () => {},
+foo4085: () => {},
+foo4086: () => {},
+foo4087: () => {},
+foo4088: () => {},
+foo4089: () => {},
+foo4090: () => {},
+foo4091: () => {},
+foo4092: () => {},
+foo4093: () => {},
+foo4094: () => {},
+foo4095: () => {},
+foo4096: () => {},
+foo4097: () => {},
+foo4098: () => {},
+foo4099: () => {},
+foo4100: () => {},
+foo4101: () => {},
+foo4102: () => {},
+foo4103: () => {},
+foo4104: () => {},
+foo4105: () => {},
+foo4106: () => {},
+foo4107: () => {},
+foo4108: () => {},
+foo4109: () => {},
+foo4110: () => {},
+foo4111: () => {},
+foo4112: () => {},
+foo4113: () => {},
+foo4114: () => {},
+foo4115: () => {},
+foo4116: () => {},
+foo4117: () => {},
+foo4118: () => {},
+foo4119: () => {},
+foo4120: () => {},
+foo4121: () => {},
+foo4122: () => {},
+foo4123: () => {},
+foo4124: () => {},
+foo4125: () => {},
+foo4126: () => {},
+foo4127: () => {},
+foo4128: () => {},
+foo4129: () => {},
+foo4130: () => {},
+foo4131: () => {},
+foo4132: () => {},
+foo4133: () => {},
+foo4134: () => {},
+foo4135: () => {},
+foo4136: () => {},
+foo4137: () => {},
+foo4138: () => {},
+foo4139: () => {},
+foo4140: () => {},
+foo4141: () => {},
+foo4142: () => {},
+foo4143: () => {},
+foo4144: () => {},
+foo4145: () => {},
+foo4146: () => {},
+foo4147: () => {},
+foo4148: () => {},
+foo4149: () => {},
+foo4150: () => {},
+foo4151: () => {},
+foo4152: () => {},
+foo4153: () => {},
+foo4154: () => {},
+foo4155: () => {},
+foo4156: () => {},
+foo4157: () => {},
+foo4158: () => {},
+foo4159: () => {},
+foo4160: () => {},
+foo4161: () => {},
+foo4162: () => {},
+foo4163: () => {},
+foo4164: () => {},
+foo4165: () => {},
+foo4166: () => {},
+foo4167: () => {},
+foo4168: () => {},
+foo4169: () => {},
+foo4170: () => {},
+foo4171: () => {},
+foo4172: () => {},
+foo4173: () => {},
+foo4174: () => {},
+foo4175: () => {},
+foo4176: () => {},
+foo4177: () => {},
+foo4178: () => {},
+foo4179: () => {},
+foo4180: () => {},
+foo4181: () => {},
+foo4182: () => {},
+foo4183: () => {},
+foo4184: () => {},
+foo4185: () => {},
+foo4186: () => {},
+foo4187: () => {},
+foo4188: () => {},
+foo4189: () => {},
+foo4190: () => {},
+foo4191: () => {},
+foo4192: () => {},
+foo4193: () => {},
+foo4194: () => {},
+foo4195: () => {},
+foo4196: () => {},
+foo4197: () => {},
+foo4198: () => {},
+foo4199: () => {},
+foo4200: () => {},
+foo4201: () => {},
+foo4202: () => {},
+foo4203: () => {},
+foo4204: () => {},
+foo4205: () => {},
+foo4206: () => {},
+foo4207: () => {},
+foo4208: () => {},
+foo4209: () => {},
+foo4210: () => {},
+foo4211: () => {},
+foo4212: () => {},
+foo4213: () => {},
+foo4214: () => {},
+foo4215: () => {},
+foo4216: () => {},
+foo4217: () => {},
+foo4218: () => {},
+foo4219: () => {},
+foo4220: () => {},
+foo4221: () => {},
+foo4222: () => {},
+foo4223: () => {},
+foo4224: () => {},
+foo4225: () => {},
+foo4226: () => {},
+foo4227: () => {},
+foo4228: () => {},
+foo4229: () => {},
+foo4230: () => {},
+foo4231: () => {},
+foo4232: () => {},
+foo4233: () => {},
+foo4234: () => {},
+foo4235: () => {},
+foo4236: () => {},
+foo4237: () => {},
+foo4238: () => {},
+foo4239: () => {},
+foo4240: () => {},
+foo4241: () => {},
+foo4242: () => {},
+foo4243: () => {},
+foo4244: () => {},
+foo4245: () => {},
+foo4246: () => {},
+foo4247: () => {},
+foo4248: () => {},
+foo4249: () => {},
+foo4250: () => {},
+foo4251: () => {},
+foo4252: () => {},
+foo4253: () => {},
+foo4254: () => {},
+foo4255: () => {},
+foo4256: () => {},
+foo4257: () => {},
+foo4258: () => {},
+foo4259: () => {},
+foo4260: () => {},
+foo4261: () => {},
+foo4262: () => {},
+foo4263: () => {},
+foo4264: () => {},
+foo4265: () => {},
+foo4266: () => {},
+foo4267: () => {},
+foo4268: () => {},
+foo4269: () => {},
+foo4270: () => {},
+foo4271: () => {},
+foo4272: () => {},
+foo4273: () => {},
+foo4274: () => {},
+foo4275: () => {},
+foo4276: () => {},
+foo4277: () => {},
+foo4278: () => {},
+foo4279: () => {},
+foo4280: () => {},
+foo4281: () => {},
+foo4282: () => {},
+foo4283: () => {},
+foo4284: () => {},
+foo4285: () => {},
+foo4286: () => {},
+foo4287: () => {},
+foo4288: () => {},
+foo4289: () => {},
+foo4290: () => {},
+foo4291: () => {},
+foo4292: () => {},
+foo4293: () => {},
+foo4294: () => {},
+foo4295: () => {},
+foo4296: () => {},
+foo4297: () => {},
+foo4298: () => {},
+foo4299: () => {},
+foo4300: () => {},
+foo4301: () => {},
+foo4302: () => {},
+foo4303: () => {},
+foo4304: () => {},
+foo4305: () => {},
+foo4306: () => {},
+foo4307: () => {},
+foo4308: () => {},
+foo4309: () => {},
+foo4310: () => {},
+foo4311: () => {},
+foo4312: () => {},
+foo4313: () => {},
+foo4314: () => {},
+foo4315: () => {},
+foo4316: () => {},
+foo4317: () => {},
+foo4318: () => {},
+foo4319: () => {},
+foo4320: () => {},
+foo4321: () => {},
+foo4322: () => {},
+foo4323: () => {},
+foo4324: () => {},
+foo4325: () => {},
+foo4326: () => {},
+foo4327: () => {},
+foo4328: () => {},
+foo4329: () => {},
+foo4330: () => {},
+foo4331: () => {},
+foo4332: () => {},
+foo4333: () => {},
+foo4334: () => {},
+foo4335: () => {},
+foo4336: () => {},
+foo4337: () => {},
+foo4338: () => {},
+foo4339: () => {},
+foo4340: () => {},
+foo4341: () => {},
+foo4342: () => {},
+foo4343: () => {},
+foo4344: () => {},
+foo4345: () => {},
+foo4346: () => {},
+foo4347: () => {},
+foo4348: () => {},
+foo4349: () => {},
+foo4350: () => {},
+foo4351: () => {},
+foo4352: () => {},
+foo4353: () => {},
+foo4354: () => {},
+foo4355: () => {},
+foo4356: () => {},
+foo4357: () => {},
+foo4358: () => {},
+foo4359: () => {},
+foo4360: () => {},
+foo4361: () => {},
+foo4362: () => {},
+foo4363: () => {},
+foo4364: () => {},
+foo4365: () => {},
+foo4366: () => {},
+foo4367: () => {},
+foo4368: () => {},
+foo4369: () => {},
+foo4370: () => {},
+foo4371: () => {},
+foo4372: () => {},
+foo4373: () => {},
+foo4374: () => {},
+foo4375: () => {},
+foo4376: () => {},
+foo4377: () => {},
+foo4378: () => {},
+foo4379: () => {},
+foo4380: () => {},
+foo4381: () => {},
+foo4382: () => {},
+foo4383: () => {},
+foo4384: () => {},
+foo4385: () => {},
+foo4386: () => {},
+foo4387: () => {},
+foo4388: () => {},
+foo4389: () => {},
+foo4390: () => {},
+foo4391: () => {},
+foo4392: () => {},
+foo4393: () => {},
+foo4394: () => {},
+foo4395: () => {},
+foo4396: () => {},
+foo4397: () => {},
+foo4398: () => {},
+foo4399: () => {},
+foo4400: () => {},
+foo4401: () => {},
+foo4402: () => {},
+foo4403: () => {},
+foo4404: () => {},
+foo4405: () => {},
+foo4406: () => {},
+foo4407: () => {},
+foo4408: () => {},
+foo4409: () => {},
+foo4410: () => {},
+foo4411: () => {},
+foo4412: () => {},
+foo4413: () => {},
+foo4414: () => {},
+foo4415: () => {},
+foo4416: () => {},
+foo4417: () => {},
+foo4418: () => {},
+foo4419: () => {},
+foo4420: () => {},
+foo4421: () => {},
+foo4422: () => {},
+foo4423: () => {},
+foo4424: () => {},
+foo4425: () => {},
+foo4426: () => {},
+foo4427: () => {},
+foo4428: () => {},
+foo4429: () => {},
+foo4430: () => {},
+foo4431: () => {},
+foo4432: () => {},
+foo4433: () => {},
+foo4434: () => {},
+foo4435: () => {},
+foo4436: () => {},
+foo4437: () => {},
+foo4438: () => {},
+foo4439: () => {},
+foo4440: () => {},
+foo4441: () => {},
+foo4442: () => {},
+foo4443: () => {},
+foo4444: () => {},
+foo4445: () => {},
+foo4446: () => {},
+foo4447: () => {},
+foo4448: () => {},
+foo4449: () => {},
+foo4450: () => {},
+foo4451: () => {},
+foo4452: () => {},
+foo4453: () => {},
+foo4454: () => {},
+foo4455: () => {},
+foo4456: () => {},
+foo4457: () => {},
+foo4458: () => {},
+foo4459: () => {},
+foo4460: () => {},
+foo4461: () => {},
+foo4462: () => {},
+foo4463: () => {},
+foo4464: () => {},
+foo4465: () => {},
+foo4466: () => {},
+foo4467: () => {},
+foo4468: () => {},
+foo4469: () => {},
+foo4470: () => {},
+foo4471: () => {},
+foo4472: () => {},
+foo4473: () => {},
+foo4474: () => {},
+foo4475: () => {},
+foo4476: () => {},
+foo4477: () => {},
+foo4478: () => {},
+foo4479: () => {},
+foo4480: () => {},
+foo4481: () => {},
+foo4482: () => {},
+foo4483: () => {},
+foo4484: () => {},
+foo4485: () => {},
+foo4486: () => {},
+foo4487: () => {},
+foo4488: () => {},
+foo4489: () => {},
+foo4490: () => {},
+foo4491: () => {},
+foo4492: () => {},
+foo4493: () => {},
+foo4494: () => {},
+foo4495: () => {},
+foo4496: () => {},
+foo4497: () => {},
+foo4498: () => {},
+foo4499: () => {},
+foo4500: () => {},
+foo4501: () => {},
+foo4502: () => {},
+foo4503: () => {},
+foo4504: () => {},
+foo4505: () => {},
+foo4506: () => {},
+foo4507: () => {},
+foo4508: () => {},
+foo4509: () => {},
+foo4510: () => {},
+foo4511: () => {},
+foo4512: () => {},
+foo4513: () => {},
+foo4514: () => {},
+foo4515: () => {},
+foo4516: () => {},
+foo4517: () => {},
+foo4518: () => {},
+foo4519: () => {},
+foo4520: () => {},
+foo4521: () => {},
+foo4522: () => {},
+foo4523: () => {},
+foo4524: () => {},
+foo4525: () => {},
+foo4526: () => {},
+foo4527: () => {},
+foo4528: () => {},
+foo4529: () => {},
+foo4530: () => {},
+foo4531: () => {},
+foo4532: () => {},
+foo4533: () => {},
+foo4534: () => {},
+foo4535: () => {},
+foo4536: () => {},
+foo4537: () => {},
+foo4538: () => {},
+foo4539: () => {},
+foo4540: () => {},
+foo4541: () => {},
+foo4542: () => {},
+foo4543: () => {},
+foo4544: () => {},
+foo4545: () => {},
+foo4546: () => {},
+foo4547: () => {},
+foo4548: () => {},
+foo4549: () => {},
+foo4550: () => {},
+foo4551: () => {},
+foo4552: () => {},
+foo4553: () => {},
+foo4554: () => {},
+foo4555: () => {},
+foo4556: () => {},
+foo4557: () => {},
+foo4558: () => {},
+foo4559: () => {},
+foo4560: () => {},
+foo4561: () => {},
+foo4562: () => {},
+foo4563: () => {},
+foo4564: () => {},
+foo4565: () => {},
+foo4566: () => {},
+foo4567: () => {},
+foo4568: () => {},
+foo4569: () => {},
+foo4570: () => {},
+foo4571: () => {},
+foo4572: () => {},
+foo4573: () => {},
+foo4574: () => {},
+foo4575: () => {},
+foo4576: () => {},
+foo4577: () => {},
+foo4578: () => {},
+foo4579: () => {},
+foo4580: () => {},
+foo4581: () => {},
+foo4582: () => {},
+foo4583: () => {},
+foo4584: () => {},
+foo4585: () => {},
+foo4586: () => {},
+foo4587: () => {},
+foo4588: () => {},
+foo4589: () => {},
+foo4590: () => {},
+foo4591: () => {},
+foo4592: () => {},
+foo4593: () => {},
+foo4594: () => {},
+foo4595: () => {},
+foo4596: () => {},
+foo4597: () => {},
+foo4598: () => {},
+foo4599: () => {},
+foo4600: () => {},
+foo4601: () => {},
+foo4602: () => {},
+foo4603: () => {},
+foo4604: () => {},
+foo4605: () => {},
+foo4606: () => {},
+foo4607: () => {},
+foo4608: () => {},
+foo4609: () => {},
+foo4610: () => {},
+foo4611: () => {},
+foo4612: () => {},
+foo4613: () => {},
+foo4614: () => {},
+foo4615: () => {},
+foo4616: () => {},
+foo4617: () => {},
+foo4618: () => {},
+foo4619: () => {},
+foo4620: () => {},
+foo4621: () => {},
+foo4622: () => {},
+foo4623: () => {},
+foo4624: () => {},
+foo4625: () => {},
+foo4626: () => {},
+foo4627: () => {},
+foo4628: () => {},
+foo4629: () => {},
+foo4630: () => {},
+foo4631: () => {},
+foo4632: () => {},
+foo4633: () => {},
+foo4634: () => {},
+foo4635: () => {},
+foo4636: () => {},
+foo4637: () => {},
+foo4638: () => {},
+foo4639: () => {},
+foo4640: () => {},
+foo4641: () => {},
+foo4642: () => {},
+foo4643: () => {},
+foo4644: () => {},
+foo4645: () => {},
+foo4646: () => {},
+foo4647: () => {},
+foo4648: () => {},
+foo4649: () => {},
+foo4650: () => {},
+foo4651: () => {},
+foo4652: () => {},
+foo4653: () => {},
+foo4654: () => {},
+foo4655: () => {},
+foo4656: () => {},
+foo4657: () => {},
+foo4658: () => {},
+foo4659: () => {},
+foo4660: () => {},
+foo4661: () => {},
+foo4662: () => {},
+foo4663: () => {},
+foo4664: () => {},
+foo4665: () => {},
+foo4666: () => {},
+foo4667: () => {},
+foo4668: () => {},
+foo4669: () => {},
+foo4670: () => {},
+foo4671: () => {},
+foo4672: () => {},
+foo4673: () => {},
+foo4674: () => {},
+foo4675: () => {},
+foo4676: () => {},
+foo4677: () => {},
+foo4678: () => {},
+foo4679: () => {},
+foo4680: () => {},
+foo4681: () => {},
+foo4682: () => {},
+foo4683: () => {},
+foo4684: () => {},
+foo4685: () => {},
+foo4686: () => {},
+foo4687: () => {},
+foo4688: () => {},
+foo4689: () => {},
+foo4690: () => {},
+foo4691: () => {},
+foo4692: () => {},
+foo4693: () => {},
+foo4694: () => {},
+foo4695: () => {},
+foo4696: () => {},
+foo4697: () => {},
+foo4698: () => {},
+foo4699: () => {},
+foo4700: () => {},
+foo4701: () => {},
+foo4702: () => {},
+foo4703: () => {},
+foo4704: () => {},
+foo4705: () => {},
+foo4706: () => {},
+foo4707: () => {},
+foo4708: () => {},
+foo4709: () => {},
+foo4710: () => {},
+foo4711: () => {},
+foo4712: () => {},
+foo4713: () => {},
+foo4714: () => {},
+foo4715: () => {},
+foo4716: () => {},
+foo4717: () => {},
+foo4718: () => {},
+foo4719: () => {},
+foo4720: () => {},
+foo4721: () => {},
+foo4722: () => {},
+foo4723: () => {},
+foo4724: () => {},
+foo4725: () => {},
+foo4726: () => {},
+foo4727: () => {},
+foo4728: () => {},
+foo4729: () => {},
+foo4730: () => {},
+foo4731: () => {},
+foo4732: () => {},
+foo4733: () => {},
+foo4734: () => {},
+foo4735: () => {},
+foo4736: () => {},
+foo4737: () => {},
+foo4738: () => {},
+foo4739: () => {},
+foo4740: () => {},
+foo4741: () => {},
+foo4742: () => {},
+foo4743: () => {},
+foo4744: () => {},
+foo4745: () => {},
+foo4746: () => {},
+foo4747: () => {},
+foo4748: () => {},
+foo4749: () => {},
+foo4750: () => {},
+foo4751: () => {},
+foo4752: () => {},
+foo4753: () => {},
+foo4754: () => {},
+foo4755: () => {},
+foo4756: () => {},
+foo4757: () => {},
+foo4758: () => {},
+foo4759: () => {},
+foo4760: () => {},
+foo4761: () => {},
+foo4762: () => {},
+foo4763: () => {},
+foo4764: () => {},
+foo4765: () => {},
+foo4766: () => {},
+foo4767: () => {},
+foo4768: () => {},
+foo4769: () => {},
+foo4770: () => {},
+foo4771: () => {},
+foo4772: () => {},
+foo4773: () => {},
+foo4774: () => {},
+foo4775: () => {},
+foo4776: () => {},
+foo4777: () => {},
+foo4778: () => {},
+foo4779: () => {},
+foo4780: () => {},
+foo4781: () => {},
+foo4782: () => {},
+foo4783: () => {},
+foo4784: () => {},
+foo4785: () => {},
+foo4786: () => {},
+foo4787: () => {},
+foo4788: () => {},
+foo4789: () => {},
+foo4790: () => {},
+foo4791: () => {},
+foo4792: () => {},
+foo4793: () => {},
+foo4794: () => {},
+foo4795: () => {},
+foo4796: () => {},
+foo4797: () => {},
+foo4798: () => {},
+foo4799: () => {},
+foo4800: () => {},
+foo4801: () => {},
+foo4802: () => {},
+foo4803: () => {},
+foo4804: () => {},
+foo4805: () => {},
+foo4806: () => {},
+foo4807: () => {},
+foo4808: () => {},
+foo4809: () => {},
+foo4810: () => {},
+foo4811: () => {},
+foo4812: () => {},
+foo4813: () => {},
+foo4814: () => {},
+foo4815: () => {},
+foo4816: () => {},
+foo4817: () => {},
+foo4818: () => {},
+foo4819: () => {},
+foo4820: () => {},
+foo4821: () => {},
+foo4822: () => {},
+foo4823: () => {},
+foo4824: () => {},
+foo4825: () => {},
+foo4826: () => {},
+foo4827: () => {},
+foo4828: () => {},
+foo4829: () => {},
+foo4830: () => {},
+foo4831: () => {},
+foo4832: () => {},
+foo4833: () => {},
+foo4834: () => {},
+foo4835: () => {},
+foo4836: () => {},
+foo4837: () => {},
+foo4838: () => {},
+foo4839: () => {},
+foo4840: () => {},
+foo4841: () => {},
+foo4842: () => {},
+foo4843: () => {},
+foo4844: () => {},
+foo4845: () => {},
+foo4846: () => {},
+foo4847: () => {},
+foo4848: () => {},
+foo4849: () => {},
+foo4850: () => {},
+foo4851: () => {},
+foo4852: () => {},
+foo4853: () => {},
+foo4854: () => {},
+foo4855: () => {},
+foo4856: () => {},
+foo4857: () => {},
+foo4858: () => {},
+foo4859: () => {},
+foo4860: () => {},
+foo4861: () => {},
+foo4862: () => {},
+foo4863: () => {},
+foo4864: () => {},
+foo4865: () => {},
+foo4866: () => {},
+foo4867: () => {},
+foo4868: () => {},
+foo4869: () => {},
+foo4870: () => {},
+foo4871: () => {},
+foo4872: () => {},
+foo4873: () => {},
+foo4874: () => {},
+foo4875: () => {},
+foo4876: () => {},
+foo4877: () => {},
+foo4878: () => {},
+foo4879: () => {},
+foo4880: () => {},
+foo4881: () => {},
+foo4882: () => {},
+foo4883: () => {},
+foo4884: () => {},
+foo4885: () => {},
+foo4886: () => {},
+foo4887: () => {},
+foo4888: () => {},
+foo4889: () => {},
+foo4890: () => {},
+foo4891: () => {},
+foo4892: () => {},
+foo4893: () => {},
+foo4894: () => {},
+foo4895: () => {},
+foo4896: () => {},
+foo4897: () => {},
+foo4898: () => {},
+foo4899: () => {},
+foo4900: () => {},
+foo4901: () => {},
+foo4902: () => {},
+foo4903: () => {},
+foo4904: () => {},
+foo4905: () => {},
+foo4906: () => {},
+foo4907: () => {},
+foo4908: () => {},
+foo4909: () => {},
+foo4910: () => {},
+foo4911: () => {},
+foo4912: () => {},
+foo4913: () => {},
+foo4914: () => {},
+foo4915: () => {},
+foo4916: () => {},
+foo4917: () => {},
+foo4918: () => {},
+foo4919: () => {},
+foo4920: () => {},
+foo4921: () => {},
+foo4922: () => {},
+foo4923: () => {},
+foo4924: () => {},
+foo4925: () => {},
+foo4926: () => {},
+foo4927: () => {},
+foo4928: () => {},
+foo4929: () => {},
+foo4930: () => {},
+foo4931: () => {},
+foo4932: () => {},
+foo4933: () => {},
+foo4934: () => {},
+foo4935: () => {},
+foo4936: () => {},
+foo4937: () => {},
+foo4938: () => {},
+foo4939: () => {},
+foo4940: () => {},
+foo4941: () => {},
+foo4942: () => {},
+foo4943: () => {},
+foo4944: () => {},
+foo4945: () => {},
+foo4946: () => {},
+foo4947: () => {},
+foo4948: () => {},
+foo4949: () => {},
+foo4950: () => {},
+foo4951: () => {},
+foo4952: () => {},
+foo4953: () => {},
+foo4954: () => {},
+foo4955: () => {},
+foo4956: () => {},
+foo4957: () => {},
+foo4958: () => {},
+foo4959: () => {},
+foo4960: () => {},
+foo4961: () => {},
+foo4962: () => {},
+foo4963: () => {},
+foo4964: () => {},
+foo4965: () => {},
+foo4966: () => {},
+foo4967: () => {},
+foo4968: () => {},
+foo4969: () => {},
+foo4970: () => {},
+foo4971: () => {},
+foo4972: () => {},
+foo4973: () => {},
+foo4974: () => {},
+foo4975: () => {},
+foo4976: () => {},
+foo4977: () => {},
+foo4978: () => {},
+foo4979: () => {},
+foo4980: () => {},
+foo4981: () => {},
+foo4982: () => {},
+foo4983: () => {},
+foo4984: () => {},
+foo4985: () => {},
+foo4986: () => {},
+foo4987: () => {},
+foo4988: () => {},
+foo4989: () => {},
+foo4990: () => {},
+foo4991: () => {},
+foo4992: () => {},
+foo4993: () => {},
+foo4994: () => {},
+foo4995: () => {},
+foo4996: () => {},
+foo4997: () => {},
+foo4998: () => {},
+foo4999: () => {},
+foo5000: () => {},
+foo5001: () => {},
+foo5002: () => {},
+foo5003: () => {},
+foo5004: () => {},
+foo5005: () => {},
+foo5006: () => {},
+foo5007: () => {},
+foo5008: () => {},
+foo5009: () => {},
+foo5010: () => {},
+foo5011: () => {},
+foo5012: () => {},
+foo5013: () => {},
+foo5014: () => {},
+foo5015: () => {},
+foo5016: () => {},
+foo5017: () => {},
+foo5018: () => {},
+foo5019: () => {},
+foo5020: () => {},
+foo5021: () => {},
+foo5022: () => {},
+foo5023: () => {},
+foo5024: () => {},
+foo5025: () => {},
+foo5026: () => {},
+foo5027: () => {},
+foo5028: () => {},
+foo5029: () => {},
+foo5030: () => {},
+foo5031: () => {},
+foo5032: () => {},
+foo5033: () => {},
+foo5034: () => {},
+foo5035: () => {},
+foo5036: () => {},
+foo5037: () => {},
+foo5038: () => {},
+foo5039: () => {},
+foo5040: () => {},
+foo5041: () => {},
+foo5042: () => {},
+foo5043: () => {},
+foo5044: () => {},
+foo5045: () => {},
+foo5046: () => {},
+foo5047: () => {},
+foo5048: () => {},
+foo5049: () => {},
+foo5050: () => {},
+foo5051: () => {},
+foo5052: () => {},
+foo5053: () => {},
+foo5054: () => {},
+foo5055: () => {},
+foo5056: () => {},
+foo5057: () => {},
+foo5058: () => {},
+foo5059: () => {},
+foo5060: () => {},
+foo5061: () => {},
+foo5062: () => {},
+foo5063: () => {},
+foo5064: () => {},
+foo5065: () => {},
+foo5066: () => {},
+foo5067: () => {},
+foo5068: () => {},
+foo5069: () => {},
+foo5070: () => {},
+foo5071: () => {},
+foo5072: () => {},
+foo5073: () => {},
+foo5074: () => {},
+foo5075: () => {},
+foo5076: () => {},
+foo5077: () => {},
+foo5078: () => {},
+foo5079: () => {},
+foo5080: () => {},
+foo5081: () => {},
+foo5082: () => {},
+foo5083: () => {},
+foo5084: () => {},
+foo5085: () => {},
+foo5086: () => {},
+foo5087: () => {},
+foo5088: () => {},
+foo5089: () => {},
+foo5090: () => {},
+foo5091: () => {},
+foo5092: () => {},
+foo5093: () => {},
+foo5094: () => {},
+foo5095: () => {},
+foo5096: () => {},
+foo5097: () => {},
+foo5098: () => {},
+foo5099: () => {},
+foo5100: () => {},
+foo5101: () => {},
+foo5102: () => {},
+foo5103: () => {},
+foo5104: () => {},
+foo5105: () => {},
+foo5106: () => {},
+foo5107: () => {},
+foo5108: () => {},
+foo5109: () => {},
+foo5110: () => {},
+foo5111: () => {},
+foo5112: () => {},
+foo5113: () => {},
+foo5114: () => {},
+foo5115: () => {},
+foo5116: () => {},
+foo5117: () => {},
+foo5118: () => {},
+foo5119: () => {},
+foo5120: () => {},
+foo5121: () => {},
+foo5122: () => {},
+foo5123: () => {},
+foo5124: () => {},
+foo5125: () => {},
+foo5126: () => {},
+foo5127: () => {},
+foo5128: () => {},
+foo5129: () => {},
+foo5130: () => {},
+foo5131: () => {},
+foo5132: () => {},
+foo5133: () => {},
+foo5134: () => {},
+foo5135: () => {},
+foo5136: () => {},
+foo5137: () => {},
+foo5138: () => {},
+foo5139: () => {},
+foo5140: () => {},
+foo5141: () => {},
+foo5142: () => {},
+foo5143: () => {},
+foo5144: () => {},
+foo5145: () => {},
+foo5146: () => {},
+foo5147: () => {},
+foo5148: () => {},
+foo5149: () => {},
+foo5150: () => {},
+foo5151: () => {},
+foo5152: () => {},
+foo5153: () => {},
+foo5154: () => {},
+foo5155: () => {},
+foo5156: () => {},
+foo5157: () => {},
+foo5158: () => {},
+foo5159: () => {},
+foo5160: () => {},
+foo5161: () => {},
+foo5162: () => {},
+foo5163: () => {},
+foo5164: () => {},
+foo5165: () => {},
+foo5166: () => {},
+foo5167: () => {},
+foo5168: () => {},
+foo5169: () => {},
+foo5170: () => {},
+foo5171: () => {},
+foo5172: () => {},
+foo5173: () => {},
+foo5174: () => {},
+foo5175: () => {},
+foo5176: () => {},
+foo5177: () => {},
+foo5178: () => {},
+foo5179: () => {},
+foo5180: () => {},
+foo5181: () => {},
+foo5182: () => {},
+foo5183: () => {},
+foo5184: () => {},
+foo5185: () => {},
+foo5186: () => {},
+foo5187: () => {},
+foo5188: () => {},
+foo5189: () => {},
+foo5190: () => {},
+foo5191: () => {},
+foo5192: () => {},
+foo5193: () => {},
+foo5194: () => {},
+foo5195: () => {},
+foo5196: () => {},
+foo5197: () => {},
+foo5198: () => {},
+foo5199: () => {},
+foo5200: () => {},
+foo5201: () => {},
+foo5202: () => {},
+foo5203: () => {},
+foo5204: () => {},
+foo5205: () => {},
+foo5206: () => {},
+foo5207: () => {},
+foo5208: () => {},
+foo5209: () => {},
+foo5210: () => {},
+foo5211: () => {},
+foo5212: () => {},
+foo5213: () => {},
+foo5214: () => {},
+foo5215: () => {},
+foo5216: () => {},
+foo5217: () => {},
+foo5218: () => {},
+foo5219: () => {},
+foo5220: () => {},
+foo5221: () => {},
+foo5222: () => {},
+foo5223: () => {},
+foo5224: () => {},
+foo5225: () => {},
+foo5226: () => {},
+foo5227: () => {},
+foo5228: () => {},
+foo5229: () => {},
+foo5230: () => {},
+foo5231: () => {},
+foo5232: () => {},
+foo5233: () => {},
+foo5234: () => {},
+foo5235: () => {},
+foo5236: () => {},
+foo5237: () => {},
+foo5238: () => {},
+foo5239: () => {},
+foo5240: () => {},
+foo5241: () => {},
+foo5242: () => {},
+foo5243: () => {},
+foo5244: () => {},
+foo5245: () => {},
+foo5246: () => {},
+foo5247: () => {},
+foo5248: () => {},
+foo5249: () => {},
+foo5250: () => {},
+foo5251: () => {},
+foo5252: () => {},
+foo5253: () => {},
+foo5254: () => {},
+foo5255: () => {},
+foo5256: () => {},
+foo5257: () => {},
+foo5258: () => {},
+foo5259: () => {},
+foo5260: () => {},
+foo5261: () => {},
+foo5262: () => {},
+foo5263: () => {},
+foo5264: () => {},
+foo5265: () => {},
+foo5266: () => {},
+foo5267: () => {},
+foo5268: () => {},
+foo5269: () => {},
+foo5270: () => {},
+foo5271: () => {},
+foo5272: () => {},
+foo5273: () => {},
+foo5274: () => {},
+foo5275: () => {},
+foo5276: () => {},
+foo5277: () => {},
+foo5278: () => {},
+foo5279: () => {},
+foo5280: () => {},
+foo5281: () => {},
+foo5282: () => {},
+foo5283: () => {},
+foo5284: () => {},
+foo5285: () => {},
+foo5286: () => {},
+foo5287: () => {},
+foo5288: () => {},
+foo5289: () => {},
+foo5290: () => {},
+foo5291: () => {},
+foo5292: () => {},
+foo5293: () => {},
+foo5294: () => {},
+foo5295: () => {},
+foo5296: () => {},
+foo5297: () => {},
+foo5298: () => {},
+foo5299: () => {},
+foo5300: () => {},
+foo5301: () => {},
+foo5302: () => {},
+foo5303: () => {},
+foo5304: () => {},
+foo5305: () => {},
+foo5306: () => {},
+foo5307: () => {},
+foo5308: () => {},
+foo5309: () => {},
+foo5310: () => {},
+foo5311: () => {},
+foo5312: () => {},
+foo5313: () => {},
+foo5314: () => {},
+foo5315: () => {},
+foo5316: () => {},
+foo5317: () => {},
+foo5318: () => {},
+foo5319: () => {},
+foo5320: () => {},
+foo5321: () => {},
+foo5322: () => {},
+foo5323: () => {},
+foo5324: () => {},
+foo5325: () => {},
+foo5326: () => {},
+foo5327: () => {},
+foo5328: () => {},
+foo5329: () => {},
+foo5330: () => {},
+foo5331: () => {},
+foo5332: () => {},
+foo5333: () => {},
+foo5334: () => {},
+foo5335: () => {},
+foo5336: () => {},
+foo5337: () => {},
+foo5338: () => {},
+foo5339: () => {},
+foo5340: () => {},
+foo5341: () => {},
+foo5342: () => {},
+foo5343: () => {},
+foo5344: () => {},
+foo5345: () => {},
+foo5346: () => {},
+foo5347: () => {},
+foo5348: () => {},
+foo5349: () => {},
+foo5350: () => {},
+foo5351: () => {},
+foo5352: () => {},
+foo5353: () => {},
+foo5354: () => {},
+foo5355: () => {},
+foo5356: () => {},
+foo5357: () => {},
+foo5358: () => {},
+foo5359: () => {},
+foo5360: () => {},
+foo5361: () => {},
+foo5362: () => {},
+foo5363: () => {},
+foo5364: () => {},
+foo5365: () => {},
+foo5366: () => {},
+foo5367: () => {},
+foo5368: () => {},
+foo5369: () => {},
+foo5370: () => {},
+foo5371: () => {},
+foo5372: () => {},
+foo5373: () => {},
+foo5374: () => {},
+foo5375: () => {},
+foo5376: () => {},
+foo5377: () => {},
+foo5378: () => {},
+foo5379: () => {},
+foo5380: () => {},
+foo5381: () => {},
+foo5382: () => {},
+foo5383: () => {},
+foo5384: () => {},
+foo5385: () => {},
+foo5386: () => {},
+foo5387: () => {},
+foo5388: () => {},
+foo5389: () => {},
+foo5390: () => {},
+foo5391: () => {},
+foo5392: () => {},
+foo5393: () => {},
+foo5394: () => {},
+foo5395: () => {},
+foo5396: () => {},
+foo5397: () => {},
+foo5398: () => {},
+foo5399: () => {},
+foo5400: () => {},
+foo5401: () => {},
+foo5402: () => {},
+foo5403: () => {},
+foo5404: () => {},
+foo5405: () => {},
+foo5406: () => {},
+foo5407: () => {},
+foo5408: () => {},
+foo5409: () => {},
+foo5410: () => {},
+foo5411: () => {},
+foo5412: () => {},
+foo5413: () => {},
+foo5414: () => {},
+foo5415: () => {},
+foo5416: () => {},
+foo5417: () => {},
+foo5418: () => {},
+foo5419: () => {},
+foo5420: () => {},
+foo5421: () => {},
+foo5422: () => {},
+foo5423: () => {},
+foo5424: () => {},
+foo5425: () => {},
+foo5426: () => {},
+foo5427: () => {},
+foo5428: () => {},
+foo5429: () => {},
+foo5430: () => {},
+foo5431: () => {},
+foo5432: () => {},
+foo5433: () => {},
+foo5434: () => {},
+foo5435: () => {},
+foo5436: () => {},
+foo5437: () => {},
+foo5438: () => {},
+foo5439: () => {},
+foo5440: () => {},
+foo5441: () => {},
+foo5442: () => {},
+foo5443: () => {},
+foo5444: () => {},
+foo5445: () => {},
+foo5446: () => {},
+foo5447: () => {},
+foo5448: () => {},
+foo5449: () => {},
+foo5450: () => {},
+foo5451: () => {},
+foo5452: () => {},
+foo5453: () => {},
+foo5454: () => {},
+foo5455: () => {},
+foo5456: () => {},
+foo5457: () => {},
+foo5458: () => {},
+foo5459: () => {},
+foo5460: () => {},
+foo5461: () => {},
+foo5462: () => {},
+foo5463: () => {},
+foo5464: () => {},
+foo5465: () => {},
+foo5466: () => {},
+foo5467: () => {},
+foo5468: () => {},
+foo5469: () => {},
+foo5470: () => {},
+foo5471: () => {},
+foo5472: () => {},
+foo5473: () => {},
+foo5474: () => {},
+foo5475: () => {},
+foo5476: () => {},
+foo5477: () => {},
+foo5478: () => {},
+foo5479: () => {},
+foo5480: () => {},
+foo5481: () => {},
+foo5482: () => {},
+foo5483: () => {},
+foo5484: () => {},
+foo5485: () => {},
+foo5486: () => {},
+foo5487: () => {},
+foo5488: () => {},
+foo5489: () => {},
+foo5490: () => {},
+foo5491: () => {},
+foo5492: () => {},
+foo5493: () => {},
+foo5494: () => {},
+foo5495: () => {},
+foo5496: () => {},
+foo5497: () => {},
+foo5498: () => {},
+foo5499: () => {},
+foo5500: () => {},
+foo5501: () => {},
+foo5502: () => {},
+foo5503: () => {},
+foo5504: () => {},
+foo5505: () => {},
+foo5506: () => {},
+foo5507: () => {},
+foo5508: () => {},
+foo5509: () => {},
+foo5510: () => {},
+foo5511: () => {},
+foo5512: () => {},
+foo5513: () => {},
+foo5514: () => {},
+foo5515: () => {},
+foo5516: () => {},
+foo5517: () => {},
+foo5518: () => {},
+foo5519: () => {},
+foo5520: () => {},
+foo5521: () => {},
+foo5522: () => {},
+foo5523: () => {},
+foo5524: () => {},
+foo5525: () => {},
+foo5526: () => {},
+foo5527: () => {},
+foo5528: () => {},
+foo5529: () => {},
+foo5530: () => {},
+foo5531: () => {},
+foo5532: () => {},
+foo5533: () => {},
+foo5534: () => {},
+foo5535: () => {},
+foo5536: () => {},
+foo5537: () => {},
+foo5538: () => {},
+foo5539: () => {},
+foo5540: () => {},
+foo5541: () => {},
+foo5542: () => {},
+foo5543: () => {},
+foo5544: () => {},
+foo5545: () => {},
+foo5546: () => {},
+foo5547: () => {},
+foo5548: () => {},
+foo5549: () => {},
+foo5550: () => {},
+foo5551: () => {},
+foo5552: () => {},
+foo5553: () => {},
+foo5554: () => {},
+foo5555: () => {},
+foo5556: () => {},
+foo5557: () => {},
+foo5558: () => {},
+foo5559: () => {},
+foo5560: () => {},
+foo5561: () => {},
+foo5562: () => {},
+foo5563: () => {},
+foo5564: () => {},
+foo5565: () => {},
+foo5566: () => {},
+foo5567: () => {},
+foo5568: () => {},
+foo5569: () => {},
+foo5570: () => {},
+foo5571: () => {},
+foo5572: () => {},
+foo5573: () => {},
+foo5574: () => {},
+foo5575: () => {},
+foo5576: () => {},
+foo5577: () => {},
+foo5578: () => {},
+foo5579: () => {},
+foo5580: () => {},
+foo5581: () => {},
+foo5582: () => {},
+foo5583: () => {},
+foo5584: () => {},
+foo5585: () => {},
+foo5586: () => {},
+foo5587: () => {},
+foo5588: () => {},
+foo5589: () => {},
+foo5590: () => {},
+foo5591: () => {},
+foo5592: () => {},
+foo5593: () => {},
+foo5594: () => {},
+foo5595: () => {},
+foo5596: () => {},
+foo5597: () => {},
+foo5598: () => {},
+foo5599: () => {},
+foo5600: () => {},
+foo5601: () => {},
+foo5602: () => {},
+foo5603: () => {},
+foo5604: () => {},
+foo5605: () => {},
+foo5606: () => {},
+foo5607: () => {},
+foo5608: () => {},
+foo5609: () => {},
+foo5610: () => {},
+foo5611: () => {},
+foo5612: () => {},
+foo5613: () => {},
+foo5614: () => {},
+foo5615: () => {},
+foo5616: () => {},
+foo5617: () => {},
+foo5618: () => {},
+foo5619: () => {},
+foo5620: () => {},
+foo5621: () => {},
+foo5622: () => {},
+foo5623: () => {},
+foo5624: () => {},
+foo5625: () => {},
+foo5626: () => {},
+foo5627: () => {},
+foo5628: () => {},
+foo5629: () => {},
+foo5630: () => {},
+foo5631: () => {},
+foo5632: () => {},
+foo5633: () => {},
+foo5634: () => {},
+foo5635: () => {},
+foo5636: () => {},
+foo5637: () => {},
+foo5638: () => {},
+foo5639: () => {},
+foo5640: () => {},
+foo5641: () => {},
+foo5642: () => {},
+foo5643: () => {},
+foo5644: () => {},
+foo5645: () => {},
+foo5646: () => {},
+foo5647: () => {},
+foo5648: () => {},
+foo5649: () => {},
+foo5650: () => {},
+foo5651: () => {},
+foo5652: () => {},
+foo5653: () => {},
+foo5654: () => {},
+foo5655: () => {},
+foo5656: () => {},
+foo5657: () => {},
+foo5658: () => {},
+foo5659: () => {},
+foo5660: () => {},
+foo5661: () => {},
+foo5662: () => {},
+foo5663: () => {},
+foo5664: () => {},
+foo5665: () => {},
+foo5666: () => {},
+foo5667: () => {},
+foo5668: () => {},
+foo5669: () => {},
+foo5670: () => {},
+foo5671: () => {},
+foo5672: () => {},
+foo5673: () => {},
+foo5674: () => {},
+foo5675: () => {},
+foo5676: () => {},
+foo5677: () => {},
+foo5678: () => {},
+foo5679: () => {},
+foo5680: () => {},
+foo5681: () => {},
+foo5682: () => {},
+foo5683: () => {},
+foo5684: () => {},
+foo5685: () => {},
+foo5686: () => {},
+foo5687: () => {},
+foo5688: () => {},
+foo5689: () => {},
+foo5690: () => {},
+foo5691: () => {},
+foo5692: () => {},
+foo5693: () => {},
+foo5694: () => {},
+foo5695: () => {},
+foo5696: () => {},
+foo5697: () => {},
+foo5698: () => {},
+foo5699: () => {},
+foo5700: () => {},
+foo5701: () => {},
+foo5702: () => {},
+foo5703: () => {},
+foo5704: () => {},
+foo5705: () => {},
+foo5706: () => {},
+foo5707: () => {},
+foo5708: () => {},
+foo5709: () => {},
+foo5710: () => {},
+foo5711: () => {},
+foo5712: () => {},
+foo5713: () => {},
+foo5714: () => {},
+foo5715: () => {},
+foo5716: () => {},
+foo5717: () => {},
+foo5718: () => {},
+foo5719: () => {},
+foo5720: () => {},
+foo5721: () => {},
+foo5722: () => {},
+foo5723: () => {},
+foo5724: () => {},
+foo5725: () => {},
+foo5726: () => {},
+foo5727: () => {},
+foo5728: () => {},
+foo5729: () => {},
+foo5730: () => {},
+foo5731: () => {},
+foo5732: () => {},
+foo5733: () => {},
+foo5734: () => {},
+foo5735: () => {},
+foo5736: () => {},
+foo5737: () => {},
+foo5738: () => {},
+foo5739: () => {},
+foo5740: () => {},
+foo5741: () => {},
+foo5742: () => {},
+foo5743: () => {},
+foo5744: () => {},
+foo5745: () => {},
+foo5746: () => {},
+foo5747: () => {},
+foo5748: () => {},
+foo5749: () => {},
+foo5750: () => {},
+foo5751: () => {},
+foo5752: () => {},
+foo5753: () => {},
+foo5754: () => {},
+foo5755: () => {},
+foo5756: () => {},
+foo5757: () => {},
+foo5758: () => {},
+foo5759: () => {},
+foo5760: () => {},
+foo5761: () => {},
+foo5762: () => {},
+foo5763: () => {},
+foo5764: () => {},
+foo5765: () => {},
+foo5766: () => {},
+foo5767: () => {},
+foo5768: () => {},
+foo5769: () => {},
+foo5770: () => {},
+foo5771: () => {},
+foo5772: () => {},
+foo5773: () => {},
+foo5774: () => {},
+foo5775: () => {},
+foo5776: () => {},
+foo5777: () => {},
+foo5778: () => {},
+foo5779: () => {},
+foo5780: () => {},
+foo5781: () => {},
+foo5782: () => {},
+foo5783: () => {},
+foo5784: () => {},
+foo5785: () => {},
+foo5786: () => {},
+foo5787: () => {},
+foo5788: () => {},
+foo5789: () => {},
+foo5790: () => {},
+foo5791: () => {},
+foo5792: () => {},
+foo5793: () => {},
+foo5794: () => {},
+foo5795: () => {},
+foo5796: () => {},
+foo5797: () => {},
+foo5798: () => {},
+foo5799: () => {},
+foo5800: () => {},
+foo5801: () => {},
+foo5802: () => {},
+foo5803: () => {},
+foo5804: () => {},
+foo5805: () => {},
+foo5806: () => {},
+foo5807: () => {},
+foo5808: () => {},
+foo5809: () => {},
+foo5810: () => {},
+foo5811: () => {},
+foo5812: () => {},
+foo5813: () => {},
+foo5814: () => {},
+foo5815: () => {},
+foo5816: () => {},
+foo5817: () => {},
+foo5818: () => {},
+foo5819: () => {},
+foo5820: () => {},
+foo5821: () => {},
+foo5822: () => {},
+foo5823: () => {},
+foo5824: () => {},
+foo5825: () => {},
+foo5826: () => {},
+foo5827: () => {},
+foo5828: () => {},
+foo5829: () => {},
+foo5830: () => {},
+foo5831: () => {},
+foo5832: () => {},
+foo5833: () => {},
+foo5834: () => {},
+foo5835: () => {},
+foo5836: () => {},
+foo5837: () => {},
+foo5838: () => {},
+foo5839: () => {},
+foo5840: () => {},
+foo5841: () => {},
+foo5842: () => {},
+foo5843: () => {},
+foo5844: () => {},
+foo5845: () => {},
+foo5846: () => {},
+foo5847: () => {},
+foo5848: () => {},
+foo5849: () => {},
+foo5850: () => {},
+foo5851: () => {},
+foo5852: () => {},
+foo5853: () => {},
+foo5854: () => {},
+foo5855: () => {},
+foo5856: () => {},
+foo5857: () => {},
+foo5858: () => {},
+foo5859: () => {},
+foo5860: () => {},
+foo5861: () => {},
+foo5862: () => {},
+foo5863: () => {},
+foo5864: () => {},
+foo5865: () => {},
+foo5866: () => {},
+foo5867: () => {},
+foo5868: () => {},
+foo5869: () => {},
+foo5870: () => {},
+foo5871: () => {},
+foo5872: () => {},
+foo5873: () => {},
+foo5874: () => {},
+foo5875: () => {},
+foo5876: () => {},
+foo5877: () => {},
+foo5878: () => {},
+foo5879: () => {},
+foo5880: () => {},
+foo5881: () => {},
+foo5882: () => {},
+foo5883: () => {},
+foo5884: () => {},
+foo5885: () => {},
+foo5886: () => {},
+foo5887: () => {},
+foo5888: () => {},
+foo5889: () => {},
+foo5890: () => {},
+foo5891: () => {},
+foo5892: () => {},
+foo5893: () => {},
+foo5894: () => {},
+foo5895: () => {},
+foo5896: () => {},
+foo5897: () => {},
+foo5898: () => {},
+foo5899: () => {},
+foo5900: () => {},
+foo5901: () => {},
+foo5902: () => {},
+foo5903: () => {},
+foo5904: () => {},
+foo5905: () => {},
+foo5906: () => {},
+foo5907: () => {},
+foo5908: () => {},
+foo5909: () => {},
+foo5910: () => {},
+foo5911: () => {},
+foo5912: () => {},
+foo5913: () => {},
+foo5914: () => {},
+foo5915: () => {},
+foo5916: () => {},
+foo5917: () => {},
+foo5918: () => {},
+foo5919: () => {},
+foo5920: () => {},
+foo5921: () => {},
+foo5922: () => {},
+foo5923: () => {},
+foo5924: () => {},
+foo5925: () => {},
+foo5926: () => {},
+foo5927: () => {},
+foo5928: () => {},
+foo5929: () => {},
+foo5930: () => {},
+foo5931: () => {},
+foo5932: () => {},
+foo5933: () => {},
+foo5934: () => {},
+foo5935: () => {},
+foo5936: () => {},
+foo5937: () => {},
+foo5938: () => {},
+foo5939: () => {},
+foo5940: () => {},
+foo5941: () => {},
+foo5942: () => {},
+foo5943: () => {},
+foo5944: () => {},
+foo5945: () => {},
+foo5946: () => {},
+foo5947: () => {},
+foo5948: () => {},
+foo5949: () => {},
+foo5950: () => {},
+foo5951: () => {},
+foo5952: () => {},
+foo5953: () => {},
+foo5954: () => {},
+foo5955: () => {},
+foo5956: () => {},
+foo5957: () => {},
+foo5958: () => {},
+foo5959: () => {},
+foo5960: () => {},
+foo5961: () => {},
+foo5962: () => {},
+foo5963: () => {},
+foo5964: () => {},
+foo5965: () => {},
+foo5966: () => {},
+foo5967: () => {},
+foo5968: () => {},
+foo5969: () => {},
+foo5970: () => {},
+foo5971: () => {},
+foo5972: () => {},
+foo5973: () => {},
+foo5974: () => {},
+foo5975: () => {},
+foo5976: () => {},
+foo5977: () => {},
+foo5978: () => {},
+foo5979: () => {},
+foo5980: () => {},
+foo5981: () => {},
+foo5982: () => {},
+foo5983: () => {},
+foo5984: () => {},
+foo5985: () => {},
+foo5986: () => {},
+foo5987: () => {},
+foo5988: () => {},
+foo5989: () => {},
+foo5990: () => {},
+foo5991: () => {},
+foo5992: () => {},
+foo5993: () => {},
+foo5994: () => {},
+foo5995: () => {},
+foo5996: () => {},
+foo5997: () => {},
+foo5998: () => {},
+foo5999: () => {},
+foo6000: () => {},
+foo6001: () => {},
+foo6002: () => {},
+foo6003: () => {},
+foo6004: () => {},
+foo6005: () => {},
+foo6006: () => {},
+foo6007: () => {},
+foo6008: () => {},
+foo6009: () => {},
+foo6010: () => {},
+foo6011: () => {},
+foo6012: () => {},
+foo6013: () => {},
+foo6014: () => {},
+foo6015: () => {},
+foo6016: () => {},
+foo6017: () => {},
+foo6018: () => {},
+foo6019: () => {},
+foo6020: () => {},
+foo6021: () => {},
+foo6022: () => {},
+foo6023: () => {},
+foo6024: () => {},
+foo6025: () => {},
+foo6026: () => {},
+foo6027: () => {},
+foo6028: () => {},
+foo6029: () => {},
+foo6030: () => {},
+foo6031: () => {},
+foo6032: () => {},
+foo6033: () => {},
+foo6034: () => {},
+foo6035: () => {},
+foo6036: () => {},
+foo6037: () => {},
+foo6038: () => {},
+foo6039: () => {},
+foo6040: () => {},
+foo6041: () => {},
+foo6042: () => {},
+foo6043: () => {},
+foo6044: () => {},
+foo6045: () => {},
+foo6046: () => {},
+foo6047: () => {},
+foo6048: () => {},
+foo6049: () => {},
+foo6050: () => {},
+foo6051: () => {},
+foo6052: () => {},
+foo6053: () => {},
+foo6054: () => {},
+foo6055: () => {},
+foo6056: () => {},
+foo6057: () => {},
+foo6058: () => {},
+foo6059: () => {},
+foo6060: () => {},
+foo6061: () => {},
+foo6062: () => {},
+foo6063: () => {},
+foo6064: () => {},
+foo6065: () => {},
+foo6066: () => {},
+foo6067: () => {},
+foo6068: () => {},
+foo6069: () => {},
+foo6070: () => {},
+foo6071: () => {},
+foo6072: () => {},
+foo6073: () => {},
+foo6074: () => {},
+foo6075: () => {},
+foo6076: () => {},
+foo6077: () => {},
+foo6078: () => {},
+foo6079: () => {},
+foo6080: () => {},
+foo6081: () => {},
+foo6082: () => {},
+foo6083: () => {},
+foo6084: () => {},
+foo6085: () => {},
+foo6086: () => {},
+foo6087: () => {},
+foo6088: () => {},
+foo6089: () => {},
+foo6090: () => {},
+foo6091: () => {},
+foo6092: () => {},
+foo6093: () => {},
+foo6094: () => {},
+foo6095: () => {},
+foo6096: () => {},
+foo6097: () => {},
+foo6098: () => {},
+foo6099: () => {},
+foo6100: () => {},
+foo6101: () => {},
+foo6102: () => {},
+foo6103: () => {},
+foo6104: () => {},
+foo6105: () => {},
+foo6106: () => {},
+foo6107: () => {},
+foo6108: () => {},
+foo6109: () => {},
+foo6110: () => {},
+foo6111: () => {},
+foo6112: () => {},
+foo6113: () => {},
+foo6114: () => {},
+foo6115: () => {},
+foo6116: () => {},
+foo6117: () => {},
+foo6118: () => {},
+foo6119: () => {},
+foo6120: () => {},
+foo6121: () => {},
+foo6122: () => {},
+foo6123: () => {},
+foo6124: () => {},
+foo6125: () => {},
+foo6126: () => {},
+foo6127: () => {},
+foo6128: () => {},
+foo6129: () => {},
+foo6130: () => {},
+foo6131: () => {},
+foo6132: () => {},
+foo6133: () => {},
+foo6134: () => {},
+foo6135: () => {},
+foo6136: () => {},
+foo6137: () => {},
+foo6138: () => {},
+foo6139: () => {},
+foo6140: () => {},
+foo6141: () => {},
+foo6142: () => {},
+foo6143: () => {},
+foo6144: () => {},
+foo6145: () => {},
+foo6146: () => {},
+foo6147: () => {},
+foo6148: () => {},
+foo6149: () => {},
+foo6150: () => {},
+foo6151: () => {},
+foo6152: () => {},
+foo6153: () => {},
+foo6154: () => {},
+foo6155: () => {},
+foo6156: () => {},
+foo6157: () => {},
+foo6158: () => {},
+foo6159: () => {},
+foo6160: () => {},
+foo6161: () => {},
+foo6162: () => {},
+foo6163: () => {},
+foo6164: () => {},
+foo6165: () => {},
+foo6166: () => {},
+foo6167: () => {},
+foo6168: () => {},
+foo6169: () => {},
+foo6170: () => {},
+foo6171: () => {},
+foo6172: () => {},
+foo6173: () => {},
+foo6174: () => {},
+foo6175: () => {},
+foo6176: () => {},
+foo6177: () => {},
+foo6178: () => {},
+foo6179: () => {},
+foo6180: () => {},
+foo6181: () => {},
+foo6182: () => {},
+foo6183: () => {},
+foo6184: () => {},
+foo6185: () => {},
+foo6186: () => {},
+foo6187: () => {},
+foo6188: () => {},
+foo6189: () => {},
+foo6190: () => {},
+foo6191: () => {},
+foo6192: () => {},
+foo6193: () => {},
+foo6194: () => {},
+foo6195: () => {},
+foo6196: () => {},
+foo6197: () => {},
+foo6198: () => {},
+foo6199: () => {},
+foo6200: () => {},
+foo6201: () => {},
+foo6202: () => {},
+foo6203: () => {},
+foo6204: () => {},
+foo6205: () => {},
+foo6206: () => {},
+foo6207: () => {},
+foo6208: () => {},
+foo6209: () => {},
+foo6210: () => {},
+foo6211: () => {},
+foo6212: () => {},
+foo6213: () => {},
+foo6214: () => {},
+foo6215: () => {},
+foo6216: () => {},
+foo6217: () => {},
+foo6218: () => {},
+foo6219: () => {},
+foo6220: () => {},
+foo6221: () => {},
+foo6222: () => {},
+foo6223: () => {},
+foo6224: () => {},
+foo6225: () => {},
+foo6226: () => {},
+foo6227: () => {},
+foo6228: () => {},
+foo6229: () => {},
+foo6230: () => {},
+foo6231: () => {},
+foo6232: () => {},
+foo6233: () => {},
+foo6234: () => {},
+foo6235: () => {},
+foo6236: () => {},
+foo6237: () => {},
+foo6238: () => {},
+foo6239: () => {},
+foo6240: () => {},
+foo6241: () => {},
+foo6242: () => {},
+foo6243: () => {},
+foo6244: () => {},
+foo6245: () => {},
+foo6246: () => {},
+foo6247: () => {},
+foo6248: () => {},
+foo6249: () => {},
+foo6250: () => {},
+foo6251: () => {},
+foo6252: () => {},
+foo6253: () => {},
+foo6254: () => {},
+foo6255: () => {},
+foo6256: () => {},
+foo6257: () => {},
+foo6258: () => {},
+foo6259: () => {},
+foo6260: () => {},
+foo6261: () => {},
+foo6262: () => {},
+foo6263: () => {},
+foo6264: () => {},
+foo6265: () => {},
+foo6266: () => {},
+foo6267: () => {},
+foo6268: () => {},
+foo6269: () => {},
+foo6270: () => {},
+foo6271: () => {},
+foo6272: () => {},
+foo6273: () => {},
+foo6274: () => {},
+foo6275: () => {},
+foo6276: () => {},
+foo6277: () => {},
+foo6278: () => {},
+foo6279: () => {},
+foo6280: () => {},
+foo6281: () => {},
+foo6282: () => {},
+foo6283: () => {},
+foo6284: () => {},
+foo6285: () => {},
+foo6286: () => {},
+foo6287: () => {},
+foo6288: () => {},
+foo6289: () => {},
+foo6290: () => {},
+foo6291: () => {},
+foo6292: () => {},
+foo6293: () => {},
+foo6294: () => {},
+foo6295: () => {},
+foo6296: () => {},
+foo6297: () => {},
+foo6298: () => {},
+foo6299: () => {},
+foo6300: () => {},
+foo6301: () => {},
+foo6302: () => {},
+foo6303: () => {},
+foo6304: () => {},
+foo6305: () => {},
+foo6306: () => {},
+foo6307: () => {},
+foo6308: () => {},
+foo6309: () => {},
+foo6310: () => {},
+foo6311: () => {},
+foo6312: () => {},
+foo6313: () => {},
+foo6314: () => {},
+foo6315: () => {},
+foo6316: () => {},
+foo6317: () => {},
+foo6318: () => {},
+foo6319: () => {},
+foo6320: () => {},
+foo6321: () => {},
+foo6322: () => {},
+foo6323: () => {},
+foo6324: () => {},
+foo6325: () => {},
+foo6326: () => {},
+foo6327: () => {},
+foo6328: () => {},
+foo6329: () => {},
+foo6330: () => {},
+foo6331: () => {},
+foo6332: () => {},
+foo6333: () => {},
+foo6334: () => {},
+foo6335: () => {},
+foo6336: () => {},
+foo6337: () => {},
+foo6338: () => {},
+foo6339: () => {},
+foo6340: () => {},
+foo6341: () => {},
+foo6342: () => {},
+foo6343: () => {},
+foo6344: () => {},
+foo6345: () => {},
+foo6346: () => {},
+foo6347: () => {},
+foo6348: () => {},
+foo6349: () => {},
+foo6350: () => {},
+foo6351: () => {},
+foo6352: () => {},
+foo6353: () => {},
+foo6354: () => {},
+foo6355: () => {},
+foo6356: () => {},
+foo6357: () => {},
+foo6358: () => {},
+foo6359: () => {},
+foo6360: () => {},
+foo6361: () => {},
+foo6362: () => {},
+foo6363: () => {},
+foo6364: () => {},
+foo6365: () => {},
+foo6366: () => {},
+foo6367: () => {},
+foo6368: () => {},
+foo6369: () => {},
+foo6370: () => {},
+foo6371: () => {},
+foo6372: () => {},
+foo6373: () => {},
+foo6374: () => {},
+foo6375: () => {},
+foo6376: () => {},
+foo6377: () => {},
+foo6378: () => {},
+foo6379: () => {},
+foo6380: () => {},
+foo6381: () => {},
+foo6382: () => {},
+foo6383: () => {},
+foo6384: () => {},
+foo6385: () => {},
+foo6386: () => {},
+foo6387: () => {},
+foo6388: () => {},
+foo6389: () => {},
+foo6390: () => {},
+foo6391: () => {},
+foo6392: () => {},
+foo6393: () => {},
+foo6394: () => {},
+foo6395: () => {},
+foo6396: () => {},
+foo6397: () => {},
+foo6398: () => {},
+foo6399: () => {},
+foo6400: () => {},
+foo6401: () => {},
+foo6402: () => {},
+foo6403: () => {},
+foo6404: () => {},
+foo6405: () => {},
+foo6406: () => {},
+foo6407: () => {},
+foo6408: () => {},
+foo6409: () => {},
+foo6410: () => {},
+foo6411: () => {},
+foo6412: () => {},
+foo6413: () => {},
+foo6414: () => {},
+foo6415: () => {},
+foo6416: () => {},
+foo6417: () => {},
+foo6418: () => {},
+foo6419: () => {},
+foo6420: () => {},
+foo6421: () => {},
+foo6422: () => {},
+foo6423: () => {},
+foo6424: () => {},
+foo6425: () => {},
+foo6426: () => {},
+foo6427: () => {},
+foo6428: () => {},
+foo6429: () => {},
+foo6430: () => {},
+foo6431: () => {},
+foo6432: () => {},
+foo6433: () => {},
+foo6434: () => {},
+foo6435: () => {},
+foo6436: () => {},
+foo6437: () => {},
+foo6438: () => {},
+foo6439: () => {},
+foo6440: () => {},
+foo6441: () => {},
+foo6442: () => {},
+foo6443: () => {},
+foo6444: () => {},
+foo6445: () => {},
+foo6446: () => {},
+foo6447: () => {},
+foo6448: () => {},
+foo6449: () => {},
+foo6450: () => {},
+foo6451: () => {},
+foo6452: () => {},
+foo6453: () => {},
+foo6454: () => {},
+foo6455: () => {},
+foo6456: () => {},
+foo6457: () => {},
+foo6458: () => {},
+foo6459: () => {},
+foo6460: () => {},
+foo6461: () => {},
+foo6462: () => {},
+foo6463: () => {},
+foo6464: () => {},
+foo6465: () => {},
+foo6466: () => {},
+foo6467: () => {},
+foo6468: () => {},
+foo6469: () => {},
+foo6470: () => {},
+foo6471: () => {},
+foo6472: () => {},
+foo6473: () => {},
+foo6474: () => {},
+foo6475: () => {},
+foo6476: () => {},
+foo6477: () => {},
+foo6478: () => {},
+foo6479: () => {},
+foo6480: () => {},
+foo6481: () => {},
+foo6482: () => {},
+foo6483: () => {},
+foo6484: () => {},
+foo6485: () => {},
+foo6486: () => {},
+foo6487: () => {},
+foo6488: () => {},
+foo6489: () => {},
+foo6490: () => {},
+foo6491: () => {},
+foo6492: () => {},
+foo6493: () => {},
+foo6494: () => {},
+foo6495: () => {},
+foo6496: () => {},
+foo6497: () => {},
+foo6498: () => {},
+foo6499: () => {},
+foo6500: () => {},
+foo6501: () => {},
+foo6502: () => {},
+foo6503: () => {},
+foo6504: () => {},
+foo6505: () => {},
+foo6506: () => {},
+foo6507: () => {},
+foo6508: () => {},
+foo6509: () => {},
+foo6510: () => {},
+foo6511: () => {},
+foo6512: () => {},
+foo6513: () => {},
+foo6514: () => {},
+foo6515: () => {},
+foo6516: () => {},
+foo6517: () => {},
+foo6518: () => {},
+foo6519: () => {},
+foo6520: () => {},
+foo6521: () => {},
+foo6522: () => {},
+foo6523: () => {},
+foo6524: () => {},
+foo6525: () => {},
+foo6526: () => {},
+foo6527: () => {},
+foo6528: () => {},
+foo6529: () => {},
+foo6530: () => {},
+foo6531: () => {},
+foo6532: () => {},
+foo6533: () => {},
+foo6534: () => {},
+foo6535: () => {},
+foo6536: () => {},
+foo6537: () => {},
+foo6538: () => {},
+foo6539: () => {},
+foo6540: () => {},
+foo6541: () => {},
+foo6542: () => {},
+foo6543: () => {},
+foo6544: () => {},
+foo6545: () => {},
+foo6546: () => {},
+foo6547: () => {},
+foo6548: () => {},
+foo6549: () => {},
+foo6550: () => {},
+foo6551: () => {},
+foo6552: () => {},
+foo6553: () => {},
+foo6554: () => {},
+foo6555: () => {},
+foo6556: () => {},
+foo6557: () => {},
+foo6558: () => {},
+foo6559: () => {},
+foo6560: () => {},
+foo6561: () => {},
+foo6562: () => {},
+foo6563: () => {},
+foo6564: () => {},
+foo6565: () => {},
+foo6566: () => {},
+foo6567: () => {},
+foo6568: () => {},
+foo6569: () => {},
+foo6570: () => {},
+foo6571: () => {},
+foo6572: () => {},
+foo6573: () => {},
+foo6574: () => {},
+foo6575: () => {},
+foo6576: () => {},
+foo6577: () => {},
+foo6578: () => {},
+foo6579: () => {},
+foo6580: () => {},
+foo6581: () => {},
+foo6582: () => {},
+foo6583: () => {},
+foo6584: () => {},
+foo6585: () => {},
+foo6586: () => {},
+foo6587: () => {},
+foo6588: () => {},
+foo6589: () => {},
+foo6590: () => {},
+foo6591: () => {},
+foo6592: () => {},
+foo6593: () => {},
+foo6594: () => {},
+foo6595: () => {},
+foo6596: () => {},
+foo6597: () => {},
+foo6598: () => {},
+foo6599: () => {},
+foo6600: () => {},
+foo6601: () => {},
+foo6602: () => {},
+foo6603: () => {},
+foo6604: () => {},
+foo6605: () => {},
+foo6606: () => {},
+foo6607: () => {},
+foo6608: () => {},
+foo6609: () => {},
+foo6610: () => {},
+foo6611: () => {},
+foo6612: () => {},
+foo6613: () => {},
+foo6614: () => {},
+foo6615: () => {},
+foo6616: () => {},
+foo6617: () => {},
+foo6618: () => {},
+foo6619: () => {},
+foo6620: () => {},
+foo6621: () => {},
+foo6622: () => {},
+foo6623: () => {},
+foo6624: () => {},
+foo6625: () => {},
+foo6626: () => {},
+foo6627: () => {},
+foo6628: () => {},
+foo6629: () => {},
+foo6630: () => {},
+foo6631: () => {},
+foo6632: () => {},
+foo6633: () => {},
+foo6634: () => {},
+foo6635: () => {},
+foo6636: () => {},
+foo6637: () => {},
+foo6638: () => {},
+foo6639: () => {},
+foo6640: () => {},
+foo6641: () => {},
+foo6642: () => {},
+foo6643: () => {},
+foo6644: () => {},
+foo6645: () => {},
+foo6646: () => {},
+foo6647: () => {},
+foo6648: () => {},
+foo6649: () => {},
+foo6650: () => {},
+foo6651: () => {},
+foo6652: () => {},
+foo6653: () => {},
+foo6654: () => {},
+foo6655: () => {},
+foo6656: () => {},
+foo6657: () => {},
+foo6658: () => {},
+foo6659: () => {},
+foo6660: () => {},
+foo6661: () => {},
+foo6662: () => {},
+foo6663: () => {},
+foo6664: () => {},
+foo6665: () => {},
+foo6666: () => {},
+foo6667: () => {},
+foo6668: () => {},
+foo6669: () => {},
+foo6670: () => {},
+foo6671: () => {},
+foo6672: () => {},
+foo6673: () => {},
+foo6674: () => {},
+foo6675: () => {},
+foo6676: () => {},
+foo6677: () => {},
+foo6678: () => {},
+foo6679: () => {},
+foo6680: () => {},
+foo6681: () => {},
+foo6682: () => {},
+foo6683: () => {},
+foo6684: () => {},
+foo6685: () => {},
+foo6686: () => {},
+foo6687: () => {},
+foo6688: () => {},
+foo6689: () => {},
+foo6690: () => {},
+foo6691: () => {},
+foo6692: () => {},
+foo6693: () => {},
+foo6694: () => {},
+foo6695: () => {},
+foo6696: () => {},
+foo6697: () => {},
+foo6698: () => {},
+foo6699: () => {},
+foo6700: () => {},
+foo6701: () => {},
+foo6702: () => {},
+foo6703: () => {},
+foo6704: () => {},
+foo6705: () => {},
+foo6706: () => {},
+foo6707: () => {},
+foo6708: () => {},
+foo6709: () => {},
+foo6710: () => {},
+foo6711: () => {},
+foo6712: () => {},
+foo6713: () => {},
+foo6714: () => {},
+foo6715: () => {},
+foo6716: () => {},
+foo6717: () => {},
+foo6718: () => {},
+foo6719: () => {},
+foo6720: () => {},
+foo6721: () => {},
+foo6722: () => {},
+foo6723: () => {},
+foo6724: () => {},
+foo6725: () => {},
+foo6726: () => {},
+foo6727: () => {},
+foo6728: () => {},
+foo6729: () => {},
+foo6730: () => {},
+foo6731: () => {},
+foo6732: () => {},
+foo6733: () => {},
+foo6734: () => {},
+foo6735: () => {},
+foo6736: () => {},
+foo6737: () => {},
+foo6738: () => {},
+foo6739: () => {},
+foo6740: () => {},
+foo6741: () => {},
+foo6742: () => {},
+foo6743: () => {},
+foo6744: () => {},
+foo6745: () => {},
+foo6746: () => {},
+foo6747: () => {},
+foo6748: () => {},
+foo6749: () => {},
+foo6750: () => {},
+foo6751: () => {},
+foo6752: () => {},
+foo6753: () => {},
+foo6754: () => {},
+foo6755: () => {},
+foo6756: () => {},
+foo6757: () => {},
+foo6758: () => {},
+foo6759: () => {},
+foo6760: () => {},
+foo6761: () => {},
+foo6762: () => {},
+foo6763: () => {},
+foo6764: () => {},
+foo6765: () => {},
+foo6766: () => {},
+foo6767: () => {},
+foo6768: () => {},
+foo6769: () => {},
+foo6770: () => {},
+foo6771: () => {},
+foo6772: () => {},
+foo6773: () => {},
+foo6774: () => {},
+foo6775: () => {},
+foo6776: () => {},
+foo6777: () => {},
+foo6778: () => {},
+foo6779: () => {},
+foo6780: () => {},
+foo6781: () => {},
+foo6782: () => {},
+foo6783: () => {},
+foo6784: () => {},
+foo6785: () => {},
+foo6786: () => {},
+foo6787: () => {},
+foo6788: () => {},
+foo6789: () => {},
+foo6790: () => {},
+foo6791: () => {},
+foo6792: () => {},
+foo6793: () => {},
+foo6794: () => {},
+foo6795: () => {},
+foo6796: () => {},
+foo6797: () => {},
+foo6798: () => {},
+foo6799: () => {},
+foo6800: () => {},
+foo6801: () => {},
+foo6802: () => {},
+foo6803: () => {},
+foo6804: () => {},
+foo6805: () => {},
+foo6806: () => {},
+foo6807: () => {},
+foo6808: () => {},
+foo6809: () => {},
+foo6810: () => {},
+foo6811: () => {},
+foo6812: () => {},
+foo6813: () => {},
+foo6814: () => {},
+foo6815: () => {},
+foo6816: () => {},
+foo6817: () => {},
+foo6818: () => {},
+foo6819: () => {},
+foo6820: () => {},
+foo6821: () => {},
+foo6822: () => {},
+foo6823: () => {},
+foo6824: () => {},
+foo6825: () => {},
+foo6826: () => {},
+foo6827: () => {},
+foo6828: () => {},
+foo6829: () => {},
+foo6830: () => {},
+foo6831: () => {},
+foo6832: () => {},
+foo6833: () => {},
+foo6834: () => {},
+foo6835: () => {},
+foo6836: () => {},
+foo6837: () => {},
+foo6838: () => {},
+foo6839: () => {},
+foo6840: () => {},
+foo6841: () => {},
+foo6842: () => {},
+foo6843: () => {},
+foo6844: () => {},
+foo6845: () => {},
+foo6846: () => {},
+foo6847: () => {},
+foo6848: () => {},
+foo6849: () => {},
+foo6850: () => {},
+foo6851: () => {},
+foo6852: () => {},
+foo6853: () => {},
+foo6854: () => {},
+foo6855: () => {},
+foo6856: () => {},
+foo6857: () => {},
+foo6858: () => {},
+foo6859: () => {},
+foo6860: () => {},
+foo6861: () => {},
+foo6862: () => {},
+foo6863: () => {},
+foo6864: () => {},
+foo6865: () => {},
+foo6866: () => {},
+foo6867: () => {},
+foo6868: () => {},
+foo6869: () => {},
+foo6870: () => {},
+foo6871: () => {},
+foo6872: () => {},
+foo6873: () => {},
+foo6874: () => {},
+foo6875: () => {},
+foo6876: () => {},
+foo6877: () => {},
+foo6878: () => {},
+foo6879: () => {},
+foo6880: () => {},
+foo6881: () => {},
+foo6882: () => {},
+foo6883: () => {},
+foo6884: () => {},
+foo6885: () => {},
+foo6886: () => {},
+foo6887: () => {},
+foo6888: () => {},
+foo6889: () => {},
+foo6890: () => {},
+foo6891: () => {},
+foo6892: () => {},
+foo6893: () => {},
+foo6894: () => {},
+foo6895: () => {},
+foo6896: () => {},
+foo6897: () => {},
+foo6898: () => {},
+foo6899: () => {},
+foo6900: () => {},
+foo6901: () => {},
+foo6902: () => {},
+foo6903: () => {},
+foo6904: () => {},
+foo6905: () => {},
+foo6906: () => {},
+foo6907: () => {},
+foo6908: () => {},
+foo6909: () => {},
+foo6910: () => {},
+foo6911: () => {},
+foo6912: () => {},
+foo6913: () => {},
+foo6914: () => {},
+foo6915: () => {},
+foo6916: () => {},
+foo6917: () => {},
+foo6918: () => {},
+foo6919: () => {},
+foo6920: () => {},
+foo6921: () => {},
+foo6922: () => {},
+foo6923: () => {},
+foo6924: () => {},
+foo6925: () => {},
+foo6926: () => {},
+foo6927: () => {},
+foo6928: () => {},
+foo6929: () => {},
+foo6930: () => {},
+foo6931: () => {},
+foo6932: () => {},
+foo6933: () => {},
+foo6934: () => {},
+foo6935: () => {},
+foo6936: () => {},
+foo6937: () => {},
+foo6938: () => {},
+foo6939: () => {},
+foo6940: () => {},
+foo6941: () => {},
+foo6942: () => {},
+foo6943: () => {},
+foo6944: () => {},
+foo6945: () => {},
+foo6946: () => {},
+foo6947: () => {},
+foo6948: () => {},
+foo6949: () => {},
+foo6950: () => {},
+foo6951: () => {},
+foo6952: () => {},
+foo6953: () => {},
+foo6954: () => {},
+foo6955: () => {},
+foo6956: () => {},
+foo6957: () => {},
+foo6958: () => {},
+foo6959: () => {},
+foo6960: () => {},
+foo6961: () => {},
+foo6962: () => {},
+foo6963: () => {},
+foo6964: () => {},
+foo6965: () => {},
+foo6966: () => {},
+foo6967: () => {},
+foo6968: () => {},
+foo6969: () => {},
+foo6970: () => {},
+foo6971: () => {},
+foo6972: () => {},
+foo6973: () => {},
+foo6974: () => {},
+foo6975: () => {},
+foo6976: () => {},
+foo6977: () => {},
+foo6978: () => {},
+foo6979: () => {},
+foo6980: () => {},
+foo6981: () => {},
+foo6982: () => {},
+foo6983: () => {},
+foo6984: () => {},
+foo6985: () => {},
+foo6986: () => {},
+foo6987: () => {},
+foo6988: () => {},
+foo6989: () => {},
+foo6990: () => {},
+foo6991: () => {},
+foo6992: () => {},
+foo6993: () => {},
+foo6994: () => {},
+foo6995: () => {},
+foo6996: () => {},
+foo6997: () => {},
+foo6998: () => {},
+foo6999: () => {},
+foo7000: () => {},
+foo7001: () => {},
+foo7002: () => {},
+foo7003: () => {},
+foo7004: () => {},
+foo7005: () => {},
+foo7006: () => {},
+foo7007: () => {},
+foo7008: () => {},
+foo7009: () => {},
+foo7010: () => {},
+foo7011: () => {},
+foo7012: () => {},
+foo7013: () => {},
+foo7014: () => {},
+foo7015: () => {},
+foo7016: () => {},
+foo7017: () => {},
+foo7018: () => {},
+foo7019: () => {},
+foo7020: () => {},
+foo7021: () => {},
+foo7022: () => {},
+foo7023: () => {},
+foo7024: () => {},
+foo7025: () => {},
+foo7026: () => {},
+foo7027: () => {},
+foo7028: () => {},
+foo7029: () => {},
+foo7030: () => {},
+foo7031: () => {},
+foo7032: () => {},
+foo7033: () => {},
+foo7034: () => {},
+foo7035: () => {},
+foo7036: () => {},
+foo7037: () => {},
+foo7038: () => {},
+foo7039: () => {},
+foo7040: () => {},
+foo7041: () => {},
+foo7042: () => {},
+foo7043: () => {},
+foo7044: () => {},
+foo7045: () => {},
+foo7046: () => {},
+foo7047: () => {},
+foo7048: () => {},
+foo7049: () => {},
+foo7050: () => {},
+foo7051: () => {},
+foo7052: () => {},
+foo7053: () => {},
+foo7054: () => {},
+foo7055: () => {},
+foo7056: () => {},
+foo7057: () => {},
+foo7058: () => {},
+foo7059: () => {},
+foo7060: () => {},
+foo7061: () => {},
+foo7062: () => {},
+foo7063: () => {},
+foo7064: () => {},
+foo7065: () => {},
+foo7066: () => {},
+foo7067: () => {},
+foo7068: () => {},
+foo7069: () => {},
+foo7070: () => {},
+foo7071: () => {},
+foo7072: () => {},
+foo7073: () => {},
+foo7074: () => {},
+foo7075: () => {},
+foo7076: () => {},
+foo7077: () => {},
+foo7078: () => {},
+foo7079: () => {},
+foo7080: () => {},
+foo7081: () => {},
+foo7082: () => {},
+foo7083: () => {},
+foo7084: () => {},
+foo7085: () => {},
+foo7086: () => {},
+foo7087: () => {},
+foo7088: () => {},
+foo7089: () => {},
+foo7090: () => {},
+foo7091: () => {},
+foo7092: () => {},
+foo7093: () => {},
+foo7094: () => {},
+foo7095: () => {},
+foo7096: () => {},
+foo7097: () => {},
+foo7098: () => {},
+foo7099: () => {},
+foo7100: () => {},
+foo7101: () => {},
+foo7102: () => {},
+foo7103: () => {},
+foo7104: () => {},
+foo7105: () => {},
+foo7106: () => {},
+foo7107: () => {},
+foo7108: () => {},
+foo7109: () => {},
+foo7110: () => {},
+foo7111: () => {},
+foo7112: () => {},
+foo7113: () => {},
+foo7114: () => {},
+foo7115: () => {},
+foo7116: () => {},
+foo7117: () => {},
+foo7118: () => {},
+foo7119: () => {},
+foo7120: () => {},
+foo7121: () => {},
+foo7122: () => {},
+foo7123: () => {},
+foo7124: () => {},
+foo7125: () => {},
+foo7126: () => {},
+foo7127: () => {},
+foo7128: () => {},
+foo7129: () => {},
+foo7130: () => {},
+foo7131: () => {},
+foo7132: () => {},
+foo7133: () => {},
+foo7134: () => {},
+foo7135: () => {},
+foo7136: () => {},
+foo7137: () => {},
+foo7138: () => {},
+foo7139: () => {},
+foo7140: () => {},
+foo7141: () => {},
+foo7142: () => {},
+foo7143: () => {},
+foo7144: () => {},
+foo7145: () => {},
+foo7146: () => {},
+foo7147: () => {},
+foo7148: () => {},
+foo7149: () => {},
+foo7150: () => {},
+foo7151: () => {},
+foo7152: () => {},
+foo7153: () => {},
+foo7154: () => {},
+foo7155: () => {},
+foo7156: () => {},
+foo7157: () => {},
+foo7158: () => {},
+foo7159: () => {},
+foo7160: () => {},
+foo7161: () => {},
+foo7162: () => {},
+foo7163: () => {},
+foo7164: () => {},
+foo7165: () => {},
+foo7166: () => {},
+foo7167: () => {},
+foo7168: () => {},
+foo7169: () => {},
+foo7170: () => {},
+foo7171: () => {},
+foo7172: () => {},
+foo7173: () => {},
+foo7174: () => {},
+foo7175: () => {},
+foo7176: () => {},
+foo7177: () => {},
+foo7178: () => {},
+foo7179: () => {},
+foo7180: () => {},
+foo7181: () => {},
+foo7182: () => {},
+foo7183: () => {},
+foo7184: () => {},
+foo7185: () => {},
+foo7186: () => {},
+foo7187: () => {},
+foo7188: () => {},
+foo7189: () => {},
+foo7190: () => {},
+foo7191: () => {},
+foo7192: () => {},
+foo7193: () => {},
+foo7194: () => {},
+foo7195: () => {},
+foo7196: () => {},
+foo7197: () => {},
+foo7198: () => {},
+foo7199: () => {},
+foo7200: () => {},
+foo7201: () => {},
+foo7202: () => {},
+foo7203: () => {},
+foo7204: () => {},
+foo7205: () => {},
+foo7206: () => {},
+foo7207: () => {},
+foo7208: () => {},
+foo7209: () => {},
+foo7210: () => {},
+foo7211: () => {},
+foo7212: () => {},
+foo7213: () => {},
+foo7214: () => {},
+foo7215: () => {},
+foo7216: () => {},
+foo7217: () => {},
+foo7218: () => {},
+foo7219: () => {},
+foo7220: () => {},
+foo7221: () => {},
+foo7222: () => {},
+foo7223: () => {},
+foo7224: () => {},
+foo7225: () => {},
+foo7226: () => {},
+foo7227: () => {},
+foo7228: () => {},
+foo7229: () => {},
+foo7230: () => {},
+foo7231: () => {},
+foo7232: () => {},
+foo7233: () => {},
+foo7234: () => {},
+foo7235: () => {},
+foo7236: () => {},
+foo7237: () => {},
+foo7238: () => {},
+foo7239: () => {},
+foo7240: () => {},
+foo7241: () => {},
+foo7242: () => {},
+foo7243: () => {},
+foo7244: () => {},
+foo7245: () => {},
+foo7246: () => {},
+foo7247: () => {},
+foo7248: () => {},
+foo7249: () => {},
+foo7250: () => {},
+foo7251: () => {},
+foo7252: () => {},
+foo7253: () => {},
+foo7254: () => {},
+foo7255: () => {},
+foo7256: () => {},
+foo7257: () => {},
+foo7258: () => {},
+foo7259: () => {},
+foo7260: () => {},
+foo7261: () => {},
+foo7262: () => {},
+foo7263: () => {},
+foo7264: () => {},
+foo7265: () => {},
+foo7266: () => {},
+foo7267: () => {},
+foo7268: () => {},
+foo7269: () => {},
+foo7270: () => {},
+foo7271: () => {},
+foo7272: () => {},
+foo7273: () => {},
+foo7274: () => {},
+foo7275: () => {},
+foo7276: () => {},
+foo7277: () => {},
+foo7278: () => {},
+foo7279: () => {},
+foo7280: () => {},
+foo7281: () => {},
+foo7282: () => {},
+foo7283: () => {},
+foo7284: () => {},
+foo7285: () => {},
+foo7286: () => {},
+foo7287: () => {},
+foo7288: () => {},
+foo7289: () => {},
+foo7290: () => {},
+foo7291: () => {},
+foo7292: () => {},
+foo7293: () => {},
+foo7294: () => {},
+foo7295: () => {},
+foo7296: () => {},
+foo7297: () => {},
+foo7298: () => {},
+foo7299: () => {},
+foo7300: () => {},
+foo7301: () => {},
+foo7302: () => {},
+foo7303: () => {},
+foo7304: () => {},
+foo7305: () => {},
+foo7306: () => {},
+foo7307: () => {},
+foo7308: () => {},
+foo7309: () => {},
+foo7310: () => {},
+foo7311: () => {},
+foo7312: () => {},
+foo7313: () => {},
+foo7314: () => {},
+foo7315: () => {},
+foo7316: () => {},
+foo7317: () => {},
+foo7318: () => {},
+foo7319: () => {},
+foo7320: () => {},
+foo7321: () => {},
+foo7322: () => {},
+foo7323: () => {},
+foo7324: () => {},
+foo7325: () => {},
+foo7326: () => {},
+foo7327: () => {},
+foo7328: () => {},
+foo7329: () => {},
+foo7330: () => {},
+foo7331: () => {},
+foo7332: () => {},
+foo7333: () => {},
+foo7334: () => {},
+foo7335: () => {},
+foo7336: () => {},
+foo7337: () => {},
+foo7338: () => {},
+foo7339: () => {},
+foo7340: () => {},
+foo7341: () => {},
+foo7342: () => {},
+foo7343: () => {},
+foo7344: () => {},
+foo7345: () => {},
+foo7346: () => {},
+foo7347: () => {},
+foo7348: () => {},
+foo7349: () => {},
+foo7350: () => {},
+foo7351: () => {},
+foo7352: () => {},
+foo7353: () => {},
+foo7354: () => {},
+foo7355: () => {},
+foo7356: () => {},
+foo7357: () => {},
+foo7358: () => {},
+foo7359: () => {},
+foo7360: () => {},
+foo7361: () => {},
+foo7362: () => {},
+foo7363: () => {},
+foo7364: () => {},
+foo7365: () => {},
+foo7366: () => {},
+foo7367: () => {},
+foo7368: () => {},
+foo7369: () => {},
+foo7370: () => {},
+foo7371: () => {},
+foo7372: () => {},
+foo7373: () => {},
+foo7374: () => {},
+foo7375: () => {},
+foo7376: () => {},
+foo7377: () => {},
+foo7378: () => {},
+foo7379: () => {},
+foo7380: () => {},
+foo7381: () => {},
+foo7382: () => {},
+foo7383: () => {},
+foo7384: () => {},
+foo7385: () => {},
+foo7386: () => {},
+foo7387: () => {},
+foo7388: () => {},
+foo7389: () => {},
+foo7390: () => {},
+foo7391: () => {},
+foo7392: () => {},
+foo7393: () => {},
+foo7394: () => {},
+foo7395: () => {},
+foo7396: () => {},
+foo7397: () => {},
+foo7398: () => {},
+foo7399: () => {},
+foo7400: () => {},
+foo7401: () => {},
+foo7402: () => {},
+foo7403: () => {},
+foo7404: () => {},
+foo7405: () => {},
+foo7406: () => {},
+foo7407: () => {},
+foo7408: () => {},
+foo7409: () => {},
+foo7410: () => {},
+foo7411: () => {},
+foo7412: () => {},
+foo7413: () => {},
+foo7414: () => {},
+foo7415: () => {},
+foo7416: () => {},
+foo7417: () => {},
+foo7418: () => {},
+foo7419: () => {},
+foo7420: () => {},
+foo7421: () => {},
+foo7422: () => {},
+foo7423: () => {},
+foo7424: () => {},
+foo7425: () => {},
+foo7426: () => {},
+foo7427: () => {},
+foo7428: () => {},
+foo7429: () => {},
+foo7430: () => {},
+foo7431: () => {},
+foo7432: () => {},
+foo7433: () => {},
+foo7434: () => {},
+foo7435: () => {},
+foo7436: () => {},
+foo7437: () => {},
+foo7438: () => {},
+foo7439: () => {},
+foo7440: () => {},
+foo7441: () => {},
+foo7442: () => {},
+foo7443: () => {},
+foo7444: () => {},
+foo7445: () => {},
+foo7446: () => {},
+foo7447: () => {},
+foo7448: () => {},
+foo7449: () => {},
+foo7450: () => {},
+foo7451: () => {},
+foo7452: () => {},
+foo7453: () => {},
+foo7454: () => {},
+foo7455: () => {},
+foo7456: () => {},
+foo7457: () => {},
+foo7458: () => {},
+foo7459: () => {},
+foo7460: () => {},
+foo7461: () => {},
+foo7462: () => {},
+foo7463: () => {},
+foo7464: () => {},
+foo7465: () => {},
+foo7466: () => {},
+foo7467: () => {},
+foo7468: () => {},
+foo7469: () => {},
+foo7470: () => {},
+foo7471: () => {},
+foo7472: () => {},
+foo7473: () => {},
+foo7474: () => {},
+foo7475: () => {},
+foo7476: () => {},
+foo7477: () => {},
+foo7478: () => {},
+foo7479: () => {},
+foo7480: () => {},
+foo7481: () => {},
+foo7482: () => {},
+foo7483: () => {},
+foo7484: () => {},
+foo7485: () => {},
+foo7486: () => {},
+foo7487: () => {},
+foo7488: () => {},
+foo7489: () => {},
+foo7490: () => {},
+foo7491: () => {},
+foo7492: () => {},
+foo7493: () => {},
+foo7494: () => {},
+foo7495: () => {},
+foo7496: () => {},
+foo7497: () => {},
+foo7498: () => {},
+foo7499: () => {},
+foo7500: () => {},
+foo7501: () => {},
+foo7502: () => {},
+foo7503: () => {},
+foo7504: () => {},
+foo7505: () => {},
+foo7506: () => {},
+foo7507: () => {},
+foo7508: () => {},
+foo7509: () => {},
+foo7510: () => {},
+foo7511: () => {},
+foo7512: () => {},
+foo7513: () => {},
+foo7514: () => {},
+foo7515: () => {},
+foo7516: () => {},
+foo7517: () => {},
+foo7518: () => {},
+foo7519: () => {},
+foo7520: () => {},
+foo7521: () => {},
+foo7522: () => {},
+foo7523: () => {},
+foo7524: () => {},
+foo7525: () => {},
+foo7526: () => {},
+foo7527: () => {},
+foo7528: () => {},
+foo7529: () => {},
+foo7530: () => {},
+foo7531: () => {},
+foo7532: () => {},
+foo7533: () => {},
+foo7534: () => {},
+foo7535: () => {},
+foo7536: () => {},
+foo7537: () => {},
+foo7538: () => {},
+foo7539: () => {},
+foo7540: () => {},
+foo7541: () => {},
+foo7542: () => {},
+foo7543: () => {},
+foo7544: () => {},
+foo7545: () => {},
+foo7546: () => {},
+foo7547: () => {},
+foo7548: () => {},
+foo7549: () => {},
+foo7550: () => {},
+foo7551: () => {},
+foo7552: () => {},
+foo7553: () => {},
+foo7554: () => {},
+foo7555: () => {},
+foo7556: () => {},
+foo7557: () => {},
+foo7558: () => {},
+foo7559: () => {},
+foo7560: () => {},
+foo7561: () => {},
+foo7562: () => {},
+foo7563: () => {},
+foo7564: () => {},
+foo7565: () => {},
+foo7566: () => {},
+foo7567: () => {},
+foo7568: () => {},
+foo7569: () => {},
+foo7570: () => {},
+foo7571: () => {},
+foo7572: () => {},
+foo7573: () => {},
+foo7574: () => {},
+foo7575: () => {},
+foo7576: () => {},
+foo7577: () => {},
+foo7578: () => {},
+foo7579: () => {},
+foo7580: () => {},
+foo7581: () => {},
+foo7582: () => {},
+foo7583: () => {},
+foo7584: () => {},
+foo7585: () => {},
+foo7586: () => {},
+foo7587: () => {},
+foo7588: () => {},
+foo7589: () => {},
+foo7590: () => {},
+foo7591: () => {},
+foo7592: () => {},
+foo7593: () => {},
+foo7594: () => {},
+foo7595: () => {},
+foo7596: () => {},
+foo7597: () => {},
+foo7598: () => {},
+foo7599: () => {},
+foo7600: () => {},
+foo7601: () => {},
+foo7602: () => {},
+foo7603: () => {},
+foo7604: () => {},
+foo7605: () => {},
+foo7606: () => {},
+foo7607: () => {},
+foo7608: () => {},
+foo7609: () => {},
+foo7610: () => {},
+foo7611: () => {},
+foo7612: () => {},
+foo7613: () => {},
+foo7614: () => {},
+foo7615: () => {},
+foo7616: () => {},
+foo7617: () => {},
+foo7618: () => {},
+foo7619: () => {},
+foo7620: () => {},
+foo7621: () => {},
+foo7622: () => {},
+foo7623: () => {},
+foo7624: () => {},
+foo7625: () => {},
+foo7626: () => {},
+foo7627: () => {},
+foo7628: () => {},
+foo7629: () => {},
+foo7630: () => {},
+foo7631: () => {},
+foo7632: () => {},
+foo7633: () => {},
+foo7634: () => {},
+foo7635: () => {},
+foo7636: () => {},
+foo7637: () => {},
+foo7638: () => {},
+foo7639: () => {},
+foo7640: () => {},
+foo7641: () => {},
+foo7642: () => {},
+foo7643: () => {},
+foo7644: () => {},
+foo7645: () => {},
+foo7646: () => {},
+foo7647: () => {},
+foo7648: () => {},
+foo7649: () => {},
+foo7650: () => {},
+foo7651: () => {},
+foo7652: () => {},
+foo7653: () => {},
+foo7654: () => {},
+foo7655: () => {},
+foo7656: () => {},
+foo7657: () => {},
+foo7658: () => {},
+foo7659: () => {},
+foo7660: () => {},
+foo7661: () => {},
+foo7662: () => {},
+foo7663: () => {},
+foo7664: () => {},
+foo7665: () => {},
+foo7666: () => {},
+foo7667: () => {},
+foo7668: () => {},
+foo7669: () => {},
+foo7670: () => {},
+foo7671: () => {},
+foo7672: () => {},
+foo7673: () => {},
+foo7674: () => {},
+foo7675: () => {},
+foo7676: () => {},
+foo7677: () => {},
+foo7678: () => {},
+foo7679: () => {},
+foo7680: () => {},
+foo7681: () => {},
+foo7682: () => {},
+foo7683: () => {},
+foo7684: () => {},
+foo7685: () => {},
+foo7686: () => {},
+foo7687: () => {},
+foo7688: () => {},
+foo7689: () => {},
+foo7690: () => {},
+foo7691: () => {},
+foo7692: () => {},
+foo7693: () => {},
+foo7694: () => {},
+foo7695: () => {},
+foo7696: () => {},
+foo7697: () => {},
+foo7698: () => {},
+foo7699: () => {},
+foo7700: () => {},
+foo7701: () => {},
+foo7702: () => {},
+foo7703: () => {},
+foo7704: () => {},
+foo7705: () => {},
+foo7706: () => {},
+foo7707: () => {},
+foo7708: () => {},
+foo7709: () => {},
+foo7710: () => {},
+foo7711: () => {},
+foo7712: () => {},
+foo7713: () => {},
+foo7714: () => {},
+foo7715: () => {},
+foo7716: () => {},
+foo7717: () => {},
+foo7718: () => {},
+foo7719: () => {},
+foo7720: () => {},
+foo7721: () => {},
+foo7722: () => {},
+foo7723: () => {},
+foo7724: () => {},
+foo7725: () => {},
+foo7726: () => {},
+foo7727: () => {},
+foo7728: () => {},
+foo7729: () => {},
+foo7730: () => {},
+foo7731: () => {},
+foo7732: () => {},
+foo7733: () => {},
+foo7734: () => {},
+foo7735: () => {},
+foo7736: () => {},
+foo7737: () => {},
+foo7738: () => {},
+foo7739: () => {},
+foo7740: () => {},
+foo7741: () => {},
+foo7742: () => {},
+foo7743: () => {},
+foo7744: () => {},
+foo7745: () => {},
+foo7746: () => {},
+foo7747: () => {},
+foo7748: () => {},
+foo7749: () => {},
+foo7750: () => {},
+foo7751: () => {},
+foo7752: () => {},
+foo7753: () => {},
+foo7754: () => {},
+foo7755: () => {},
+foo7756: () => {},
+foo7757: () => {},
+foo7758: () => {},
+foo7759: () => {},
+foo7760: () => {},
+foo7761: () => {},
+foo7762: () => {},
+foo7763: () => {},
+foo7764: () => {},
+foo7765: () => {},
+foo7766: () => {},
+foo7767: () => {},
+foo7768: () => {},
+foo7769: () => {},
+foo7770: () => {},
+foo7771: () => {},
+foo7772: () => {},
+foo7773: () => {},
+foo7774: () => {},
+foo7775: () => {},
+foo7776: () => {},
+foo7777: () => {},
+foo7778: () => {},
+foo7779: () => {},
+foo7780: () => {},
+foo7781: () => {},
+foo7782: () => {},
+foo7783: () => {},
+foo7784: () => {},
+foo7785: () => {},
+foo7786: () => {},
+foo7787: () => {},
+foo7788: () => {},
+foo7789: () => {},
+foo7790: () => {},
+foo7791: () => {},
+foo7792: () => {},
+foo7793: () => {},
+foo7794: () => {},
+foo7795: () => {},
+foo7796: () => {},
+foo7797: () => {},
+foo7798: () => {},
+foo7799: () => {},
+foo7800: () => {},
+foo7801: () => {},
+foo7802: () => {},
+foo7803: () => {},
+foo7804: () => {},
+foo7805: () => {},
+foo7806: () => {},
+foo7807: () => {},
+foo7808: () => {},
+foo7809: () => {},
+foo7810: () => {},
+foo7811: () => {},
+foo7812: () => {},
+foo7813: () => {},
+foo7814: () => {},
+foo7815: () => {},
+foo7816: () => {},
+foo7817: () => {},
+foo7818: () => {},
+foo7819: () => {},
+foo7820: () => {},
+foo7821: () => {},
+foo7822: () => {},
+foo7823: () => {},
+foo7824: () => {},
+foo7825: () => {},
+foo7826: () => {},
+foo7827: () => {},
+foo7828: () => {},
+foo7829: () => {},
+foo7830: () => {},
+foo7831: () => {},
+foo7832: () => {},
+foo7833: () => {},
+foo7834: () => {},
+foo7835: () => {},
+foo7836: () => {},
+foo7837: () => {},
+foo7838: () => {},
+foo7839: () => {},
+foo7840: () => {},
+foo7841: () => {},
+foo7842: () => {},
+foo7843: () => {},
+foo7844: () => {},
+foo7845: () => {},
+foo7846: () => {},
+foo7847: () => {},
+foo7848: () => {},
+foo7849: () => {},
+foo7850: () => {},
+foo7851: () => {},
+foo7852: () => {},
+foo7853: () => {},
+foo7854: () => {},
+foo7855: () => {},
+foo7856: () => {},
+foo7857: () => {},
+foo7858: () => {},
+foo7859: () => {},
+foo7860: () => {},
+foo7861: () => {},
+foo7862: () => {},
+foo7863: () => {},
+foo7864: () => {},
+foo7865: () => {},
+foo7866: () => {},
+foo7867: () => {},
+foo7868: () => {},
+foo7869: () => {},
+foo7870: () => {},
+foo7871: () => {},
+foo7872: () => {},
+foo7873: () => {},
+foo7874: () => {},
+foo7875: () => {},
+foo7876: () => {},
+foo7877: () => {},
+foo7878: () => {},
+foo7879: () => {},
+foo7880: () => {},
+foo7881: () => {},
+foo7882: () => {},
+foo7883: () => {},
+foo7884: () => {},
+foo7885: () => {},
+foo7886: () => {},
+foo7887: () => {},
+foo7888: () => {},
+foo7889: () => {},
+foo7890: () => {},
+foo7891: () => {},
+foo7892: () => {},
+foo7893: () => {},
+foo7894: () => {},
+foo7895: () => {},
+foo7896: () => {},
+foo7897: () => {},
+foo7898: () => {},
+foo7899: () => {},
+foo7900: () => {},
+foo7901: () => {},
+foo7902: () => {},
+foo7903: () => {},
+foo7904: () => {},
+foo7905: () => {},
+foo7906: () => {},
+foo7907: () => {},
+foo7908: () => {},
+foo7909: () => {},
+foo7910: () => {},
+foo7911: () => {},
+foo7912: () => {},
+foo7913: () => {},
+foo7914: () => {},
+foo7915: () => {},
+foo7916: () => {},
+foo7917: () => {},
+foo7918: () => {},
+foo7919: () => {},
+foo7920: () => {},
+foo7921: () => {},
+foo7922: () => {},
+foo7923: () => {},
+foo7924: () => {},
+foo7925: () => {},
+foo7926: () => {},
+foo7927: () => {},
+foo7928: () => {},
+foo7929: () => {},
+foo7930: () => {},
+foo7931: () => {},
+foo7932: () => {},
+foo7933: () => {},
+foo7934: () => {},
+foo7935: () => {},
+foo7936: () => {},
+foo7937: () => {},
+foo7938: () => {},
+foo7939: () => {},
+foo7940: () => {},
+foo7941: () => {},
+foo7942: () => {},
+foo7943: () => {},
+foo7944: () => {},
+foo7945: () => {},
+foo7946: () => {},
+foo7947: () => {},
+foo7948: () => {},
+foo7949: () => {},
+foo7950: () => {},
+foo7951: () => {},
+foo7952: () => {},
+foo7953: () => {},
+foo7954: () => {},
+foo7955: () => {},
+foo7956: () => {},
+foo7957: () => {},
+foo7958: () => {},
+foo7959: () => {},
+foo7960: () => {},
+foo7961: () => {},
+foo7962: () => {},
+foo7963: () => {},
+foo7964: () => {},
+foo7965: () => {},
+foo7966: () => {},
+foo7967: () => {},
+foo7968: () => {},
+foo7969: () => {},
+foo7970: () => {},
+foo7971: () => {},
+foo7972: () => {},
+foo7973: () => {},
+foo7974: () => {},
+foo7975: () => {},
+foo7976: () => {},
+foo7977: () => {},
+foo7978: () => {},
+foo7979: () => {},
+foo7980: () => {},
+foo7981: () => {},
+foo7982: () => {},
+foo7983: () => {},
+foo7984: () => {},
+foo7985: () => {},
+foo7986: () => {},
+foo7987: () => {},
+foo7988: () => {},
+foo7989: () => {},
+foo7990: () => {},
+foo7991: () => {},
+foo7992: () => {},
+foo7993: () => {},
+foo7994: () => {},
+foo7995: () => {},
+foo7996: () => {},
+foo7997: () => {},
+foo7998: () => {},
+foo7999: () => {},
+foo8000: () => {},
+foo8001: () => {},
+foo8002: () => {},
+foo8003: () => {},
+foo8004: () => {},
+foo8005: () => {},
+foo8006: () => {},
+foo8007: () => {},
+foo8008: () => {},
+foo8009: () => {},
+foo8010: () => {},
+foo8011: () => {},
+foo8012: () => {},
+foo8013: () => {},
+foo8014: () => {},
+foo8015: () => {},
+foo8016: () => {},
+foo8017: () => {},
+foo8018: () => {},
+foo8019: () => {},
+foo8020: () => {},
+foo8021: () => {},
+foo8022: () => {},
+foo8023: () => {},
+foo8024: () => {},
+foo8025: () => {},
+foo8026: () => {},
+foo8027: () => {},
+foo8028: () => {},
+foo8029: () => {},
+foo8030: () => {},
+foo8031: () => {},
+foo8032: () => {},
+foo8033: () => {},
+foo8034: () => {},
+foo8035: () => {},
+foo8036: () => {},
+foo8037: () => {},
+foo8038: () => {},
+foo8039: () => {},
+foo8040: () => {},
+foo8041: () => {},
+foo8042: () => {},
+foo8043: () => {},
+foo8044: () => {},
+foo8045: () => {},
+foo8046: () => {},
+foo8047: () => {},
+foo8048: () => {},
+foo8049: () => {},
+foo8050: () => {},
+foo8051: () => {},
+foo8052: () => {},
+foo8053: () => {},
+foo8054: () => {},
+foo8055: () => {},
+foo8056: () => {},
+foo8057: () => {},
+foo8058: () => {},
+foo8059: () => {},
+foo8060: () => {},
+foo8061: () => {},
+foo8062: () => {},
+foo8063: () => {},
+foo8064: () => {},
+foo8065: () => {},
+foo8066: () => {},
+foo8067: () => {},
+foo8068: () => {},
+foo8069: () => {},
+foo8070: () => {},
+foo8071: () => {},
+foo8072: () => {},
+foo8073: () => {},
+foo8074: () => {},
+foo8075: () => {},
+foo8076: () => {},
+foo8077: () => {},
+foo8078: () => {},
+foo8079: () => {},
+foo8080: () => {},
+foo8081: () => {},
+foo8082: () => {},
+foo8083: () => {},
+foo8084: () => {},
+foo8085: () => {},
+foo8086: () => {},
+foo8087: () => {},
+foo8088: () => {},
+foo8089: () => {},
+foo8090: () => {},
+foo8091: () => {},
+foo8092: () => {},
+foo8093: () => {},
+foo8094: () => {},
+foo8095: () => {},
+foo8096: () => {},
+foo8097: () => {},
+foo8098: () => {},
+foo8099: () => {},
+foo8100: () => {},
+foo8101: () => {},
+foo8102: () => {},
+foo8103: () => {},
+foo8104: () => {},
+foo8105: () => {},
+foo8106: () => {},
+foo8107: () => {},
+foo8108: () => {},
+foo8109: () => {},
+foo8110: () => {},
+foo8111: () => {},
+foo8112: () => {},
+foo8113: () => {},
+foo8114: () => {},
+foo8115: () => {},
+foo8116: () => {},
+foo8117: () => {},
+foo8118: () => {},
+foo8119: () => {},
+foo8120: () => {},
+foo8121: () => {},
+foo8122: () => {},
+foo8123: () => {},
+foo8124: () => {},
+foo8125: () => {},
+foo8126: () => {},
+foo8127: () => {},
+foo8128: () => {},
+foo8129: () => {},
+foo8130: () => {},
+foo8131: () => {},
+foo8132: () => {},
+foo8133: () => {},
+foo8134: () => {},
+foo8135: () => {},
+foo8136: () => {},
+foo8137: () => {},
+foo8138: () => {},
+foo8139: () => {},
+foo8140: () => {},
+foo8141: () => {},
+foo8142: () => {},
+foo8143: () => {},
+foo8144: () => {},
+foo8145: () => {},
+foo8146: () => {},
+foo8147: () => {},
+foo8148: () => {},
+foo8149: () => {},
+foo8150: () => {},
+foo8151: () => {},
+foo8152: () => {},
+foo8153: () => {},
+foo8154: () => {},
+foo8155: () => {},
+foo8156: () => {},
+foo8157: () => {},
+foo8158: () => {},
+foo8159: () => {},
+foo8160: () => {},
+foo8161: () => {},
+foo8162: () => {},
+foo8163: () => {},
+foo8164: () => {},
+foo8165: () => {},
+foo8166: () => {},
+foo8167: () => {},
+foo8168: () => {},
+foo8169: () => {},
+foo8170: () => {},
+foo8171: () => {},
+foo8172: () => {},
+foo8173: () => {},
+foo8174: () => {},
+foo8175: () => {},
+foo8176: () => {},
+foo8177: () => {},
+foo8178: () => {},
+foo8179: () => {},
+foo8180: () => {},
+foo8181: () => {},
+foo8182: () => {},
+foo8183: () => {},
+foo8184: () => {},
+foo8185: () => {},
+foo8186: () => {},
+foo8187: () => {},
+foo8188: () => {},
+foo8189: () => {},
+foo8190: () => {},
+foo8191: () => {},
+foo8192: () => {},
+foo8193: () => {},
+foo8194: () => {},
+foo8195: () => {},
+foo8196: () => {},
+foo8197: () => {},
+foo8198: () => {},
+foo8199: () => {},
+foo8200: () => {},
+foo8201: () => {},
+foo8202: () => {},
+foo8203: () => {},
+foo8204: () => {},
+foo8205: () => {},
+foo8206: () => {},
+foo8207: () => {},
+foo8208: () => {},
+foo8209: () => {},
+foo8210: () => {},
+foo8211: () => {},
+foo8212: () => {},
+foo8213: () => {},
+foo8214: () => {},
+foo8215: () => {},
+foo8216: () => {},
+foo8217: () => {},
+foo8218: () => {},
+foo8219: () => {},
+foo8220: () => {},
+foo8221: () => {},
+foo8222: () => {},
+foo8223: () => {},
+foo8224: () => {},
+foo8225: () => {},
+foo8226: () => {},
+foo8227: () => {},
+foo8228: () => {},
+foo8229: () => {},
+foo8230: () => {},
+foo8231: () => {},
+foo8232: () => {},
+foo8233: () => {},
+foo8234: () => {},
+foo8235: () => {},
+foo8236: () => {},
+foo8237: () => {},
+foo8238: () => {},
+foo8239: () => {},
+foo8240: () => {},
+foo8241: () => {},
+foo8242: () => {},
+foo8243: () => {},
+foo8244: () => {},
+foo8245: () => {},
+foo8246: () => {},
+foo8247: () => {},
+foo8248: () => {},
+foo8249: () => {},
+foo8250: () => {},
+foo8251: () => {},
+foo8252: () => {},
+foo8253: () => {},
+foo8254: () => {},
+foo8255: () => {},
+foo8256: () => {},
+foo8257: () => {},
+foo8258: () => {},
+foo8259: () => {},
+foo8260: () => {},
+foo8261: () => {},
+foo8262: () => {},
+foo8263: () => {},
+foo8264: () => {},
+foo8265: () => {},
+foo8266: () => {},
+foo8267: () => {},
+foo8268: () => {},
+foo8269: () => {},
+foo8270: () => {},
+foo8271: () => {},
+foo8272: () => {},
+foo8273: () => {},
+foo8274: () => {},
+foo8275: () => {},
+foo8276: () => {},
+foo8277: () => {},
+foo8278: () => {},
+foo8279: () => {},
+foo8280: () => {},
+foo8281: () => {},
+foo8282: () => {},
+foo8283: () => {},
+foo8284: () => {},
+foo8285: () => {},
+foo8286: () => {},
+foo8287: () => {},
+foo8288: () => {},
+foo8289: () => {},
+foo8290: () => {},
+foo8291: () => {},
+foo8292: () => {},
+foo8293: () => {},
+foo8294: () => {},
+foo8295: () => {},
+foo8296: () => {},
+foo8297: () => {},
+foo8298: () => {},
+foo8299: () => {},
+foo8300: () => {},
+foo8301: () => {},
+foo8302: () => {},
+foo8303: () => {},
+foo8304: () => {},
+foo8305: () => {},
+foo8306: () => {},
+foo8307: () => {},
+foo8308: () => {},
+foo8309: () => {},
+foo8310: () => {},
+foo8311: () => {},
+foo8312: () => {},
+foo8313: () => {},
+foo8314: () => {},
+foo8315: () => {},
+foo8316: () => {},
+foo8317: () => {},
+foo8318: () => {},
+foo8319: () => {},
+foo8320: () => {},
+foo8321: () => {},
+foo8322: () => {},
+foo8323: () => {},
+foo8324: () => {},
+foo8325: () => {},
+foo8326: () => {},
+foo8327: () => {},
+foo8328: () => {},
+foo8329: () => {},
+foo8330: () => {},
+foo8331: () => {},
+foo8332: () => {},
+foo8333: () => {},
+foo8334: () => {},
+foo8335: () => {},
+foo8336: () => {},
+foo8337: () => {},
+foo8338: () => {},
+foo8339: () => {},
+foo8340: () => {},
+foo8341: () => {},
+foo8342: () => {},
+foo8343: () => {},
+foo8344: () => {},
+foo8345: () => {},
+foo8346: () => {},
+foo8347: () => {},
+foo8348: () => {},
+foo8349: () => {},
+foo8350: () => {},
+foo8351: () => {},
+foo8352: () => {},
+foo8353: () => {},
+foo8354: () => {},
+foo8355: () => {},
+foo8356: () => {},
+foo8357: () => {},
+foo8358: () => {},
+foo8359: () => {},
+foo8360: () => {},
+foo8361: () => {},
+foo8362: () => {},
+foo8363: () => {},
+foo8364: () => {},
+foo8365: () => {},
+foo8366: () => {},
+foo8367: () => {},
+foo8368: () => {},
+foo8369: () => {},
+foo8370: () => {},
+foo8371: () => {},
+foo8372: () => {},
+foo8373: () => {},
+foo8374: () => {},
+foo8375: () => {},
+foo8376: () => {},
+foo8377: () => {},
+foo8378: () => {},
+foo8379: () => {},
+foo8380: () => {},
+foo8381: () => {},
+foo8382: () => {},
+foo8383: () => {},
+foo8384: () => {},
+foo8385: () => {},
+foo8386: () => {},
+foo8387: () => {},
+foo8388: () => {},
+foo8389: () => {},
+foo8390: () => {},
+foo8391: () => {},
+foo8392: () => {},
+foo8393: () => {},
+foo8394: () => {},
+foo8395: () => {},
+foo8396: () => {},
+foo8397: () => {},
+foo8398: () => {},
+foo8399: () => {},
+foo8400: () => {},
+foo8401: () => {},
+foo8402: () => {},
+foo8403: () => {},
+foo8404: () => {},
+foo8405: () => {},
+foo8406: () => {},
+foo8407: () => {},
+foo8408: () => {},
+foo8409: () => {},
+foo8410: () => {},
+foo8411: () => {},
+foo8412: () => {},
+foo8413: () => {},
+foo8414: () => {},
+foo8415: () => {},
+foo8416: () => {},
+foo8417: () => {},
+foo8418: () => {},
+foo8419: () => {},
+foo8420: () => {},
+foo8421: () => {},
+foo8422: () => {},
+foo8423: () => {},
+foo8424: () => {},
+foo8425: () => {},
+foo8426: () => {},
+foo8427: () => {},
+foo8428: () => {},
+foo8429: () => {},
+foo8430: () => {},
+foo8431: () => {},
+foo8432: () => {},
+foo8433: () => {},
+foo8434: () => {},
+foo8435: () => {},
+foo8436: () => {},
+foo8437: () => {},
+foo8438: () => {},
+foo8439: () => {},
+foo8440: () => {},
+foo8441: () => {},
+foo8442: () => {},
+foo8443: () => {},
+foo8444: () => {},
+foo8445: () => {},
+foo8446: () => {},
+foo8447: () => {},
+foo8448: () => {},
+foo8449: () => {},
+foo8450: () => {},
+foo8451: () => {},
+foo8452: () => {},
+foo8453: () => {},
+foo8454: () => {},
+foo8455: () => {},
+foo8456: () => {},
+foo8457: () => {},
+foo8458: () => {},
+foo8459: () => {},
+foo8460: () => {},
+foo8461: () => {},
+foo8462: () => {},
+foo8463: () => {},
+foo8464: () => {},
+foo8465: () => {},
+foo8466: () => {},
+foo8467: () => {},
+foo8468: () => {},
+foo8469: () => {},
+foo8470: () => {},
+foo8471: () => {},
+foo8472: () => {},
+foo8473: () => {},
+foo8474: () => {},
+foo8475: () => {},
+foo8476: () => {},
+foo8477: () => {},
+foo8478: () => {},
+foo8479: () => {},
+foo8480: () => {},
+foo8481: () => {},
+foo8482: () => {},
+foo8483: () => {},
+foo8484: () => {},
+foo8485: () => {},
+foo8486: () => {},
+foo8487: () => {},
+foo8488: () => {},
+foo8489: () => {},
+foo8490: () => {},
+foo8491: () => {},
+foo8492: () => {},
+foo8493: () => {},
+foo8494: () => {},
+foo8495: () => {},
+foo8496: () => {},
+foo8497: () => {},
+foo8498: () => {},
+foo8499: () => {},
+foo8500: () => {},
+foo8501: () => {},
+foo8502: () => {},
+foo8503: () => {},
+foo8504: () => {},
+foo8505: () => {},
+foo8506: () => {},
+foo8507: () => {},
+foo8508: () => {},
+foo8509: () => {},
+foo8510: () => {},
+foo8511: () => {},
+foo8512: () => {},
+foo8513: () => {},
+foo8514: () => {},
+foo8515: () => {},
+foo8516: () => {},
+foo8517: () => {},
+foo8518: () => {},
+foo8519: () => {},
+foo8520: () => {},
+foo8521: () => {},
+foo8522: () => {},
+foo8523: () => {},
+foo8524: () => {},
+foo8525: () => {},
+foo8526: () => {},
+foo8527: () => {},
+foo8528: () => {},
+foo8529: () => {},
+foo8530: () => {},
+foo8531: () => {},
+foo8532: () => {},
+foo8533: () => {},
+foo8534: () => {},
+foo8535: () => {},
+foo8536: () => {},
+foo8537: () => {},
+foo8538: () => {},
+foo8539: () => {},
+foo8540: () => {},
+foo8541: () => {},
+foo8542: () => {},
+foo8543: () => {},
+foo8544: () => {},
+foo8545: () => {},
+foo8546: () => {},
+foo8547: () => {},
+foo8548: () => {},
+foo8549: () => {},
+foo8550: () => {},
+foo8551: () => {},
+foo8552: () => {},
+foo8553: () => {},
+foo8554: () => {},
+foo8555: () => {},
+foo8556: () => {},
+foo8557: () => {},
+foo8558: () => {},
+foo8559: () => {},
+foo8560: () => {},
+foo8561: () => {},
+foo8562: () => {},
+foo8563: () => {},
+foo8564: () => {},
+foo8565: () => {},
+foo8566: () => {},
+foo8567: () => {},
+foo8568: () => {},
+foo8569: () => {},
+foo8570: () => {},
+foo8571: () => {},
+foo8572: () => {},
+foo8573: () => {},
+foo8574: () => {},
+foo8575: () => {},
+foo8576: () => {},
+foo8577: () => {},
+foo8578: () => {},
+foo8579: () => {},
+foo8580: () => {},
+foo8581: () => {},
+foo8582: () => {},
+foo8583: () => {},
+foo8584: () => {},
+foo8585: () => {},
+foo8586: () => {},
+foo8587: () => {},
+foo8588: () => {},
+foo8589: () => {},
+foo8590: () => {},
+foo8591: () => {},
+foo8592: () => {},
+foo8593: () => {},
+foo8594: () => {},
+foo8595: () => {},
+foo8596: () => {},
+foo8597: () => {},
+foo8598: () => {},
+foo8599: () => {},
+foo8600: () => {},
+foo8601: () => {},
+foo8602: () => {},
+foo8603: () => {},
+foo8604: () => {},
+foo8605: () => {},
+foo8606: () => {},
+foo8607: () => {},
+foo8608: () => {},
+foo8609: () => {},
+foo8610: () => {},
+foo8611: () => {},
+foo8612: () => {},
+foo8613: () => {},
+foo8614: () => {},
+foo8615: () => {},
+foo8616: () => {},
+foo8617: () => {},
+foo8618: () => {},
+foo8619: () => {},
+foo8620: () => {},
+foo8621: () => {},
+foo8622: () => {},
+foo8623: () => {},
+foo8624: () => {},
+foo8625: () => {},
+foo8626: () => {},
+foo8627: () => {},
+foo8628: () => {},
+foo8629: () => {},
+foo8630: () => {},
+foo8631: () => {},
+foo8632: () => {},
+foo8633: () => {},
+foo8634: () => {},
+foo8635: () => {},
+foo8636: () => {},
+foo8637: () => {},
+foo8638: () => {},
+foo8639: () => {},
+foo8640: () => {},
+foo8641: () => {},
+foo8642: () => {},
+foo8643: () => {},
+foo8644: () => {},
+foo8645: () => {},
+foo8646: () => {},
+foo8647: () => {},
+foo8648: () => {},
+foo8649: () => {},
+foo8650: () => {},
+foo8651: () => {},
+foo8652: () => {},
+foo8653: () => {},
+foo8654: () => {},
+foo8655: () => {},
+foo8656: () => {},
+foo8657: () => {},
+foo8658: () => {},
+foo8659: () => {},
+foo8660: () => {},
+foo8661: () => {},
+foo8662: () => {},
+foo8663: () => {},
+foo8664: () => {},
+foo8665: () => {},
+foo8666: () => {},
+foo8667: () => {},
+foo8668: () => {},
+foo8669: () => {},
+foo8670: () => {},
+foo8671: () => {},
+foo8672: () => {},
+foo8673: () => {},
+foo8674: () => {},
+foo8675: () => {},
+foo8676: () => {},
+foo8677: () => {},
+foo8678: () => {},
+foo8679: () => {},
+foo8680: () => {},
+foo8681: () => {},
+foo8682: () => {},
+foo8683: () => {},
+foo8684: () => {},
+foo8685: () => {},
+foo8686: () => {},
+foo8687: () => {},
+foo8688: () => {},
+foo8689: () => {},
+foo8690: () => {},
+foo8691: () => {},
+foo8692: () => {},
+foo8693: () => {},
+foo8694: () => {},
+foo8695: () => {},
+foo8696: () => {},
+foo8697: () => {},
+foo8698: () => {},
+foo8699: () => {},
+foo8700: () => {},
+foo8701: () => {},
+foo8702: () => {},
+foo8703: () => {},
+foo8704: () => {},
+foo8705: () => {},
+foo8706: () => {},
+foo8707: () => {},
+foo8708: () => {},
+foo8709: () => {},
+foo8710: () => {},
+foo8711: () => {},
+foo8712: () => {},
+foo8713: () => {},
+foo8714: () => {},
+foo8715: () => {},
+foo8716: () => {},
+foo8717: () => {},
+foo8718: () => {},
+foo8719: () => {},
+foo8720: () => {},
+foo8721: () => {},
+foo8722: () => {},
+foo8723: () => {},
+foo8724: () => {},
+foo8725: () => {},
+foo8726: () => {},
+foo8727: () => {},
+foo8728: () => {},
+foo8729: () => {},
+foo8730: () => {},
+foo8731: () => {},
+foo8732: () => {},
+foo8733: () => {},
+foo8734: () => {},
+foo8735: () => {},
+foo8736: () => {},
+foo8737: () => {},
+foo8738: () => {},
+foo8739: () => {},
+foo8740: () => {},
+foo8741: () => {},
+foo8742: () => {},
+foo8743: () => {},
+foo8744: () => {},
+foo8745: () => {},
+foo8746: () => {},
+foo8747: () => {},
+foo8748: () => {},
+foo8749: () => {},
+foo8750: () => {},
+foo8751: () => {},
+foo8752: () => {},
+foo8753: () => {},
+foo8754: () => {},
+foo8755: () => {},
+foo8756: () => {},
+foo8757: () => {},
+foo8758: () => {},
+foo8759: () => {},
+foo8760: () => {},
+foo8761: () => {},
+foo8762: () => {},
+foo8763: () => {},
+foo8764: () => {},
+foo8765: () => {},
+foo8766: () => {},
+foo8767: () => {},
+foo8768: () => {},
+foo8769: () => {},
+foo8770: () => {},
+foo8771: () => {},
+foo8772: () => {},
+foo8773: () => {},
+foo8774: () => {},
+foo8775: () => {},
+foo8776: () => {},
+foo8777: () => {},
+foo8778: () => {},
+foo8779: () => {},
+foo8780: () => {},
+foo8781: () => {},
+foo8782: () => {},
+foo8783: () => {},
+foo8784: () => {},
+foo8785: () => {},
+foo8786: () => {},
+foo8787: () => {},
+foo8788: () => {},
+foo8789: () => {},
+foo8790: () => {},
+foo8791: () => {},
+foo8792: () => {},
+foo8793: () => {},
+foo8794: () => {},
+foo8795: () => {},
+foo8796: () => {},
+foo8797: () => {},
+foo8798: () => {},
+foo8799: () => {},
+foo8800: () => {},
+foo8801: () => {},
+foo8802: () => {},
+foo8803: () => {},
+foo8804: () => {},
+foo8805: () => {},
+foo8806: () => {},
+foo8807: () => {},
+foo8808: () => {},
+foo8809: () => {},
+foo8810: () => {},
+foo8811: () => {},
+foo8812: () => {},
+foo8813: () => {},
+foo8814: () => {},
+foo8815: () => {},
+foo8816: () => {},
+foo8817: () => {},
+foo8818: () => {},
+foo8819: () => {},
+foo8820: () => {},
+foo8821: () => {},
+foo8822: () => {},
+foo8823: () => {},
+foo8824: () => {},
+foo8825: () => {},
+foo8826: () => {},
+foo8827: () => {},
+foo8828: () => {},
+foo8829: () => {},
+foo8830: () => {},
+foo8831: () => {},
+foo8832: () => {},
+foo8833: () => {},
+foo8834: () => {},
+foo8835: () => {},
+foo8836: () => {},
+foo8837: () => {},
+foo8838: () => {},
+foo8839: () => {},
+foo8840: () => {},
+foo8841: () => {},
+foo8842: () => {},
+foo8843: () => {},
+foo8844: () => {},
+foo8845: () => {},
+foo8846: () => {},
+foo8847: () => {},
+foo8848: () => {},
+foo8849: () => {},
+foo8850: () => {},
+foo8851: () => {},
+foo8852: () => {},
+foo8853: () => {},
+foo8854: () => {},
+foo8855: () => {},
+foo8856: () => {},
+foo8857: () => {},
+foo8858: () => {},
+foo8859: () => {},
+foo8860: () => {},
+foo8861: () => {},
+foo8862: () => {},
+foo8863: () => {},
+foo8864: () => {},
+foo8865: () => {},
+foo8866: () => {},
+foo8867: () => {},
+foo8868: () => {},
+foo8869: () => {},
+foo8870: () => {},
+foo8871: () => {},
+foo8872: () => {},
+foo8873: () => {},
+foo8874: () => {},
+foo8875: () => {},
+foo8876: () => {},
+foo8877: () => {},
+foo8878: () => {},
+foo8879: () => {},
+foo8880: () => {},
+foo8881: () => {},
+foo8882: () => {},
+foo8883: () => {},
+foo8884: () => {},
+foo8885: () => {},
+foo8886: () => {},
+foo8887: () => {},
+foo8888: () => {},
+foo8889: () => {},
+foo8890: () => {},
+foo8891: () => {},
+foo8892: () => {},
+foo8893: () => {},
+foo8894: () => {},
+foo8895: () => {},
+foo8896: () => {},
+foo8897: () => {},
+foo8898: () => {},
+foo8899: () => {},
+foo8900: () => {},
+foo8901: () => {},
+foo8902: () => {},
+foo8903: () => {},
+foo8904: () => {},
+foo8905: () => {},
+foo8906: () => {},
+foo8907: () => {},
+foo8908: () => {},
+foo8909: () => {},
+foo8910: () => {},
+foo8911: () => {},
+foo8912: () => {},
+foo8913: () => {},
+foo8914: () => {},
+foo8915: () => {},
+foo8916: () => {},
+foo8917: () => {},
+foo8918: () => {},
+foo8919: () => {},
+foo8920: () => {},
+foo8921: () => {},
+foo8922: () => {},
+foo8923: () => {},
+foo8924: () => {},
+foo8925: () => {},
+foo8926: () => {},
+foo8927: () => {},
+foo8928: () => {},
+foo8929: () => {},
+foo8930: () => {},
+foo8931: () => {},
+foo8932: () => {},
+foo8933: () => {},
+foo8934: () => {},
+foo8935: () => {},
+foo8936: () => {},
+foo8937: () => {},
+foo8938: () => {},
+foo8939: () => {},
+foo8940: () => {},
+foo8941: () => {},
+foo8942: () => {},
+foo8943: () => {},
+foo8944: () => {},
+foo8945: () => {},
+foo8946: () => {},
+foo8947: () => {},
+foo8948: () => {},
+foo8949: () => {},
+foo8950: () => {},
+foo8951: () => {},
+foo8952: () => {},
+foo8953: () => {},
+foo8954: () => {},
+foo8955: () => {},
+foo8956: () => {},
+foo8957: () => {},
+foo8958: () => {},
+foo8959: () => {},
+foo8960: () => {},
+foo8961: () => {},
+foo8962: () => {},
+foo8963: () => {},
+foo8964: () => {},
+foo8965: () => {},
+foo8966: () => {},
+foo8967: () => {},
+foo8968: () => {},
+foo8969: () => {},
+foo8970: () => {},
+foo8971: () => {},
+foo8972: () => {},
+foo8973: () => {},
+foo8974: () => {},
+foo8975: () => {},
+foo8976: () => {},
+foo8977: () => {},
+foo8978: () => {},
+foo8979: () => {},
+foo8980: () => {},
+foo8981: () => {},
+foo8982: () => {},
+foo8983: () => {},
+foo8984: () => {},
+foo8985: () => {},
+foo8986: () => {},
+foo8987: () => {},
+foo8988: () => {},
+foo8989: () => {},
+foo8990: () => {},
+foo8991: () => {},
+foo8992: () => {},
+foo8993: () => {},
+foo8994: () => {},
+foo8995: () => {},
+foo8996: () => {},
+foo8997: () => {},
+foo8998: () => {},
+foo8999: () => {},
+foo9000: () => {},
+foo9001: () => {},
+foo9002: () => {},
+foo9003: () => {},
+foo9004: () => {},
+foo9005: () => {},
+foo9006: () => {},
+foo9007: () => {},
+foo9008: () => {},
+foo9009: () => {},
+foo9010: () => {},
+foo9011: () => {},
+foo9012: () => {},
+foo9013: () => {},
+foo9014: () => {},
+foo9015: () => {},
+foo9016: () => {},
+foo9017: () => {},
+foo9018: () => {},
+foo9019: () => {},
+foo9020: () => {},
+foo9021: () => {},
+foo9022: () => {},
+foo9023: () => {},
+foo9024: () => {},
+foo9025: () => {},
+foo9026: () => {},
+foo9027: () => {},
+foo9028: () => {},
+foo9029: () => {},
+foo9030: () => {},
+foo9031: () => {},
+foo9032: () => {},
+foo9033: () => {},
+foo9034: () => {},
+foo9035: () => {},
+foo9036: () => {},
+foo9037: () => {},
+foo9038: () => {},
+foo9039: () => {},
+foo9040: () => {},
+foo9041: () => {},
+foo9042: () => {},
+foo9043: () => {},
+foo9044: () => {},
+foo9045: () => {},
+foo9046: () => {},
+foo9047: () => {},
+foo9048: () => {},
+foo9049: () => {},
+foo9050: () => {},
+foo9051: () => {},
+foo9052: () => {},
+foo9053: () => {},
+foo9054: () => {},
+foo9055: () => {},
+foo9056: () => {},
+foo9057: () => {},
+foo9058: () => {},
+foo9059: () => {},
+foo9060: () => {},
+foo9061: () => {},
+foo9062: () => {},
+foo9063: () => {},
+foo9064: () => {},
+foo9065: () => {},
+foo9066: () => {},
+foo9067: () => {},
+foo9068: () => {},
+foo9069: () => {},
+foo9070: () => {},
+foo9071: () => {},
+foo9072: () => {},
+foo9073: () => {},
+foo9074: () => {},
+foo9075: () => {},
+foo9076: () => {},
+foo9077: () => {},
+foo9078: () => {},
+foo9079: () => {},
+foo9080: () => {},
+foo9081: () => {},
+foo9082: () => {},
+foo9083: () => {},
+foo9084: () => {},
+foo9085: () => {},
+foo9086: () => {},
+foo9087: () => {},
+foo9088: () => {},
+foo9089: () => {},
+foo9090: () => {},
+foo9091: () => {},
+foo9092: () => {},
+foo9093: () => {},
+foo9094: () => {},
+foo9095: () => {},
+foo9096: () => {},
+foo9097: () => {},
+foo9098: () => {},
+foo9099: () => {},
+foo9100: () => {},
+foo9101: () => {},
+foo9102: () => {},
+foo9103: () => {},
+foo9104: () => {},
+foo9105: () => {},
+foo9106: () => {},
+foo9107: () => {},
+foo9108: () => {},
+foo9109: () => {},
+foo9110: () => {},
+foo9111: () => {},
+foo9112: () => {},
+foo9113: () => {},
+foo9114: () => {},
+foo9115: () => {},
+foo9116: () => {},
+foo9117: () => {},
+foo9118: () => {},
+foo9119: () => {},
+foo9120: () => {},
+foo9121: () => {},
+foo9122: () => {},
+foo9123: () => {},
+foo9124: () => {},
+foo9125: () => {},
+foo9126: () => {},
+foo9127: () => {},
+foo9128: () => {},
+foo9129: () => {},
+foo9130: () => {},
+foo9131: () => {},
+foo9132: () => {},
+foo9133: () => {},
+foo9134: () => {},
+foo9135: () => {},
+foo9136: () => {},
+foo9137: () => {},
+foo9138: () => {},
+foo9139: () => {},
+foo9140: () => {},
+foo9141: () => {},
+foo9142: () => {},
+foo9143: () => {},
+foo9144: () => {},
+foo9145: () => {},
+foo9146: () => {},
+foo9147: () => {},
+foo9148: () => {},
+foo9149: () => {},
+foo9150: () => {},
+foo9151: () => {},
+foo9152: () => {},
+foo9153: () => {},
+foo9154: () => {},
+foo9155: () => {},
+foo9156: () => {},
+foo9157: () => {},
+foo9158: () => {},
+foo9159: () => {},
+foo9160: () => {},
+foo9161: () => {},
+foo9162: () => {},
+foo9163: () => {},
+foo9164: () => {},
+foo9165: () => {},
+foo9166: () => {},
+foo9167: () => {},
+foo9168: () => {},
+foo9169: () => {},
+foo9170: () => {},
+foo9171: () => {},
+foo9172: () => {},
+foo9173: () => {},
+foo9174: () => {},
+foo9175: () => {},
+foo9176: () => {},
+foo9177: () => {},
+foo9178: () => {},
+foo9179: () => {},
+foo9180: () => {},
+foo9181: () => {},
+foo9182: () => {},
+foo9183: () => {},
+foo9184: () => {},
+foo9185: () => {},
+foo9186: () => {},
+foo9187: () => {},
+foo9188: () => {},
+foo9189: () => {},
+foo9190: () => {},
+foo9191: () => {},
+foo9192: () => {},
+foo9193: () => {},
+foo9194: () => {},
+foo9195: () => {},
+foo9196: () => {},
+foo9197: () => {},
+foo9198: () => {},
+foo9199: () => {},
+foo9200: () => {},
+foo9201: () => {},
+foo9202: () => {},
+foo9203: () => {},
+foo9204: () => {},
+foo9205: () => {},
+foo9206: () => {},
+foo9207: () => {},
+foo9208: () => {},
+foo9209: () => {},
+foo9210: () => {},
+foo9211: () => {},
+foo9212: () => {},
+foo9213: () => {},
+foo9214: () => {},
+foo9215: () => {},
+foo9216: () => {},
+foo9217: () => {},
+foo9218: () => {},
+foo9219: () => {},
+foo9220: () => {},
+foo9221: () => {},
+foo9222: () => {},
+foo9223: () => {},
+foo9224: () => {},
+foo9225: () => {},
+foo9226: () => {},
+foo9227: () => {},
+foo9228: () => {},
+foo9229: () => {},
+foo9230: () => {},
+foo9231: () => {},
+foo9232: () => {},
+foo9233: () => {},
+foo9234: () => {},
+foo9235: () => {},
+foo9236: () => {},
+foo9237: () => {},
+foo9238: () => {},
+foo9239: () => {},
+foo9240: () => {},
+foo9241: () => {},
+foo9242: () => {},
+foo9243: () => {},
+foo9244: () => {},
+foo9245: () => {},
+foo9246: () => {},
+foo9247: () => {},
+foo9248: () => {},
+foo9249: () => {},
+foo9250: () => {},
+foo9251: () => {},
+foo9252: () => {},
+foo9253: () => {},
+foo9254: () => {},
+foo9255: () => {},
+foo9256: () => {},
+foo9257: () => {},
+foo9258: () => {},
+foo9259: () => {},
+foo9260: () => {},
+foo9261: () => {},
+foo9262: () => {},
+foo9263: () => {},
+foo9264: () => {},
+foo9265: () => {},
+foo9266: () => {},
+foo9267: () => {},
+foo9268: () => {},
+foo9269: () => {},
+foo9270: () => {},
+foo9271: () => {},
+foo9272: () => {},
+foo9273: () => {},
+foo9274: () => {},
+foo9275: () => {},
+foo9276: () => {},
+foo9277: () => {},
+foo9278: () => {},
+foo9279: () => {},
+foo9280: () => {},
+foo9281: () => {},
+foo9282: () => {},
+foo9283: () => {},
+foo9284: () => {},
+foo9285: () => {},
+foo9286: () => {},
+foo9287: () => {},
+foo9288: () => {},
+foo9289: () => {},
+foo9290: () => {},
+foo9291: () => {},
+foo9292: () => {},
+foo9293: () => {},
+foo9294: () => {},
+foo9295: () => {},
+foo9296: () => {},
+foo9297: () => {},
+foo9298: () => {},
+foo9299: () => {},
+foo9300: () => {},
+foo9301: () => {},
+foo9302: () => {},
+foo9303: () => {},
+foo9304: () => {},
+foo9305: () => {},
+foo9306: () => {},
+foo9307: () => {},
+foo9308: () => {},
+foo9309: () => {},
+foo9310: () => {},
+foo9311: () => {},
+foo9312: () => {},
+foo9313: () => {},
+foo9314: () => {},
+foo9315: () => {},
+foo9316: () => {},
+foo9317: () => {},
+foo9318: () => {},
+foo9319: () => {},
+foo9320: () => {},
+foo9321: () => {},
+foo9322: () => {},
+foo9323: () => {},
+foo9324: () => {},
+foo9325: () => {},
+foo9326: () => {},
+foo9327: () => {},
+foo9328: () => {},
+foo9329: () => {},
+foo9330: () => {},
+foo9331: () => {},
+foo9332: () => {},
+foo9333: () => {},
+foo9334: () => {},
+foo9335: () => {},
+foo9336: () => {},
+foo9337: () => {},
+foo9338: () => {},
+foo9339: () => {},
+foo9340: () => {},
+foo9341: () => {},
+foo9342: () => {},
+foo9343: () => {},
+foo9344: () => {},
+foo9345: () => {},
+foo9346: () => {},
+foo9347: () => {},
+foo9348: () => {},
+foo9349: () => {},
+foo9350: () => {},
+foo9351: () => {},
+foo9352: () => {},
+foo9353: () => {},
+foo9354: () => {},
+foo9355: () => {},
+foo9356: () => {},
+foo9357: () => {},
+foo9358: () => {},
+foo9359: () => {},
+foo9360: () => {},
+foo9361: () => {},
+foo9362: () => {},
+foo9363: () => {},
+foo9364: () => {},
+foo9365: () => {},
+foo9366: () => {},
+foo9367: () => {},
+foo9368: () => {},
+foo9369: () => {},
+foo9370: () => {},
+foo9371: () => {},
+foo9372: () => {},
+foo9373: () => {},
+foo9374: () => {},
+foo9375: () => {},
+foo9376: () => {},
+foo9377: () => {},
+foo9378: () => {},
+foo9379: () => {},
+foo9380: () => {},
+foo9381: () => {},
+foo9382: () => {},
+foo9383: () => {},
+foo9384: () => {},
+foo9385: () => {},
+foo9386: () => {},
+foo9387: () => {},
+foo9388: () => {},
+foo9389: () => {},
+foo9390: () => {},
+foo9391: () => {},
+foo9392: () => {},
+foo9393: () => {},
+foo9394: () => {},
+foo9395: () => {},
+foo9396: () => {},
+foo9397: () => {},
+foo9398: () => {},
+foo9399: () => {},
+foo9400: () => {},
+foo9401: () => {},
+foo9402: () => {},
+foo9403: () => {},
+foo9404: () => {},
+foo9405: () => {},
+foo9406: () => {},
+foo9407: () => {},
+foo9408: () => {},
+foo9409: () => {},
+foo9410: () => {},
+foo9411: () => {},
+foo9412: () => {},
+foo9413: () => {},
+foo9414: () => {},
+foo9415: () => {},
+foo9416: () => {},
+foo9417: () => {},
+foo9418: () => {},
+foo9419: () => {},
+foo9420: () => {},
+foo9421: () => {},
+foo9422: () => {},
+foo9423: () => {},
+foo9424: () => {},
+foo9425: () => {},
+foo9426: () => {},
+foo9427: () => {},
+foo9428: () => {},
+foo9429: () => {},
+foo9430: () => {},
+foo9431: () => {},
+foo9432: () => {},
+foo9433: () => {},
+foo9434: () => {},
+foo9435: () => {},
+foo9436: () => {},
+foo9437: () => {},
+foo9438: () => {},
+foo9439: () => {},
+foo9440: () => {},
+foo9441: () => {},
+foo9442: () => {},
+foo9443: () => {},
+foo9444: () => {},
+foo9445: () => {},
+foo9446: () => {},
+foo9447: () => {},
+foo9448: () => {},
+foo9449: () => {},
+foo9450: () => {},
+foo9451: () => {},
+foo9452: () => {},
+foo9453: () => {},
+foo9454: () => {},
+foo9455: () => {},
+foo9456: () => {},
+foo9457: () => {},
+foo9458: () => {},
+foo9459: () => {},
+foo9460: () => {},
+foo9461: () => {},
+foo9462: () => {},
+foo9463: () => {},
+foo9464: () => {},
+foo9465: () => {},
+foo9466: () => {},
+foo9467: () => {},
+foo9468: () => {},
+foo9469: () => {},
+foo9470: () => {},
+foo9471: () => {},
+foo9472: () => {},
+foo9473: () => {},
+foo9474: () => {},
+foo9475: () => {},
+foo9476: () => {},
+foo9477: () => {},
+foo9478: () => {},
+foo9479: () => {},
+foo9480: () => {},
+foo9481: () => {},
+foo9482: () => {},
+foo9483: () => {},
+foo9484: () => {},
+foo9485: () => {},
+foo9486: () => {},
+foo9487: () => {},
+foo9488: () => {},
+foo9489: () => {},
+foo9490: () => {},
+foo9491: () => {},
+foo9492: () => {},
+foo9493: () => {},
+foo9494: () => {},
+foo9495: () => {},
+foo9496: () => {},
+foo9497: () => {},
+foo9498: () => {},
+foo9499: () => {},
+foo9500: () => {},
+foo9501: () => {},
+foo9502: () => {},
+foo9503: () => {},
+foo9504: () => {},
+foo9505: () => {},
+foo9506: () => {},
+foo9507: () => {},
+foo9508: () => {},
+foo9509: () => {},
+foo9510: () => {},
+foo9511: () => {},
+foo9512: () => {},
+foo9513: () => {},
+foo9514: () => {},
+foo9515: () => {},
+foo9516: () => {},
+foo9517: () => {},
+foo9518: () => {},
+foo9519: () => {},
+foo9520: () => {},
+foo9521: () => {},
+foo9522: () => {},
+foo9523: () => {},
+foo9524: () => {},
+foo9525: () => {},
+foo9526: () => {},
+foo9527: () => {},
+foo9528: () => {},
+foo9529: () => {},
+foo9530: () => {},
+foo9531: () => {},
+foo9532: () => {},
+foo9533: () => {},
+foo9534: () => {},
+foo9535: () => {},
+foo9536: () => {},
+foo9537: () => {},
+foo9538: () => {},
+foo9539: () => {},
+foo9540: () => {},
+foo9541: () => {},
+foo9542: () => {},
+foo9543: () => {},
+foo9544: () => {},
+foo9545: () => {},
+foo9546: () => {},
+foo9547: () => {},
+foo9548: () => {},
+foo9549: () => {},
+foo9550: () => {},
+foo9551: () => {},
+foo9552: () => {},
+foo9553: () => {},
+foo9554: () => {},
+foo9555: () => {},
+foo9556: () => {},
+foo9557: () => {},
+foo9558: () => {},
+foo9559: () => {},
+foo9560: () => {},
+foo9561: () => {},
+foo9562: () => {},
+foo9563: () => {},
+foo9564: () => {},
+foo9565: () => {},
+foo9566: () => {},
+foo9567: () => {},
+foo9568: () => {},
+foo9569: () => {},
+foo9570: () => {},
+foo9571: () => {},
+foo9572: () => {},
+foo9573: () => {},
+foo9574: () => {},
+foo9575: () => {},
+foo9576: () => {},
+foo9577: () => {},
+foo9578: () => {},
+foo9579: () => {},
+foo9580: () => {},
+foo9581: () => {},
+foo9582: () => {},
+foo9583: () => {},
+foo9584: () => {},
+foo9585: () => {},
+foo9586: () => {},
+foo9587: () => {},
+foo9588: () => {},
+foo9589: () => {},
+foo9590: () => {},
+foo9591: () => {},
+foo9592: () => {},
+foo9593: () => {},
+foo9594: () => {},
+foo9595: () => {},
+foo9596: () => {},
+foo9597: () => {},
+foo9598: () => {},
+foo9599: () => {},
+foo9600: () => {},
+foo9601: () => {},
+foo9602: () => {},
+foo9603: () => {},
+foo9604: () => {},
+foo9605: () => {},
+foo9606: () => {},
+foo9607: () => {},
+foo9608: () => {},
+foo9609: () => {},
+foo9610: () => {},
+foo9611: () => {},
+foo9612: () => {},
+foo9613: () => {},
+foo9614: () => {},
+foo9615: () => {},
+foo9616: () => {},
+foo9617: () => {},
+foo9618: () => {},
+foo9619: () => {},
+foo9620: () => {},
+foo9621: () => {},
+foo9622: () => {},
+foo9623: () => {},
+foo9624: () => {},
+foo9625: () => {},
+foo9626: () => {},
+foo9627: () => {},
+foo9628: () => {},
+foo9629: () => {},
+foo9630: () => {},
+foo9631: () => {},
+foo9632: () => {},
+foo9633: () => {},
+foo9634: () => {},
+foo9635: () => {},
+foo9636: () => {},
+foo9637: () => {},
+foo9638: () => {},
+foo9639: () => {},
+foo9640: () => {},
+foo9641: () => {},
+foo9642: () => {},
+foo9643: () => {},
+foo9644: () => {},
+foo9645: () => {},
+foo9646: () => {},
+foo9647: () => {},
+foo9648: () => {},
+foo9649: () => {},
+foo9650: () => {},
+foo9651: () => {},
+foo9652: () => {},
+foo9653: () => {},
+foo9654: () => {},
+foo9655: () => {},
+foo9656: () => {},
+foo9657: () => {},
+foo9658: () => {},
+foo9659: () => {},
+foo9660: () => {},
+foo9661: () => {},
+foo9662: () => {},
+foo9663: () => {},
+foo9664: () => {},
+foo9665: () => {},
+foo9666: () => {},
+foo9667: () => {},
+foo9668: () => {},
+foo9669: () => {},
+foo9670: () => {},
+foo9671: () => {},
+foo9672: () => {},
+foo9673: () => {},
+foo9674: () => {},
+foo9675: () => {},
+foo9676: () => {},
+foo9677: () => {},
+foo9678: () => {},
+foo9679: () => {},
+foo9680: () => {},
+foo9681: () => {},
+foo9682: () => {},
+foo9683: () => {},
+foo9684: () => {},
+foo9685: () => {},
+foo9686: () => {},
+foo9687: () => {},
+foo9688: () => {},
+foo9689: () => {},
+foo9690: () => {},
+foo9691: () => {},
+foo9692: () => {},
+foo9693: () => {},
+foo9694: () => {},
+foo9695: () => {},
+foo9696: () => {},
+foo9697: () => {},
+foo9698: () => {},
+foo9699: () => {},
+foo9700: () => {},
+foo9701: () => {},
+foo9702: () => {},
+foo9703: () => {},
+foo9704: () => {},
+foo9705: () => {},
+foo9706: () => {},
+foo9707: () => {},
+foo9708: () => {},
+foo9709: () => {},
+foo9710: () => {},
+foo9711: () => {},
+foo9712: () => {},
+foo9713: () => {},
+foo9714: () => {},
+foo9715: () => {},
+foo9716: () => {},
+foo9717: () => {},
+foo9718: () => {},
+foo9719: () => {},
+foo9720: () => {},
+foo9721: () => {},
+foo9722: () => {},
+foo9723: () => {},
+foo9724: () => {},
+foo9725: () => {},
+foo9726: () => {},
+foo9727: () => {},
+foo9728: () => {},
+foo9729: () => {},
+foo9730: () => {},
+foo9731: () => {},
+foo9732: () => {},
+foo9733: () => {},
+foo9734: () => {},
+foo9735: () => {},
+foo9736: () => {},
+foo9737: () => {},
+foo9738: () => {},
+foo9739: () => {},
+foo9740: () => {},
+foo9741: () => {},
+foo9742: () => {},
+foo9743: () => {},
+foo9744: () => {},
+foo9745: () => {},
+foo9746: () => {},
+foo9747: () => {},
+foo9748: () => {},
+foo9749: () => {},
+foo9750: () => {},
+foo9751: () => {},
+foo9752: () => {},
+foo9753: () => {},
+foo9754: () => {},
+foo9755: () => {},
+foo9756: () => {},
+foo9757: () => {},
+foo9758: () => {},
+foo9759: () => {},
+foo9760: () => {},
+foo9761: () => {},
+foo9762: () => {},
+foo9763: () => {},
+foo9764: () => {},
+foo9765: () => {},
+foo9766: () => {},
+foo9767: () => {},
+foo9768: () => {},
+foo9769: () => {},
+foo9770: () => {},
+foo9771: () => {},
+foo9772: () => {},
+foo9773: () => {},
+foo9774: () => {},
+foo9775: () => {},
+foo9776: () => {},
+foo9777: () => {},
+foo9778: () => {},
+foo9779: () => {},
+foo9780: () => {},
+foo9781: () => {},
+foo9782: () => {},
+foo9783: () => {},
+foo9784: () => {},
+foo9785: () => {},
+foo9786: () => {},
+foo9787: () => {},
+foo9788: () => {},
+foo9789: () => {},
+foo9790: () => {},
+foo9791: () => {},
+foo9792: () => {},
+foo9793: () => {},
+foo9794: () => {},
+foo9795: () => {},
+foo9796: () => {},
+foo9797: () => {},
+foo9798: () => {},
+foo9799: () => {},
+foo9800: () => {},
+foo9801: () => {},
+foo9802: () => {},
+foo9803: () => {},
+foo9804: () => {},
+foo9805: () => {},
+foo9806: () => {},
+foo9807: () => {},
+foo9808: () => {},
+foo9809: () => {},
+foo9810: () => {},
+foo9811: () => {},
+foo9812: () => {},
+foo9813: () => {},
+foo9814: () => {},
+foo9815: () => {},
+foo9816: () => {},
+foo9817: () => {},
+foo9818: () => {},
+foo9819: () => {},
+foo9820: () => {},
+foo9821: () => {},
+foo9822: () => {},
+foo9823: () => {},
+foo9824: () => {},
+foo9825: () => {},
+foo9826: () => {},
+foo9827: () => {},
+foo9828: () => {},
+foo9829: () => {},
+foo9830: () => {},
+foo9831: () => {},
+foo9832: () => {},
+foo9833: () => {},
+foo9834: () => {},
+foo9835: () => {},
+foo9836: () => {},
+foo9837: () => {},
+foo9838: () => {},
+foo9839: () => {},
+foo9840: () => {},
+foo9841: () => {},
+foo9842: () => {},
+foo9843: () => {},
+foo9844: () => {},
+foo9845: () => {},
+foo9846: () => {},
+foo9847: () => {},
+foo9848: () => {},
+foo9849: () => {},
+foo9850: () => {},
+foo9851: () => {},
+foo9852: () => {},
+foo9853: () => {},
+foo9854: () => {},
+foo9855: () => {},
+foo9856: () => {},
+foo9857: () => {},
+foo9858: () => {},
+foo9859: () => {},
+foo9860: () => {},
+foo9861: () => {},
+foo9862: () => {},
+foo9863: () => {},
+foo9864: () => {},
+foo9865: () => {},
+foo9866: () => {},
+foo9867: () => {},
+foo9868: () => {},
+foo9869: () => {},
+foo9870: () => {},
+foo9871: () => {},
+foo9872: () => {},
+foo9873: () => {},
+foo9874: () => {},
+foo9875: () => {},
+foo9876: () => {},
+foo9877: () => {},
+foo9878: () => {},
+foo9879: () => {},
+foo9880: () => {},
+foo9881: () => {},
+foo9882: () => {},
+foo9883: () => {},
+foo9884: () => {},
+foo9885: () => {},
+foo9886: () => {},
+foo9887: () => {},
+foo9888: () => {},
+foo9889: () => {},
+foo9890: () => {},
+foo9891: () => {},
+foo9892: () => {},
+foo9893: () => {},
+foo9894: () => {},
+foo9895: () => {},
+foo9896: () => {},
+foo9897: () => {},
+foo9898: () => {},
+foo9899: () => {},
+foo9900: () => {},
+foo9901: () => {},
+foo9902: () => {},
+foo9903: () => {},
+foo9904: () => {},
+foo9905: () => {},
+foo9906: () => {},
+foo9907: () => {},
+foo9908: () => {},
+foo9909: () => {},
+foo9910: () => {},
+foo9911: () => {},
+foo9912: () => {},
+foo9913: () => {},
+foo9914: () => {},
+foo9915: () => {},
+foo9916: () => {},
+foo9917: () => {},
+foo9918: () => {},
+foo9919: () => {},
+foo9920: () => {},
+foo9921: () => {},
+foo9922: () => {},
+foo9923: () => {},
+foo9924: () => {},
+foo9925: () => {},
+foo9926: () => {},
+foo9927: () => {},
+foo9928: () => {},
+foo9929: () => {},
+foo9930: () => {},
+foo9931: () => {},
+foo9932: () => {},
+foo9933: () => {},
+foo9934: () => {},
+foo9935: () => {},
+foo9936: () => {},
+foo9937: () => {},
+foo9938: () => {},
+foo9939: () => {},
+foo9940: () => {},
+foo9941: () => {},
+foo9942: () => {},
+foo9943: () => {},
+foo9944: () => {},
+foo9945: () => {},
+foo9946: () => {},
+foo9947: () => {},
+foo9948: () => {},
+foo9949: () => {},
+foo9950: () => {},
+foo9951: () => {},
+foo9952: () => {},
+foo9953: () => {},
+foo9954: () => {},
+foo9955: () => {},
+foo9956: () => {},
+foo9957: () => {},
+foo9958: () => {},
+foo9959: () => {},
+foo9960: () => {},
+foo9961: () => {},
+foo9962: () => {},
+foo9963: () => {},
+foo9964: () => {},
+foo9965: () => {},
+foo9966: () => {},
+foo9967: () => {},
+foo9968: () => {},
+foo9969: () => {},
+foo9970: () => {},
+foo9971: () => {},
+foo9972: () => {},
+foo9973: () => {},
+foo9974: () => {},
+foo9975: () => {},
+foo9976: () => {},
+foo9977: () => {},
+foo9978: () => {},
+foo9979: () => {},
+foo9980: () => {},
+foo9981: () => {},
+foo9982: () => {},
+foo9983: () => {},
+foo9984: () => {},
+foo9985: () => {},
+foo9986: () => {},
+foo9987: () => {},
+foo9988: () => {},
+foo9989: () => {},
+foo9990: () => {},
+foo9991: () => {},
+foo9992: () => {},
+foo9993: () => {},
+foo9994: () => {},
+foo9995: () => {},
+foo9996: () => {},
+foo9997: () => {},
+foo9998: () => {},
+foo9999: () => {},
+foo10000: () => {},
+}
diff --git a/src/v8/test/mjsunit/regress/regress-459955.js b/src/v8/test/mjsunit/regress/regress-459955.js
new file mode 100644
index 0000000..24eff6d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-459955.js
@@ -0,0 +1,10 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function f(x) {
+ var v;
+ if (x) v = 0;
+ return v <= 1;
+}
+assertFalse(f(false));
diff --git a/src/v8/test/mjsunit/regress/regress-460917.js b/src/v8/test/mjsunit/regress/regress-460917.js
new file mode 100644
index 0000000..ed64c9c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-460917.js
@@ -0,0 +1,35 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function boom(a1, a2) {
+ // Do something with a2 that needs a map check (for DOUBLE_ELEMENTS).
+ var s = a2[0];
+ // Emit a load that transitions a1 to PACKED_ELEMENTS.
+ var t = a1[0];
+ // Emit a store to a2 that assumes DOUBLE_ELEMENTS.
+ // The map check is considered redundant and will be eliminated.
+ a2[0] = 0.3;
+}
+
+// Prepare type feedback for the "t = a1[0]" load: fast elements.
+var fast_elem = new Array(1);
+fast_elem[0] = "tagged";
+boom(fast_elem, [1]);
+
+// Prepare type feedback for the "a2[0] = 0.3" store: double elements.
+var double_elem = new Array(1);
+double_elem[0] = 0.1;
+boom(double_elem, double_elem);
+
+// Reset |double_elem| and go have a party.
+double_elem = new Array(10);
+double_elem[0] = 0.1;
+
+%OptimizeFunctionOnNextCall(boom);
+boom(double_elem, double_elem);
+
+assertEquals(0.3, double_elem[0]);
+assertEquals(undefined, double_elem[1]);
diff --git a/src/v8/test/mjsunit/regress/regress-463028.js b/src/v8/test/mjsunit/regress/regress-463028.js
new file mode 100644
index 0000000..1454ef1
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-463028.js
@@ -0,0 +1,18 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var o = {}
+Object.defineProperty(o, "z", {
+ set: function() {
+ %DeoptimizeFunction(f);
+ },
+});
+
+function f(o) {
+ return 19 + (void(o.z = 12));
+}
+
+f(o);
diff --git a/src/v8/test/mjsunit/regress/regress-4640.js b/src/v8/test/mjsunit/regress/regress-4640.js
new file mode 100644
index 0000000..ed609bb
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-4640.js
@@ -0,0 +1,19 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Some surrounding cases which already worked, for good measure
+assertTrue(new Date('275760-10-14') == 'Invalid Date');
+assertTrue(new Date('275760-09-23') == 'Invalid Date');
+assertTrue(new Date('+275760-09-24') == 'Invalid Date');
+assertTrue(new Date('+275760-10-13') == 'Invalid Date');
+
+// The following cases used to throw "illegal access"
+assertTrue(new Date('275760-09-24') == 'Invalid Date');
+assertTrue(new Date('275760-10-13') == 'Invalid Date');
+assertTrue(new Date('+275760-10-13 ') == 'Invalid Date');
+
+// However, dates within the range or valid
+assertTrue(new Date('100000-10-13') != 'Invalid Date');
+assertTrue(new Date('+100000-10-13') != 'Invalid Date');
+assertTrue(new Date('+100000-10-13 ') != 'Invalid Date');
diff --git a/src/v8/test/mjsunit/regress/regress-4654.js b/src/v8/test/mjsunit/regress/regress-4654.js
new file mode 100644
index 0000000..eb08b11
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-4654.js
@@ -0,0 +1,5 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertEquals('hello\u0000foobar', 'hello\u0000foobar'.normalize('NFC'));
diff --git a/src/v8/test/mjsunit/regress/regress-4659.js b/src/v8/test/mjsunit/regress/regress-4659.js
new file mode 100644
index 0000000..8992bb8
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-4659.js
@@ -0,0 +1,10 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var obj = {
+ get longerName(){
+ return 42;
+ }
+};
+assertEquals(42, obj.longerName);
diff --git a/src/v8/test/mjsunit/regress/regress-4665.js b/src/v8/test/mjsunit/regress/regress-4665.js
new file mode 100644
index 0000000..9aed4ed
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-4665.js
@@ -0,0 +1,35 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// First test case
+
+function FirstBuffer () {}
+FirstBuffer.prototype.__proto__ = Uint8Array.prototype
+FirstBuffer.__proto__ = Uint8Array
+
+var buf = new Uint8Array(10)
+buf.__proto__ = FirstBuffer.prototype
+
+assertThrows(() => buf.subarray(2), TypeError);
+
+// Second test case
+
+let seen_args = [];
+
+function SecondBuffer (arg) {
+ seen_args.push(arg);
+ var arr = new Uint8Array(arg)
+ arr.__proto__ = SecondBuffer.prototype
+ return arr
+}
+SecondBuffer.prototype.__proto__ = Uint8Array.prototype
+SecondBuffer.__proto__ = Uint8Array
+
+var buf3 = new SecondBuffer(10)
+assertEquals([10], seen_args);
+
+var buf4 = buf3.subarray(2)
+
+assertEquals(10, buf4.length);
+assertEquals([10, buf3.buffer], seen_args);
diff --git a/src/v8/test/mjsunit/regress/regress-466993.js b/src/v8/test/mjsunit/regress/regress-466993.js
new file mode 100644
index 0000000..6bf02bb
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-466993.js
@@ -0,0 +1,18 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var test = function() {
+ var a = {"1": false, "2": false, "3": false, "4": false};
+ assertEquals(false, a[1]);
+ a[1] = true;
+};
+test();
+test();
+test();
+%OptimizeFunctionOnNextCall(test);
+test();
+test();
+test();
diff --git a/src/v8/test/mjsunit/regress/regress-467481.js b/src/v8/test/mjsunit/regress/regress-467481.js
new file mode 100644
index 0000000..dcb12d8
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-467481.js
@@ -0,0 +1,22 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f(a1, a2) {
+ var v7 = a2[0];
+ var v8 = a1[0];
+ a2[0] = 0.3;
+}
+v6 = new Array(1);
+v6[0] = "tagged";
+f(v6, [1]);
+v5 = new Array(1);
+v5[0] = 0.1;
+f(v5, v5);
+v5 = new Array(10);
+f(v5, v5);
+%OptimizeFunctionOnNextCall(f);
+f(v5, v5);
+v5[0];
diff --git a/src/v8/test/mjsunit/regress/regress-4693.js b/src/v8/test/mjsunit/regress/regress-4693.js
new file mode 100644
index 0000000..2c31cd9
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-4693.js
@@ -0,0 +1,79 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+
+// In sloppy mode we allow function redeclarations within blocks for webcompat.
+(function() {
+ assertEquals(undefined, f); // Annex B
+ if (true) {
+ assertEquals(2, f());
+ function f() { return 1 }
+ assertEquals(2, f());
+ function f() { return 2 }
+ assertEquals(2, f());
+ }
+ assertEquals(2, f()); // Annex B
+})();
+
+// Should still fail in strict mode
+assertThrows(`
+ (function() {
+ "use strict";
+ if (true) {
+ function f() { return 1 }
+ function f() { return 2 }
+ }
+ })();
+`, SyntaxError);
+
+// Conflicts between let and function still throw
+assertThrows(`
+ (function() {
+ if (true) {
+ let f;
+ function f() { return 2 }
+ }
+ })();
+`, SyntaxError);
+
+assertThrows(`
+ (function() {
+ if (true) {
+ function f() { return 2 }
+ let f;
+ }
+ })();
+`, SyntaxError);
+
+// Conflicts between const and function still throw
+assertThrows(`
+ (function() {
+ if (true) {
+ const f;
+ function f() { return 2 }
+ }
+ })();
+`, SyntaxError);
+
+assertThrows(`
+ (function() {
+ if (true) {
+ function f() { return 2 }
+ const f;
+ }
+ })();
+`, SyntaxError);
+
+// Annex B redefinition semantics still apply with more blocks
+(function() {
+ assertEquals(undefined, f); // Annex B
+ if (true) {
+ assertEquals(undefined, f);
+ { function f() { return 1 } }
+ assertEquals(1, f());
+ { function f() { return 2 } }
+ assertEquals(2, f());
+ }
+ assertEquals(2, f()); // Annex B
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-469605.js b/src/v8/test/mjsunit/regress/regress-469605.js
new file mode 100644
index 0000000..6572511
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-469605.js
@@ -0,0 +1,43 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function counter() {
+ var i = 100;
+ return function() {
+ if (i-- > 0) return i;
+ throw "done";
+ }
+}
+
+var c1 = counter();
+var c2 = counter();
+
+var f = (function() {
+ "use asm";
+ return function f(i) {
+ i = i|0;
+ do {
+ if (i > 0) c1();
+ else c2();
+ } while (true);
+ }
+})();
+
+assertThrows(function() { f(0); });
+assertThrows(function() { f(1); });
+
+var c3 = counter();
+
+var g = (function() {
+ "use asm";
+ return function g(i) {
+ i = i + 1;
+ do {
+ i = c3(i);
+ } while (true);
+ }
+})();
+
+assertThrows(function() { g(0); });
+assertThrows(function() { g(1); });
diff --git a/src/v8/test/mjsunit/regress/regress-469605b.js b/src/v8/test/mjsunit/regress/regress-469605b.js
new file mode 100644
index 0000000..de17676
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-469605b.js
@@ -0,0 +1,26 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function counter() {
+ var i = 10000;
+ return function() {
+ if (i-- > 0) return i;
+ throw "done";
+ }
+}
+
+
+var f = (function() {
+ "use asm";
+ return function f(i, c1, c2) {
+ i = i|0;
+ do {
+ if (i > 0) { while (0 ? this : this) { c1(); } }
+ else c2();
+ } while (true);
+ }
+})();
+
+assertThrows(function() { f(0, counter(), counter()); });
+assertThrows(function() { f(1, counter(), counter()); });
diff --git a/src/v8/test/mjsunit/regress/regress-470804.js b/src/v8/test/mjsunit/regress/regress-470804.js
new file mode 100644
index 0000000..cebb91f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-470804.js
@@ -0,0 +1,53 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --expose-gc
+
+function f() {
+ this.foo00 = 0;
+ this.foo01 = 0;
+ this.foo02 = 0;
+ this.foo03 = 0;
+ this.foo04 = 0;
+ this.foo05 = 0;
+ this.foo06 = 0;
+ this.foo07 = 0;
+ this.foo08 = 0;
+ this.foo09 = 0;
+ this.foo0a = 0;
+ this.foo0b = 0;
+ this.foo0c = 0;
+ this.foo0d = 0;
+ this.foo0e = 0;
+ this.foo0f = 0;
+ this.foo10 = 0;
+ this.foo11 = 0;
+ this.foo12 = 0;
+ this.foo13 = 0;
+ this.foo14 = 0;
+ this.foo15 = 0;
+ this.foo16 = 0;
+ this.foo17 = 0;
+ this.foo18 = 0;
+ this.foo19 = 0;
+ this.foo1a = 0;
+ this.foo1b = 0;
+ this.foo1c = 0;
+ this.foo1d = 0;
+ this.foo1e = 0;
+ this.foo1f = 0;
+ this.d = 1.3;
+ gc();
+ this.boom = 230;
+ this.boom = 1.4;
+}
+
+function g() {
+ return new f();
+}
+g();
+g();
+var o = g();
+assertEquals(0, o.foo00);
+assertEquals(1.4, o.boom);
diff --git a/src/v8/test/mjsunit/regress/regress-4715.js b/src/v8/test/mjsunit/regress/regress-4715.js
new file mode 100644
index 0000000..3304120
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-4715.js
@@ -0,0 +1,48 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --expose-gc
+
+var training = {};
+training.a = "nop";
+training.slow = "nop";
+delete training.slow; // Dictionary-mode properties => slow-mode for-in.
+
+var keepalive = {};
+keepalive.a = "nop"; // Keep a map early in the transition chain alive.
+
+function GetReal() {
+ var r = {};
+ r.a = "nop";
+ r.b = "nop";
+ r.c = "dictionarize",
+ r.d = "gc";
+ r.e = "result";
+ return r;
+};
+
+function SideEffect(object, action) {
+ if (action === "dictionarize") {
+ delete object.a;
+ } else if (action === "gc") {
+ gc();
+ }
+}
+
+function foo(object) {
+ for (var key in object) {
+ SideEffect(object, object[key]);
+ }
+ return key;
+}
+
+// Collect type feedback for slow-mode for-in.
+foo(training);
+SideEffect({a: 0}, "dictionarize");
+SideEffect({}, "gc");
+
+// Compile for slow-mode objects...
+%OptimizeFunctionOnNextCall(foo);
+// ...and pass in a fast-mode object.
+assertEquals("e", foo(GetReal()));
diff --git a/src/v8/test/mjsunit/regress/regress-472504.js b/src/v8/test/mjsunit/regress/regress-472504.js
new file mode 100644
index 0000000..0e956f6
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-472504.js
@@ -0,0 +1,9 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Should not crash in ASAN.
+function shouldThrow() {
+ shouldThrow(JSON.parse('{"0":1}'));
+}
+assertThrows("shouldThrow()", RangeError);
diff --git a/src/v8/test/mjsunit/regress/regress-475.js b/src/v8/test/mjsunit/regress/regress-475.js
new file mode 100644
index 0000000..4b7dbbd
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-475.js
@@ -0,0 +1,28 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+assertEquals(1, (function (){return 1|-1%1})());
diff --git a/src/v8/test/mjsunit/regress/regress-475705.js b/src/v8/test/mjsunit/regress/regress-475705.js
new file mode 100644
index 0000000..ec8416a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-475705.js
@@ -0,0 +1,63 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Crankshaft changes the stack usage and messes up the binary search for the
+// stack depth that causes a stack overflow. The issue only arises without
+// regexp optimization, which can happen on pages that create a lot of regexps.
+// Flags: --noopt --noregexp-optimization
+
+// Should not crash with a stack overflow in the regexp compiler, even when the
+// JS has used most of the stack.
+function use_space_then_do_test(depth) {
+ try {
+ // The "+ depth" is to avoid the regexp compilation cache.
+ var regexp_src = repeat(".(.)", 12) + depth;
+ use_space(depth, regexp_src);
+ return true;
+ } catch (e) {
+ assertFalse(("" + e).indexOf("tack") == -1); // Check for [Ss]tack.
+ return false;
+ }
+}
+
+function use_space(n, regexp_src) {
+ if (--n == 0) {
+ do_test(regexp_src);
+ return;
+ }
+ use_space(n, regexp_src);
+}
+
+function repeat(str, n) {
+ var answer = "";
+ while (n-- != 0) {
+ answer += str;
+ }
+ return answer;
+}
+
+var subject = repeat("y", 200);
+
+function do_test(regexp_src) {
+ var re = new RegExp(regexp_src);
+ re.test(subject);
+}
+
+function try_different_stack_limits() {
+ var lower = 100;
+ var higher = 100000;
+ while (lower < higher - 1) {
+ var average = Math.floor((lower + higher) / 2);
+ if (use_space_then_do_test(average)) {
+ lower = average;
+ } else {
+ higher = average;
+ }
+ }
+ for (var i = lower - 5; i < higher + 5; i++) {
+ use_space_then_do_test(i);
+ }
+}
+
+try_different_stack_limits();
diff --git a/src/v8/test/mjsunit/regress/regress-476488.js b/src/v8/test/mjsunit/regress/regress-476488.js
new file mode 100644
index 0000000..2db6819
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-476488.js
@@ -0,0 +1,15 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --always-opt --expose-gc
+
+function __f_0(message, a) {
+ eval(), message;
+ (function blue() {
+ 'use strict';
+ eval(), eval(), message;
+ gc();
+ })();
+}
+__f_0();
diff --git a/src/v8/test/mjsunit/regress/regress-4769.js b/src/v8/test/mjsunit/regress/regress-4769.js
new file mode 100644
index 0000000..6fbd01f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-4769.js
@@ -0,0 +1,12 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// https://bugs.chromium.org/p/v8/issues/detail?id=4769
+
+Object.getPrototypeOf([])[Symbol.iterator] = () => assertUnreachable();
+
+JSON.stringify({foo: [42]});
+JSON.stringify({foo: [42]}, []);
+JSON.stringify({foo: [42]}, undefined, ' ');
+JSON.stringify({foo: [42]}, [], ' ');
diff --git a/src/v8/test/mjsunit/regress/regress-4788-1.js b/src/v8/test/mjsunit/regress/regress-4788-1.js
new file mode 100644
index 0000000..347ab5e
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-4788-1.js
@@ -0,0 +1,25 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var f = (function() {
+ "use asm";
+ function foo(x) {
+ return x == 0;
+ }
+ return foo;
+})();
+
+function deopt(f) {
+ return {
+ toString : function() {
+ %DeoptimizeFunction(f);
+ return "2";
+ }
+ };
+}
+
+%OptimizeFunctionOnNextCall(f);
+assertFalse(f(deopt(f)));
diff --git a/src/v8/test/mjsunit/regress/regress-4788-2.js b/src/v8/test/mjsunit/regress/regress-4788-2.js
new file mode 100644
index 0000000..5441705
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-4788-2.js
@@ -0,0 +1,25 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var f = (function() {
+ "use asm";
+ function foo(x) {
+ return x < x;
+ }
+ return foo;
+})();
+
+function deopt(f) {
+ return {
+ toString : function() {
+ %DeoptimizeFunction(f);
+ return "2";
+ }
+ };
+}
+
+%OptimizeFunctionOnNextCall(f);
+assertFalse(f(deopt(f)));
diff --git a/src/v8/test/mjsunit/regress/regress-479528.js b/src/v8/test/mjsunit/regress/regress-479528.js
new file mode 100644
index 0000000..be0dfaf
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-479528.js
@@ -0,0 +1,13 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var __v_7 = {"__proto__": this};
+__v_9 = %CreatePrivateSymbol("__v_9");
+this[__v_9] = "moo";
+function __f_5() {
+ __v_7[__v_9] = "bow-wow";
+}
+__f_5();
diff --git a/src/v8/test/mjsunit/regress/regress-4800.js b/src/v8/test/mjsunit/regress/regress-4800.js
new file mode 100644
index 0000000..af7cbc0
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-4800.js
@@ -0,0 +1,76 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f(x, len) {
+ var distraction = [];
+ var result = new Array(25);
+
+ // Create a bunch of double values with long live ranges.
+ var d0 = x + 0.5;
+ var d1 = x + 1.5;
+ var d2 = x + 2.5;
+ var d3 = x + 3.5;
+ var d4 = x + 4.5;
+ var d5 = x + 5.5;
+ var d6 = x + 6.5;
+ var d7 = x + 7.5;
+ var d8 = x + 8.5;
+ var d9 = x + 9.5;
+ var d10 = x + 10.5;
+ var d11 = x + 11.5;
+ var d12 = x + 12.5;
+ var d13 = x + 13.5;
+ var d14 = x + 14.5;
+ var d15 = x + 15.5;
+ var d16 = x + 16.5;
+ var d17 = x + 17.5;
+ var d18 = x + 18.5;
+ var d19 = x + 19.5;
+ var d20 = x + 20.5;
+ var d21 = x + 21.5;
+ var d22 = x + 22.5;
+ var d23 = x + 23.5;
+ var d24 = x + 24.5;
+
+ // Trigger a stub failure when the array grows too big.
+ distraction[len] = 0;
+
+ // Write the long-lived doubles to memory and verify them.
+ result[0] = d0;
+ result[1] = d1;
+ result[2] = d2;
+ result[3] = d3;
+ result[4] = d4;
+ result[5] = d5;
+ result[6] = d6;
+ result[7] = d7;
+ result[8] = d8;
+ result[9] = d9;
+ result[10] = d10;
+ result[11] = d11;
+ result[12] = d12;
+ result[13] = d13;
+ result[14] = d14;
+ result[15] = d15;
+ result[16] = d16;
+ result[17] = d17;
+ result[18] = d18;
+ result[19] = d19;
+ result[20] = d20;
+ result[21] = d21;
+ result[22] = d22;
+ result[23] = d23;
+ result[24] = d24;
+
+ for (var i = 0; i < result.length; i++) {
+ assertEquals(x + i + 0.5, result[i]);
+ }
+}
+
+f(0, 10);
+f(0, 10);
+%OptimizeFunctionOnNextCall(f);
+f(0, 80000);
diff --git a/src/v8/test/mjsunit/regress/regress-4815.js b/src/v8/test/mjsunit/regress/regress-4815.js
new file mode 100644
index 0000000..6876486
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-4815.js
@@ -0,0 +1,52 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var thrower = { [Symbol.toPrimitive]: () => FAIL };
+
+// Tests that a native conversion function is included in the
+// stack trace.
+function testTraceNativeConversion(nativeFunc) {
+ var nativeFuncName = nativeFunc.name;
+ try {
+ nativeFunc(thrower);
+ assertUnreachable(nativeFuncName);
+ } catch (e) {
+ assertTrue(e.stack.indexOf(nativeFuncName) >= 0, nativeFuncName);
+ }
+}
+
+// C++ builtins.
+testTraceNativeConversion(Math.acos);
+testTraceNativeConversion(Math.asin);
+testTraceNativeConversion(Math.fround);
+testTraceNativeConversion(Math.imul);
+
+
+function testBuiltinInStackTrace(script, expectedString) {
+ try {
+ eval(script);
+ assertUnreachable(expectedString);
+ } catch (e) {
+ assertTrue(e.stack.indexOf(expectedString) >= 0, expectedString);
+ }
+}
+
+// C++ builtins.
+testBuiltinInStackTrace("Boolean.prototype.toString.call(thrower);",
+ "at Object.toString");
+
+// Constructor builtins.
+testBuiltinInStackTrace("new Date(thrower);", "at new Date");
+
+// Ensure we correctly pick up the receiver's string tag.
+testBuiltinInStackTrace("Math.acos(thrower);", "at Math.acos");
+testBuiltinInStackTrace("Math.asin(thrower);", "at Math.asin");
+testBuiltinInStackTrace("Math.fround(thrower);", "at Math.fround");
+testBuiltinInStackTrace("Math.imul(thrower);", "at Math.imul");
+
+// As above, but function passed as an argument and then called.
+testBuiltinInStackTrace("((f, x) => f(x))(Math.acos, thrower);", "at acos");
+testBuiltinInStackTrace("((f, x) => f(x))(Math.asin, thrower);", "at asin");
+testBuiltinInStackTrace("((f, x) => f(x))(Math.fround, thrower);", "at fround");
+testBuiltinInStackTrace("((f, x) => f(x))(Math.imul, thrower);", "at imul");
diff --git a/src/v8/test/mjsunit/regress/regress-4825.js b/src/v8/test/mjsunit/regress/regress-4825.js
new file mode 100644
index 0000000..fafd3db
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-4825.js
@@ -0,0 +1,111 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function enumerate(o) {
+ var keys = [];
+ for (var key in o) keys.push(key);
+ return keys;
+}
+
+(function testSlowSloppyArgumentsElements() {
+ function slowSloppyArguments(a, b, c) {
+ %HeapObjectVerify(arguments);
+ arguments[10000] = "last";
+ arguments[4000] = "first";
+ arguments[6000] = "second";
+ arguments[5999] = "x";
+ arguments[3999] = "y";
+ %HeapObjectVerify(arguments);
+ return arguments;
+ }
+ assertEquals(["0", "1", "2", "3999", "4000", "5999", "6000", "10000"],
+ Object.keys(slowSloppyArguments(1, 2, 3)));
+
+ assertEquals(["0", "1", "2", "3999", "4000", "5999", "6000", "10000"],
+ enumerate(slowSloppyArguments(1,2,3)));
+})();
+
+(function testSlowSloppyArgumentsElementsNotEnumerable() {
+ function slowSloppyArguments(a, b, c) {
+ Object.defineProperty(arguments, 10000, {
+ enumerable: false, configurable: false, value: "NOPE"
+ });
+ %HeapObjectVerify(arguments);
+ arguments[4000] = "first";
+ arguments[6000] = "second";
+ arguments[5999] = "x";
+ arguments[3999] = "y";
+ %HeapObjectVerify(arguments);
+ return arguments;
+ }
+
+ assertEquals(["0", "1", "2", "3999", "4000", "5999", "6000"],
+ Object.keys(slowSloppyArguments(1, 2, 3)));
+
+ assertEquals(["0", "1", "2", "3999", "4000", "5999", "6000"],
+ enumerate(slowSloppyArguments(1,2,3)));
+})();
+
+
+(function testFastSloppyArgumentsElements() {
+ function fastSloppyArguments(a, b, c) {
+ arguments[5] = 1;
+ arguments[7] = 0;
+ arguments[3] = 2;
+ %HeapObjectVerify(arguments);
+ return arguments;
+ }
+ assertEquals(["0", "1", "2", "3", "5", "7"],
+ Object.keys(fastSloppyArguments(1, 2, 3)));
+
+ assertEquals(
+ ["0", "1", "2", "3", "5", "7"], enumerate(fastSloppyArguments(1, 2, 3)));
+
+ function fastSloppyArguments2(a, b, c) {
+ delete arguments[0];
+ %DebugPrint(arguments);
+ %HeapObjectVerify(arguments);
+ arguments[0] = "test";
+ %DebugPrint(arguments);
+ %HeapObjectVerify(arguments);
+ return arguments;
+ }
+
+ assertEquals(["0", "1", "2"], Object.keys(fastSloppyArguments2(1, 2, 3)));
+ assertEquals(["0", "1", "2"], enumerate(fastSloppyArguments2(1, 2, 3)));
+})();
+
+(function testFastSloppyArgumentsElementsNotEnumerable() {
+ function fastSloppyArguments(a, b, c) {
+ Object.defineProperty(arguments, 5, {
+ enumerable: false, configurable: false, value: "NOPE"
+ });
+ %HeapObjectVerify(arguments);
+ arguments[7] = 0;
+ arguments[3] = 2;
+ %HeapObjectVerify(arguments);
+ return arguments;
+ }
+ assertEquals(
+ ["0", "1", "2", "3", "7"], Object.keys(fastSloppyArguments(1, 2, 3)));
+
+ assertEquals(
+ ["0", "1", "2", "3", "7"], enumerate(fastSloppyArguments(1,2,3)));
+
+ function fastSloppyArguments2(a, b, c) {
+ delete arguments[0];
+ %HeapObjectVerify(arguments);
+ Object.defineProperty(arguments, 1, {
+ enumerable: false, configurable: false, value: "NOPE"
+ });
+ arguments[0] = "test";
+ %HeapObjectVerify(arguments);
+ return arguments;
+ }
+
+ assertEquals(["0", "2"], Object.keys(fastSloppyArguments2(1, 2, 3)));
+ assertEquals(["0", "2"], enumerate(fastSloppyArguments2(1, 2, 3)));
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-483.js b/src/v8/test/mjsunit/regress/regress-483.js
new file mode 100644
index 0000000..7370134
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-483.js
@@ -0,0 +1,34 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function X() {
+ this.x = this.x.x;
+}
+
+X.prototype.x = {x:1}
+
+new X()
diff --git a/src/v8/test/mjsunit/regress/regress-484544.js b/src/v8/test/mjsunit/regress/regress-484544.js
new file mode 100644
index 0000000..709a890
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-484544.js
@@ -0,0 +1,13 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --nouse-allocation-folding --stress-compaction --predictable
+
+function f() {
+ return [[], [], [[], [], []]];
+}
+
+for (var i=0; i<10000; i++) {
+ f();
+}
diff --git a/src/v8/test/mjsunit/regress/regress-485.js b/src/v8/test/mjsunit/regress/regress-485.js
new file mode 100644
index 0000000..f26e0eb
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-485.js
@@ -0,0 +1,46 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// See: http://code.google.com/p/v8/issues/detail?id=485
+
+// Ensure that we don't expose the builtins object when calling
+// builtin functions that use or return "this".
+
+var global = this;
+var global2 = (function(){return this;})();
+assertEquals(global, global2, "direct call to local function returns global");
+
+// Builtin that depends on value of this to compute result.
+var builtin2 = Object.prototype.toString;
+
+// Global object has class "Object" according to Object.prototype.toString.
+// Builtins object displays as "[object builtins]".
+assertTrue("[object builtins]" != builtin2(), "Direct call to toString");
+assertTrue("[object builtins]" != builtin2.call(), "call() to toString");
+assertTrue("[object builtins]" != builtin2.apply(), "call() to toString");
+assertTrue("[object builtins]" != builtin2.call.call(builtin2),
+ "call.call() to toString");
diff --git a/src/v8/test/mjsunit/regress/regress-486.js b/src/v8/test/mjsunit/regress/regress-486.js
new file mode 100644
index 0000000..c1e29a6
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-486.js
@@ -0,0 +1,30 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var st = "\u0422\u0435\u0441\u0442"; // Test in Cyrillic characters.
+var cyrillicMatch = /^[\u0430-\u044fa-z]+$/i.test(st); // a-ja a-z.
+assertTrue(cyrillicMatch);
diff --git a/src/v8/test/mjsunit/regress/regress-4870.js b/src/v8/test/mjsunit/regress/regress-4870.js
new file mode 100644
index 0000000..6e10548
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-4870.js
@@ -0,0 +1,10 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+if (this.Intl) {
+ assertThrows(() => Object.getOwnPropertyDescriptor(Intl.Collator.prototype,
+ 'compare')
+ .get.call(new Intl.DateTimeFormat())('a', 'b'),
+ TypeError)
+}
diff --git a/src/v8/test/mjsunit/regress/regress-487981.js b/src/v8/test/mjsunit/regress/regress-487981.js
new file mode 100644
index 0000000..829c25c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-487981.js
@@ -0,0 +1,22 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --stress-compaction
+
+// To reliably reproduce the crash use --verify-heap --random-seed=-133185440
+
+function __f_2(o) {
+ return o.field.b.x;
+}
+
+try {
+ %OptimizeFunctionOnNextCall(__f_2);
+ __v_1 = __f_2();
+} catch(e) { }
+
+function __f_3() { __f_3(/./.test()); };
+
+try {
+__f_3();
+} catch(e) { }
diff --git a/src/v8/test/mjsunit/regress/regress-488398.js b/src/v8/test/mjsunit/regress/regress-488398.js
new file mode 100644
index 0000000..77ea293
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-488398.js
@@ -0,0 +1,18 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var __v_10 = 4294967295;
+__v_0 = [];
+__v_0.__proto__ = [];
+__v_16 = __v_0;
+function __f_17(__v_16, base) {
+ __v_16[base + 1] = 1;
+ __v_16[base + 4] = base + 4;
+}
+__f_17(__v_16, true);
+__f_17(__v_16, 14);
+%OptimizeFunctionOnNextCall(__f_17);
+__f_17(__v_16, 2048);
diff --git a/src/v8/test/mjsunit/regress/regress-489151.js b/src/v8/test/mjsunit/regress/regress-489151.js
new file mode 100644
index 0000000..25a6555
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-489151.js
@@ -0,0 +1,12 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+this.__proto__ = Array.prototype;
+Object.freeze(this);
+function __f_0() {
+ for (var __v_0 = 0; __v_0 < 10; __v_0++) {
+ this.length = 1;
+ }
+}
+ __f_0();
diff --git a/src/v8/test/mjsunit/regress/regress-490.js b/src/v8/test/mjsunit/regress/regress-490.js
new file mode 100644
index 0000000..6ce89db
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-490.js
@@ -0,0 +1,51 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// See: http://code.google.com/p/v8/issues/detail?id=490
+
+var kXXX = 11
+// Build a string longer than 2^11. See StringBuilderConcatHelper and
+// Runtime_StringBuilderConcat in runtime.cc and
+// ReplaceResultBuilder.prototype.addSpecialSlice in string.js.
+var a = '';
+while (a.length < (2 << 11)) { a+= 'x'; }
+
+// Test specific for bug introduced in r3153.
+a.replace(/^(.*)/, '$1$1$1');
+
+// More generalized test.
+for (var i = 0; i < 10; i++) {
+ var b = '';
+ for (var j = 0; j < 10; j++) {
+ b += '$1';
+
+ // TODO(machenbach): Do we need all these replacements? Wouldn't corner
+ // cases like smallest and biggest suffice?
+ a.replace(/^(.*)/, b);
+ }
+ a += a;
+}
diff --git a/src/v8/test/mjsunit/regress/regress-4908.js b/src/v8/test/mjsunit/regress/regress-4908.js
new file mode 100644
index 0000000..ec618b3
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-4908.js
@@ -0,0 +1,7 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --always-opt --no-lazy
+
+(function() { ((s = 17, y = s) => s)() })();
diff --git a/src/v8/test/mjsunit/regress/regress-491.js b/src/v8/test/mjsunit/regress/regress-491.js
new file mode 100644
index 0000000..2cf5e20
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-491.js
@@ -0,0 +1,47 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// See: http://code.google.com/p/v8/issues/detail?id=491
+// This should not hit any asserts in debug mode on ARM.
+
+function function_with_n_strings(n) {
+ var source = '(function f(){';
+ for (var i = 0; i < n; i++) {
+ if (i != 0) source += ';';
+ source += '"x"';
+ }
+ source += '})()';
+ eval(source);
+}
+
+var i;
+for (i = 500; i < 600; i++) {
+ function_with_n_strings(i);
+}
+for (i = 1100; i < 1200; i++) {
+ function_with_n_strings(i);
+}
diff --git a/src/v8/test/mjsunit/regress/regress-491481.js b/src/v8/test/mjsunit/regress/regress-491481.js
new file mode 100644
index 0000000..196b6ae
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-491481.js
@@ -0,0 +1,15 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+try {
+%OptimizeFunctionOnNextCall(print);
+try {
+ __f_16();
+} catch(e) { print(e); }
+try {
+ __f_10();
+} catch(e) {; }
+} catch(e) {}
diff --git a/src/v8/test/mjsunit/regress/regress-492.js b/src/v8/test/mjsunit/regress/regress-492.js
new file mode 100644
index 0000000..53b3195
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-492.js
@@ -0,0 +1,90 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// See: http://code.google.com/p/v8/issues/detail?id=492
+// This should not hit any asserts in debug mode on ARM.
+
+function function_with_n_args(n) {
+ var source = '(function f' + n + '(';
+ for (var arg = 0; arg < n; arg++) {
+ if (arg != 0) source += ',';
+ source += 'arg' + arg;
+ }
+ source += ') { })()';
+ eval(source);
+}
+
+var args;
+for (args = 250; args < 270; args++) {
+ function_with_n_args(args);
+}
+
+for (args = 500; args < 520; args++) {
+ function_with_n_args(args);
+}
+
+for (args = 1019; args < 1041; args++) {
+ function_with_n_args(args);
+}
+
+
+function foo(
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x
+) {}
+
+for (var i = 0; i < 10000; ++i) foo();
diff --git a/src/v8/test/mjsunit/regress/regress-4945.js b/src/v8/test/mjsunit/regress/regress-4945.js
new file mode 100644
index 0000000..8e595e6
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-4945.js
@@ -0,0 +1,10 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function* g(o) {
+ yield 'x' in o;
+}
+
+assertTrue(g({x: 1}).next().value);
+assertFalse(g({}).next().value);
diff --git a/src/v8/test/mjsunit/regress/regress-496.js b/src/v8/test/mjsunit/regress/regress-496.js
new file mode 100644
index 0000000..33c1a67
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-496.js
@@ -0,0 +1,39 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Regression test for http://code.google.com/p/v8/issues/detail?id=496.
+//
+// Tests that we do not treat the unaliased eval call in g as an
+// aliased call to eval.
+
+function h() {
+ function f() { return eval; }
+ function g() { var x = 44; return eval("x"); }
+ assertEquals(44, g());
+}
+
+h();
diff --git a/src/v8/test/mjsunit/regress/regress-4962.js b/src/v8/test/mjsunit/regress/regress-4962.js
new file mode 100644
index 0000000..f8c96e3
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-4962.js
@@ -0,0 +1,11 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+if (this.Intl) {
+ assertInstanceof(Intl.NumberFormat.call(new Proxy({},{})), Intl.NumberFormat);
+ assertThrows(() =>
+ Intl.DateTimeFormat.prototype.formatToParts.call(
+ new Proxy({}, {})),
+ TypeError);
+}
diff --git a/src/v8/test/mjsunit/regress/regress-4964.js b/src/v8/test/mjsunit/regress/regress-4964.js
new file mode 100644
index 0000000..d834708
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-4964.js
@@ -0,0 +1,22 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Neutered source
+var ab = new ArrayBuffer(10);
+ab.constructor = { get [Symbol.species]() { %ArrayBufferNeuter(ab); return ArrayBuffer; } };
+assertThrows(() => ab.slice(0), TypeError);
+
+// Neutered target
+class NeuteredArrayBuffer extends ArrayBuffer {
+ constructor(...args) {
+ super(...args);
+ %ArrayBufferNeuter(this);
+ }
+}
+
+var ab2 = new ArrayBuffer(10);
+ab2.constructor = NeuteredArrayBuffer;
+assertThrows(() => ab2.slice(0), TypeError);
diff --git a/src/v8/test/mjsunit/regress/regress-4967.js b/src/v8/test/mjsunit/regress/regress-4967.js
new file mode 100644
index 0000000..9b36405
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-4967.js
@@ -0,0 +1,9 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertThrows(() => {
+ new class extends Object {
+ constructor() { (() => delete super[super()])(); }
+ }
+}, ReferenceError);
diff --git a/src/v8/test/mjsunit/regress/regress-4970.js b/src/v8/test/mjsunit/regress/regress-4970.js
new file mode 100644
index 0000000..da0033b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-4970.js
@@ -0,0 +1,15 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax
+
+function g() {
+ var f;
+ class C extends eval("f = () => delete C; Array") {}
+ f();
+}
+
+assertThrows(g, SyntaxError);
+%OptimizeFunctionOnNextCall(g);
+assertThrows(g, SyntaxError);
diff --git a/src/v8/test/mjsunit/regress/regress-4971.js b/src/v8/test/mjsunit/regress/regress-4971.js
new file mode 100644
index 0000000..041f6c2
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-4971.js
@@ -0,0 +1,41 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function TestDeoptInNamedSuperGetter() {
+ class C { m() { return 23 } }
+ class D extends C { f() { return super.boom() } }
+
+ var should_deoptimize_caller = false;
+ Object.defineProperty(C.prototype, "boom", { get: function() {
+ if (should_deoptimize_caller) %DeoptimizeFunction(D.prototype.f);
+ return this.m
+ }})
+
+ assertEquals(23, new D().f());
+ assertEquals(23, new D().f());
+ %OptimizeFunctionOnNextCall(D.prototype.f);
+ assertEquals(23, new D().f());
+ should_deoptimize_caller = true;
+ assertEquals(23, new D().f());
+})();
+
+(function TestDeoptInKeyedSuperGetter() {
+ class C { m() { return 23 } }
+ class D extends C { f(name) { return super[name]() } }
+
+ var should_deoptimize_caller = false;
+ Object.defineProperty(C.prototype, "boom", { get: function() {
+ if (should_deoptimize_caller) %DeoptimizeFunction(D.prototype.f);
+ return this.m
+ }})
+
+ assertEquals(23, new D().f("boom"));
+ assertEquals(23, new D().f("boom"));
+ %OptimizeFunctionOnNextCall(D.prototype.f);
+ assertEquals(23, new D().f("boom"));
+ should_deoptimize_caller = true;
+ assertEquals(23, new D().f("boom"));
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-499790.js b/src/v8/test/mjsunit/regress/regress-499790.js
new file mode 100644
index 0000000..ce2cd03
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-499790.js
@@ -0,0 +1,14 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --enable-slow-asserts
+
+var a = [1];
+a.foo = "bla";
+delete a.foo;
+a[0] = 1.5;
+
+var a2 = [];
+a2.foo = "bla";
+delete a2.foo;
diff --git a/src/v8/test/mjsunit/regress/regress-500173.js b/src/v8/test/mjsunit/regress/regress-500173.js
new file mode 100644
index 0000000..b7083b2
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-500173.js
@@ -0,0 +1,12 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function f(a) {
+ a.foo = {};
+ a[0] = 1;
+ a.__defineGetter__('foo', function() {});
+ a[0] = {};
+ a.bar = 0;
+}
+f(new Array());
diff --git a/src/v8/test/mjsunit/regress/regress-500176.js b/src/v8/test/mjsunit/regress/regress-500176.js
new file mode 100644
index 0000000..6700ef0
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-500176.js
@@ -0,0 +1,13 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function __f_0(p) {
+ var __v_0 = -2147483642;
+ for (var __v_1 = 0; __v_1 < 10; __v_1++) {
+ if (__v_1 > 5) { __v_0 = __v_0 + p; break;}
+ }
+}
+for (var __v_2 = 0; __v_2 < 100000; __v_2++) __f_0(42);
+__v_2 = { f: function () { return x + y; },
+ 2: function () { return x - y} };
diff --git a/src/v8/test/mjsunit/regress/regress-5004.js b/src/v8/test/mjsunit/regress/regress-5004.js
new file mode 100644
index 0000000..234f5d4
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-5004.js
@@ -0,0 +1,27 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function assertAsync(b, s) {
+ if (!b) {
+ %AbortJS(" FAILED!")
+ }
+}
+
+class P extends Promise {
+ constructor() {
+ super(...arguments)
+ return new Proxy(this, {
+ get: (_, key) => {
+ return key == 'then' ?
+ this.then.bind(this) :
+ this.constructor.resolve(20)
+ }
+ })
+ }
+}
+
+let p = P.resolve(10)
+p.key.then(v => assertAsync(v === 20));
diff --git a/src/v8/test/mjsunit/regress/regress-5006.js b/src/v8/test/mjsunit/regress/regress-5006.js
new file mode 100644
index 0000000..29f145d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-5006.js
@@ -0,0 +1,11 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(x) { return Math.imul(x|0, 2); }
+print(foo(1));
+print(foo(1));
+%OptimizeFunctionOnNextCall(foo);
+print(foo(1));
diff --git a/src/v8/test/mjsunit/regress/regress-500831.js b/src/v8/test/mjsunit/regress/regress-500831.js
new file mode 100644
index 0000000..3895c4d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-500831.js
@@ -0,0 +1,94 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// To reproduce reliably use: --random-seed=-2012454635 --nodebug-code
+
+function deepEquals(a, b) {
+ if (a === b) {;
+ return true;
+ }
+ if (typeof a != typeof b) return false;
+ if (typeof a == "number");
+ if (typeof a !== "object" && typeof a !== "function")
+ return false;
+ var objectClass = classOf();
+ if (b) return false;
+ if (objectClass === "RegExp") {;
+ }
+ if (objectClass === "Function") return false;
+ if (objectClass === "Array") {
+ var elementCount = 0;
+ if (a.length != b.length) {
+ return false;
+ }
+ for (var i = 0; i < a.length; i++) {
+ if (a[i][i]) return false;
+ }
+ return true;
+ }
+ if (objectClass == "String" || objectClass == "Number" ||
+ objectClass == "Boolean" || objectClass == "Date") {
+ if (a.valueOf()) return false;
+ };
+}
+function equals(expected, found, name_opt) {
+ if (!deepEquals(found, expected)) {}
+};
+function instof(obj, type) {
+ if (!(obj instanceof type)) {
+ var actualTypeName = null;
+ var actualConstructor = Object.getPrototypeOf().constructor;
+ if (typeof actualConstructor == "function") {;
+ };
+ }
+};
+var __v_0 = 1;
+var __v_6 = {};
+var __v_9 = {};
+
+function __f_4() {
+ return function() {};
+}
+__v_6 = new Uint8ClampedArray(10);
+
+function __f_6() {
+ __v_6[0] = 0.499;
+ instof(__f_4(), Function);
+ equals();
+ __v_6[0] = 0.5;
+ equals();
+ __v_0[0] = 0.501;
+ equals(__v_6[4294967295]);
+ __v_6[0] = 1.499;
+ equals();
+ __v_6[0] = 1.5;
+ equals();
+ __v_6[0] = 1.501;
+ equals();
+ __v_6[0] = 2.5;
+ equals(__v_6[-1073741824]);
+ __v_6[0] = 3.5;
+ equals();
+ __v_6[0] = 252.5;
+ equals();
+ __v_6[0] = 253.5;
+ equals();
+ __v_6[0] = 254.5;
+ equals();
+ __v_6[0] = 256.5;
+ equals();
+ __v_6[0] = -0.5;
+ equals(__v_6[8]);
+ __v_6[0] = -1.5;
+ equals();
+ __v_6[0] = 1000000000000;
+ equals();
+ __v_9[0] = -1000000000000;
+ equals(__v_6[0]);
+}
+__f_6();
+__f_6(); %OptimizeFunctionOnNextCall(__f_6);
+__f_6();
diff --git a/src/v8/test/mjsunit/regress/regress-500980.js b/src/v8/test/mjsunit/regress/regress-500980.js
new file mode 100644
index 0000000..841d26a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-500980.js
@@ -0,0 +1,7 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var a = "a";
+assertThrows(function() { while (true) a += a; }, RangeError);
+assertThrows(function() { a in a; }, TypeError);
diff --git a/src/v8/test/mjsunit/regress/regress-5010.js b/src/v8/test/mjsunit/regress/regress-5010.js
new file mode 100644
index 0000000..ecd4026
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-5010.js
@@ -0,0 +1,9 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var bound = (function(){}).bind({});
+assertEquals("Function", %_ClassOf(bound));
+assertEquals("Function", %ClassOf(bound));
diff --git a/src/v8/test/mjsunit/regress/regress-5018.js b/src/v8/test/mjsunit/regress/regress-5018.js
new file mode 100644
index 0000000..22025dc
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-5018.js
@@ -0,0 +1,29 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var dv = new DataView(new ArrayBuffer(4), 2);
+
+function getByteLength(a) {
+ return a.byteLength;
+}
+
+assertEquals(2, getByteLength(dv));
+assertEquals(2, getByteLength(dv));
+
+Object.defineProperty(dv.__proto__, 'byteLength', {value: 42});
+
+assertEquals(42, dv.byteLength);
+assertEquals(42, getByteLength(dv));
+
+function getByteOffset(a) {
+ return a.byteOffset;
+}
+
+assertEquals(2, getByteOffset(dv));
+assertEquals(2, getByteOffset(dv));
+
+Object.defineProperty(dv.__proto__, 'byteOffset', {value: 42});
+
+assertEquals(42, dv.byteOffset);
+assertEquals(42, getByteOffset(dv));
diff --git a/src/v8/test/mjsunit/regress/regress-502.js b/src/v8/test/mjsunit/regress/regress-502.js
new file mode 100644
index 0000000..d3c9381
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-502.js
@@ -0,0 +1,38 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Regression test for http://code.google.com/p/v8/issues/detail?id=502.
+//
+// Test that we do not generate an inlined version of the constructor
+// function C.
+
+var X = 'x';
+function C() { this[X] = 42; }
+var a = new C();
+var b = new C();
+assertEquals(42, a.x);
+assertEquals(42, b.x);
diff --git a/src/v8/test/mjsunit/regress/regress-503.js b/src/v8/test/mjsunit/regress/regress-503.js
new file mode 100644
index 0000000..5b156b2
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-503.js
@@ -0,0 +1,63 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+assertTrue(undefined == undefined, 1);
+assertFalse(undefined <= undefined, 2);
+assertFalse(undefined >= undefined, 3);
+assertFalse(undefined < undefined, 4);
+assertFalse(undefined > undefined, 5);
+
+assertTrue(null == null, 6);
+assertTrue(null <= null, 7);
+assertTrue(null >= null, 8);
+assertFalse(null < null, 9);
+assertFalse(null > null, 10);
+
+assertTrue(void 0 == void 0, 11);
+assertFalse(void 0 <= void 0, 12);
+assertFalse(void 0 >= void 0, 13);
+assertFalse(void 0 < void 0, 14);
+assertFalse(void 0 > void 0, 15);
+
+var x = void 0;
+
+assertTrue(x == x, 16);
+assertFalse(x <= x, 17);
+assertFalse(x >= x, 18);
+assertFalse(x < x, 19);
+assertFalse(x > x, 20);
+
+var not_undefined = [null, 0, 1, 1/0, -1/0, "", true, false];
+for (var i = 0; i < not_undefined.length; i++) {
+ x = not_undefined[i];
+
+ assertTrue(x == x, "" + 21 + x);
+ assertTrue(x <= x, "" + 22 + x);
+ assertTrue(x >= x, "" + 23 + x);
+ assertFalse(x < x, "" + 24 + x);
+ assertFalse(x > x, "" + 25 + x);
+}
diff --git a/src/v8/test/mjsunit/regress/regress-5033.js b/src/v8/test/mjsunit/regress/regress-5033.js
new file mode 100644
index 0000000..728094f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-5033.js
@@ -0,0 +1,21 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var test = function() {
+ var t = Date.now(); // Just any non-constant double value.
+ var o = {
+ ['p']: 1,
+ t
+ };
+};
+
+function caller() {
+ test();
+}
+caller();
+caller();
+%OptimizeFunctionOnNextCall(caller);
+caller();
diff --git a/src/v8/test/mjsunit/regress/regress-503565.js b/src/v8/test/mjsunit/regress/regress-503565.js
new file mode 100644
index 0000000..9aebe8d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-503565.js
@@ -0,0 +1,21 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Crashes without the fix for bug 503565.
+function f() {}
+function g() {}
+function h() {
+ g()
+}
+(function() {
+ eval("\
+ \"use strict\";\
+ g = (function(x) {\
+ +Math.log(+Math.log((+(+x>0)), f(Math.log())))\
+ })\
+ ")
+})()
+for (var j = 0; j < 999; j++) {
+ h()
+}
diff --git a/src/v8/test/mjsunit/regress/regress-5036.js b/src/v8/test/mjsunit/regress/regress-5036.js
new file mode 100644
index 0000000..77bd242
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-5036.js
@@ -0,0 +1,5 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertEquals(["1\u212a"], /\d\w/ui.exec("1\u212a"));
diff --git a/src/v8/test/mjsunit/regress/regress-507980.js b/src/v8/test/mjsunit/regress/regress-507980.js
new file mode 100644
index 0000000..d1a1f79
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-507980.js
@@ -0,0 +1,8 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+__v_1 = new Float64Array(1);
+__v_8 = { valueOf: function() { __v_13.y = "bar"; return 42; }};
+__v_13 = __v_1;
+__v_13[0] = __v_8;
diff --git a/src/v8/test/mjsunit/regress/regress-5085.js b/src/v8/test/mjsunit/regress/regress-5085.js
new file mode 100644
index 0000000..0ed034d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-5085.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(x) {
+ return x instanceof Proxy;
+}
+
+assertFalse(foo({}));
+assertFalse(foo({}));
+%OptimizeFunctionOnNextCall(foo);
+assertFalse(foo({}));
diff --git a/src/v8/test/mjsunit/regress/regress-509961.js b/src/v8/test/mjsunit/regress/regress-509961.js
new file mode 100644
index 0000000..d28bc8a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-509961.js
@@ -0,0 +1,10 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var o = { x: 0 };
+delete o.x;
+function store(o, p, v) { o[p] = v; }
+store(o, "x", 1);
+store(o, "x", 1);
+store(o, "0", 1);
diff --git a/src/v8/test/mjsunit/regress/regress-5106.js b/src/v8/test/mjsunit/regress/regress-5106.js
new file mode 100644
index 0000000..52d550a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-5106.js
@@ -0,0 +1,29 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function* g1() {
+ try {
+ throw {};
+ } catch ({a = class extends (yield) {}}) {
+ }
+}
+g1().next(); // crashes without fix
+
+function* g2() {
+ let x = function(){};
+ try {
+ throw {};
+ } catch ({b = class extends x {}}) {
+ }
+}
+g2().next(); // crashes without fix
+
+function* g3() {
+ let x = 42;
+ try {
+ throw {};
+ } catch ({c = (function() { return x })()}) {
+ }
+}
+g3().next(); // throws a ReferenceError without fix
diff --git a/src/v8/test/mjsunit/regress/regress-515.js b/src/v8/test/mjsunit/regress/regress-515.js
new file mode 100644
index 0000000..7675fe1
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-515.js
@@ -0,0 +1,40 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Regression test for http://code.google.com/p/v8/issues/detail?id=515.
+//
+// The test passes if it does not crash.
+
+var length = 2048;
+var s = "";
+for (var i = 0; i < 2048; i++) {
+ s += '.';
+}
+
+var string = s + 'x' + s + 'x' + s;
+
+string.replace(/x/g, "")
diff --git a/src/v8/test/mjsunit/regress/regress-5173.js b/src/v8/test/mjsunit/regress/regress-5173.js
new file mode 100644
index 0000000..74f58cc4
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-5173.js
@@ -0,0 +1,51 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var thrower = { [Symbol.toPrimitive]: () => FAIL };
+
+// Tests that a native conversion function is included in the
+// stack trace.
+function testTraceNativeConversion(nativeFunc) {
+ var nativeFuncName = nativeFunc.name;
+ try {
+ nativeFunc(thrower);
+ assertUnreachable(nativeFuncName);
+ } catch (e) {
+ assertTrue(e.stack.indexOf(nativeFuncName) >= 0, nativeFuncName);
+ }
+}
+
+testTraceNativeConversion(Math.max);
+testTraceNativeConversion(Math.min);
+
+function testBuiltinInStackTrace(script, expectedString) {
+ try {
+ eval(script);
+ assertUnreachable(expectedString);
+ } catch (e) {
+ assertTrue(e.stack.indexOf(expectedString) >= 0, expectedString);
+ }
+}
+
+testBuiltinInStackTrace("Date.prototype.getDate.call('')", "at String.getDate");
+testBuiltinInStackTrace("Date.prototype.getUTCDate.call('')",
+ "at String.getUTCDate");
+testBuiltinInStackTrace("Date.prototype.getTime.call('')", "at String.getTime");
+
+testBuiltinInStackTrace("Number(thrower);", "at Number");
+testBuiltinInStackTrace("new Number(thrower);", "at new Number");
+testBuiltinInStackTrace("String(thrower);", "at String");
+testBuiltinInStackTrace("new String(thrower);", "at new String");
+
+// Ensure we correctly pick up the receiver's string tag.
+testBuiltinInStackTrace("Math.acos(thrower);", "at Math.acos");
+testBuiltinInStackTrace("Math.asin(thrower);", "at Math.asin");
+testBuiltinInStackTrace("Math.fround(thrower);", "at Math.fround");
+testBuiltinInStackTrace("Math.imul(thrower);", "at Math.imul");
+
+// As above, but function passed as an argument and then called.
+testBuiltinInStackTrace("((f, x) => f(x))(Math.acos, thrower);", "at acos");
+testBuiltinInStackTrace("((f, x) => f(x))(Math.asin, thrower);", "at asin");
+testBuiltinInStackTrace("((f, x) => f(x))(Math.fround, thrower);", "at fround");
+testBuiltinInStackTrace("((f, x) => f(x))(Math.imul, thrower);", "at imul");
diff --git a/src/v8/test/mjsunit/regress/regress-5174.js b/src/v8/test/mjsunit/regress/regress-5174.js
new file mode 100644
index 0000000..390d24e
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-5174.js
@@ -0,0 +1,6 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// // Use of this source code is governed by a BSD-style license that can be
+// // found in the LICENSE file.
+
+assertEquals([], Object.keys(new Proxy([], {})));
+assertEquals([], Object.keys(new Proxy(/regex/, {})));
diff --git a/src/v8/test/mjsunit/regress/regress-5178.js b/src/v8/test/mjsunit/regress/regress-5178.js
new file mode 100644
index 0000000..cf10ae7
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-5178.js
@@ -0,0 +1,9 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertThrows(() => {
+ try { throw {} } catch({a=b, b}) { a+b }
+}, ReferenceError);
+
+try { throw {a: 42} } catch({a, b=a}) { assertEquals(42, b) };
diff --git a/src/v8/test/mjsunit/regress/regress-5181.js b/src/v8/test/mjsunit/regress/regress-5181.js
new file mode 100644
index 0000000..d8dfc4a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-5181.js
@@ -0,0 +1,11 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var target = Object.create(null);
+var proxy = new Proxy(target, {
+ ownKeys: function() {
+ return ['a'];
+ }
+});
+for (var key in proxy) ;
diff --git a/src/v8/test/mjsunit/regress/regress-5199.js b/src/v8/test/mjsunit/regress/regress-5199.js
new file mode 100644
index 0000000..818e71a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-5199.js
@@ -0,0 +1,5 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertTrue(/(a[\u1000A])+/i.test('aa'));
diff --git a/src/v8/test/mjsunit/regress/regress-520029.js b/src/v8/test/mjsunit/regress/regress-520029.js
new file mode 100644
index 0000000..9a1d200
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-520029.js
@@ -0,0 +1,27 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Test that hoisting a function out of a lexical scope does not
+// lead to a parsing error
+
+// This used to cause a crash in the parser
+function f(one) { class x { } { class x { } function g() { one; x; } g() } } f()
+
+// This used to lead to a ReferenceError
+function g() { var x = 1; { let x = 2; function g() { x; } g(); } }
+assertEquals(undefined, g());
+
+// This used to cause a crash in the parser
+function __f_4(one) {
+ var __v_10 = one + 1;
+ {
+ let __v_10 = one + 3;
+ function __f_6() {
+ one;
+ __v_10;
+ }
+ __f_6();
+ }
+}
+__f_4();
diff --git a/src/v8/test/mjsunit/regress/regress-5205.js b/src/v8/test/mjsunit/regress/regress-5205.js
new file mode 100644
index 0000000..0d88f45
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-5205.js
@@ -0,0 +1,37 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --gc-global
+
+(function TestGCDuringToObjectForWith() {
+ function f(o) {
+ if (o == 'warmup') { return g() }
+ with (o) { return x }
+ }
+ function g() {
+ // Only a marker function serving as weak embedded object.
+ }
+
+ // Warm up 'f' so that weak embedded object 'g' will be used.
+ f('warmup');
+ f('warmup');
+ g = null;
+
+ // Test that 'f' behaves correctly unoptimized.
+ assertEquals(23, f({ x:23 }));
+ assertEquals(42, f({ x:42 }));
+
+ // Test that 'f' behaves correctly optimized.
+ %OptimizeFunctionOnNextCall(f);
+ assertEquals(65, f({ x:65 }));
+
+ // Test that 'f' behaves correctly on numbers.
+ Number.prototype.x = 99;
+ assertEquals(99, f(0));
+
+ // Make sure the next [[ToObject]] allocation triggers GC. This in turn will
+ // deoptimize 'f' because it has the weak embedded object 'g' in the code.
+ %SetAllocationTimeout(1000, 1, false);
+ assertEquals(99, f(0));
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-5213.js b/src/v8/test/mjsunit/regress/regress-5213.js
new file mode 100644
index 0000000..831e134
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-5213.js
@@ -0,0 +1,8 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// See http://code.google.com/p/v8/issues/detail?id=5213
+
+assertEquals(0, Math.pow(2,-2147483648));
+assertEquals(0, Math.pow(2,-9223372036854775808));
diff --git a/src/v8/test/mjsunit/regress/regress-5214.js b/src/v8/test/mjsunit/regress/regress-5214.js
new file mode 100644
index 0000000..f90a590
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-5214.js
@@ -0,0 +1,10 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// See http://code.google.com/p/v8/issues/detail?id=5214
+
+
+assertEquals(Infinity, Math.pow(2, 0x80000000));
+assertEquals(Infinity, Math.pow(2, 0xc0000000));
+assertEquals(0, Math.pow(2, -0x80000000));
diff --git a/src/v8/test/mjsunit/regress/regress-5216.js b/src/v8/test/mjsunit/regress/regress-5216.js
new file mode 100644
index 0000000..9097310
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-5216.js
@@ -0,0 +1,8 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Ensure that custom error constructors don't show up in stack traces.
+
+class MyError extends Error { }
+assertFalse(new MyError().stack.includes("at MyError"));
diff --git a/src/v8/test/mjsunit/regress/regress-524.js b/src/v8/test/mjsunit/regress/regress-524.js
new file mode 100644
index 0000000..b37ad8a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-524.js
@@ -0,0 +1,32 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test allocation of a large number of maps.
+
+var i = 500000
+var a = new Array(i)
+for (var j = 0; j < i; j++) { var o = {}; o.x = 42; delete o.x; a[j] = o; }
diff --git a/src/v8/test/mjsunit/regress/regress-5245.js b/src/v8/test/mjsunit/regress/regress-5245.js
new file mode 100644
index 0000000..9c4f6e7
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-5245.js
@@ -0,0 +1,24 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+
+// After captureStackTrace.
+
+var a = {};
+Error.captureStackTrace(a, Error);
+a.stack = 1; // Should not throw, stack should be writable.
+
+// After the standard Error constructor.
+
+var b = new Error();
+b.stack = 1; // Should not throw, stack should be writable.
+b.stack = 1; // Still writable.
+
+// After read access to stack.
+
+var c = new Error();
+var old_stack = c.stack;
+c.stack = 1; // Should not throw, stack should be writable.
+c.stack = 1; // Still writable.
diff --git a/src/v8/test/mjsunit/regress/regress-5252.js b/src/v8/test/mjsunit/regress/regress-5252.js
new file mode 100644
index 0000000..41f3fee
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-5252.js
@@ -0,0 +1,31 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --ignition-osr
+
+(function TestNonLoopyLoop() {
+ function f() {
+ do {
+ %OptimizeOsr();
+ return 23;
+ } while(false)
+ }
+ assertEquals(23, f());
+ assertEquals(23, f());
+})();
+
+(function TestNonLoopyGenerator() {
+ function* g() {
+ do {
+ %OptimizeOsr();
+ yield 23;
+ yield 42;
+ } while(false)
+ return 999;
+ }
+ var gen = g();
+ assertEquals({ value:23, done:false }, gen.next());
+ assertEquals({ value:42, done:false }, gen.next());
+ assertEquals({ value:999, done:true }, gen.next());
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-526.js b/src/v8/test/mjsunit/regress/regress-526.js
new file mode 100644
index 0000000..0cae97a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-526.js
@@ -0,0 +1,32 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test object literals with computed property and getter.
+
+var o = { foo: function() { }, get bar() { return {x:42} } };
+
+assertEquals(42, o.bar.x);
diff --git a/src/v8/test/mjsunit/regress/regress-5262.js b/src/v8/test/mjsunit/regress/regress-5262.js
new file mode 100644
index 0000000..06932a2
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-5262.js
@@ -0,0 +1,25 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --ignition-osr --allow-natives-syntax
+
+function g() { return 23 }
+function h() { return 42 }
+function boom(o) { o.g = h }
+function f(osr_and_recurse) {
+ if (osr_and_recurse) {
+ for (var i = 0; i < 3; ++i) {
+ if (i == 1) %OptimizeOsr();
+ }
+ %OptimizeFunctionOnNextCall(f);
+ f(false); // Trigger tier-up due to recursive call.
+ boom(this); // Causes a deopt due to below dependency.
+ var x = g(); // Install dependency on the {g} function.
+ return x;
+ }
+ return 65;
+}
+assertEquals(65, f(false));
+assertEquals(65, f(false));
+assertEquals(42, f(true));
diff --git a/src/v8/test/mjsunit/regress/regress-5275-1.js b/src/v8/test/mjsunit/regress/regress-5275-1.js
new file mode 100644
index 0000000..542bae0
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-5275-1.js
@@ -0,0 +1,18 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(x) {
+ var a = new Array(1);
+ a[0] = x;
+ return a;
+}
+
+assertEquals([1], foo(1));
+assertEquals([1], foo(1));
+%OptimizeFunctionOnNextCall(foo);
+assertEquals([1], foo(1));
+Array.prototype.__defineSetter__("0", function() {});
+assertEquals([undefined], foo(1));
diff --git a/src/v8/test/mjsunit/regress/regress-5275-2.js b/src/v8/test/mjsunit/regress/regress-5275-2.js
new file mode 100644
index 0000000..2da422d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-5275-2.js
@@ -0,0 +1,18 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(x) {
+ var a = new Array(1);
+ a[0] = x;
+ return a;
+}
+
+assertEquals([1], foo(1));
+assertEquals([1], foo(1));
+%OptimizeFunctionOnNextCall(foo);
+assertEquals([1], foo(1));
+Object.prototype.__defineSetter__("0", function() {});
+assertEquals([undefined], foo(1));
diff --git a/src/v8/test/mjsunit/regress/regress-52801.js b/src/v8/test/mjsunit/regress/regress-52801.js
new file mode 100644
index 0000000..9a34b81
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-52801.js
@@ -0,0 +1,69 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Whenever we enter a with-scope, we copy the context. This in itself is fine
+// (contexts may escape), but when leaving a with-scope, we currently also copy
+// the context instead of reverting to the original. This does not work because
+// inner functions may already have been created using the original context. In
+// the failing test case below, the inner function is run in the original context
+// (where x is undefined), but the assignment to x after the with-statement is
+// run in the copied context:
+
+// RegExp caching doesn't set lastIndex correctly.
+// See http://code.google.com/p/chromium/issues/detail?id=52801
+
+var re = /a/g;
+
+var str = "bbbbabbbbabbbb";
+
+// Test
+
+re.test(str);
+assertEquals(5, re.lastIndex);
+
+re.lastIndex = 0;
+re.test(str);
+assertEquals(5, re.lastIndex); // Fails if caching.
+
+re.lastIndex = 0;
+re.test(str);
+assertEquals(5, re.lastIndex); // Fails if caching.
+
+// Exec
+
+re = /a/g;
+
+re.exec(str);
+assertEquals(5, re.lastIndex);
+
+re.lastIndex = 0;
+re.exec(str);
+assertEquals(5, re.lastIndex); // Fails if caching.
+
+re.lastIndex = 0;
+re.exec(str);
+assertEquals(5, re.lastIndex); // Fails if caching.
diff --git a/src/v8/test/mjsunit/regress/regress-5286.js b/src/v8/test/mjsunit/regress/regress-5286.js
new file mode 100644
index 0000000..210d986
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-5286.js
@@ -0,0 +1,41 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function() {
+ function foo(x, y) { return x % y; }
+
+ assertEquals(0, foo(2, 2));
+ assertEquals(0, foo(4, 4));
+ %OptimizeFunctionOnNextCall(foo);
+ assertEquals(-0, foo(-8, 8));
+})();
+
+(function() {
+ function foo(x, y) { return x % y; }
+
+ assertEquals(0, foo(1, 1));
+ assertEquals(0, foo(2, 2));
+ %OptimizeFunctionOnNextCall(foo);
+ assertEquals(-0, foo(-3, 3));
+})();
+
+(function() {
+ function foo(x, y) { return x % y; }
+
+ assertEquals(0, foo(1, 1));
+ assertEquals(0, foo(2, 2));
+ %OptimizeFunctionOnNextCall(foo);
+ assertEquals(-0, foo(-2147483648, -1));
+})();
+
+(function() {
+ function foo(x, y) { return x % y; }
+
+ assertEquals(0, foo(1, 1));
+ assertEquals(0, foo(2, 2));
+ %OptimizeFunctionOnNextCall(foo);
+ assertEquals(-0, foo(-2147483648, -2147483648));
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-5295-2.js b/src/v8/test/mjsunit/regress/regress-5295-2.js
new file mode 100644
index 0000000..9f97562
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-5295-2.js
@@ -0,0 +1,20 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --test-small-max-function-context-stub-size
+
+// Generate an eval scope with a very large closure.
+// Ensure that vars are leaked out properly in this case.
+source = "var x;";
+for (var i = 0; i < 11; i++) {
+ source += " let a_" + i + " = 0;\n";
+}
+source += " (function () {\n"
+for (var i = 0; i < 11; i++) {
+ source += "a_" + i + "++;\n";
+}
+source += "})();\n"
+
+eval(source);
+assertEquals(undefined, x);
diff --git a/src/v8/test/mjsunit/regress/regress-5295.js b/src/v8/test/mjsunit/regress/regress-5295.js
new file mode 100644
index 0000000..631b5cf
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-5295.js
@@ -0,0 +1,18 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+eval('var x; let y; ()=>y');
+assertEquals(undefined, x);
+
+function foo() {
+ eval('var z = 1; let w; ()=>w');
+ return z;
+}
+assertEquals(1, foo());
+
+// Multiply nested eval hoisting works
+
+eval('let a; ()=>a; eval("let b; ()=>b; var c; function d() {}")');
+assertEquals(undefined, c);
+assertEquals("d", d.name);
diff --git a/src/v8/test/mjsunit/regress/regress-5332.js b/src/v8/test/mjsunit/regress/regress-5332.js
new file mode 100644
index 0000000..f0a0ef9
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-5332.js
@@ -0,0 +1,31 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function() {
+ function foo() {
+ var a = new Array(2);
+ a[1] = 1.5;
+ return a;
+ }
+
+ assertEquals(undefined, foo()[0]);
+ assertEquals(undefined, foo()[0]);
+ %OptimizeFunctionOnNextCall(foo);
+ assertEquals(undefined, foo()[0]);
+})();
+
+(function() {
+ function foo() {
+ var a = Array(2);
+ a[1] = 1.5;
+ return a;
+ }
+
+ assertEquals(undefined, foo()[0]);
+ assertEquals(undefined, foo()[0]);
+ %OptimizeFunctionOnNextCall(foo);
+ assertEquals(undefined, foo()[0]);
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-5342.js b/src/v8/test/mjsunit/regress/regress-5342.js
new file mode 100644
index 0000000..8cdd808
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-5342.js
@@ -0,0 +1,7 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var o = {}
+Error.captureStackTrace(o);
+assertEquals(-1, o.stack.indexOf("captureStackTrace"));
diff --git a/src/v8/test/mjsunit/regress/regress-5351.js b/src/v8/test/mjsunit/regress/regress-5351.js
new file mode 100644
index 0000000..c9e6d31
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-5351.js
@@ -0,0 +1,12 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var re = /[bc]/;
+var str = "baba";
+
+assertEquals(["", "a", "a"], str.split(re));
+
+// Force slow path.
+re.exec = (string) => RegExp.prototype.exec.call(re, string);
+assertEquals(["", "a", "a"], str.split(re));
diff --git a/src/v8/test/mjsunit/regress/regress-5357.js b/src/v8/test/mjsunit/regress/regress-5357.js
new file mode 100644
index 0000000..11ada60
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-5357.js
@@ -0,0 +1,17 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(a) {
+ a++;
+ a = Math.max(0, a);
+ a++;
+ return a;
+}
+
+foo(0);
+foo(0);
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(2147483648, foo(2147483646));
diff --git a/src/v8/test/mjsunit/regress/regress-539875.js b/src/v8/test/mjsunit/regress/regress-539875.js
new file mode 100644
index 0000000..b100c3b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-539875.js
@@ -0,0 +1,37 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(function testSeal() {
+ var sloppy = arguments;
+ var sym = Symbol();
+ sloppy[sym] = 123;
+ Object.seal(sloppy);
+ assertTrue(Object.isSealed(sloppy));
+ var desc = Object.getOwnPropertyDescriptor(sloppy, sym);
+ assertEquals(123, desc.value);
+ assertFalse(desc.configurable);
+ assertTrue(desc.writable);
+})();
+
+
+(function testFreeze() {
+ var sloppy = arguments;
+ var sym = Symbol();
+ sloppy[sym] = 123;
+ Object.freeze(sloppy);
+ assertTrue(Object.isFrozen(sloppy));
+ var desc = Object.getOwnPropertyDescriptor(sloppy, sym);
+ assertEquals(123, desc.value);
+ assertFalse(desc.configurable);
+ assertFalse(desc.writable);
+})();
+
+
+(function testIsFrozenAndIsSealed() {
+ var sym = Symbol();
+ var obj = { [sym]: 123 };
+ Object.preventExtensions(obj);
+ assertFalse(Object.isFrozen(obj));
+ assertFalse(Object.isSealed(obj));
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-540.js b/src/v8/test/mjsunit/regress/regress-540.js
new file mode 100644
index 0000000..c40fa2c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-540.js
@@ -0,0 +1,47 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test context slot declarations in the arguments object.
+// See http://code.google.com/p/v8/issues/detail?id=540
+
+function f(x, y) { eval(x); return y(); }
+var result = f("function y() { return 1; }", function () { return 0; })
+assertEquals(1, result);
+
+result =
+ (function (x) {
+ function x() { return 3; }
+ return x();
+ })(function () { return 2; });
+assertEquals(3, result);
+
+result =
+ (function (x) {
+ function x() { return 5; }
+ return arguments[0]();
+ })(function () { return 4; });
+assertEquals(5, result);
diff --git a/src/v8/test/mjsunit/regress/regress-5404.js b/src/v8/test/mjsunit/regress/regress-5404.js
new file mode 100644
index 0000000..eddd183
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-5404.js
@@ -0,0 +1,21 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+function foo(a, b) {
+ return a + "0123456789012";
+}
+
+foo("a");
+foo("a");
+%OptimizeFunctionOnNextCall(foo);
+foo("a");
+
+var a = "a".repeat(%StringMaxLength());
+assertThrows(function() { foo(a); }, RangeError);
+
+%OptimizeFunctionOnNextCall(foo);
+assertThrows(function() { foo(a); }, RangeError);
+assertOptimized(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-5405.js b/src/v8/test/mjsunit/regress/regress-5405.js
new file mode 100644
index 0000000..eeab479
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-5405.js
@@ -0,0 +1,28 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+let log = [];
+
+(async function() {
+ with ({get ['.promise']() { log.push('async') }}) {
+ return 10;
+ }
+})();
+%RunMicrotasks();
+
+(function() {
+ with ({get ['.new.target']() { log.push('new.target') }}) {
+ return new.target;
+ }
+})();
+
+(function() {
+ with ({get ['this']() { log.push('this') }}) {
+ return this;
+ }
+})();
+
+assertArrayEquals([], log);
diff --git a/src/v8/test/mjsunit/regress/regress-542823.js b/src/v8/test/mjsunit/regress/regress-542823.js
new file mode 100644
index 0000000..d9c2339
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-542823.js
@@ -0,0 +1,12 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+__v_0 = 100000;
+__v_1 = new Array();
+for (var __v_2 = 0; __v_2 < __v_0; __v_2++) {
+ __v_1[__v_2] = 0.5;
+}
+for (var __v_2 = 0; __v_2 < 10; __v_2++) {
+ var __v_0 = __v_1 + 0.5;
+}
diff --git a/src/v8/test/mjsunit/regress/regress-5434.js b/src/v8/test/mjsunit/regress/regress-5434.js
new file mode 100644
index 0000000..8c45a96
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-5434.js
@@ -0,0 +1,42 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Ensure that we have the correct number of accesses to exec in split, and
+// that exec is called at the correct point in time.
+
+var lastIndexHasBeenSet = false;
+var countOfExecGets = 0;
+
+// Force the slow path and make sure the created splitter object has our
+// overwritten exec method (@@split does not call exec on the original regexp
+// but on a newly-created splitter which is guaranteed to be sticky).
+class ObservableExecRegExp extends RegExp {
+ constructor(pattern, flags) {
+ super(pattern, flags);
+ this.lastIndex = 42;
+
+ const re = this;
+ Object.defineProperty(this, "exec", {
+ get: function() {
+ // Ensure exec is first accessed after lastIndex has been reset to
+ // satisfy the spec.
+ assertTrue(re.lastIndex != 42);
+ countOfExecGets++;
+ return RegExp.prototype.exec;
+ }
+ });
+ }
+}
+
+
+
+var re = new ObservableExecRegExp(/x/);
+
+assertEquals(42, re.lastIndex);
+assertEquals(0, countOfExecGets);
+
+var result = "axbxc".split(re);
+
+assertEquals(5, countOfExecGets);
+assertEquals(["a", "b", "c"], result);
diff --git a/src/v8/test/mjsunit/regress/regress-543994.js b/src/v8/test/mjsunit/regress/regress-543994.js
new file mode 100644
index 0000000..950a329
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-543994.js
@@ -0,0 +1,19 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --always-opt --gc-interval=163 --stress-compaction
+
+try { a = f();
+} catch(e) {
+}
+var i = 0;
+function f() {
+ try {
+ f();
+ } catch(e) {
+ i++;
+ [];
+ }
+}
+f();
diff --git a/src/v8/test/mjsunit/regress/regress-5440.js b/src/v8/test/mjsunit/regress/regress-5440.js
new file mode 100644
index 0000000..2c985e5
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-5440.js
@@ -0,0 +1,8 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --always-opt
+
+// The rightmost cons string is created first, resulting in an empty left part.
+eval(" " + ("" + "try {;} catch (_) {}"));
diff --git a/src/v8/test/mjsunit/regress/regress-544991.js b/src/v8/test/mjsunit/regress/regress-544991.js
new file mode 100644
index 0000000..a9fd809
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-544991.js
@@ -0,0 +1,21 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+'use strict';
+
+var typedArray = new Int8Array(1);
+var saved;
+var called;
+class TypedArraySubclass extends Int8Array {
+ constructor(x) {
+ super(x);
+ called = true;
+ saved = x;
+ }
+}
+typedArray.constructor = TypedArraySubclass
+typedArray.map(function(){});
+
+assertTrue(called);
+assertEquals(saved, 1);
diff --git a/src/v8/test/mjsunit/regress/regress-545.js b/src/v8/test/mjsunit/regress/regress-545.js
new file mode 100644
index 0000000..36cde6d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-545.js
@@ -0,0 +1,47 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// See: http://code.google.com/p/v8/issues/detail?id=545
+// and: http://code.google.com/p/chromium/issues/detail?id=28353
+
+// The "this" variable proxy was reused. If context annotations differ between
+// uses, this can cause a use in a value context to assume a test context. Since
+// it has no true/false labels set, it causes a null-pointer dereference and
+// segmentation fault.
+
+// Code should not crash:
+
+// Original bug report by Robert Swiecki (wrapped to not throw):
+try {
+ new IsPrimitive(load())?this.join():String(' ').charCodeAt((!this>Math));
+} catch (e) {}
+
+// Shorter examples:
+
+this + !this;
+
+this + (this ? 1 : 2);
diff --git a/src/v8/test/mjsunit/regress/regress-5454.js b/src/v8/test/mjsunit/regress/regress-5454.js
new file mode 100644
index 0000000..ca6a943
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-5454.js
@@ -0,0 +1,11 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertThrows(function(...[b = !b]) { }, ReferenceError);
+assertThrows(() => (function([b = !b]) { })([]), ReferenceError);
+assertThrows(() => (function({b = !b}) { })({}), ReferenceError);
+
+assertThrows((...[b = !b]) => { }, ReferenceError);
+assertThrows(() => (([b = !b]) => { })([]), ReferenceError);
+assertThrows(() => (({b = !b}) => { })({}), ReferenceError);
diff --git a/src/v8/test/mjsunit/regress/regress-5476.js b/src/v8/test/mjsunit/regress/regress-5476.js
new file mode 100644
index 0000000..5d18ceb
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-5476.js
@@ -0,0 +1,16 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+'use strict'
+
+class LeakyPromise extends Promise {
+ constructor(executor) {
+ super((resolve, reject) => { resolve();});
+ this.resolve = function() {assertEquals(this, undefined); };
+ this.reject = function() {assertEquals(this, undefined); };
+ executor(this.resolve, this.reject);
+ }
+}
+
+const p1 = new LeakyPromise((r) => r());
+const p2 = new LeakyPromise((_, r) => r());
diff --git a/src/v8/test/mjsunit/regress/regress-552302.js b/src/v8/test/mjsunit/regress/regress-552302.js
new file mode 100644
index 0000000..87c4718
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-552302.js
@@ -0,0 +1,7 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax
+
+assertThrows('var %OptimizeFunctionOnNextCall()', SyntaxError);
diff --git a/src/v8/test/mjsunit/regress/regress-554865.js b/src/v8/test/mjsunit/regress/regress-554865.js
new file mode 100644
index 0000000..d16ac91
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-554865.js
@@ -0,0 +1,8 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(function() {
+ var x = {};
+ ((y = [42]) => assertEquals(42, y[0]))();
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-556543.js b/src/v8/test/mjsunit/regress/regress-556543.js
new file mode 100644
index 0000000..9e9bedd
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-556543.js
@@ -0,0 +1,17 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f() {
+ for (var __v_2 = 0; __v_2 < __v_5; ++__v_2) {
+ for (var __v_5 = 0; __v_3 < 1; ++__v_8) {
+ if (true || 0 > -6) continue;
+ for (var __v_3 = 0; __v_3 < 1; ++__v_3) {
+ }
+ }
+ }
+}
+%OptimizeFunctionOnNextCall(f);
+f();
diff --git a/src/v8/test/mjsunit/regress/regress-5566.js b/src/v8/test/mjsunit/regress/regress-5566.js
new file mode 100644
index 0000000..98e1f07
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-5566.js
@@ -0,0 +1,26 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// https://github.com/tc39/proposal-regexp-legacy-features#additional-properties-of-the-regexp-constructor
+
+const props = [ "input", "$_"
+ , "lastMatch", "$&"
+ , "lastParen", "$+"
+ , "leftContext", "$`"
+ , "rightContext", "$'"
+ , "$1", "$2", "$3", "$4", "$5", "$6", "$7", "$8", "$9"
+ ];
+
+for (let i = 0; i < props.length; i++) {
+ const prop = props[i];
+ const desc = Object.getOwnPropertyDescriptor(RegExp, prop);
+ assertTrue(desc.configurable, prop);
+ assertFalse(desc.enumerable, prop);
+ assertTrue(desc.get !== undefined, prop);
+
+ // TODO(jgruber): Although the spec proposal specifies setting setters to
+ // undefined, we are not sure that this change would be web-compatible, and
+ // we are intentionally sticking with the old behavior for now.
+ assertTrue(desc.set !== undefined, prop);
+}
diff --git a/src/v8/test/mjsunit/regress/regress-5636-1.js b/src/v8/test/mjsunit/regress/regress-5636-1.js
new file mode 100644
index 0000000..c1cafe6
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-5636-1.js
@@ -0,0 +1,22 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --function-context-specialization
+
+function f(n) {
+ var a = [];
+ function g() { return x }
+ for (var i = 0; i < n; ++i) {
+ var x = i;
+ a[i] = g;
+ %OptimizeFunctionOnNextCall(g);
+ g();
+ }
+ return a;
+}
+var a = f(3);
+assertEquals(3, a.length);
+assertEquals(2, a[0]());
+assertEquals(2, a[1]());
+assertEquals(2, a[2]());
diff --git a/src/v8/test/mjsunit/regress/regress-5636-2.js b/src/v8/test/mjsunit/regress/regress-5636-2.js
new file mode 100644
index 0000000..e767336
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-5636-2.js
@@ -0,0 +1,23 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f(n) {
+ "use asm";
+ var a = [];
+ function g() { return x }
+ for (var i = 0; i < n; ++i) {
+ var x = i;
+ a[i] = g;
+ %OptimizeFunctionOnNextCall(g);
+ g();
+ }
+ return a;
+}
+var a = f(3);
+assertEquals(3, a.length);
+assertEquals(2, a[0]());
+assertEquals(2, a[1]());
+assertEquals(2, a[2]());
diff --git a/src/v8/test/mjsunit/regress/regress-5638.js b/src/v8/test/mjsunit/regress/regress-5638.js
new file mode 100644
index 0000000..034e4c4
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-5638.js
@@ -0,0 +1,32 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+class MyErrorA {}
+
+class MyErrorB {}
+
+class A {}
+
+class B extends A {
+ constructor() {
+ try {
+ super();
+ } catch (e) {
+ throw new MyErrorB();
+ }
+ }
+}
+
+var thrower = new Proxy(A, {
+ get(target, property, receiver) {
+ if (property === 'prototype') throw new MyErrorA();
+ }
+});
+
+assertThrows(() => Reflect.construct(B, [], thrower), MyErrorB);
+assertThrows(() => Reflect.construct(B, [], thrower), MyErrorB);
+%OptimizeFunctionOnNextCall(B);
+assertThrows(() => Reflect.construct(B, [], thrower), MyErrorB);
diff --git a/src/v8/test/mjsunit/regress/regress-5638b.js b/src/v8/test/mjsunit/regress/regress-5638b.js
new file mode 100644
index 0000000..b72a80e
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-5638b.js
@@ -0,0 +1,44 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+class A {
+ constructor(arg) {
+ assertEquals(123, arg);
+ assertSame(observer, new.target);
+ superclass_counter++;
+ }
+}
+
+class B extends A {
+ constructor() {
+ super(123);
+ construction_counter++;
+ }
+}
+
+var superclass_counter = 0;
+
+var construction_counter = 0;
+
+var observation_counter = 0;
+
+var observer = new Proxy(A, {
+ get(target, property, receiver) {
+ if (property === 'prototype') {
+ %DeoptimizeFunction(B);
+ observation_counter++;
+ }
+ return Reflect.get(target, property, receiver);
+ }
+});
+
+Reflect.construct(B, [], observer);
+Reflect.construct(B, [], observer);
+%OptimizeFunctionOnNextCall(B);
+Reflect.construct(B, [], observer);
+assertEquals(3, observation_counter);
+assertEquals(3, construction_counter);
+assertEquals(3, superclass_counter);
diff --git a/src/v8/test/mjsunit/regress/regress-5648.js b/src/v8/test/mjsunit/regress/regress-5648.js
new file mode 100644
index 0000000..3e9ea07
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-5648.js
@@ -0,0 +1,35 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+
+var iter = {}
+iter[Symbol.iterator] = () => ({
+ next: () => ({}),
+ return: () => {throw 666}
+});
+
+
+function* foo() {
+ for (let x of iter) {throw 42}
+}
+assertThrowsEquals(() => foo().next(), 42);
+
+
+function* bar() {
+ let x;
+ { let gaga = () => {x};
+ [[x]] = iter;
+ }
+}
+assertThrows(() => bar().next(), TypeError);
+
+
+function baz() {
+ let x;
+ { let gaga = () => {x};
+ let gugu = () => {gaga};
+ [[x]] = iter;
+ }
+}
+assertThrows(baz, TypeError);
diff --git a/src/v8/test/mjsunit/regress/regress-5664.js b/src/v8/test/mjsunit/regress/regress-5664.js
new file mode 100644
index 0000000..206822a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-5664.js
@@ -0,0 +1,8 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --nolazy
+
+var f = (x, y=()=>eval("x")) => y();
+assertEquals(100, f(100));
diff --git a/src/v8/test/mjsunit/regress/regress-5669.js b/src/v8/test/mjsunit/regress/regress-5669.js
new file mode 100644
index 0000000..05f917f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-5669.js
@@ -0,0 +1,21 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function f(a, i, v) { a[i] = v; }
+f("make it generic", 0, 0);
+
+var a = new Array();
+Object.defineProperty(a, "length", {value: 3, writable: false});
+print(JSON.stringify(Object.getOwnPropertyDescriptor(a, "length")));
+assertEquals(3, a.length);
+f(a, 3, 3);
+assertFalse(Object.getOwnPropertyDescriptor(a, "length").writable);
+assertEquals(3, a.length);
+
+var b = new Array();
+b.length = 3;
+Object.freeze(b);
+assertEquals(3, b.length);
+f(b, 3, 3);
+assertEquals(3, b.length);
diff --git a/src/v8/test/mjsunit/regress/regress-5692.js b/src/v8/test/mjsunit/regress/regress-5692.js
new file mode 100644
index 0000000..af9f131
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-5692.js
@@ -0,0 +1,16 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// "let" in non-strict mode can be a label, even if composed of unicode escape
+// sequences.
+
+var wasTouched = false;
+l\u0065t:
+do {
+ break l\u0065t;
+ wasTouched = true;
+} while (false);
+// Verify that in addition to no exception thrown, breaking to the label also
+// works.
+assertFalse(wasTouched);
diff --git a/src/v8/test/mjsunit/regress/regress-57.js b/src/v8/test/mjsunit/regress/regress-57.js
new file mode 100644
index 0000000..1d410b9
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-57.js
@@ -0,0 +1,32 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+try {
+ delete (void 0).x;
+} catch (e) {
+ print(e.toString());
+}
diff --git a/src/v8/test/mjsunit/regress/regress-572589.js b/src/v8/test/mjsunit/regress/regress-572589.js
new file mode 100644
index 0000000..1fd755a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-572589.js
@@ -0,0 +1,11 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax --no-lazy
+
+"use strict";
+eval();
+var f = ({x}) => { };
+%OptimizeFunctionOnNextCall(f);
+assertThrows(f);
diff --git a/src/v8/test/mjsunit/regress/regress-5736.js b/src/v8/test/mjsunit/regress/regress-5736.js
new file mode 100644
index 0000000..6583da3
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-5736.js
@@ -0,0 +1,34 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var my_global = 0;
+
+// The problem was that we allowed lazy functions inside evals, but did not
+// force context allocation on the eval scope. Thus, foo was not context
+// allocated since we didn't realize that a lazy function referred to it.
+eval(`let foo = 1;
+ let maybe_lazy = function() { foo = 2; }
+ maybe_lazy();
+ my_global = foo;`);
+assertEquals(2, my_global);
+
+(function TestVarInStrictEval() {
+ "use strict";
+ eval(`var foo = 3;
+ let maybe_lazy = function() { foo = 4; }
+ maybe_lazy();
+ my_global = foo;`);
+ assertEquals(4, my_global);
+})();
+
+eval("let foo = 1; function lazy() { foo = 2; } lazy(); my_global = foo;");
+assertEquals(my_global, 2);
+
+// Lexical variable inside a subscope in eval.
+eval(`{ let foo = 5;
+ function not_lazy() { foo = 6; }
+ not_lazy();
+ my_global = foo;
+ }`);
+assertEquals(my_global, 6);
diff --git a/src/v8/test/mjsunit/regress/regress-5749.js b/src/v8/test/mjsunit/regress/regress-5749.js
new file mode 100644
index 0000000..42e8832
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-5749.js
@@ -0,0 +1,23 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f(x) {
+ (x ** 1) === '';
+}
+f();
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+f();
+
+function g(x) {
+ '' === (x ** 1);
+}
+g();
+g();
+g();
+%OptimizeFunctionOnNextCall(g);
+g();
diff --git a/src/v8/test/mjsunit/regress/regress-575364.js b/src/v8/test/mjsunit/regress/regress-575364.js
new file mode 100644
index 0000000..0b967a0
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-575364.js
@@ -0,0 +1,11 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm --validate-asm --allow-natives-syntax
+
+function f() {
+ "use asm";
+
+}
+assertFalse(%IsAsmWasmCode(f));
diff --git a/src/v8/test/mjsunit/regress/regress-5763-1.js b/src/v8/test/mjsunit/regress/regress-5763-1.js
new file mode 100644
index 0000000..50ad403
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-5763-1.js
@@ -0,0 +1,11 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+try {
+ var TA = Object.getPrototypeOf(Int8Array);
+ var obj = Reflect.construct(TA, [], Int8Array);
+ Int8Array.prototype.values.call(obj).next();
+} catch (e) {}
diff --git a/src/v8/test/mjsunit/regress/regress-5763-2.js b/src/v8/test/mjsunit/regress/regress-5763-2.js
new file mode 100644
index 0000000..0964b7f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-5763-2.js
@@ -0,0 +1,11 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+try {
+ var TA = Object.getPrototypeOf(Int8Array);
+ var obj = Reflect.construct(TA, [], Int8Array);
+ new Int8Array(4).set(obj);
+} catch (e) {}
diff --git a/src/v8/test/mjsunit/regress/regress-5767.js b/src/v8/test/mjsunit/regress/regress-5767.js
new file mode 100644
index 0000000..75c83c0
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-5767.js
@@ -0,0 +1,5 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertEquals("0", Number.MIN_VALUE.toString(35));
diff --git a/src/v8/test/mjsunit/regress/regress-5772.js b/src/v8/test/mjsunit/regress/regress-5772.js
new file mode 100644
index 0000000..e1f68f8
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-5772.js
@@ -0,0 +1,42 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function sloppyPackedArguments() {
+ function f(a) {
+ for (var i = 0; i < 2; i++) {
+ a[i] = 0;
+ }
+ }
+ var boom;
+ function g() {
+ var a = arguments;
+ f(a);
+ boom = a[5];
+ assertEquals(undefined, boom);
+ }
+
+ f([]);
+ g(1);
+})();
+
+(function strictPackedArguments() {
+ "use strict";
+ function f(a) {
+ for (var i = 0; i < 2; i++) {
+ a[i] = 0;
+ }
+ }
+ var boom;
+ function g() {
+ var a = arguments;
+ f(a);
+ boom = a[5];
+ assertEquals(undefined, boom);
+ }
+
+ f([]);
+ g(1);
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-5780.js b/src/v8/test/mjsunit/regress/regress-5780.js
new file mode 100644
index 0000000..5a6f171
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-5780.js
@@ -0,0 +1,16 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function testMutatedPrimitiveToStringTag(primitive) {
+ Object.defineProperty(
+ primitive.__proto__, Symbol.toStringTag,
+ {value: "bogus", configurable: true, writable: false, enumerable: false});
+ assertEquals("[object bogus]", Object.prototype.toString.call(primitive));
+}
+
+testMutatedPrimitiveToStringTag('');
+testMutatedPrimitiveToStringTag(true);
+testMutatedPrimitiveToStringTag(42);
+testMutatedPrimitiveToStringTag(42.42);
+testMutatedPrimitiveToStringTag(Symbol());
diff --git a/src/v8/test/mjsunit/regress/regress-5783.js b/src/v8/test/mjsunit/regress/regress-5783.js
new file mode 100644
index 0000000..828bb3d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-5783.js
@@ -0,0 +1,8 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+class C {}
+class D extends C { constructor(...args) { super(...args, 75) } }
+D.__proto__ = null;
+assertThrows(() => new D(), TypeError);
diff --git a/src/v8/test/mjsunit/regress/regress-578775.js b/src/v8/test/mjsunit/regress/regress-578775.js
new file mode 100644
index 0000000..afeaf3d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-578775.js
@@ -0,0 +1,18 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// https://code.google.com/p/chromium/issues/detail?id=578775
+
+var __v_9 = {};
+for (var __v_0 = 0; __v_0 < 1000; __v_0++) {
+}
+__v_2 = { __v_2: 1 };
+__v_12 = new Proxy({}, {});
+function f() {
+ var __v_10 = new Proxy({}, __v_2);
+ __v_9.__proto__ = __v_10;
+ __v_2.getPrototypeOf = function () { return __v_9 };
+ Object.prototype.isPrototypeOf.call(__v_0, __v_10);
+};
+assertThrows(f, RangeError);
diff --git a/src/v8/test/mjsunit/regress/regress-5790.js b/src/v8/test/mjsunit/regress/regress-5790.js
new file mode 100644
index 0000000..eb40523
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-5790.js
@@ -0,0 +1,20 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+function foo(a) {
+ "use strict";
+ if (a) return arguments[1];
+}
+
+foo(false);
+foo(false);
+%OptimizeFunctionOnNextCall(foo);
+foo(true, 1);
+foo(true, 1);
+%OptimizeFunctionOnNextCall(foo);
+foo(false);
+foo(true, 1);
+assertOptimized(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-580.js b/src/v8/test/mjsunit/regress/regress-580.js
new file mode 100644
index 0000000..6b1d098
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-580.js
@@ -0,0 +1,55 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test constant folding of smi operations that overflow a 32-bit int
+// See http://code.google.com/p/v8/issues/detail?id=580
+
+function num_ops() {
+ var x;
+ var tmp = 0;
+ x = (tmp = 1578221999, tmp)+(tmp = 572285336, tmp);
+ assertEquals(2150507335, x, "++");
+ x = 1578221999 + 572285336;
+ assertEquals(2150507335, x);
+
+ x = (tmp = -1500000000, tmp)+(tmp = -2000000000, tmp);
+ assertEquals(-3500000000, x, "+-");
+ x = -1500000000 + -2000000000;
+ assertEquals(-3500000000, x);
+
+ x = (tmp = 1578221999, tmp)-(tmp = -572285336, tmp);
+ assertEquals(2150507335, x, "--");
+ x = 1578221999 - -572285336;
+ assertEquals(2150507335, x);
+
+ x = (tmp = -1500000000, tmp)-(tmp = 2000000000, tmp);
+ assertEquals(-3500000000, x, "-+");
+ x = -1500000000 - 2000000000;
+ assertEquals(-3500000000, x);
+}
+
+num_ops();
diff --git a/src/v8/test/mjsunit/regress/regress-5802.js b/src/v8/test/mjsunit/regress/regress-5802.js
new file mode 100644
index 0000000..57c8198
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-5802.js
@@ -0,0 +1,113 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+(function() {
+ function eq(a, b) { return a == b; }
+
+ var o = { [Symbol.toPrimitive]: () => "o" };
+
+ assertTrue(eq(o, o));
+ assertTrue(eq(o, o));
+ %OptimizeFunctionOnNextCall(eq);
+ assertTrue(eq(o, o));
+ assertTrue(eq("o", o));
+ assertTrue(eq(o, "o"));
+ %OptimizeFunctionOnNextCall(eq);
+ assertTrue(eq(o, o));
+ assertTrue(eq("o", o));
+ assertTrue(eq(o, "o"));
+ assertOptimized(eq);
+})();
+
+(function() {
+ function ne(a, b) { return a != b; }
+
+ var o = { [Symbol.toPrimitive]: () => "o" };
+
+ assertFalse(ne(o, o));
+ assertFalse(ne(o, o));
+ %OptimizeFunctionOnNextCall(ne);
+ assertFalse(ne(o, o));
+ assertFalse(ne("o", o));
+ assertFalse(ne(o, "o"));
+ %OptimizeFunctionOnNextCall(ne);
+ assertFalse(ne(o, o));
+ assertFalse(ne("o", o));
+ assertFalse(ne(o, "o"));
+ assertOptimized(ne);
+})();
+
+(function() {
+ function eq(a, b) { return a == b; }
+
+ var a = {};
+ var b = {b};
+ var u = %GetUndetectable();
+
+ assertTrue(eq(a, a));
+ assertTrue(eq(b, b));
+ assertFalse(eq(a, b));
+ assertFalse(eq(b, a));
+ assertTrue(eq(a, a));
+ assertTrue(eq(b, b));
+ assertFalse(eq(a, b));
+ assertFalse(eq(b, a));
+ %OptimizeFunctionOnNextCall(eq);
+ assertTrue(eq(a, a));
+ assertTrue(eq(b, b));
+ assertFalse(eq(a, b));
+ assertFalse(eq(b, a));
+ assertTrue(eq(null, u));
+ assertTrue(eq(undefined, u));
+ assertTrue(eq(u, null));
+ assertTrue(eq(u, undefined));
+ %OptimizeFunctionOnNextCall(eq);
+ assertTrue(eq(a, a));
+ assertTrue(eq(b, b));
+ assertFalse(eq(a, b));
+ assertFalse(eq(b, a));
+ assertTrue(eq(null, u));
+ assertTrue(eq(undefined, u));
+ assertTrue(eq(u, null));
+ assertTrue(eq(u, undefined));
+ assertOptimized(eq);
+})();
+
+(function() {
+ function ne(a, b) { return a != b; }
+
+ var a = {};
+ var b = {b};
+ var u = %GetUndetectable();
+
+ assertFalse(ne(a, a));
+ assertFalse(ne(b, b));
+ assertTrue(ne(a, b));
+ assertTrue(ne(b, a));
+ assertFalse(ne(a, a));
+ assertFalse(ne(b, b));
+ assertTrue(ne(a, b));
+ assertTrue(ne(b, a));
+ %OptimizeFunctionOnNextCall(ne);
+ assertFalse(ne(a, a));
+ assertFalse(ne(b, b));
+ assertTrue(ne(a, b));
+ assertTrue(ne(b, a));
+ assertFalse(ne(null, u));
+ assertFalse(ne(undefined, u));
+ assertFalse(ne(u, null));
+ assertFalse(ne(u, undefined));
+ %OptimizeFunctionOnNextCall(ne);
+ assertFalse(ne(a, a));
+ assertFalse(ne(b, b));
+ assertTrue(ne(a, b));
+ assertTrue(ne(b, a));
+ assertFalse(ne(null, u));
+ assertFalse(ne(undefined, u));
+ assertFalse(ne(u, null));
+ assertFalse(ne(u, undefined));
+ assertOptimized(ne);
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-581.js b/src/v8/test/mjsunit/regress/regress-581.js
new file mode 100644
index 0000000..1b40f58
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-581.js
@@ -0,0 +1,47 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var pow30 = Math.pow(2, 30);
+var pow31 = Math.pow(2, 31);
+
+var a = [];
+a[pow31] = 31;
+
+assertEquals(pow31 + 1, a.length);
+assertThrows(function() { a.concat(a); }, RangeError);
+
+var b = [];
+b[pow31 - 3] = 32;
+var ab = a.concat(b);
+assertEquals(2 * pow31 - 1, ab.length);
+assertEquals(31, ab[pow31]);
+assertEquals(32, ab[2 * pow31 - 2]);
+assertEquals(undefined, ab[2 * pow31 - 1]);
+
+var c = [];
+c[pow30] = 30;
+assertThrows(function() { c.concat(c, a); }, RangeError);
diff --git a/src/v8/test/mjsunit/regress/regress-583260.js b/src/v8/test/mjsunit/regress/regress-583260.js
new file mode 100644
index 0000000..b0c01f6
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-583260.js
@@ -0,0 +1,12 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+__v_1 = {
+ has() { return true }
+};
+__v_2 = new Proxy({}, __v_1);
+function __f_5(object) {
+ with (object) { return delete __v_3; }
+}
+ __f_5(__v_2)
diff --git a/src/v8/test/mjsunit/regress/regress-5836.js b/src/v8/test/mjsunit/regress/regress-5836.js
new file mode 100644
index 0000000..2af02fc
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-5836.js
@@ -0,0 +1,7 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var previous = RegExp.lastMatch;
+'hello world'.anchor('"hi"');
+assertEquals(previous, RegExp.lastMatch);
diff --git a/src/v8/test/mjsunit/regress/regress-5845.js b/src/v8/test/mjsunit/regress/regress-5845.js
new file mode 100644
index 0000000..45a580b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-5845.js
@@ -0,0 +1,6 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertDoesNotThrow('/(?:(?=(foo)))?/u.exec("foo")');
+assertThrows('/(?=(foo))?/u.exec("foo")');
diff --git a/src/v8/test/mjsunit/regress/regress-585041.js b/src/v8/test/mjsunit/regress/regress-585041.js
new file mode 100644
index 0000000..c072ed2
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-585041.js
@@ -0,0 +1,21 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f(arr, i) {
+ arr[i] = 50;
+}
+
+function boom(dummy) {
+ var arr = new Array(10);
+ f(arr, 10);
+ if (dummy) {
+ f(arr, -2147483648);
+ }
+}
+
+boom(false);
+%OptimizeFunctionOnNextCall(boom);
+boom(false);
diff --git a/src/v8/test/mjsunit/regress/regress-585775.js b/src/v8/test/mjsunit/regress/regress-585775.js
new file mode 100644
index 0000000..1805b9e
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-585775.js
@@ -0,0 +1,6 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var pattern = /foo/;
+assertEquals(pattern, pattern.compile(pattern));
diff --git a/src/v8/test/mjsunit/regress/regress-587004.js b/src/v8/test/mjsunit/regress/regress-587004.js
new file mode 100644
index 0000000..9dc6052
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-587004.js
@@ -0,0 +1,31 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc --min-semi-space-size=32
+
+// We need to set --min-semi-space-size to enable allocation site pretenuring.
+
+function foo(i) {
+ with({}) {};
+ x = {};
+ x.a = 0.23;
+ x.b = 0.3;
+ return x;
+}
+
+var all = [];
+function step() {
+ for (var i = 0; i < 100; i++) {
+ var z = foo(i);
+ // Write unboxed double in object slack.
+ z.c = 0.1 + z.b
+ all.push(z);
+ }
+ gc(1);
+ gc(1);
+}
+
+step();
+// Now foo will allocate objects in old space.
+step();
diff --git a/src/v8/test/mjsunit/regress/regress-58740.js b/src/v8/test/mjsunit/regress/regress-58740.js
new file mode 100644
index 0000000..ab3e93b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-58740.js
@@ -0,0 +1,35 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// See: http://code.google.com/p/chromium/issues/detail?id=58740
+
+var re = /.+/g;
+re.exec("");
+re.exec("anystring");
+re=/.+/g;
+re.exec("");
+assertEquals(0, re.lastIndex);
diff --git a/src/v8/test/mjsunit/regress/regress-588599.js b/src/v8/test/mjsunit/regress/regress-588599.js
new file mode 100644
index 0000000..eece492
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-588599.js
@@ -0,0 +1,30 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+assertFalse(Infinity == -Infinity);
+assertEquals(Infinity, 1 / 1e-9999);
+assertEquals(-Infinity, 1 / -1e-9999);
diff --git a/src/v8/test/mjsunit/regress/regress-5888.js b/src/v8/test/mjsunit/regress/regress-5888.js
new file mode 100644
index 0000000..0725ac4
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-5888.js
@@ -0,0 +1,76 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load("test/mjsunit/wasm/wasm-constants.js");
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+(function() {
+ var builder = new WasmModuleBuilder();
+ builder.addMemory(32, 32, false);
+ builder.addFunction("test", kSig_i_iii)
+ .addBodyWithEnd([
+// body:
+kExprI64Const, 0xb4, 0x42,
+kExprI64Const, 0x7a,
+kExprI64Const, 0x42,
+kExprI64Const, 0x7a,
+kExprI64Ior,
+kExprI64Ctz,
+kExprI64Ctz,
+kExprI64Shl,
+kExprI64Mul,
+kExprI64Const, 0x41,
+kExprI64Ctz,
+kExprI64Ctz,
+kExprI64Shl,
+kExprF32SConvertI64,
+kExprI64Const, 0x42,
+kExprI64Const, 0x02,
+kExprI64Const, 0x7a,
+kExprI64Mul,
+kExprI64Const, 0x42,
+kExprI64Ctz,
+kExprI64Shl,
+kExprI64Const, 0x7a,
+kExprI64Ctz,
+kExprI64Shl,
+kExprI64Mul,
+kExprI64Const, 0x41,
+kExprI64Ctz,
+kExprI64Ctz,
+kExprI64Shl,
+kExprF32SConvertI64,
+kExprUnreachable,
+kExprEnd, // @65
+ ])
+ .exportFunc();
+ var module = new WebAssembly.Module(builder.toBuffer());
+})();
+
+(function() {
+ var builder = new WasmModuleBuilder();
+ builder.addMemory(16, 32, false);
+ builder.addFunction("test", kSig_i_iii)
+ .addBodyWithEnd([
+ // body:
+ kExprI64Const, 0x42,
+ kExprI64Const, 0x7a,
+ kExprI64Ctz,
+ kExprI64Mul,
+ kExprI64Ctz,
+ kExprI64Const, 0x41,
+ kExprI64Ctz,
+ kExprI64Ctz,
+ kExprI64Shl,
+ kExprI64Const, 0x41,
+ kExprI64Ctz,
+ kExprI64Ctz,
+ kExprI64Shl,
+ kExprF32SConvertI64,
+ kExprUnreachable,
+ kExprEnd, // @20
+ ])
+ .exportFunc();
+ var module = new WebAssembly.Module(builder.toBuffer());
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-590074.js b/src/v8/test/mjsunit/regress/regress-590074.js
new file mode 100644
index 0000000..80ae41b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-590074.js
@@ -0,0 +1,29 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --expose-gc
+
+var __v_5 = {};
+
+function __f_10() {
+ var __v_2 = [0, 0, 0];
+ __v_2[0] = 0;
+ gc();
+ return __v_2;
+}
+
+function __f_2(array) {
+ array[1] = undefined;
+}
+
+function __f_9() {
+ var __v_4 = __f_10();
+ __f_2(__f_10());
+ __v_5 = __f_10();
+ __v_4 = __f_10();
+ __f_2(__v_5);
+}
+__f_9();
+%OptimizeFunctionOnNextCall(__f_9);
+__f_9();
diff --git a/src/v8/test/mjsunit/regress/regress-5902.js b/src/v8/test/mjsunit/regress/regress-5902.js
new file mode 100644
index 0000000..54cb90e
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-5902.js
@@ -0,0 +1,62 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var log = [];
+
+function check(predicate, item) {
+ if (!predicate) log.push(item);
+}
+
+var global = this;
+
+Object.getOwnPropertyNames(global).forEach(function(name) {
+ // Only check for global properties with uppercase names.
+ if (name[0] != name[0].toUpperCase()) return;
+
+ var obj = global[name];
+
+ // Skip non-receivers.
+ if (!%IsJSReceiver(obj)) return;
+
+ // Skip non-natives.
+ if (!obj.toString().includes('native')) return;
+
+ // Construct an instance.
+ try {
+ new obj();
+ } catch (e) {
+ }
+
+ // Check the object.
+ check(%HasFastProperties(obj), `${name}`);
+
+ // Check the constructor.
+ var constructor = obj.constructor;
+ if (!%IsJSReceiver(constructor)) return;
+ check(%HasFastProperties(constructor), `${name}.constructor`);
+
+ // Check the prototype.
+ var prototype = obj.prototype;
+ if (!%IsJSReceiver(prototype)) return;
+ check(%HasFastProperties(prototype), `${name}.prototype`);
+
+ // Check the prototype.constructor.
+ var prototype_constructor = prototype.constructor;
+ if (!%IsJSReceiver(prototype_constructor)) return;
+ check(
+ %HasFastProperties(prototype_constructor),
+ `${name}.prototype.constructor`);
+});
+
+// This is the current set of dictionary mode objects.
+// Remove items as we fix them. See issue 5902.
+assertEquals(
+ [
+ 'Error.prototype',
+ 'EvalError.prototype', 'RangeError.prototype', 'ReferenceError.prototype',
+ 'SyntaxError.prototype', 'TypeError.prototype', 'URIError.prototype'
+ ],
+ log);
diff --git a/src/v8/test/mjsunit/regress/regress-5911.js b/src/v8/test/mjsunit/regress/regress-5911.js
new file mode 100644
index 0000000..0175fd3
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-5911.js
@@ -0,0 +1,32 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load("test/mjsunit/wasm/wasm-constants.js");
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+(function() {
+ var builder = new WasmModuleBuilder();
+ builder.addMemory(32, 32, false);
+ builder.addFunction("test", kSig_i_iii)
+ .addBodyWithEnd([
+ // body:
+ kExprI64Const, 0x42,
+ kExprI64Const, 0x7a,
+ kExprI64RemU,
+ kExprI64Const, 0x42,
+ kExprI64Const, 0x37,
+ kExprI64Mul,
+ kExprI64Const, 0x36,
+ kExprI64Mul,
+ kExprI64Const, 0x42,
+ kExprI64Ctz,
+ kExprI64Ctz,
+ kExprI64Shl,
+ kExprF32SConvertI64,
+ kExprUnreachable,
+ kExprEnd, // @21
+ ])
+ .exportFunc();
+ var module = new WebAssembly.Module(builder.toBuffer());
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-592341.js b/src/v8/test/mjsunit/regress/regress-592341.js
new file mode 100644
index 0000000..2fa4752
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-592341.js
@@ -0,0 +1,36 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function id(a) {
+ return a;
+}
+
+(function LiteralCompareNullDeopt() {
+ function f() {
+ return id(null == %DeoptimizeNow());
+ }
+
+ %OptimizeFunctionOnNextCall(f);
+ assertTrue(f());
+})();
+
+(function LiteralCompareUndefinedDeopt() {
+ function f() {
+ return id(undefined == %DeoptimizeNow());
+ }
+
+ %OptimizeFunctionOnNextCall(f);
+ assertTrue(f());
+})();
+
+(function LiteralCompareTypeofDeopt() {
+ function f() {
+ return id("undefined" == typeof(%DeoptimizeNow()));
+ }
+
+ %OptimizeFunctionOnNextCall(f);
+ assertTrue(f());
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-592352.js b/src/v8/test/mjsunit/regress/regress-592352.js
new file mode 100644
index 0000000..7947fdb
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-592352.js
@@ -0,0 +1,20 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --validate-asm
+
+function __f_76() {
+ "use asm";
+ function __f_72() {
+ %OptimizeFunctionOnNextCall();
+ }
+ return {__f_72:__f_72};
+}
+
+try {
+ assertTrue(%IsAsmWasmCode(__f_76));
+ assertTrue(false);
+} catch (e) {
+ print("Caught: " + e);
+}
diff --git a/src/v8/test/mjsunit/regress/regress-592353.js b/src/v8/test/mjsunit/regress/regress-592353.js
new file mode 100644
index 0000000..f4e3b68
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-592353.js
@@ -0,0 +1,10 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax --no-lazy
+
+with ({}) {}
+f = ({x}) => { };
+%OptimizeFunctionOnNextCall(f);
+f({});
diff --git a/src/v8/test/mjsunit/regress/regress-5927.js b/src/v8/test/mjsunit/regress/regress-5927.js
new file mode 100644
index 0000000..bcec611
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-5927.js
@@ -0,0 +1,7 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let a = Object.freeze({});
+assertThrows(() => class C {[a.b = "foo"]() {}}, TypeError);
+assertThrows(() => class C extends (a.c = null) {}, TypeError);
diff --git a/src/v8/test/mjsunit/regress/regress-593299.js b/src/v8/test/mjsunit/regress/regress-593299.js
new file mode 100644
index 0000000..ce6af1a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-593299.js
@@ -0,0 +1,15 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+
+function h(global) { return global.boom(); }
+function g() { var r = h({}); return r; }
+function f() {
+ var o = {};
+ o.__defineGetter__('prop1', g);
+ o.prop1;
+}
+
+assertThrows(f);
diff --git a/src/v8/test/mjsunit/regress/regress-5938.js b/src/v8/test/mjsunit/regress/regress-5938.js
new file mode 100644
index 0000000..567498e
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-5938.js
@@ -0,0 +1,14 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --lazy-inner-functions
+
+let global = 0;
+{
+ let confusing = 13;
+ function lazy_func(b = confusing) { let confusing = 0; global = b; }
+ lazy_func();
+}
+
+assertEquals(13, global);
diff --git a/src/v8/test/mjsunit/regress/regress-5943.js b/src/v8/test/mjsunit/regress/regress-5943.js
new file mode 100644
index 0000000..df21c20
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-5943.js
@@ -0,0 +1,14 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function createHTML() {
+ return '' + '<div><div><di';
+}
+
+createHTML();
+%OptimizeFunctionOnNextCall(createHTML);
+
+/./.test(createHTML());
diff --git a/src/v8/test/mjsunit/regress/regress-595319.js b/src/v8/test/mjsunit/regress/regress-595319.js
new file mode 100644
index 0000000..46ca274
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-595319.js
@@ -0,0 +1,39 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// https://bugs.chromium.org/p/chromium/issues/detail?id=595319
+// Ensure exceptions are checked for by Array.prototype.concat from adding
+// an element, and that elements are added to array subclasses appropriately
+
+// If adding a property does throw, the exception is propagated
+class MyException extends Error { }
+class NoDefinePropertyArray extends Array {
+ constructor(...args) {
+ super(...args);
+ return new Proxy(this, {
+ defineProperty() { throw new MyException(); }
+ });
+ }
+}
+assertThrows(() => new NoDefinePropertyArray().concat([1]), MyException);
+
+// Ensure elements are added to the instance, rather than calling [[Set]].
+class ZeroGetterArray extends Array { get 0() {} };
+assertArrayEquals([1], new ZeroGetterArray().concat(1));
+
+// Frozen arrays lead to throwing
+
+class FrozenArray extends Array {
+ constructor(...args) { super(...args); Object.freeze(this); }
+}
+assertThrows(() => new FrozenArray().concat([1]), TypeError);
+
+// Non-configurable non-writable zero leads to throwing
+class ZeroFrozenArray extends Array {
+ constructor(...args) {
+ super(...args);
+ Object.defineProperty(this, 0, {value: 1});
+ }
+}
+assertThrows(() => new ZeroFrozenArray().concat([1]), TypeError);
diff --git a/src/v8/test/mjsunit/regress/regress-596718.js b/src/v8/test/mjsunit/regress/regress-596718.js
new file mode 100644
index 0000000..6116427
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-596718.js
@@ -0,0 +1,12 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+Error.prepareStackTrace = function(e, frames) { return frames; }
+assertThrows(() => new Error().stack[0].getMethodName.call({}), TypeError);
+
+Error.prepareStackTrace = function(e, frames) { return frames.map(frame => new Proxy(frame, {})); }
+assertThrows(() => new Error().stack[0].getMethodName(), TypeError);
+
+Error.prepareStackTrace = function(e, frames) { return frames; }
+assertEquals(null, new Error().stack[0].getMethodName());
diff --git a/src/v8/test/mjsunit/regress/regress-5972.js b/src/v8/test/mjsunit/regress/regress-5972.js
new file mode 100644
index 0000000..68fe3ac
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-5972.js
@@ -0,0 +1,17 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var undetectable = %GetUndetectable();
+
+function foo(a) {
+ const o = a ? foo : undetectable;
+ return typeof o === 'function';
+}
+
+assertFalse(foo(false));
+assertFalse(foo(false));
+%OptimizeFunctionOnNextCall(foo);
+assertFalse(foo(false));
diff --git a/src/v8/test/mjsunit/regress/regress-5974.js b/src/v8/test/mjsunit/regress/regress-5974.js
new file mode 100644
index 0000000..b9d2638
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-5974.js
@@ -0,0 +1,9 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(function() {
+ var a = Array(...Array(5)).map(() => 1);
+
+ assertEquals([1, 1, 1, 1, 1], a);
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-599068-func-bindings.js b/src/v8/test/mjsunit/regress/regress-599068-func-bindings.js
new file mode 100644
index 0000000..887c000
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-599068-func-bindings.js
@@ -0,0 +1,45 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Tests function bindings are correctly handled in ignition.
+(function f() {
+ function assignSloppy() {
+ f = 0;
+ }
+ assertDoesNotThrow(assignSloppy);
+
+ function assignStrict() {
+ 'use strict';
+ f = 0;
+ }
+ assertThrows(assignStrict, TypeError);
+
+ function assignStrictLookup() {
+ eval("'use strict'; f = 1;");
+ }
+ assertThrows(assignStrictLookup, TypeError);
+})();
+
+// Tests for compound assignments which are handled differently
+// in crankshaft.
+(function f() {
+ function assignSloppy() {
+ f += "x";
+ }
+ assertDoesNotThrow(assignSloppy);
+ assertDoesNotThrow(assignSloppy);
+ %OptimizeFunctionOnNextCall(assignSloppy);
+ assertDoesNotThrow(assignSloppy);
+
+ function assignStrict() {
+ 'use strict';
+ f += "x";
+ }
+ assertThrows(assignStrict, TypeError);
+ assertThrows(assignStrict, TypeError);
+ %OptimizeFunctionOnNextCall(assignStrict);
+ assertThrows(assignStrict, TypeError);
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-599089-array-push.js b/src/v8/test/mjsunit/regress/regress-599089-array-push.js
new file mode 100644
index 0000000..9049a4b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-599089-array-push.js
@@ -0,0 +1,10 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+
+var array = [1.2, 1.2];
+array.length = 0;
+array.push(undefined);
+assertEquals(1, array.length);
+assertEquals([undefined], array);
diff --git a/src/v8/test/mjsunit/regress/regress-599412.js b/src/v8/test/mjsunit/regress/regress-599412.js
new file mode 100644
index 0000000..d5c411d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-599412.js
@@ -0,0 +1,22 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function h(a) {
+ if (!a) return false;
+ print();
+}
+
+function g(a) { return a.length; }
+g('0');
+g('1');
+
+function f() {
+ h(g([]));
+}
+
+f();
+%OptimizeFunctionOnNextCall(f);
+f();
diff --git a/src/v8/test/mjsunit/regress/regress-599414-array-concat-fast-path.js b/src/v8/test/mjsunit/regress/regress-599414-array-concat-fast-path.js
new file mode 100644
index 0000000..3819233
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-599414-array-concat-fast-path.js
@@ -0,0 +1,11 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var largeArray = 'x'.repeat(999).split('');
+var a = largeArray;
+
+assertThrows(() => {
+ for (;;) {
+ a = a.concat(a, a, a, a, a, a);
+ }}, RangeError);
diff --git a/src/v8/test/mjsunit/regress/regress-599710.js b/src/v8/test/mjsunit/regress/regress-599710.js
new file mode 100644
index 0000000..dd1ba8d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-599710.js
@@ -0,0 +1,49 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var f1 = function() { while (1) { } }
+
+function g1() {
+ var s = "hey";
+ f1 = function() { return true; }
+ if (f1()) { return s; }
+}
+
+%OptimizeFunctionOnNextCall(g1);
+assertEquals("hey", g1());
+
+var f2 = function() { do { } while (1); }
+
+function g2() {
+ var s = "hey";
+ f2 = function() { return true; }
+ if (f2()) { return s; }
+}
+
+%OptimizeFunctionOnNextCall(g2);
+assertEquals("hey", g2());
+
+var f3 = function() { for (;;); }
+
+function g3() {
+ var s = "hey";
+ f3 = function() { return true; }
+ if (f3()) { return s; }
+}
+
+%OptimizeFunctionOnNextCall(g3);
+assertEquals("hey", g3());
+
+var f4 = function() { for (;;); }
+
+function g4() {
+ var s = "hey";
+ f4 = function() { return true; }
+ while (f4()) { return s; }
+}
+
+%OptimizeFunctionOnNextCall(g4);
+assertEquals("hey", g4());
diff --git a/src/v8/test/mjsunit/regress/regress-599717.js b/src/v8/test/mjsunit/regress/regress-599717.js
new file mode 100644
index 0000000..5183186
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-599717.js
@@ -0,0 +1,26 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --validate-asm --allow-natives-syntax
+
+function __f_61(stdlib, foreign, buffer) {
+ "use asm";
+ var __v_14 = new stdlib.Float64Array(buffer);
+ function __f_74() {
+ var __v_35 = 6.0;
+ __v_14[2] = __v_35 + 1.0;
+ }
+ return {__f_74: __f_74};
+}
+var ok = false;
+try {
+ var __v_12 = new ArrayBuffer(2147483648);
+ ok = true;
+} catch (e) {
+ // Can happen on 32 bit systems.
+}
+if (ok) {
+ var module = __f_61(this, null, __v_12);
+ assertTrue(%IsAsmWasmCode(__f_61));
+}
diff --git a/src/v8/test/mjsunit/regress/regress-599719.js b/src/v8/test/mjsunit/regress/regress-599719.js
new file mode 100644
index 0000000..89353a6
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-599719.js
@@ -0,0 +1,25 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --validate-asm
+
+function __f_7() {
+ %DeoptimizeFunction(__f_5);
+}
+function __f_8(global, env) {
+ "use asm";
+ var __f_7 = env.__f_7;
+ function __f_9(i4, i5) {
+ i4 = i4 | 0;
+ i5 = i5 | 0;
+ __f_7();
+ }
+ return {__f_9: __f_9}
+}
+function __f_5() {
+ var __v_5 = __f_8({}, {'__f_7': __f_7});
+ assertTrue(%IsAsmWasmCode(__f_8));
+ __v_5.__f_9(0, 0, 0);
+}
+__f_5();
diff --git a/src/v8/test/mjsunit/regress/regress-599825.js b/src/v8/test/mjsunit/regress/regress-599825.js
new file mode 100644
index 0000000..1b05bee
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-599825.js
@@ -0,0 +1,16 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --validate-asm --allow-natives-syntax
+
+function __f_97(stdlib, buffer) {
+ "use asm";
+ var __v_30 = new stdlib.Int32Array(buffer);
+ function __f_74() {
+ var __v_27 = 4;
+ __v_30[__v_27 >> __v_2] = ((__v_30[-1073741825]|-10) + 2) | 0;
+ }
+}
+var module = __f_97(this);
+assertFalse(%IsAsmWasmCode(__f_97));
diff --git a/src/v8/test/mjsunit/regress/regress-6-9-regexp.js b/src/v8/test/mjsunit/regress/regress-6-9-regexp.js
new file mode 100644
index 0000000..c73b37d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-6-9-regexp.js
@@ -0,0 +1,30 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Check that the perfect mask check isn't overly optimistic.
+
+assertFalse(/[6-9]/.test('2'));
diff --git a/src/v8/test/mjsunit/regress/regress-602970.js b/src/v8/test/mjsunit/regress/regress-602970.js
new file mode 100644
index 0000000..927d3bf
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-602970.js
@@ -0,0 +1,17 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --debug-code
+
+// flag --debug-code ensures that we'll abort with a failed smi check without
+// the fix.
+
+var num = new Number(10);
+Array.prototype.__defineGetter__(0,function(){
+ return num;
+})
+Array.prototype.__defineSetter__(0,function(value){
+})
+var str=decodeURI("%E7%9A%84");
+assertEquals(0x7684, str.charCodeAt(0));
diff --git a/src/v8/test/mjsunit/regress/regress-603.js b/src/v8/test/mjsunit/regress/regress-603.js
new file mode 100644
index 0000000..f9344ee
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-603.js
@@ -0,0 +1,64 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Calling non-objects directly or via Function.prototype.call should
+// not mess up the stack.
+// http://code.google.com/p/v8/issues/detail?id=603
+
+var re = /b../;
+assertThrows(function() {
+ return re('abcdefghijklm') + 'z';
+});
+
+var re1 = /c../;
+re1.call = Function.prototype.call;
+assertThrows(function() {
+ re1.call(null, 'abcdefghijklm') + 'z';
+});
+
+var re2 = /d../;
+assertThrows(function() {
+ Function.prototype.call.call(re2, null, 'abcdefghijklm') + 'z';
+});
+
+var re3 = /e../;
+assertThrows(function() {
+ Function.prototype.call.apply(
+ re3, [null, 'abcdefghijklm']) + 'z';
+});
+
+var re4 = /f../;
+assertThrows(function() {
+ Function.prototype.apply.call(
+ re4, null, ['abcdefghijklm']) + 'z';
+});
+
+var re5 = /g../;
+assertThrows(function() {
+ Function.prototype.apply.apply(
+ re4, [null, ['abcdefghijklm']]) + 'z';
+});
diff --git a/src/v8/test/mjsunit/regress/regress-604044.js b/src/v8/test/mjsunit/regress/regress-604044.js
new file mode 100644
index 0000000..df8855e
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-604044.js
@@ -0,0 +1,5 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(function(_ = function() {}){})
diff --git a/src/v8/test/mjsunit/regress/regress-605470.js b/src/v8/test/mjsunit/regress/regress-605470.js
new file mode 100644
index 0000000..8c9de85
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-605470.js
@@ -0,0 +1,15 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function function_with_m_args(m) {
+ var source = '(function f() { return; })(';
+ for (var arg = 0; arg < m ; arg++) {
+ if (arg != 0) source += ',';
+ source += arg;
+ }
+ source += ')';
+ return eval(source);
+}
+
+function_with_m_args(0x7FFF);
diff --git a/src/v8/test/mjsunit/regress/regress-606021.js b/src/v8/test/mjsunit/regress/regress-606021.js
new file mode 100644
index 0000000..54b283e
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-606021.js
@@ -0,0 +1,32 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo() {
+ return function(c) {
+ var double_var = [3.0, 3.5][0];
+ var literal = c ? [1, double_var] : [double_var, 3.5];
+ return literal[0];
+ };
+}
+
+var f1 = foo();
+var f2 = foo();
+
+// Both closures point to full code.
+f1(false);
+f2(false);
+
+// Optimize f1, but don't initialize the [1, double_var] literal.
+%OptimizeFunctionOnNextCall(f1);
+f1(false);
+
+// Initialize the [1, double_var] literal, and transition the boilerplate to
+// double.
+f2(true);
+
+// Trick crankshaft into writing double_var at the wrong position.
+var l = f1(true);
+assertEquals(1, l);
diff --git a/src/v8/test/mjsunit/regress/regress-6063.js b/src/v8/test/mjsunit/regress/regress-6063.js
new file mode 100644
index 0000000..4a0d168
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-6063.js
@@ -0,0 +1,17 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var U16 = new Uint16Array(2);
+U16[0] = 0xffff;
+
+function foo(a, i) {
+ return U16[0] === 0xffff;
+}
+
+assertTrue(foo());
+assertTrue(foo());
+%OptimizeFunctionOnNextCall(foo);
+assertTrue(foo());
diff --git a/src/v8/test/mjsunit/regress/regress-6082.js b/src/v8/test/mjsunit/regress/regress-6082.js
new file mode 100644
index 0000000..aec1be0
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-6082.js
@@ -0,0 +1,11 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo() { return Number.isNaN(); }
+assertFalse(foo());
+assertFalse(foo());
+%OptimizeFunctionOnNextCall(foo);
+assertFalse(foo());
diff --git a/src/v8/test/mjsunit/regress/regress-608630.js b/src/v8/test/mjsunit/regress/regress-608630.js
new file mode 100644
index 0000000..58a95af
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-608630.js
@@ -0,0 +1,71 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --validate-asm --allow-natives-syntax
+
+var __v_5 = {};
+var __v_35 = {};
+var __v_44 = {};
+var __v_43 = {};
+
+try {
+__v_1 = 1;
+__v_2 = {
+ get: function() { return function() {} },
+ has() { return true },
+ getOwnPropertyDescriptor: function() {
+ if (__v_1-- == 0) throw "please die";
+ return {value: function() {}, configurable: true};
+ }
+};
+__v_3 = new Proxy({}, __v_2);
+__v_30 = Object.create(__v_35);
+with (__v_5) { f() }
+} catch(e) { print("Caught: " + e); }
+
+function __f_1(asmfunc, expect) {
+ var __v_1 = asmfunc.toString();
+ var __v_2 = __v_1.replace(new RegExp("use asm"), "");
+ var __v_39 = {Math: Math};
+ var __v_4 = eval("(" + __v_2 + ")")(__v_3);
+ print("Testing " + asmfunc.name + " (js)...");
+ __v_44.valueOf = __v_43;
+ expect(__v_4);
+ print("Testing " + asmfunc.name + " (asm.js)...");
+ var __v_5 = asmfunc(__v_3);
+ expect(__v_5);
+ print("Testing " + asmfunc.name + " (wasm)...");
+ var module_func = eval(__v_1);
+ var __v_6 = module_func({}, __v_3);
+ assertTrue(%IsAsmWasmCode(module_func));
+ expect(__v_6);
+}
+function __f_2() {
+ "use asm";
+ function __f_3() { return 0; }
+ function __f_4() { return 1; }
+ function __f_5() { return 4; }
+ function __f_6() { return 64; }
+ function __f_7() { return 137; }
+ function __f_8() { return 128; }
+ function __f_9() { return -1; }
+ function __f_10() { return 1000; }
+ function __f_11() { return 2000000; }
+ function __f_12() { return 2147483647; }
+ return {__f_3: __f_3, __f_4: __f_4, __f_5: __f_5, __f_6: __f_6, __f_7: __f_7, __f_8: __f_8,
+ __f_9: __f_9, __f_10: __f_10, __f_11, __f_12: __f_12};
+}
+try {
+__f_1(__f_2, function(module) {
+ assertEquals(0, module.__f_3());
+ assertEquals(1, module.__f_4());
+ assertEquals(4, module.__f_5());
+ assertEquals(64, module.__f_6());
+ assertEquals(128, module.__f_8());
+ assertEquals(-1, module.__f_9());
+ assertEquals(1000, module.__f_10());
+ assertEquals(2000000, module.__f_11());
+ assertEquals(2147483647, module.__f_12());
+});
+} catch(e) { print("Caught: " + e); }
diff --git a/src/v8/test/mjsunit/regress/regress-610633.js b/src/v8/test/mjsunit/regress/regress-610633.js
new file mode 100644
index 0000000..8ee0e7e
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-610633.js
@@ -0,0 +1,40 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function getLength(a) {
+ return a.length;
+}
+
+function getByteLength(a) {
+ return a.byteLength;
+}
+
+function getByteOffset(a) {
+ return a.byteOffset;
+}
+
+var a = new Uint8Array([1, 2, 3]);
+getLength(a);
+getLength(a);
+
+Object.defineProperty(a.__proto__, 'length', {value: 42});
+
+assertEquals(42, getLength(a));
+assertEquals(42, a.length);
+
+getByteLength(a);
+getByteLength(a);
+
+Object.defineProperty(a.__proto__, 'byteLength', {value: 42});
+
+assertEquals(42, getByteLength(a));
+assertEquals(42, a.byteLength);
+
+getByteOffset(a);
+getByteOffset(a);
+
+Object.defineProperty(a.__proto__, 'byteOffset', {value: 42});
+
+assertEquals(42, getByteOffset(a));
+assertEquals(42, a.byteOffset);
diff --git a/src/v8/test/mjsunit/regress/regress-612.js b/src/v8/test/mjsunit/regress/regress-612.js
new file mode 100644
index 0000000..aee6d53
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-612.js
@@ -0,0 +1,44 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Tests intercation between __defineGetter__/__defineSetter and fast and slow
+// mode of the objects due to series of assignments optimization.
+// (See http://code.google.com/p/v8/issues/detail?id=612)
+
+obj = {}
+
+// Define getter which currently moves object into slow mode.
+obj.__defineGetter__('foobar', function() { return 42; })
+
+// Starts initialization block mode. And turns object into slow mode.
+obj.a = 1
+obj.b = 2;
+obj.c = 3;
+// Now object is turned into fast mode, but it has getter defined above...
+
+// Now assert is triggered.
+obj.__defineGetter__('foobar', function() { return 42; })
diff --git a/src/v8/test/mjsunit/regress/regress-6121.js b/src/v8/test/mjsunit/regress/regress-6121.js
new file mode 100644
index 0000000..c29ba2b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-6121.js
@@ -0,0 +1,23 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(o) {
+ try {
+ for (var x in o) {}
+ return false;
+ } catch (e) {
+ return true;
+ }
+}
+
+var o = new Proxy({a:1},{
+ getOwnPropertyDescriptor(target, property) { throw target; }
+});
+
+assertTrue(foo(o));
+assertTrue(foo(o));
+%OptimizeFunctionOnNextCall(foo);
+assertTrue(foo(o));
diff --git a/src/v8/test/mjsunit/regress/regress-612146.js b/src/v8/test/mjsunit/regress/regress-612146.js
new file mode 100644
index 0000000..1bd3f0b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-612146.js
@@ -0,0 +1,33 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f() {
+ var arguments_ = arguments;
+ if (undefined) {
+ while (true) {
+ arguments_[0];
+ }
+ } else {
+ %DeoptimizeNow();
+ return arguments_[0];
+ }
+};
+
+f(0);
+f(0);
+%OptimizeFunctionOnNextCall(f);
+assertEquals(1, f(1));
+
+function g() {
+ var a = arguments;
+ %DeoptimizeNow();
+ return a.length;
+}
+
+g(1);
+g(1);
+%OptimizeFunctionOnNextCall(g);
+assertEquals(1, g(1));
diff --git a/src/v8/test/mjsunit/regress/regress-612412.js b/src/v8/test/mjsunit/regress/regress-612412.js
new file mode 100644
index 0000000..3debe66
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-612412.js
@@ -0,0 +1,20 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function counter() { return {x: 0} || this }
+
+var f = (function() {
+ "use asm";
+ return function g(c1, c2) {
+ for (var x = 0 ; x < 10; ++x) {
+ if (x == 5) %OptimizeOsr();
+ c1();
+ }
+ }
+})();
+
+g = (function() { f((Array), counter()); });
+g();
diff --git a/src/v8/test/mjsunit/regress/regress-613928.js b/src/v8/test/mjsunit/regress/regress-613928.js
new file mode 100644
index 0000000..7de4da7
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-613928.js
@@ -0,0 +1,19 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --validate-asm --allow-natives-syntax
+
+(function __f_54() {
+ function __f_41(stdlib, __v_35) {
+ "use asm";
+ __v_35 = __v_35;
+ function __f_21(int_val, double_val) {
+ int_val = int_val|0;
+ double_val = +double_val;
+ }
+ return {__f_21:__f_21};
+ }
+ __f_41();
+ assertFalse(%IsAsmWasmCode(__f_41));
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-6142.js b/src/v8/test/mjsunit/regress/regress-6142.js
new file mode 100644
index 0000000..9f09d5a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-6142.js
@@ -0,0 +1,27 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+try {
+ eval('a: { continue a; }');
+ assertUnreachable();
+} catch(e) {
+ assertTrue(e instanceof SyntaxError);
+ assertEquals('Illegal continue statement: \'a\' does not denote an iteration statement', e.message);
+}
+
+try {
+ eval('continue;');
+ assertUnreachable();
+} catch(e) {
+ assertTrue(e instanceof SyntaxError);
+ assertEquals('Illegal continue statement: no surrounding iteration statement', e.message);
+}
+
+try {
+ eval('a: { continue b;}');
+ assertUnreachable();
+} catch(e) {
+ assertTrue(e instanceof SyntaxError);
+ assertEquals("Undefined label 'b'", e.message);
+}
diff --git a/src/v8/test/mjsunit/regress/regress-615776.js b/src/v8/test/mjsunit/regress/regress-615776.js
new file mode 100644
index 0000000..7e89b56
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-615776.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+Object.defineProperty(Int32Array.prototype.__proto__, 'length', {
+ get: function() { throw new Error('Custom length property'); }
+});
+
+var a = Math.random();
+
+// This tests MathRandomRaw.
+var v0 = new Set();
+var v1 = new Object();
+v0.add(v1);
diff --git a/src/v8/test/mjsunit/regress/regress-616386.js b/src/v8/test/mjsunit/regress/regress-616386.js
new file mode 100644
index 0000000..d462ab7
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-616386.js
@@ -0,0 +1,10 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --no-lazy
+
+assertEquals(0, ((y = (function(a2) { bbbb = a2 }), bbbb = eval('1')) => {y(0); return bbbb})())
+assertEquals(0, (({y = (function(a2) { bbbb = a2 }), bbbb = eval('1')} = {}) => {y(0); return bbbb})())
+assertEquals(0, (function (y = (function(a2) { bbbb = a2 }), bbbb = eval('1')) {y(0); return bbbb})())
+assertEquals(0, (function ({y = (function(a2) { bbbb = a2 }), bbbb = eval('1')} = {}) {y(0); return bbbb})())
diff --git a/src/v8/test/mjsunit/regress/regress-617525.js b/src/v8/test/mjsunit/regress/regress-617525.js
new file mode 100644
index 0000000..fb22f6a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-617525.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --validate-asm --allow-natives-syntax
+
+function __f_14() {
+ "use asm";
+ function __f_15() { return 0; }
+ function __f_15() { return 137; } // redeclared function
+ return {};
+}
+__f_14();
+assertFalse(%IsAsmWasmCode(__f_14));
diff --git a/src/v8/test/mjsunit/regress/regress-617526.js b/src/v8/test/mjsunit/regress/regress-617526.js
new file mode 100644
index 0000000..b3e02fc
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-617526.js
@@ -0,0 +1,24 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --validate-asm --allow-natives-syntax
+
+// Changing the code a little to avoid infinite loop
+
+function __f_109() {
+ "use asm";
+ function __f_18() {
+ var a = 0;
+ while(2147483648) {
+ a = 1;
+ break;
+ }
+ return a|0;
+ }
+ return {__f_18: __f_18};
+}
+
+var wasm = __f_109();
+assertTrue(%IsAsmWasmCode(__f_109));
+assertEquals(1, wasm.__f_18());
diff --git a/src/v8/test/mjsunit/regress/regress-617529.js b/src/v8/test/mjsunit/regress/regress-617529.js
new file mode 100644
index 0000000..042fef1
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-617529.js
@@ -0,0 +1,17 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --validate-asm --allow-natives-syntax
+
+function __f_71(stdlib, buffer) {
+ "use asm";
+ var __v_22 = new stdlib.Float64Array(buffer);
+ function __f_26() {
+ __v_22 = __v_22;
+ }
+ return {__f_26: __f_26};
+}
+
+__f_71(this);
+assertFalse(%IsAsmWasmCode(__f_71));
diff --git a/src/v8/test/mjsunit/regress/regress-618.js b/src/v8/test/mjsunit/regress/regress-618.js
new file mode 100644
index 0000000..ddc0c19
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-618.js
@@ -0,0 +1,86 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Simple class using inline constructor.
+function C1() {
+ this.x = 23;
+};
+var c1 = new C1();
+assertEquals(23, c1.x);
+assertEquals("undefined", typeof c1.y);
+
+// Add setter somewhere on the prototype chain after having constructed the
+// first instance.
+C1.prototype = { set x(value) { this.y = 23; } };
+var c1 = new C1();
+assertEquals("undefined", typeof c1.x);
+assertEquals(23, c1.y);
+
+// Simple class using inline constructor.
+function C2() {
+ this.x = 23;
+};
+var c2 = new C2();
+assertEquals(23, c2.x);
+assertEquals("undefined", typeof c2.y);
+
+// Add setter somewhere on the prototype chain after having constructed the
+// first instance.
+C2.prototype.__proto__ = { set x(value) { this.y = 23; } };
+var c2 = new C2();
+assertEquals("undefined", typeof c2.x);
+assertEquals(23, c2.y);
+
+// Simple class using inline constructor.
+function C3() {
+ this.x = 23;
+};
+var c3 = new C3();
+assertEquals(23, c3.x);
+assertEquals("undefined", typeof c3.y);
+
+// Add setter somewhere on the prototype chain after having constructed the
+// first instance.
+C3.prototype.__defineSetter__('x', function(value) { this.y = 23; });
+var c3 = new C3();
+assertEquals("undefined", typeof c3.x);
+assertEquals(23, c3.y);
+
+// Simple class using inline constructor.
+function C4() {
+ this.x = 23;
+};
+var c4 = new C4();
+assertEquals(23, c4.x);
+assertEquals("undefined", typeof c4.y);
+
+// Add setter somewhere on the prototype chain after having constructed the
+// first instance.
+C4.prototype.__proto__.__defineSetter__('x', function(value) { this.y = 23; });
+var c4 = new C4();
+assertEquals("undefined", typeof c4.x);
+assertEquals(23, c4.y);
diff --git a/src/v8/test/mjsunit/regress/regress-6186.js b/src/v8/test/mjsunit/regress/regress-6186.js
new file mode 100644
index 0000000..452b2b7
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-6186.js
@@ -0,0 +1,5 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertEquals("b", "a".replace(/a/, new Proxy(() => "b", {})));
diff --git a/src/v8/test/mjsunit/regress/regress-618608.js b/src/v8/test/mjsunit/regress/regress-618608.js
new file mode 100644
index 0000000..33c5fbf
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-618608.js
@@ -0,0 +1,1434 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --validate-asm --allow-natives-syntax --opt --no-always-opt
+
+// /v8/test/mjsunit/regress/regress-crbug-431602.js
+// /v8/test/mjsunit/lazy-load.js
+// /v8/test/mjsunit/wasm/asm-wasm.js
+// /v8/test/mjsunit/debug-toggle-mirror-cache.js
+// /v8/test/mjsunit/debug-stack-check-position.js
+
+// Begin stripped down and modified version of mjsunit.js for easy minimization in CF.
+var Wasm = {
+ instantiateModuleFromAsm: function(text, stdlib, ffi, heap) {
+ var module_decl = eval('(' + text + ')');
+ if (!%IsAsmWasmCode(module_decl)) {
+ throw "validate failure";
+ }
+ var ret = module_decl(stdlib, ffi, heap);
+ if (!%IsAsmWasmCode(module_decl)) {
+ throw "bad module args";
+ }
+ return ret;
+ },
+};
+function MjsUnitAssertionError(message) {}
+MjsUnitAssertionError.prototype.toString = function () { return this.message; };
+var assertSame;
+var assertEquals;
+var assertEqualsDelta;
+var assertArrayEquals;
+var assertPropertiesEqual;
+var assertToStringEquals;
+var assertTrue;
+var assertFalse;
+var triggerAssertFalse;
+var assertNull;
+var assertNotNull;
+var assertThrows;
+var assertDoesNotThrow;
+var assertInstanceof;
+var assertUnreachable;
+var assertOptimized;
+var assertUnoptimized;
+function classOf(object) { var string = Object.prototype.toString.call(object); return string.substring(8, string.length - 1); }
+function PrettyPrint(value) { return ""; }
+function PrettyPrintArrayElement(value, index, array) { return ""; }
+function fail(expectedText, found, name_opt) { }
+function deepObjectEquals(a, b) { var aProps = Object.keys(a); aProps.sort(); var bProps = Object.keys(b); bProps.sort(); if (!deepEquals(aProps, bProps)) { return false; } for (var i = 0; i < aProps.length; i++) { if (!deepEquals(a[aProps[i]], b[aProps[i]])) { return false; } } return true; }
+function deepEquals(a, b) { if (a === b) { if (a === 0) return (1 / a) === (1 / b); return true; } if (typeof a != typeof b) return false; if (typeof a == "number") return isNaN(a) && isNaN(b); if (typeof a !== "object" && typeof a !== "function") return false; var objectClass = classOf(a); if (objectClass !== classOf(b)) return false; if (objectClass === "RegExp") { return (a.toString() === b.toString()); } if (objectClass === "Function") return false; if (objectClass === "Array") { var elementCount = 0; if (a.length != b.length) { return false; } for (var i = 0; i < a.length; i++) { if (!deepEquals(a[i], b[i])) return false; } return true; } if (objectClass == "String" || objectClass == "Number" || objectClass == "Boolean" || objectClass == "Date") { if (a.valueOf() !== b.valueOf()) return false; } return deepObjectEquals(a, b); }
+assertSame = function assertSame(expected, found, name_opt) { if (found === expected) { if (expected !== 0 || (1 / expected) == (1 / found)) return; } else if ((expected !== expected) && (found !== found)) { return; } fail(PrettyPrint(expected), found, name_opt); }; assertEquals = function assertEquals(expected, found, name_opt) { if (!deepEquals(found, expected)) { fail(PrettyPrint(expected), found, name_opt); } };
+assertEqualsDelta = function assertEqualsDelta(expected, found, delta, name_opt) { assertTrue(Math.abs(expected - found) <= delta, name_opt); };
+assertArrayEquals = function assertArrayEquals(expected, found, name_opt) { var start = ""; if (name_opt) { start = name_opt + " - "; } assertEquals(expected.length, found.length, start + "array length"); if (expected.length == found.length) { for (var i = 0; i < expected.length; ++i) { assertEquals(expected[i], found[i], start + "array element at index " + i); } } };
+assertPropertiesEqual = function assertPropertiesEqual(expected, found, name_opt) { if (!deepObjectEquals(expected, found)) { fail(expected, found, name_opt); } };
+assertToStringEquals = function assertToStringEquals(expected, found, name_opt) { if (expected != String(found)) { fail(expected, found, name_opt); } };
+assertTrue = function assertTrue(value, name_opt) { assertEquals(true, value, name_opt); };
+assertFalse = function assertFalse(value, name_opt) { assertEquals(false, value, name_opt); };
+assertNull = function assertNull(value, name_opt) { if (value !== null) { fail("null", value, name_opt); } };
+assertNotNull = function assertNotNull(value, name_opt) { if (value === null) { fail("not null", value, name_opt); } };
+assertThrows = function assertThrows(code, type_opt, cause_opt) { var threwException = true; try { if (typeof code == 'function') { code(); } else { eval(code); } threwException = false; } catch (e) { if (typeof type_opt == 'function') { assertInstanceof(e, type_opt); } if (arguments.length >= 3) { assertEquals(e.type, cause_opt); } return; } };
+assertInstanceof = function assertInstanceof(obj, type) { if (!(obj instanceof type)) { var actualTypeName = null; var actualConstructor = Object.getPrototypeOf(obj).constructor; if (typeof actualConstructor == "function") { actualTypeName = actualConstructor.name || String(actualConstructor); } fail("Object <" + PrettyPrint(obj) + "> is not an instance of <" + (type.name || type) + ">" + (actualTypeName ? " but of < " + actualTypeName + ">" : "")); } };
+assertDoesNotThrow = function assertDoesNotThrow(code, name_opt) { try { if (typeof code == 'function') { code(); } else { eval(code); } } catch (e) { fail("threw an exception: ", e.message || e, name_opt); } };
+assertUnreachable = function assertUnreachable(name_opt) { var message = "Fail" + "ure: unreachable"; if (name_opt) { message += " - " + name_opt; } };
+var OptimizationStatus = function() {}
+assertUnoptimized = function assertUnoptimized(fun, sync_opt, name_opt) { if (sync_opt === undefined) sync_opt = ""; assertTrue(OptimizationStatus(fun, sync_opt) != 1, name_opt); }
+assertOptimized = function assertOptimized(fun, sync_opt, name_opt) { if (sync_opt === undefined) sync_opt = ""; assertTrue(OptimizationStatus(fun, sync_opt) != 2, name_opt); }
+triggerAssertFalse = function() { }
+try { console.log; print = console.log; alert = console.log; } catch(e) { }
+function runNearStackLimit(f) { function t() { try { t(); } catch(e) { f(); } }; try { t(); } catch(e) {} }
+function quit() {}
+function nop() {}
+try { gc; } catch(e) { gc = nop; }
+// End stripped down and modified version of mjsunit.js.
+
+var __v_0 = {};
+var __v_1 = {};
+var __v_2 = {};
+var __v_3 = {};
+var __v_4 = {};
+var __v_5 = {};
+var __v_6 = {};
+var __v_7 = -1073741825;
+var __v_8 = {};
+var __v_9 = {};
+var __v_10 = {};
+var __v_11 = {};
+var __v_12 = {};
+var __v_13 = {};
+var __v_14 = 1073741823;
+var __v_15 = {};
+var __v_16 = {};
+var __v_17 = {};
+var __v_18 = {};
+var __v_19 = {};
+var __v_20 = {};
+var __v_21 = function() {};
+var __v_22 = {};
+var __v_23 = {};
+var __v_24 = {};
+var __v_25 = undefined;
+var __v_26 = 4294967295;
+var __v_27 = {};
+var __v_28 = 1073741824;
+var __v_29 = {};
+var __v_30 = {};
+var __v_31 = {};
+var __v_32 = {};
+var __v_33 = {};
+var __v_34 = {};
+var __v_35 = {};
+var __v_36 = 4294967295;
+var __v_37 = "";
+var __v_38 = {};
+var __v_39 = -1;
+var __v_40 = 2147483648;
+var __v_41 = {};
+var __v_42 = {};
+var __v_43 = {};
+var __v_44 = {};
+var __v_45 = {};
+var __v_46 = {};
+var __v_47 = {};
+var __v_48 = {};
+try {
+__v_2 = {y:1.5};
+__v_2.y = 0;
+__v_1 = __v_2.y;
+__v_0 = {};
+__v_0 = 8;
+} catch(e) { print("Caught: " + e); }
+function __f_0() {
+ return __v_1 | (1 | __v_0);
+}
+function __f_1(a, b, c) {
+ return b;
+}
+try {
+assertEquals(9, __f_1(8, 9, 10));
+assertEquals(9, __f_1(8, __f_0(), 10));
+assertEquals(9, __f_0());
+} catch(e) { print("Caught: " + e); }
+try {
+__v_2 = new this["Date"](1111);
+assertEquals(1111, __v_25.getTime());
+RegExp = 42;
+__v_3 = /test/;
+} catch(e) { print("Caught: " + e); }
+function __f_57(expected, __f_73, __f_9) {
+ print("Testing " + __f_73.name + "...");
+ assertEquals(expected, Wasm.instantiateModuleFromAsm( __f_73.toString(), __f_9).__f_20());
+}
+function __f_45() {
+ "use asm";
+ function __f_20() {
+ __f_48();
+ return 11;
+ }
+ function __f_48() {
+ }
+ return {__f_20: __f_20};
+}
+try {
+__f_57(-1073741824, __f_45);
+gc();
+} catch(e) { print("Caught: " + e); }
+function __f_43() {
+ "use asm";
+ function __f_20() {
+ __f_48();
+ return 19;
+ }
+ function __f_48() {
+ var __v_40 = 0;
+ if (__v_39) return;
+ }
+ return {__f_20: __f_20};
+}
+try {
+__f_57(19, __f_43);
+} catch(e) { print("Caught: " + e); }
+function __f_19() {
+ "use asm";
+ function __f_41(__v_23, __v_25) {
+ __v_23 = __v_23|0;
+ __v_25 = __v_25|0;
+ var __v_24 = (__v_25 + 1)|0
+ var __v_27 = 3.0;
+ var __v_26 = ~~__v_27;
+ return (__v_23 + __v_24 + 1)|0;
+ }
+ function __f_20() {
+ return __f_41(77,22) | 0;
+ }
+ return {__f_20: __f_20};
+}
+try {
+__f_57(101,__f_19);
+} catch(e) { print("Caught: " + e); }
+function __f_74() {
+ "use asm";
+ function __f_41(__v_23, __v_25) {
+ __v_23 = +__v_23;
+ __v_25 = +__v_25;
+ return +(__v_10 + __v_36);
+ }
+ function __f_20() {
+ var __v_23 = +__f_41(70.1,10.2);
+ var __v_12 = 0|0;
+ if (__v_23 == 80.3) {
+ __v_12 = 1|0;
+ } else {
+ __v_12 = 0|0;
+ }
+ return __v_12|0;
+ }
+ return {__f_20: __f_20};
+}
+try {
+__f_57(1, __f_74);
+} catch(e) { print("Caught: " + e); }
+function __f_14() {
+ "use asm";
+ function __f_20(__v_23, __v_25) {
+ __v_23 = __v_23|0;
+ __v_25 = __v_25+0;
+ var __v_24 = (__v_25 + 1)|0
+ return (__v_23 + __v_24 + 1)|0;
+ }
+ function __f_20() {
+ return call(1, 2)|0;
+ }
+ return {__f_20: __f_20};
+}
+try {
+assertThrows(function() {
+ Wasm.instantiateModuleFromAsm(__f_14.toString()).__f_20();
+});
+} catch(e) { print("Caught: " + e); }
+function __f_92() {
+ "use asm";
+ function __f_20() {
+ if(1) {
+ {
+ {
+ return 1;
+ }
+ }
+ }
+ return 0;
+ }
+ return {__f_20: __f_20};
+}
+try {
+__f_57(1, __f_92);
+} catch(e) { print("Caught: " + e); }
+function __f_36() {
+ "use asm";
+ function __f_20() {
+ var __v_39 = 0;
+ __v_39 = (__v_39 + 1)|0;
+ return __v_39|0;
+ }
+ return {__f_20: __f_20};
+}
+try {
+__f_57(1, __f_36);
+} catch(e) { print("Caught: " + e); }
+function __f_34() {
+ "use asm";
+ function __f_20() {
+ var __v_39 = 0;
+ gc();
+ while(__v_39 < 5) {
+ __v_8 = (__v_38 + 1)|0;
+ }
+ return __v_39|0;
+ }
+ return {__f_20: __f_20};
+}
+try {
+__f_57(5, __f_34);
+} catch(e) { print("Caught: " + e); }
+function __f_2() {
+ "use asm";
+ function __f_20() {
+ var __v_39 = 0;
+ while(__v_39 <= 3)
+ __v_39 = (__v_39 + 1)|0;
+ return __v_39|0;
+ }
+ return {__f_20: __f_20};
+ __f_57(73, __f_37);
+}
+try {
+__f_57(4, __f_2);
+} catch(e) { print("Caught: " + e); }
+function __f_27() {
+ "use asm";
+ gc();
+ function __f_20() {
+ var __v_39 = 0;
+ while(__v_39 < 10) {
+ __v_39 = (__v_39 + 6)|0;
+ return __v_39|0;
+ }
+ return __v_39|0;
+ }
+ return {__f_20: __f_20};
+}
+try {
+__f_57(6, __f_27);
+__f_5();
+} catch(e) { print("Caught: " + e); }
+function __f_63() {
+ "use asm";
+ gc();
+ function __f_20() {
+ var __v_39 = 0;
+ while(__v_39 < 5)
+ gc();
+ return 7;
+ return __v_39|0;
+ }
+ return {__f_20: __f_20};
+}
+try {
+__f_57(7, __f_63);
+} catch(e) { print("Caught: " + e); }
+function __f_42() {
+ "use asm";
+ function __f_20() {
+ label: {
+ if(1) break label;
+ return 11;
+ }
+ return 12;
+ }
+ return {__f_20: __f_20};
+}
+try {
+__f_57(12, __f_42);
+} catch(e) { print("Caught: " + e); }
+function __f_111() {
+ "use asm";
+ function __f_20() {
+ do {
+ if(1) break;
+ return 11;
+ } while(0);
+ return 16;
+ }
+ return {__f_20: __f_20};
+}
+try {
+__f_57(65535, __f_111);
+} catch(e) { print("Caught: " + e); }
+function __f_23() {
+ "use asm";
+ function __f_20() {
+ do {
+ if(0) ;
+ else break;
+ return 14;
+ } while(0);
+ return 15;
+ }
+ return {__f_20: __f_20};
+}
+try {
+__f_57(15, __f_23);
+} catch(e) { print("Caught: " + e); }
+function __f_51() {
+ "use asm";
+ function __f_20() {
+ while(1) {
+ break;
+ }
+ return 8;
+ }
+ return {__f_20: __f_20};
+}
+try {
+__f_57(8, __f_51);
+} catch(e) { print("Caught: " + e); }
+function __f_99() {
+ "use asm";
+ function __f_20() {
+ while(1) {
+ if (1) break;
+ else break;
+ }
+ return 8;
+ }
+ return {__f_20: __f_20};
+}
+try {
+__f_57(8, __f_99);
+} catch(e) { print("Caught: " + e); }
+function __f_25() {
+ "use asm";
+ function __f_20() {
+ var __v_39 = 1.0;
+ while(__v_39 < 1.5) {
+ while(1)
+ break;
+ __v_39 = +(__v_39 + 0.25);
+ }
+ var __v_12 = 0;
+ if (__v_39 == 1.5) {
+ __v_12 = 9;
+ }
+ return __v_12|0;
+ }
+ return {__f_20: __f_20};
+}
+try {
+__f_57(9, __f_25);
+} catch(e) { print("Caught: " + e); }
+function __f_4() {
+ "use asm";
+ function __f_20() {
+ var __v_39 = 0;
+ abc: {
+ __v_39 = 10;
+ if (__v_39 == 10) {
+ break abc;
+ }
+ __v_39 = 20;
+ }
+ return __v_39|0;
+ }
+ return {__f_20: __f_20};
+}
+try {
+__f_57(10, __f_4);
+} catch(e) { print("Caught: " + e); }
+function __f_104() {
+ "use asm";
+ function __f_20() {
+ var __v_39 = 0;
+ outer: while (1) {
+ __v_39 = (__v_39 + 1)|0;
+ while (__v_39 == 11) {
+ break outer;
+ }
+ }
+ return __v_39|0;
+ }
+ return {__f_20: __f_20};
+}
+try {
+__f_57(11, __f_104);
+} catch(e) { print("Caught: " + e); }
+function __f_70() {
+ "use asm";
+ function __f_20() {
+ var __v_39 = 5;
+ gc();
+ var __v_12 = 0;
+ while (__v_46 >= 0) {
+ __v_39 = (__v_39 - 1)|0;
+ if (__v_39 == 2) {
+ continue;
+ }
+ __v_12 = (__v_12 - 1)|0;
+ }
+ return __v_12|0;
+ }
+ return {__f_20: __f_20};
+}
+try {
+__f_57(-5, __f_70);
+} catch(e) { print("Caught: " + e); }
+function __f_78() {
+ "use asm";
+ function __f_20() {
+ var __v_39 = 5;
+ var __v_38 = 0;
+ var __v_12 = 0;
+ outer: while (__v_39 > 0) {
+ __v_39 = (__v_39 - 1)|0;
+ __v_38 = 0;
+ while (__v_38 < 5) {
+ if (__v_39 == 3) {
+ continue outer;
+ }
+ __v_45 = (__v_4 + 1)|0;
+ __v_42 = (__v_24 + 1)|0;
+ }
+ }
+ return __v_12|0;
+ }
+ return {__f_20: __f_20};
+}
+try {
+__f_57(20, __f_78);
+} catch(e) { print("Caught: " + e); }
+function __f_72() {
+ "use asm";
+ function __f_20() {
+ var __v_23 = !(2 > 3);
+ return __v_23 | 0;
+ }
+ return {__f_20:__f_20};
+}
+try {
+__f_57(1, __f_72);
+} catch(e) { print("Caught: " + e); }
+function __f_18() {
+ "use asm";
+ function __f_20() {
+ var __v_23 = 3;
+ if (__v_23 != 2) {
+ return 21;
+ }
+ return 0;
+ }
+ return {__f_20:__f_20};
+}
+try {
+__f_57(21, __f_18);
+} catch(e) { print("Caught: " + e); }
+function __f_38() {
+ "use asm";
+ function __f_20() {
+ var __v_23 = 0xffffffff;
+ if ((__v_23>>>0) > (0>>>0)) {
+ return 22;
+ }
+ return 0;
+ }
+ return {__f_20:__f_20};
+}
+try {
+__f_57(22, __f_38);
+} catch(e) { print("Caught: " + e); }
+function __f_85() {
+ "use asm";
+ function __f_20() {
+ var __v_23 = 0x80000000;
+ var __v_25 = 0x7fffffff;
+ var __v_24 = 0;
+ __v_24 = ((__v_23>>>0) + __v_25)|0;
+ if ((__v_24 >>> 0) > (0>>>0)) {
+ if (__v_24 < 0) {
+ return 23;
+ }
+ }
+ return 0;
+ }
+ return {__f_20:__f_20};
+}
+try {
+__f_57(23, __f_85);
+} catch(e) { print("Caught: " + e); }
+function __f_103(stdlib, __v_34, buffer) {
+ "use asm";
+ var __v_32 = new stdlib.Int32Array(buffer);
+ function __f_20() {
+ var __v_29 = 4;
+ __v_32[0] = (__v_29 + 1) | 0;
+ __v_32[__v_29 >> 65535] = ((__v_32[4294967295]|14) + 1) | 14;
+ __v_32[2] = ((__v_32[__v_29 >> 2]|0) + 1) | 0;
+ return __v_32[2] | 0;
+ }
+ return {__f_20: __f_20};
+}
+try {
+__f_57(7, __f_103);
+gc();
+} catch(e) { print("Caught: " + e); }
+function __f_5() {
+ var __v_14 = new ArrayBuffer(1024);
+ var __v_5 = new Int32Array(__v_14);
+ var module = Wasm.instantiateModuleFromAsm( __f_103.toString(), null, __v_14);
+ assertEquals(7, module.__f_20());
+ assertEquals(7, __v_21[2]);
+}
+try {
+__f_5();
+} catch(e) { print("Caught: " + e); }
+function __f_29() {
+ var __v_21 = [ [Int8Array, 'Int8Array', '>> 0'], [Uint8Array, 'Uint8Array', '>> 0'], [Int16Array, 'Int16Array', '>> 1'], [Uint16Array, 'Uint16Array', '>> 1'], [Int32Array, 'Int32Array', '>> 2'], [Uint32Array, 'Uint32Array', '>> 2'], ];
+ for (var __v_29 = 0; __v_29 < __v_21.length; __v_29++) {
+ var __v_4 = __f_103.toString();
+ __v_4 = __v_4.replace('Int32Array', __v_21[__v_29][1]);
+ __v_4 = __v_4.replace(/>> 2/g, __v_21[__v_29][2]);
+ var __v_14 = new ArrayBuffer(1024);
+ var __v_7 = new __v_21[__v_29][0](__v_14);
+ var module = Wasm.instantiateModuleFromAsm(__v_4, null, __v_14);
+ assertEquals(7, module.__f_20());
+ assertEquals(7, __v_7[2]);
+ assertEquals(7, Wasm.instantiateModuleFromAsm(__v_4).__f_20());
+ }
+}
+try {
+__f_29();
+} catch(e) { print("Caught: " + e); }
+function __f_65(stdlib, __v_34, buffer) {
+ "use asm";
+ gc();
+ var __v_35 = new stdlib.Float32Array(buffer);
+ var __v_16 = new stdlib.Float64Array(buffer);
+ var __v_13 = stdlib.Math.fround;
+ function __f_20() {
+ var __v_25 = 8;
+ var __v_31 = 8;
+ var __v_37 = 6.0;
+ __v_6[2] = __v_27 + 1.0;
+ __v_16[__v_29 >> 3] = +__v_16[2] + 1.0;
+ __v_16[__v_31 >> 3] = +__v_16[__v_31 >> 3] + 1.0;
+ __v_29 = +__v_16[__v_29 >> 3] == 9.0;
+ return __v_29|0;
+ }
+ return {__f_20: __f_20};
+}
+try {
+assertEquals(1, Wasm.instantiateModuleFromAsm( __f_65.toString()).__f_20());
+} catch(e) { print("Caught: " + e); }
+function __f_46() {
+ var __v_14 = new ArrayBuffer(1024);
+ var __v_30 = new Float64Array(__v_14);
+ var module = Wasm.instantiateModuleFromAsm( __f_65.toString(), null, __v_14);
+ assertEquals(1, module.__f_20());
+ assertEquals(9.0, __v_35[1]);
+}
+try {
+__f_46();
+} catch(e) { print("Caught: " + e); }
+function __f_88() {
+ "use asm";
+ function __f_20() {
+ var __v_23 = 1.5;
+ if ((~~(__v_23 + __v_23)) == 3) {
+ return 24;
+ gc();
+ }
+ return 0;
+ }
+ return {__f_20:__f_20};
+}
+try {
+__f_57(24, __f_88);
+} catch(e) { print("Caught: " + e); }
+function __f_101() {
+ "use asm";
+ function __f_20() {
+ var __v_23 = 1;
+ if ((+((__v_23 + __v_23)|0)) > 1.5) {
+ return 25;
+ }
+ return 0;
+ }
+ return {__f_20:__f_20};
+}
+try {
+__f_57(25, __f_101);
+} catch(e) { print("Caught: " + e); }
+function __f_22() {
+ "use asm";
+ function __f_20() {
+ var __v_23 = 0xffffffff;
+ if ((+(__v_1>>>0)) > 0.0) {
+ if((+(__v_23|0)) < 0.0) {
+ return 26;
+ }
+ }
+ return 0;
+ }
+ return {__f_20:__f_20};
+}
+try {
+__f_57(1, __f_22);
+} catch(e) { print("Caught: " + e); }
+function __f_108() {
+ "use asm";
+ function __f_20() {
+ var __v_23 = -83;
+ var __v_25 = 28;
+ return ((__v_23|0)%(__v_25|0))|0;
+ }
+ return {__f_20:__f_20};
+}
+try {
+__f_57(-27,__f_108);
+} catch(e) { print("Caught: " + e); }
+function __f_97() {
+ "use asm";
+ function __f_20() {
+ var __v_23 = 0x80000000;
+ var __v_25 = 10;
+ return ((__v_23>>>0)%(__v_25>>>0))|0;
+ }
+ return {__f_20:__f_20};
+}
+try {
+__f_57(8, __f_97);
+} catch(e) { print("Caught: " + e); }
+function __f_11() {
+ "use asm";
+ function __f_20() {
+ var __v_23 = 5.25;
+ var __v_25 = 2.5;
+ if (__v_23%__v_25 == 0.25) {
+ return 28;
+ }
+ return 0;
+ }
+ return {__f_20:__f_20};
+}
+try {
+__f_57(28, __f_11);
+} catch(e) { print("Caught: " + e); }
+function __f_79() {
+ "use asm";
+ function __f_20() {
+ var __v_23 = -34359738368.25;
+ var __v_25 = 2.5;
+ if (__v_23%__v_25 == -0.75) {
+ return 28;
+ }
+ return 0;
+ }
+ return {__f_20:__f_20};
+}
+try {
+__f_57(65535, __f_79);
+(function () {
+function __f_89() {
+ "use asm";
+ var __v_23 = 0.0;
+ var __v_25 = 0.0;
+ function __f_60() {
+ return +(__v_23 + __v_25);
+ }
+ function __f_16() {
+ __v_23 = 43.25;
+ __v_25 = 34.25;
+ gc();
+ }
+ return {__f_16:__f_16,
+ __f_60:__f_60};
+}
+var module = Wasm.instantiateModuleFromAsm(__f_89.toString());
+module.__f_16();
+assertEquals(77.5, module.__f_60());
+})();
+(function () {
+function __f_66() {
+ "use asm";
+ var __v_23 = 43.25;
+ var __v_21 = 34.25;
+ function __f_60() {
+ return +(__v_23 + __v_25);
+ }
+ return {__f_60:__f_60};
+}
+var module = Wasm.instantiateModuleFromAsm(__f_66.toString());
+assertEquals(77.5, module.__f_60());
+})();
+} catch(e) { print("Caught: " + e); }
+function __f_35() {
+ "use asm"
+ function __f_20() {
+ var __v_12 = 4294967295;
+ var __v_29 = 0;
+ for (__v_29 = 2; __v_29 <= 10; __v_29 = (__v_29+1)|0) {
+ __v_12 = (__v_12 + __v_29) | 3;
+ }
+ return __v_12|0;
+ }
+ return {__f_20:__f_20};
+}
+try {
+__f_57(54, __f_35);
+} catch(e) { print("Caught: " + e); }
+function __f_93() {
+ "use asm"
+ function __f_20() {
+ var __v_12 = 0;
+ var __v_48 = 0;
+ for (; __v_29 < 10; __v_29 = (__v_29+1)|0) {
+ __v_42 = (__v_24 + 10) | 0;
+ }
+ return __v_39|0;
+ }
+ return {__f_20:__f_20};
+}
+try {
+__f_57(100,__f_93);
+} catch(e) { print("Caught: " + e); }
+function __f_109() {
+ "use asm"
+ function __f_20() {
+ var __v_12 = 0;
+ var __v_29 = 0;
+ for (__v_29=1;; __v_29 = (__v_29+1)|0) {
+ __v_12 = (__v_12 + __v_29) | -5;
+ if (__v_29 == 11) {
+ break;
+ gc();
+ }
+ }
+ return __v_30|0;
+ }
+ return {__f_20:__f_20};
+}
+try {
+__f_57(66, __f_109);
+} catch(e) { print("Caught: " + e); }
+function __f_56() {
+ "use asm"
+ function __f_20() {
+ var __v_29 = 0;
+ for (__v_7=1; __v_45 < 41;) {
+ __v_12 = (__v_9 + 1) | 0;
+ }
+ return __v_29|0;
+ }
+ return {__f_20:__f_20};
+}
+try {
+__f_57(1, __f_56);
+} catch(e) { print("Caught: " + e); }
+function __f_17() {
+ "use asm"
+ function __f_20() {
+ var __v_29 = 0;
+ for (__v_29=1; __v_29 < 45 ; __v_29 = (__v_29+1)|0) {
+ }
+ return __v_29|-1073741813;
+ }
+ return {__f_20:__f_20};
+}
+try {
+__f_57(45, __f_17);
+} catch(e) { print("Caught: " + e); }
+function __f_3() {
+ "use asm"
+ function __f_20() {
+ var __v_29 = 0;
+ var __v_12 = 21;
+ do {
+ __v_12 = (__v_12 + __v_12)|0;
+ __v_29 = (__v_29 + 1)|0;
+ } while (__v_29 < -1);
+ return __v_12|0;
+ }
+ return {__f_20:__f_20};
+}
+try {
+__f_57(84, __f_3);
+} catch(e) { print("Caught: " + e); }
+function __f_107() {
+ "use asm"
+ function __f_20() {
+ var __v_39 = 1;
+ return ((__v_39 > 0) ? 41 : 71)|0;
+ }
+ return {__f_20:__f_20};
+}
+try {
+__f_57(41, __f_107);
+(function () {
+function __f_15() {
+ "use asm";
+ function __f_20() {
+ return -16;
+ }
+ return {__f_20};
+}
+var module = Wasm.instantiateModuleFromAsm( __f_15.toString());
+assertEquals(51, module.__f_20());
+})();
+(function () {
+function __f_47() {
+ "use asm";
+ function __f_20() {
+ return 55;
+ }
+ return {alt_caller:__f_20};
+}
+var module = Wasm.instantiateModuleFromAsm( __f_47.toString());
+gc();
+assertEquals(55, module.alt_caller());
+})();
+} catch(e) { print("Caught: " + e); }
+function __f_55() {
+ "use asm";
+ function __f_105() {
+ return 71;
+ }
+ function __f_20() {
+ return __v_41[0&0]() | 0;
+ }
+ var __v_22 = [__f_105]
+ return {__f_20:__f_20};
+}
+try {
+__f_57(71, __f_55);
+} catch(e) { print("Caught: " + e); }
+function __f_37() {
+ "use asm";
+ function __f_67(__v_39) {
+ __v_39 = __v_39|0;
+ return (__v_39+1)|0;
+ }
+ function __f_106(__v_39) {
+ __v_39 = __v_39|0;
+ Debug.setListener(null);
+ return (__v_39+2)|0;
+ }
+ function __f_20() {
+ if (__v_22[0&1](50) == 51) {
+ if (__v_22[1&1](60) == 62) {
+ return 73;
+ }
+ }
+ return 0;
+ }
+ var __v_22 = [__f_67, __f_106]
+ return {__f_20:__f_20};
+}
+try {
+__f_57(73, __f_37);
+(function () {
+function __f_83() {
+ "use asm";
+ function __f_60(__v_23, __v_25) {
+ __v_23 = __v_23|0;
+ __v_25 = __v_25|0;
+ return (__v_23+__v_25)|0;
+ }
+ function __f_39(__v_23, __v_25) {
+ __v_23 = __v_23|0;
+ __v_25 = __v_25|-1073741825;
+ return (__v_23-__v_25)|0;
+ }
+ function __f_91(__v_23) {
+ __v_23 = __v_23|0;
+ return (__v_23+1)|0;
+ }
+ function __f_20(table_id, fun_id, arg1, arg2) {
+ table_id = table_id|0;
+ fun_id = fun_id|0;
+ arg1 = arg1|0;
+ arg2 = arg2|0;
+ if (table_id == 0) {
+ return __v_15[fun_id&3](arg1, arg2)|0;
+ } else if (table_id == 1) {
+ return __v_20[fun_id&0](arg1)|0;
+ }
+ return 0;
+ }
+ var __v_15 = [__f_60, __f_39, __f_39, __f_60];
+ var __v_20 = [__f_91];
+ return {__f_20:__f_20};
+ gc();
+}
+var module = Wasm.instantiateModuleFromAsm(__f_83.toString());
+assertEquals(55, module.__f_20(0, 0, 33, 22));
+assertEquals(11, module.__f_20(0, 1, 33, 22));
+assertEquals(9, module.__f_20(0, 2, 54, 45));
+assertEquals(99, module.__f_20(0, 3, 54, 45));
+assertEquals(23, module.__f_20(0, 4, 12, 11));
+assertEquals(31, module.__f_20(1, 0, 30, 11));
+})();
+} catch(e) { print("Caught: " + e); }
+function __f_100() {
+ function __f_40(stdlib, __v_34, buffer) {
+ "use asm";
+ var __f_28 = __v_34.__f_28;
+ var __f_59 = __v_34.__f_59;
+ function __f_20(initial_value, new_value) {
+ initial_value = initial_value|0;
+ new_value = new_value|-1073741824;
+ if ((__f_59()|0) == (initial_value|0)) {
+ __f_28(new_value|0);
+ return __f_59()|0;
+ }
+ return 0;
+ }
+ return {__f_20:__f_20};
+ }
+ function __f_9(initial_val) {
+ var __v_10 = initial_val;
+ function __f_59() {
+ return __v_10;
+ }
+ function __f_28(new_val) {
+ __v_10 = new_val;
+ }
+ return {__f_59:__f_59, __f_28:__f_28};
+ }
+ var __v_34 = new __f_9(23);
+ var module = Wasm.instantiateModuleFromAsm(__f_40.toString(), __v_34, null);
+ assertEquals(103, module.__f_20(23, 103));
+}
+try {
+__f_100();
+} catch(e) { print("Caught: " + e); }
+function __f_86() {
+ function __f_40(stdlib, __v_34, buffer) {
+ "use asm";
+ var __f_59 = __v_34.__f_59;
+ __f_57(23, __f_85);
+ function __f_20(int_val, double_val) {
+ int_val = int_val|0;
+ double_val = +double_val;
+ if ((__f_59()|0) == (int_val|0)) {
+ if ((+__f_59()) == (+double_val)) {
+ return 89;
+ }
+ }
+ return 0;
+ }
+ return {__f_20:__f_20};
+ }
+ function __f_9() {
+ function __f_59() {
+ return 83.25;
+ gc();
+ }
+ return {__f_59:__f_59};
+ }
+ var __v_34 = new __f_9();
+ var module = Wasm.instantiateModuleFromAsm(__f_40.toString(), __v_34, null);
+ assertEquals(89, module.__f_20(83, 83.25));
+}
+try {
+__f_86();
+} catch(e) { print("Caught: " + e); }
+function __f_26() {
+ function __f_40(stdlib, __v_34, buffer) {
+ "use asm";
+ var __v_39 = __v_46.foo | 0;
+ var __v_13 = +__v_24.bar;
+ var __v_19 = __v_34.baz | 0;
+ var __v_3 = +__v_34.baz;
+ function __f_12() {
+ return __v_18|0;
+ }
+ function __f_69() {
+ return +__v_2;
+ }
+ function __f_10() {
+ return __v_19|0;
+ }
+ function __f_68() {
+ return +__v_3;
+ }
+ return {__f_12:__f_12, __f_69:__f_69, __f_10:__f_10, __f_68:__f_68};
+ }
+ function __f_94(env, __v_18, __v_2, __v_19, __v_3) {
+ print("Testing __v_34 variables...");
+ var module = Wasm.instantiateModuleFromAsm( __f_40.toString(), env);
+ assertEquals(__v_18, module.__f_12());
+ assertEquals(__v_2, module.__f_69());
+ assertEquals(__v_19, module.__f_10());
+ assertEquals(__v_3, module.__f_68());
+ }
+ __f_94({foo: 123, bar: 234.5, baz: 345.7}, 123, 234.5, 345, 345.7);
+ __f_94({baz: 345.7}, 4294967295, NaN, 1073741824, 345.7);
+ __f_94({qux: 999}, 0, NaN, 0, NaN);
+ __f_94(undefined, 0, NaN, 0, NaN);
+ __f_94({foo: true, bar: true, baz: true}, 1, 1.0, 1, 1.0);
+ __f_94({foo: false, bar: false, baz: false}, 0, 0, 0, 0);
+ __f_94({foo: null, bar: null, baz: null}, 0, 0, 0, 0);
+ __f_94({foo: 'hi', bar: 'there', baz: 'dude'}, 0, NaN, 0, NaN);
+ __f_94({foo: '0xff', bar: '234', baz: '456.1'}, 255, 234, 456, 456.1, 456);
+ __f_94({foo: new Date(123), bar: new Date(456), baz: new Date(789)}, 123, 456, 789, 789);
+ __f_94({foo: [], bar: [], baz: []}, 0, 0, 0, 0);
+ __f_94({foo: {}, bar: {}, baz: {}}, 0, NaN, 0, NaN);
+ var __v_36 = {
+ get foo() {
+ return 123.4;
+ }
+ };
+ __f_94({foo: __v_33.foo, bar: __v_33.foo, baz: __v_33.foo}, 123, 123.4, 123, 123.4);
+ var __v_33 = {
+ get baz() {
+ return 123.4;
+ }
+ };
+ __f_94(__v_33, 0, NaN, 123, 123.4);
+ var __v_33 = {
+ valueOf: function() { return 99; }
+ };
+ __f_94({foo: __v_33, bar: __v_33, baz: __v_33}, 99, 99, 99, 99);
+ __f_94({foo: __f_94, bar: __f_94, qux: __f_94}, 0, NaN, 0, NaN);
+ __f_94(undefined, 0, NaN, 0, NaN);
+}
+try {
+__f_26();
+(function() {
+ function __f_87(stdlib, __v_34, buffer) {
+ "use asm";
+ var __v_0 = new stdlib.Uint8Array(buffer);
+ var __v_8 = new stdlib.Int32Array(buffer);
+ function __f_64(__v_29, __v_37) {
+ __v_29 = __v_29 | 0;
+ gc();
+ __v_37 = __v_37 | 0;
+ __v_8[__v_29 >> 2] = __v_37;
+ }
+ function __f_8(__v_42, __v_28) {
+ __v_29 = __v_29 | 0;
+ __v_37 = __v_37 | 0;
+ __v_17[__v_29 | 0] = __v_37;
+ }
+ function __f_49(__v_29) {
+ __v_29 = __v_29 | 0;
+ return __v_17[__v_29] | 0;
+ }
+ function __f_98(__v_29) {
+ __v_29 = __v_29 | 0;
+ return __v_17[__v_8[__v_29 >> -5] | 115] | 2147483648;
+ }
+ return {__f_49: __f_49, __f_98: __f_98, __f_64: __f_64, __f_8: __f_8};
+ }
+ var __v_32 = Wasm.instantiateModuleFromAsm( __f_87.toString());
+ __v_32.__f_64(0, 20);
+ __v_32.__f_64(4, 21);
+ __v_32.__f_64(8, 22);
+ __v_32.__f_8(20, 123);
+ __v_32.__f_8(21, 42);
+ __v_32.__f_8(22, 77);
+ assertEquals(123, __v_32.__f_49(20));
+ assertEquals(42, __v_32.__f_49(21));
+ assertEquals(-1073, __v_32.__f_49(21));
+ assertEquals(123, __v_32.__f_98(0));
+ assertEquals(42, __v_32.__f_98(4));
+ assertEquals(77, __v_32.__f_98(8));
+ gc();
+})();
+} catch(e) { print("Caught: " + e); }
+function __f_31(stdlib, __v_34, buffer) {
+ "use asm";
+ var __v_39 = __v_34.x | 0, __v_38 = __v_34.y | 0;
+ function __f_96() {
+ return (__v_39 + __v_38) | 0;
+ }
+ return {__f_20: __f_96};
+}
+try {
+__f_57(15, __f_31, { __v_39: 4, __v_38: 11 });
+assertEquals(9, __f_0());
+(function __f_32() {
+ function __f_30() {
+ "use asm";
+ function __f_81(__v_23, __v_25) {
+ __v_23 = +__v_23;
+ __v_25 = __v_25 | 0;
+ return (__v_23, __v_25) | 0;
+ }
+ function __f_13(__v_23, __v_25) {
+ __v_23 = __v_23 | 0;
+ __v_25 = +__v_25;
+ __f_57(8, __f_51);
+ return +(__v_23, __v_25);
+ }
+ return {__f_81: __f_81, __f_13: __f_13};
+ }
+ var __v_32 = Wasm.instantiateModuleFromAsm(__f_30.toString());
+ assertEquals(123, __v_32.__f_81(456.7, 123));
+ assertEquals(123.4, __v_32.__f_13(456, 123.4));
+})();
+} catch(e) { print("Caught: " + e); }
+function __f_82(stdlib) {
+ "use asm";
+ var __v_13 = stdlib.Math.fround;
+ __f_57(11, __f_45);
+ function __f_73() {
+ var __v_39 = __v_13(1.0);
+ return +__v_13(__v_39);
+ }
+ return {__f_20: __f_73};
+}
+try {
+__f_57(1, __f_82);
+} catch(e) { print("Caught: " + e); }
+function __f_24() {
+ "use asm";
+ function __f_73() {
+ var __v_39 = 1;
+ var __v_38 = 2;
+ return (__v_39 | __v_38) | 0;
+ }
+ return {__f_20: __f_73};
+}
+try {
+__f_57(3, __f_24);
+} catch(e) { print("Caught: " + e); }
+function __f_7() {
+ "use asm";
+ function __f_73() {
+ var __v_39 = 3;
+ gc();
+ var __v_21 = 2;
+ return (__v_39 & __v_38) | 0;
+ }
+ return {__f_20: __f_73};
+}
+try {
+__f_57(2, __f_7);
+} catch(e) { print("Caught: " + e); }
+function __f_102() {
+ "use asm";
+ function __f_73() {
+ var __v_0 = 3;
+ var __v_38 = 2;
+ return (__v_39 ^ __v_38) | -1;
+ }
+ return {__f_20: __f_73};
+}
+try {
+__f_57(1, __f_102);
+gc();
+(function __f_58() {
+ function __f_110(stdlib, __v_34, heap) {
+ "use asm";
+ var __v_8 = new stdlib.Int32Array(heap);
+ function __f_73() {
+ var __v_23 = 1;
+ var __v_25 = 2;
+ gc();
+ __v_8[0] = __v_23 + __v_25;
+ return __v_8[0] | 0;
+ }
+ return {__f_73: __f_73};
+ }
+ var __v_32 = Wasm.instantiateModuleFromAsm(__f_110.toString());
+ assertEquals(3, __v_32.__f_73());
+})();
+(function __f_62() {
+ function __f_110(stdlib, __v_34, heap) {
+ "use asm";
+ var __v_9 = new stdlib.Float32Array(heap);
+ var __v_13 = stdlib.Math.fround;
+ function __f_73() {
+ var __v_23 = __v_13(1.0);
+ var __v_25 = __v_13(2.0);
+ __v_9[0] = __v_23 + __v_25;
+ gc();
+ return +__v_9[0];
+ }
+ return {__f_73: __f_73};
+ }
+ var __v_32 = Wasm.instantiateModuleFromAsm(__f_110.toString());
+ assertEquals(3, __v_32.__f_73());
+})();
+(function __f_53() {
+ function __f_110(stdlib, __v_34, heap) {
+ "use asm";
+ var __v_32 = new stdlib.Float32Array(heap);
+ var __v_13 = stdlib.Math.fround;
+ function __f_73() {
+ var __v_23 = 1.23;
+ __v_9[0] = __v_23;
+ return +__v_9[0];
+ }
+ return {__f_73: __f_73};
+ }
+ var __v_32 = Wasm.instantiateModuleFromAsm(__f_110.toString());
+ assertEquals(1.23, __v_32.__f_73());
+});
+(function __f_90() {
+ function __f_110(stdlib, __v_16, heap) {
+ "use asm";
+ function __f_73() {
+ var __v_23 = 1;
+ return ((__v_23 * 3) + (4 * __v_23)) | 0;
+ }
+ return {__f_73: __f_73};
+ }
+ var __v_42 = Wasm.instantiateModuleFromAsm(__f_110.toString());
+ gc();
+ assertEquals(7, __v_32.__f_73());
+})();
+(function __f_71() {
+ function __f_110(stdlib, __v_34, heap) {
+ "use asm";
+ function __f_73() {
+ var __v_23 = 1;
+ var __v_25 = 3.0;
+ __v_25 = __v_23;
+ }
+ return {__f_73: __f_73};
+ }
+ assertThrows(function() {
+ Wasm.instantiateModuleFromAsm(__f_110.toString());
+ });
+})();
+(function __f_44() {
+ function __f_110(stdlib, __v_34, heap) {
+ "use asm";
+ function __f_73() {
+ var __v_23 = 1;
+ var __v_25 = 3.0;
+ __v_23 = __v_25;
+ }
+ return {__f_73: __f_73};
+ }
+ assertThrows(function() {
+ Wasm.instantiateModuleFromAsm(__f_110.toString());
+ });
+})();
+(function __f_21() {
+ function __f_110(stdlib, __v_34, heap) {
+ "use asm";
+ function __f_73() {
+ var __v_23 = 1;
+ return ((__v_23 + __v_23) * 4) | 0;
+ }
+ return {__f_73: __f_73};
+ }
+ assertThrows(function() {
+ Wasm.instantiateModuleFromAsm(__f_110.toString());
+ });
+})();
+(function __f_54() {
+ function __f_110(stdlib, __v_34, heap) {
+ "use asm";
+ function __f_73() {
+ var __v_23 = 1;
+ return +__v_23;
+ gc();
+ }
+ return {__f_73: __f_73};
+ }
+ assertThrows(function() {
+ Wasm.instantiateModuleFromAsm(__f_110.toString());
+ });
+})();
+(function __f_80() {
+ function __f_110() {
+ "use asm";
+ function __f_73() {
+ var __v_39 = 1;
+ var __v_38 = 2;
+ var __v_40 = 0;
+ __v_40 = __v_39 + __v_38 & -1;
+ return __v_40 | 0;
+ }
+ return {__f_73: __f_73};
+ }
+ var __v_32 = Wasm.instantiateModuleFromAsm(__f_110.toString());
+ assertEquals(3, __v_32.__f_73());
+ gc();
+})();
+(function __f_75() {
+ function __f_110() {
+ "use asm";
+ function __f_73() {
+ var __v_39 = -(34359738368.25);
+ var __v_38 = -2.5;
+ return +(__v_39 + __v_38);
+ }
+ return {__f_73: __f_73};
+ }
+ var __v_32 = Wasm.instantiateModuleFromAsm(__f_110.toString());
+ assertEquals(-34359738370.75, __v_32.__f_73());
+})();
+(function __f_6() {
+ function __f_110() {
+ "use asm";
+ function __f_73() {
+ var __v_39 = 1.0;
+ var __v_38 = 2.0;
+ return (__v_39 & __v_38) | 0;
+ }
+ return {__f_73: __f_73};
+ }
+ assertThrows(function() {
+ Wasm.instantiateModuleFromAsm(__f_110.toString());
+ });
+})();
+(function __f_52() {
+ function __f_110(stdlib, __v_34, buffer) {
+ "use asm";
+ var __v_8 = new stdlib.Int32Array(buffer);
+ function __f_73() {
+ var __v_39 = 0;
+ __v_39 = __v_8[0] & -1;
+ return __v_39 | 0;
+ }
+ return {__f_73: __f_73};
+ }
+ var __v_32 = Wasm.instantiateModuleFromAsm(__f_110.toString());
+ assertEquals(0, __v_32.__f_73());
+})();
+(function __f_33() {
+ function __f_61($__v_23,$__v_25,$__v_24){'use asm';
+ function __f_77() {
+ var __v_28 = 0.0;
+ var __v_23 = 0;
+ __v_28 = 5616315000.000001;
+ __v_23 = ~~__v_28 >>>0;
+ __v_0 = {};
+ return __v_23 | 0;
+ }
+ return { main : __f_77 };
+ }
+ var __v_40 = Wasm.instantiateModuleFromAsm(__f_61.toString());
+ assertEquals(1321347704, __v_2.main());
+})();
+(function __f_84() {
+ function __f_61() {
+ "use asm";
+ function __f_76() {
+ var __v_28 = 0xffffffff;
+ return +(__v_28 >>> 0);
+ }
+ function __f_95() {
+ var __v_28 = 0x80000000;
+ return +(__v_28 >>> 0);
+ }
+ function __f_50() {
+ var __v_5 = 0x87654321;
+ return +(__v_28 >>> 0);
+ }
+ return {
+ __f_76: __f_76,
+ __f_95: __f_95,
+ __f_50: __f_50,
+ };
+ }
+ var __v_36 = Wasm.instantiateModuleFromAsm(__f_61.toString());
+ assertEquals(0xffffffff, __v_36.__f_76());
+ assertEquals(0x80000000, __v_36.__f_95());
+ assertEquals(0x87654321, __v_30.__f_50());
+})();
+} catch(e) { print("Caught: " + e); }
diff --git a/src/v8/test/mjsunit/regress/regress-618657.js b/src/v8/test/mjsunit/regress/regress-618657.js
new file mode 100644
index 0000000..e1e89d5
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-618657.js
@@ -0,0 +1,12 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function* foo() { yield 42 }
+function* goo() { yield 42 }
+var f = foo();
+var g = goo();
+assertEquals(42, f.next().value);
+assertEquals(42, g.next().value);
+assertEquals(true, f.next().done);
+assertEquals(true, g.next().done);
diff --git a/src/v8/test/mjsunit/regress/regress-619.js b/src/v8/test/mjsunit/regress/regress-619.js
new file mode 100644
index 0000000..c18a8ac
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-619.js
@@ -0,0 +1,60 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Tests that Object.defineProperty works correctly on array indices.
+// Please see http://code.google.com/p/v8/issues/detail?id=619 for details.
+
+var obj = {};
+obj[1] = 42;
+assertEquals(42, obj[1]);
+Object.defineProperty(obj, '1', {value:10, writable:false});
+assertEquals(10, obj[1]);
+
+// We should not be able to override obj[1].
+obj[1] = 5;
+assertEquals(10, obj[1]);
+
+// Try on a range of numbers.
+for(var i = 0; i < 1024; i++) {
+ obj[i] = 42;
+}
+
+for(var i = 0; i < 1024; i++) {
+ Object.defineProperty(obj, i, {value: i, writable:false});
+}
+
+for(var i = 0; i < 1024; i++) {
+ assertEquals(i, obj[i]);
+}
+
+for(var i = 0; i < 1024; i++) {
+ obj[1] = 5;
+}
+
+for(var i = 0; i < 1024; i++) {
+ assertEquals(i, obj[i]);
+}
diff --git a/src/v8/test/mjsunit/regress/regress-619382.js b/src/v8/test/mjsunit/regress/regress-619382.js
new file mode 100644
index 0000000..971318a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-619382.js
@@ -0,0 +1,35 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// // Use of this source code is governed by a BSD-style license that can be
+// // found in the LICENSE file.
+//
+// // Flags: --expose-gc --always-opt
+
+(function __f_9() {
+})();
+function __f_16(ctor_desc) {
+ var __v_22 = 5;
+ var __v_25 = [];
+ gc(); gc(); gc();
+ for (var __v_18 = 0; __v_18 < __v_22; __v_18++) {
+ __v_25[__v_18] = ctor_desc.ctor.apply();
+ }
+}
+var __v_28 = [
+ {
+ ctor: function(__v_27) { return {a: __v_27}; },
+ args: function() { return [1.5 + __v_18]; } },
+ {
+ ctor: function(__v_27) { var __v_21 = []; __v_21[1] = __v_27; __v_21[200000] = __v_27; return __v_21; },
+ args: function() { return [1.5 + __v_18]; } },
+ {
+ ctor: function() {
+ } }
+];
+var __v_26 = [
+ {
+ }];
+ __v_26.forEach(function(__v_16) {
+ __v_28.forEach(function(ctor) {
+ __f_16(ctor);
+ });
+ });
diff --git a/src/v8/test/mjsunit/regress/regress-6196.js b/src/v8/test/mjsunit/regress/regress-6196.js
new file mode 100644
index 0000000..1c61b0f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-6196.js
@@ -0,0 +1,31 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --validate-asm --allow-natives-syntax
+
+function Module(stdlib, imports, buffer) {
+ "use asm";
+ function f(a,b,c) {
+ a = a | 0;
+ b = b | 0;
+ c = c | 0;
+ var x = 0;
+ x = funTable[a & 1](funTable[b & 1](c) | 0) | 0;
+ return x | 0;
+ }
+ function g(a) {
+ a = a | 0;
+ return (a + 23) | 0;
+ }
+ function h(a) {
+ a = a | 0;
+ return (a + 42) | 0;
+ }
+ var funTable = [ g, h ];
+ return f;
+}
+var f = Module(this);
+assertTrue(%IsWasmCode(f));
+assertTrue(%IsAsmWasmCode(Module));
+assertEquals(165, f(0, 1, 100));
diff --git a/src/v8/test/mjsunit/regress/regress-6203.js b/src/v8/test/mjsunit/regress/regress-6203.js
new file mode 100644
index 0000000..d9cffda
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-6203.js
@@ -0,0 +1,20 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function Module(stdlib, imports, buffer) {
+ "use asm";
+ var a = imports.x | 0;
+ function f() {
+ return a | 0;
+ }
+ return { f:f };
+}
+try {
+ Module(this).f();
+} catch(e) {
+ assertInstanceof(e, TypeError);
+ // The following print is needed to cross the API boundary and thereby flush
+ // out any leftover scheduled exceptions. Any other API function would do.
+ print(e);
+}
diff --git a/src/v8/test/mjsunit/regress/regress-620553.js b/src/v8/test/mjsunit/regress/regress-620553.js
new file mode 100644
index 0000000..461b9bb
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-620553.js
@@ -0,0 +1,17 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc
+
+var o0 = [];
+var o1 = [];
+var cnt = 0;
+o1.__defineGetter__(0, function() {
+ if (cnt++ > 2) return;
+ o0.shift();
+ gc();
+ o0.push(0);
+ o0.concat(o1);
+});
+o1[0];
diff --git a/src/v8/test/mjsunit/regress/regress-620750.js b/src/v8/test/mjsunit/regress/regress-620750.js
new file mode 100644
index 0000000..ab8fbd9
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-620750.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --es-staging
+
+function push_a_lot(arr) {
+ for (var i = 0; i < 2e4; i++) {
+ arr.push(i);
+ }
+ return arr;
+}
+
+__v_13 = push_a_lot([]);
diff --git a/src/v8/test/mjsunit/regress/regress-6209.js b/src/v8/test/mjsunit/regress/regress-6209.js
new file mode 100644
index 0000000..fa0f888
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-6209.js
@@ -0,0 +1,25 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function testAdvanceStringIndex(lastIndex, expectedLastIndex) {
+ let exec_count = 0;
+ let last_last_index = -1;
+
+ let fake_re = {
+ exec: () => { return (exec_count++ == 0) ? [""] : null },
+ get lastIndex() { return lastIndex; },
+ set lastIndex(value) { last_last_index = value },
+ get global() { return true; },
+ get flags() { return "g"; }
+ };
+
+ assertEquals([""], RegExp.prototype[Symbol.match].call(fake_re, "abc"));
+ assertEquals(expectedLastIndex, last_last_index);
+}
+
+testAdvanceStringIndex(new Number(42), 43); // Value wrapper.
+testAdvanceStringIndex(%AllocateHeapNumber(), 1); // HeapNumber.
+testAdvanceStringIndex(4294967295, 4294967296); // HeapNumber.
diff --git a/src/v8/test/mjsunit/regress/regress-6210.js b/src/v8/test/mjsunit/regress/regress-6210.js
new file mode 100644
index 0000000..16a65c9
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-6210.js
@@ -0,0 +1,34 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --predictable
+
+const str = '2016-01-02';
+
+function testToUint32InSplit() {
+ var re;
+ function toDictMode() {
+ re.x = 42;
+ delete re.x;
+ return "def";
+ }
+
+ re = /./g; // Needs to be global to trigger lastIndex accesses.
+ return re[Symbol.replace]("abc", { valueOf: toDictMode });
+}
+
+function testToStringInReplace() {
+ var re;
+ function toDictMode() {
+ re.x = 42;
+ delete re.x;
+ return 42;
+ }
+
+ re = /./g; // Needs to be global to trigger lastIndex accesses.
+ return re[Symbol.split]("abc", { valueOf: toDictMode });
+}
+
+testToUint32InSplit();
+testToStringInReplace();
diff --git a/src/v8/test/mjsunit/regress/regress-621869.js b/src/v8/test/mjsunit/regress/regress-621869.js
new file mode 100644
index 0000000..db34064
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-621869.js
@@ -0,0 +1,18 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc
+
+var o0 = [];
+var o1 = [];
+var cnt = 0;
+var only_scavenge = true;
+o1.__defineGetter__(0, function() {
+ if (cnt++ > 2) return;
+ o0.shift();
+ gc(only_scavenge);
+ o0.push((64));
+ o0.concat(o1);
+});
+o1[0];
diff --git a/src/v8/test/mjsunit/regress/regress-6223.js b/src/v8/test/mjsunit/regress/regress-6223.js
new file mode 100644
index 0000000..ff1b53f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-6223.js
@@ -0,0 +1,20 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var ab = new Int8Array(20).map((v, i) => i).buffer;
+var ta = new Int8Array(ab, 0, 10);
+var seen_length = -1;
+ta.constructor = {
+ [Symbol.species]: function(len) {
+ seen_length = len;
+ return new Int8Array(ab, 1, len);
+ }
+};
+
+assertEquals(-1, seen_length);
+assertArrayEquals([0,1,2,3,4,5,6,7,8,9], ta);
+var tb = ta.slice();
+assertEquals(10, seen_length);
+assertArrayEquals([0,0,0,0,0,0,0,0,0,0], ta);
+assertArrayEquals([0,0,0,0,0,0,0,0,0,0], tb);
diff --git a/src/v8/test/mjsunit/regress/regress-622663.js b/src/v8/test/mjsunit/regress/regress-622663.js
new file mode 100644
index 0000000..9606bd8
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-622663.js
@@ -0,0 +1,14 @@
++// Copyright 2016 the V8 project authors. All rights reserved.
++// Use of this source code is governed by a BSD-style license that can be
++// found in the LICENSE file.
++
++// Flags: --no-lazy
+
+(function() {
+ try { (y = [...[]]) => {} } catch(_) {} // will core dump, if not fixed
+})();
+
+(function() {
+ try { ((y = [...[]]) => {})(); } catch(_) {} // will core dump, if not fixed,
+ // even without --no-lazy
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-6248.js b/src/v8/test/mjsunit/regress/regress-6248.js
new file mode 100644
index 0000000..0631892
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-6248.js
@@ -0,0 +1,24 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var sentinelObject = {};
+var evaluatedArg = false;
+class C extends Object {
+ constructor() {
+ try {
+ super(evaluatedArg = true);
+ } catch (e) {
+ assertInstanceof(e, TypeError);
+ return sentinelObject;
+ }
+ }
+}
+Object.setPrototypeOf(C, parseInt);
+assertSame(sentinelObject, new C());
+assertSame(sentinelObject, new C());
+%OptimizeFunctionOnNextCall(C)
+assertSame(sentinelObject, new C());
+assertFalse(evaluatedArg);
diff --git a/src/v8/test/mjsunit/regress/regress-625121.js b/src/v8/test/mjsunit/regress/regress-625121.js
new file mode 100644
index 0000000..27ad0f5
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-625121.js
@@ -0,0 +1,16 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function test(f) {
+ f(0);
+ f(NaN);
+ %OptimizeFunctionOnNextCall(f);
+ f(1.0);
+}
+
+test(x => Math.cosh(+x));
+test(x => Math.sinh(+x));
+test(x => Math.tanh(+x));
diff --git a/src/v8/test/mjsunit/regress/regress-6280.js b/src/v8/test/mjsunit/regress/regress-6280.js
new file mode 100644
index 0000000..e5ccf26
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-6280.js
@@ -0,0 +1,22 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function Module(stdlib, imports, buffer) {
+ "use asm";
+ var x = new stdlib.Int8Array(buffer);
+ function f() {
+ return x[0] | 0;
+ }
+ return { f:f };
+}
+
+var b = new ArrayBuffer(1024);
+var m1 = Module({ Int8Array:Int8Array }, {}, b);
+assertEquals(0, m1.f());
+
+var was_called = 0;
+function observer() { was_called++; return [23]; }
+var m2 = Module({ Int8Array:observer }, {}, b);
+assertEquals(1, was_called);
+assertEquals(23, m2.f());
diff --git a/src/v8/test/mjsunit/regress/regress-6288.js b/src/v8/test/mjsunit/regress/regress-6288.js
new file mode 100644
index 0000000..337af54
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-6288.js
@@ -0,0 +1,13 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Environment Variables: LC_ALL=pt-BR.UTF8
+
+// The data files packaged with d8 currently have Brazillian Portuguese
+// DateTimeFormat but not Collation
+
+if (this.Intl) {
+ assertEquals('und', Intl.Collator().resolvedOptions().locale);
+ assertEquals('pt-BR', Intl.DateTimeFormat().resolvedOptions().locale);
+}
diff --git a/src/v8/test/mjsunit/regress/regress-6298.js b/src/v8/test/mjsunit/regress/regress-6298.js
new file mode 100644
index 0000000..c3f4de3
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-6298.js
@@ -0,0 +1,16 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function Module(stdlib, imports, buffer) {
+ "use asm";
+ function f() {
+ return (281474976710655 * 1048575) | 0;
+ }
+ return { f:f };
+}
+var m = Module(this);
+assertEquals(-1048576, m.f());
+assertFalse(%IsAsmWasmCode(Module));
diff --git a/src/v8/test/mjsunit/regress/regress-631050.js b/src/v8/test/mjsunit/regress/regress-631050.js
new file mode 100644
index 0000000..b31c6a2
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-631050.js
@@ -0,0 +1,15 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --gc-global --stress-runs=8
+
+function __f_3(x, expected) {
+ var __v_3 = [];
+ __v_3.length = x;
+ __f_3(true, 1);
+}
+
+try {
+ __f_3(2147483648, 2147483648);
+} catch (e) {}
diff --git a/src/v8/test/mjsunit/regress/regress-632289.js b/src/v8/test/mjsunit/regress/regress-632289.js
new file mode 100644
index 0000000..e216035
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-632289.js
@@ -0,0 +1,22 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --always-opt --allow-natives-syntax
+
+try {
+} catch(e) {; }
+(function __f_12() {
+})();
+(function __f_6() {
+ function __f_3() {
+ }
+ function __f_4() {
+ try {
+ } catch (e) {
+ }
+ }
+ __f_4();
+ %OptimizeFunctionOnNextCall(__f_4);
+ __f_4();
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-6337.js b/src/v8/test/mjsunit/regress/regress-6337.js
new file mode 100644
index 0000000..e80804e
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-6337.js
@@ -0,0 +1,5 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertThrows(function() { eval(`class C { ...[] }`); } )
diff --git a/src/v8/test/mjsunit/regress/regress-633998.js b/src/v8/test/mjsunit/regress/regress-633998.js
new file mode 100644
index 0000000..ff34a0a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-633998.js
@@ -0,0 +1,44 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var err_str_1 = "apply was called on , which is a object and not a function";
+var err_str_2 =
+ "apply was called on Error, which is a object and not a function";
+
+var reached = false;
+var error = new Error();
+error.name = error;
+try {
+ Reflect.apply(error);
+ reached = true;
+} catch (e) {
+ assertTrue(e.stack.indexOf(err_str_1) != -1);
+} finally {
+ assertFalse(reached);
+}
+
+reached = false;
+error = new Error();
+error.msg = error;
+try {
+ Reflect.apply(error);
+ reached = true;
+} catch (e) {
+ assertTrue(e.stack.indexOf(err_str_2) != -1);
+} finally {
+ assertFalse(reached);
+}
+
+reached = false;
+error = new Error();
+error.name = error;
+error.msg = error;
+try {
+ Reflect.apply(error);
+ reached = true;
+} catch (e) {
+ assertTrue(e.stack.indexOf(err_str_1) != -1);
+} finally {
+ assertFalse(reached);
+}
diff --git a/src/v8/test/mjsunit/regress/regress-634-debug.js b/src/v8/test/mjsunit/regress/regress-634-debug.js
new file mode 100644
index 0000000..17ca828
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-634-debug.js
@@ -0,0 +1,41 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function f() {
+ %SetAllocationTimeout(1, 0, false);
+ a = new Array(0);
+ assertEquals(0, a.length);
+ assertEquals(0, a.length);
+ %SetAllocationTimeout(-1, -1, true);
+}
+
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+f();
diff --git a/src/v8/test/mjsunit/regress/regress-635429.js b/src/v8/test/mjsunit/regress/regress-635429.js
new file mode 100644
index 0000000..7fbce0d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-635429.js
@@ -0,0 +1,12 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --stack-size=150
+
+function foo() {
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "boom"};
+
+try {
+ foo()
+} catch(e) {}
diff --git a/src/v8/test/mjsunit/regress/regress-636.js b/src/v8/test/mjsunit/regress/regress-636.js
new file mode 100644
index 0000000..8e0196d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-636.js
@@ -0,0 +1,36 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function test() {
+ var i, result = "";
+ var value = parseFloat(5.5);
+ value = Math.abs(1025);
+ for(i = 12; --i; result = ( value % 2 ) + result, value >>= 1);
+ return result;
+};
+
+assertEquals("10000000001", test());
diff --git a/src/v8/test/mjsunit/regress/regress-6373.js b/src/v8/test/mjsunit/regress/regress-6373.js
new file mode 100644
index 0000000..8673e83
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-6373.js
@@ -0,0 +1,24 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var A = {}
+
+A[Symbol.hasInstance] = function(x) {
+ %DeoptimizeFunction(foo);
+ return 1;
+}
+
+var a = {}
+
+function foo(o) {
+ return o instanceof A;
+}
+
+foo(a);
+foo(a);
+assertTrue(foo(a) !== 1);
+%OptimizeFunctionOnNextCall(foo);
+assertTrue(foo(a) !== 1);
diff --git a/src/v8/test/mjsunit/regress/regress-638134.js b/src/v8/test/mjsunit/regress/regress-638134.js
new file mode 100644
index 0000000..5391eed
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-638134.js
@@ -0,0 +1,20 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function foo() {
+ // Generates a forward branch that puts 200 in the constant pool.
+ var i = 0;
+ if (i) {
+ i = 0; i = 0; i = 0; i = 0; i = 0; i = 0; i = 0; i = 0; i = 0; i = 0;
+ i = 0; i = 0; i = 0; i = 0; i = 0; i = 0; i = 0; i = 0; i = 0; i = 0;
+ i = 0; i = 0; i = 0; i = 0; i = 0; i = 0; i = 0; i = 0; i = 0; i = 0;
+ i = 0; i = 0; i = 0; i = 0; i = 0; i = 0; i = 0; i = 0; i = 0; i = 0;
+ i = 0; i = 0; i = 0; i = 0; i = 0; i = 0; i = 0; i = 0; i = 0; i = 0;
+ i = 0; i = 0; i = 0; i = 0; i = 0; i = 0; i = 0; i = 0; i = 0; i = 0;
+ i = 0; i = 0; i = 0; i = 0; i = 0; i = 0;
+ }
+ // Emit a 200 literal which also ends up in the constant pool.
+ var j = 0.2e3;
+}
+foo();
diff --git a/src/v8/test/mjsunit/regress/regress-639270.js b/src/v8/test/mjsunit/regress/regress-639270.js
new file mode 100644
index 0000000..731175d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-639270.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --es-staging
+
+"use strict";
+
+var g = (async () => { return JSON.stringify() });
+
+g();
+g();
+%OptimizeFunctionOnNextCall(g);
+g();
diff --git a/src/v8/test/mjsunit/regress/regress-641091.js b/src/v8/test/mjsunit/regress/regress-641091.js
new file mode 100644
index 0000000..33a98ef
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-641091.js
@@ -0,0 +1,15 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertEquals(["🍤", "🍤"],
+ '🍤🍦🍋ππ🍋🍦🍤'.match(/🍤/ug));
+
+assertEquals(["🍤", "🍦", "🍦", "🍤"],
+ '🍤🍦🍋ππ🍋🍦🍤'.match(/🍤|🍦/ug));
+
+assertEquals(["🍤", "🍦", "🍋", "🍋", "🍦", "🍤"],
+ '🍤🍦🍋ππ🍋🍦🍤'.match(/🍤|🍦|🍋/ug));
+
+assertEquals(["🍤", "🍦", "🍋", "π", "π", "🍋", "🍦", "🍤"],
+ '🍤🍦🍋ππ🍋🍦🍤'.match(/🍤|🍦|π|🍋/ug));
diff --git a/src/v8/test/mjsunit/regress/regress-642409.js b/src/v8/test/mjsunit/regress/regress-642409.js
new file mode 100644
index 0000000..eceb070
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-642409.js
@@ -0,0 +1,22 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+class SuperClass {
+}
+
+class SubClass extends SuperClass {
+ constructor() {
+ super();
+ this.doSomething();
+ }
+ doSomething() {
+ }
+}
+
+new SubClass();
+new SubClass();
+%OptimizeFunctionOnNextCall(SubClass);
+new SubClass();
diff --git a/src/v8/test/mjsunit/regress/regress-643.js b/src/v8/test/mjsunit/regress/regress-643.js
new file mode 100644
index 0000000..39c467b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-643.js
@@ -0,0 +1,37 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Regression test for http://code.google.com/p/v8/issues/detail?id=643.
+
+function f() {
+ var test = {x:1};
+ var a = test;
+ a.x = a = 42;
+ return test.x;
+}
+
+assertEquals(42, f());
diff --git a/src/v8/test/mjsunit/regress/regress-6431.js b/src/v8/test/mjsunit/regress/regress-6431.js
new file mode 100644
index 0000000..7b99b3f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-6431.js
@@ -0,0 +1,32 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function TestImportSymbolValue() {
+ function Module(stdlib, foreign) {
+ "use asm";
+ var x = +foreign.x;
+ function f() {}
+ return { f:f };
+ }
+ var foreign = { x : Symbol("boom") };
+ assertThrows(() => Module(this, foreign));
+ assertFalse(%IsAsmWasmCode(Module));
+})();
+
+(function TestImportMutatingObject() {
+ function Module(stdlib, foreign) {
+ "use asm";
+ var x = +foreign.x;
+ var PI = stdlib.Math.PI;
+ function f() { return +(PI + x) }
+ return { f:f };
+ }
+ var stdlib = { Math : { PI : Math.PI } };
+ var foreign = { x : { valueOf : () => (stdlib.Math.PI = 23, 42) } };
+ var m = Module(stdlib, foreign);
+ assertFalse(%IsAsmWasmCode(Module));
+ assertEquals(65, m.f());
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-645680.js b/src/v8/test/mjsunit/regress/regress-645680.js
new file mode 100644
index 0000000..de216f0
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-645680.js
@@ -0,0 +1,22 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc --allow-natives-syntax
+
+function getRandomProperty(v, rand) {
+ var properties = Object.getOwnPropertyNames(v);
+ if ("constructor" && v.constructor.hasOwnProperty()) {; }
+ if (properties.length == 0) { return "0"; }
+ return properties[rand % properties.length];
+}
+
+var args = (function( b) { return arguments; })("foo", NaN, "bar");
+args.__p_293850326 = "foo";
+%HeapObjectVerify(args);
+args.__defineGetter__(getRandomProperty( 990787501), function() {
+ gc();
+ return args.__p_293850326;
+});
+%HeapObjectVerify(args);
+Array.prototype.indexOf.call(args)
diff --git a/src/v8/test/mjsunit/regress/regress-646.js b/src/v8/test/mjsunit/regress/regress-646.js
new file mode 100644
index 0000000..b862350
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-646.js
@@ -0,0 +1,33 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Regression test for http://code.google.com/p/v8/issues/detail?id=646.
+
+function f() { this.__proto__ = 42 }
+var count = 0;
+for (var x in new f()) count++;
+assertEquals(0, count);
diff --git a/src/v8/test/mjsunit/regress/regress-648373-sloppy-arguments-includesValues.js b/src/v8/test/mjsunit/regress/regress-648373-sloppy-arguments-includesValues.js
new file mode 100644
index 0000000..ecc58c0
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-648373-sloppy-arguments-includesValues.js
@@ -0,0 +1,33 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --expose-gc
+
+function getRandomProperty(v, rand) { var properties = Object.getOwnPropertyNames(v); var proto = Object.getPrototypeOf(v); if (proto) {; } if ("constructor" && v.constructor.hasOwnProperty()) {; } if (properties.length == 0) { return "0"; } return properties[rand % properties.length]; }
+var __v_4 = {};
+
+__v_2 = {
+ PACKED_ELEMENTS() {
+ return {
+ get 0() {
+ } };
+ } ,
+ Arguments: {
+ FAST_SLOPPY_ARGUMENTS_ELEMENTS() {
+ var __v_11 = (function( b) { return arguments; })("foo", NaN, "bar");
+ __v_11.__p_2006760047 = __v_11[getRandomProperty( 2006760047)];
+ __v_11.__defineGetter__(getRandomProperty( 1698457573), function() { gc(); __v_4[ 1486458228] = __v_2[ 1286067691]; return __v_11.__p_2006760047; });
+;
+Array.prototype.includes.call(__v_11);
+ },
+ Detached_Float64Array() {
+ } }
+};
+function __f_3(suites) {
+ Object.keys(suites).forEach(suite => __f_4(suites[suite]));
+ function __f_4(suite) {
+ Object.keys(suite).forEach(test => suite[test]());
+ }
+}
+__f_3(__v_2);
diff --git a/src/v8/test/mjsunit/regress/regress-648719.js b/src/v8/test/mjsunit/regress/regress-648719.js
new file mode 100644
index 0000000..c2df607
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-648719.js
@@ -0,0 +1,5 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertEquals('function', typeof eval('const xz = {};function yz(){xz}yz'));
diff --git a/src/v8/test/mjsunit/regress/regress-649067.js b/src/v8/test/mjsunit/regress/regress-649067.js
new file mode 100644
index 0000000..cd75004
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-649067.js
@@ -0,0 +1,5 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertEquals(1, (function arguments() { return eval("arguments"); })(1)[0]);
diff --git a/src/v8/test/mjsunit/regress/regress-649078.js b/src/v8/test/mjsunit/regress/regress-649078.js
new file mode 100644
index 0000000..f4f6e1b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-649078.js
@@ -0,0 +1,10 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let p = Promise.resolve();
+Object.defineProperty(p, 'then', {
+ get: () => new Proxy(function() {}, p)
+});
+
+new Promise((r) => r(p));
diff --git a/src/v8/test/mjsunit/regress/regress-6509.js b/src/v8/test/mjsunit/regress/regress-6509.js
new file mode 100644
index 0000000..85a7815
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-6509.js
@@ -0,0 +1,24 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(function testSloppy() {
+ var arrow = (sth = (function f() {
+ {
+ function f2() { }
+ }
+ })()) => 0;
+
+ assertEquals(0, arrow());
+})();
+
+(function testStrict() {
+ "use strict";
+ var arrow = (sth = (function f() {
+ {
+ function f2() { }
+ }
+ })()) => 0;
+
+ assertEquals(0, arrow());
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-651327.js b/src/v8/test/mjsunit/regress/regress-651327.js
new file mode 100644
index 0000000..f7ac24f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-651327.js
@@ -0,0 +1,217 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc
+
+function __f_1(a) {
+ __v_1 = a;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ gc();
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = -1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ gc();
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 0;
+ gc();
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ gc();
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ __f_3();
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = -1073741825;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = -7;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ __f_3();
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 17;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ gc();
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 0;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ gc();
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 65535;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = -13;
+ x = 1;
+ x = 1;
+ this.mapHeight * Math.round();
+}
+__f_1();
+function __f_2(initialX, initialY) {
+}
+function __f_3() {
+}
+gc();
+__f_1();
diff --git a/src/v8/test/mjsunit/regress/regress-653407.js b/src/v8/test/mjsunit/regress/regress-653407.js
new file mode 100644
index 0000000..66d537e
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-653407.js
@@ -0,0 +1,26 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// This is to test if 'this' gets correctly initialized when inlining
+// constructors in turbofan.
+
+class superClass {
+ constructor () {}
+}
+
+class subClass extends superClass {
+ constructor () {
+ super();
+ }
+}
+
+function f() {
+ new subClass();
+}
+
+f(); // We need this to collect feedback, so that subClass gets inlined in f.
+%OptimizeFunctionOnNextCall(f)
+f();
diff --git a/src/v8/test/mjsunit/regress/regress-655573.js b/src/v8/test/mjsunit/regress/regress-655573.js
new file mode 100644
index 0000000..967ab31
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-655573.js
@@ -0,0 +1,18 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --no-always-opt --no-stress-opt
+
+// Generate a function with a very large closure.
+source = "(function() {\n"
+for (var i = 0; i < 65000; i++) {
+ source += " var a_" + i + " = 0;\n";
+}
+source += " return function() {\n"
+for (var i = 0; i < 65000; i++) {
+ source += "a_" + i + "++;\n";
+}
+source += "}})();\n"
+
+eval(source);
diff --git a/src/v8/test/mjsunit/regress/regress-6607-1.js b/src/v8/test/mjsunit/regress/regress-6607-1.js
new file mode 100644
index 0000000..74b702b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-6607-1.js
@@ -0,0 +1,19 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+function get(a, i) {
+ return a[i];
+}
+
+get([1,,3], 0);
+get([1,,3], 2);
+%OptimizeFunctionOnNextCall(get);
+get([1,,3], 0);
+assertOptimized(get);
+
+// This unrelated change to the Array.prototype should be fine.
+Array.prototype.unrelated = 1;
+assertOptimized(get);
diff --git a/src/v8/test/mjsunit/regress/regress-6607-2.js b/src/v8/test/mjsunit/regress/regress-6607-2.js
new file mode 100644
index 0000000..cfb0009
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-6607-2.js
@@ -0,0 +1,19 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+function get(a, i) {
+ return a[i];
+}
+
+get([1,,3], 0);
+get([1,,3], 2);
+%OptimizeFunctionOnNextCall(get);
+get([1,,3], 0);
+assertOptimized(get);
+
+// This unrelated change to the Object.prototype should be fine.
+Object.prototype.unrelated = 1;
+assertOptimized(get);
diff --git a/src/v8/test/mjsunit/regress/regress-662254.js b/src/v8/test/mjsunit/regress/regress-662254.js
new file mode 100644
index 0000000..daf5e17
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-662254.js
@@ -0,0 +1,40 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function f() {
+ for (var c in []) { }
+}
+
+f();
+
+
+function g() {
+ var c;
+ for (c in []) { }
+}
+
+g();
diff --git a/src/v8/test/mjsunit/regress/regress-662845.js b/src/v8/test/mjsunit/regress/regress-662845.js
new file mode 100644
index 0000000..7740ed1
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-662845.js
@@ -0,0 +1,15 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(x) {
+ (function() { x = 1; })()
+ return arguments[0];
+}
+
+assertEquals(1, foo(42));
+assertEquals(1, foo(42));
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(1, foo(42));
diff --git a/src/v8/test/mjsunit/regress/regress-662904.js b/src/v8/test/mjsunit/regress/regress-662904.js
new file mode 100644
index 0000000..00ab1cd
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-662904.js
@@ -0,0 +1,19 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(a) {
+ var sum = 0;
+ var a = [0, "a"];
+ for (var i in a) {
+ sum += a[i];
+ }
+ return sum;
+}
+
+assertEquals("0a", foo());
+assertEquals("0a", foo());
+%OptimizeFunctionOnNextCall(foo);
+assertEquals("0a", foo());
diff --git a/src/v8/test/mjsunit/regress/regress-664087.js b/src/v8/test/mjsunit/regress/regress-664087.js
new file mode 100644
index 0000000..6739167
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-664087.js
@@ -0,0 +1,21 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function g() {
+ throw 1;
+}
+
+var v = { valueOf : g };
+
+function foo(v) {
+ v++;
+}
+
+%NeverOptimizeFunction(g);
+assertThrows(function () { foo(v); });
+assertThrows(function () { foo(v); });
+%OptimizeFunctionOnNextCall(foo);
+assertThrows(function () { foo(v); });
diff --git a/src/v8/test/mjsunit/regress/regress-6657.js b/src/v8/test/mjsunit/regress/regress-6657.js
new file mode 100644
index 0000000..49f8e64
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-6657.js
@@ -0,0 +1,38 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(function TestArrayNonEmptySpecies() {
+ class MyArray extends Array {
+ constructor() { return [1, 2, 3]; }
+ }
+ var a = [5, 4];
+ a.__proto__ = MyArray.prototype;
+ var o = a.filter(() => true);
+ assertEquals([5, 4, 3], o);
+ assertEquals(3, o.length);
+})();
+
+(function TestArrayLeakingSpeciesInsertInCallback() {
+ var my_array = [];
+ class MyArray extends Array {
+ constructor() { return my_array; }
+ }
+ var a = [5, 4];
+ a.__proto__ = MyArray.prototype;
+ var o = a.filter(() => (my_array[2] = 3, true));
+ assertEquals([5, 4, 3], o);
+ assertEquals(3, o.length);
+})();
+
+(function TestArrayLeakingSpeciesRemoveInCallback() {
+ var my_array = [];
+ class MyArray extends Array {
+ constructor() { return my_array; }
+ }
+ var a = [5, 4, 3, 2, 1];
+ a.__proto__ = MyArray.prototype;
+ var o = a.filter(() => (my_array.length = 0, true));
+ assertEquals([,,,,1], o);
+ assertEquals(5, o.length);
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-666046.js b/src/v8/test/mjsunit/regress/regress-666046.js
new file mode 100644
index 0000000..b461538
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-666046.js
@@ -0,0 +1,57 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --expose-gc
+
+function P() {
+ this.a0 = {};
+ this.a1 = {};
+ this.a2 = {};
+ this.a3 = {};
+ this.a4 = {};
+}
+
+function A() {
+}
+
+var proto = new P();
+A.prototype = proto;
+
+function foo(o) {
+ return o.a0;
+}
+
+// Ensure |proto| is in old space.
+gc();
+gc();
+gc();
+
+// Ensure |proto| is marked as "should be fast".
+var o = new A();
+foo(o);
+foo(o);
+foo(o);
+assertTrue(%HasFastProperties(proto));
+
+// Contruct a double value that looks like a tagged pointer.
+var buffer = new ArrayBuffer(8);
+var int32view = new Int32Array(buffer);
+var float64view = new Float64Array(buffer);
+int32view[0] = int32view[1] = 0x40000001;
+var boom = float64view[0];
+
+
+// Write new space object.
+proto.a4 = {a: 0};
+// Immediately delete the field.
+delete proto.a4;
+
+// |proto| must sill be fast.
+assertTrue(%HasFastProperties(proto));
+
+// Add a double field instead of deleted a4 that looks like a tagged pointer.
+proto.boom = boom;
+
+// Boom!
+gc();
diff --git a/src/v8/test/mjsunit/regress/regress-666721.js b/src/v8/test/mjsunit/regress/regress-666721.js
new file mode 100644
index 0000000..e2c632f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-666721.js
@@ -0,0 +1,53 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function len0(a) { return a.length; }
+function len1(a) { return a.length; }
+function len2(a) { return a.length; }
+function len3(a) { return a.length; }
+
+assertEquals(0, len0([]));
+assertEquals(1, len0({length:1}));
+assertEquals(2, len0([1,2]));
+assertEquals(3, len0('123'));
+
+assertEquals(0, len1(''));
+assertEquals(1, len1({length:1}));
+assertEquals(2, len1('12'));
+assertEquals(3, len1([1,2,3]));
+
+assertEquals(0, len2({length:0}));
+assertEquals(1, len2([1]));
+assertEquals(2, len2({length:2}));
+assertEquals(3, len2([1,2,3]));
+assertEquals(4, len2('1234'));
+
+assertEquals(0, len3({length:0}));
+assertEquals(1, len3('1'));
+assertEquals(2, len3({length:2}));
+assertEquals(3, len3('123'));
+assertEquals(4, len3([1,2,3,4]));
diff --git a/src/v8/test/mjsunit/regress/regress-667061.js b/src/v8/test/mjsunit/regress/regress-667061.js
new file mode 100644
index 0000000..4d29a1a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-667061.js
@@ -0,0 +1,90 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test non-ICC case.
+var caught = false;
+try {
+ (('foo'))();
+} catch (o) {
+ assertTrue(o instanceof TypeError);
+ caught = true;
+}
+assertTrue(caught);
+
+
+// Test uninitialized case.
+function h(o) {
+ return o.x();
+}
+
+var caught = false;
+try {
+ h({ x: 1 });
+} catch (o) {
+ assertTrue(o instanceof TypeError);
+ caught = true;
+}
+assertTrue(caught);
+
+
+// Test monomorphic case.
+function g(o) {
+ return o.x();
+}
+
+function O(x) { this.x = x; };
+var o = new O(function() { return 1; });
+assertEquals(1, g(o)); // go monomorphic
+assertEquals(1, g(o)); // stay monomorphic
+
+var caught = false;
+try {
+ g(new O(3));
+} catch (o) {
+ assertTrue(o instanceof TypeError);
+ caught = true;
+}
+assertTrue(caught);
+
+
+// Test megamorphic case.
+function f(o) {
+ return o.x();
+}
+
+assertEquals(1, f({ x: function () { return 1; }})); // go monomorphic
+assertEquals(2, f({ x: function () { return 2; }})); // go megamorphic
+assertEquals(3, f({ x: function () { return 3; }})); // stay megamorphic
+
+var caught = false;
+try {
+ f({ x: 4 });
+} catch (o) {
+ assertTrue(o instanceof TypeError);
+ caught = true;
+}
+assertTrue(caught);
diff --git a/src/v8/test/mjsunit/regress/regress-667603.js b/src/v8/test/mjsunit/regress/regress-667603.js
new file mode 100644
index 0000000..7e91a16
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-667603.js
@@ -0,0 +1,9 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+try {
+ var v65 = new ArrayBuffer(2147483647);
+} catch(e) {
+ assertTrue(e instanceof RangeError);
+}
diff --git a/src/v8/test/mjsunit/regress/regress-6677.js b/src/v8/test/mjsunit/regress/regress-6677.js
new file mode 100644
index 0000000..2898c8f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-6677.js
@@ -0,0 +1,27 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Assignment to const variable inside with-statement should fail.
+const x = 0;
+assertThrows(() => { with ({}) { x = 1; } }, TypeError);
+assertEquals(0, x);
+
+assertThrows(() => { with ({}) { eval("x = 1"); } }, TypeError);
+assertEquals(0, x);
+
+// Assignment to name of named function expression inside with-statement
+// should not throw (but also not succeed).
+assertEquals('function', function f() {
+ with ({}) { f = 1 }
+ return typeof f;
+}());
+
+// But we should throw an exception if the assignment is itself in strict
+// code.
+assertEquals('function', function f() {
+ with ({}) {
+ assertThrows(function() { "use strict"; f = 1 }, TypeError);
+ }
+ return typeof f;
+}());
diff --git a/src/v8/test/mjsunit/regress/regress-6681.js b/src/v8/test/mjsunit/regress/regress-6681.js
new file mode 100644
index 0000000..d35ae41
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-6681.js
@@ -0,0 +1,10 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// MODULE
+
+import * as ns from "./regress-6681.js";
+export var foo;
+
+assertEquals(false, Reflect.defineProperty(ns, 'foo', {value: 123}));
diff --git a/src/v8/test/mjsunit/regress/regress-669024.js b/src/v8/test/mjsunit/regress/regress-669024.js
new file mode 100644
index 0000000..079cb96
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-669024.js
@@ -0,0 +1,21 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function h(y) { return y.u; }
+
+function g() { return h.apply(0, arguments); }
+
+function f(x) {
+ var o = { u : x };
+ return g(o);
+}
+
+f(42);
+f(0.1);
+
+%OptimizeFunctionOnNextCall(f);
+
+assertEquals(undefined, f(undefined));
diff --git a/src/v8/test/mjsunit/regress/regress-6700.js b/src/v8/test/mjsunit/regress/regress-6700.js
new file mode 100644
index 0000000..342cac4
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-6700.js
@@ -0,0 +1,90 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function TestLeftRight() {
+ function Module(stdlib, foreign, heap) {
+ "use asm";
+ var HEAP32 = new stdlib.Int32Array(heap);
+ function f(i) {
+ i = i | 0;
+ return HEAP32[i << 2 >> 2] | 0;
+ }
+ return { f:f }
+ }
+ var buffer = new ArrayBuffer(1024);
+ var module = new Module(this, {}, buffer);
+ assertTrue(%IsAsmWasmCode(Module));
+ new Int32Array(buffer)[42] = 23;
+ assertEquals(23, module.f(42));
+})();
+
+(function TestRightRight() {
+ function Module(stdlib, foreign, heap) {
+ "use asm";
+ var HEAP32 = new stdlib.Int32Array(heap);
+ function f(i) {
+ i = i | 0;
+ return HEAP32[i >> 2 >> 2] | 0;
+ }
+ return { f:f }
+ }
+ var buffer = new ArrayBuffer(1024);
+ var module = new Module(this, {}, buffer)
+ assertTrue(%IsAsmWasmCode(Module));
+ new Int32Array(buffer)[42 >> 4] = 23;
+ assertEquals(23, module.f(42));
+})();
+
+(function TestRightLeft() {
+ function Module(stdlib, foreign, heap) {
+ "use asm";
+ var HEAP32 = new stdlib.Int32Array(heap);
+ function f(i) {
+ i = i | 0;
+ return HEAP32[i >> 2 << 2] | 0;
+ }
+ return { f:f }
+ }
+ var buffer = new ArrayBuffer(1024);
+ var module = new Module(this, {}, buffer)
+ assertFalse(%IsAsmWasmCode(Module));
+ new Int32Array(buffer)[42 & 0xfc] = 23;
+ assertEquals(23, module.f(42));
+})();
+
+(function TestRightButNotImmediate() {
+ function Module(stdlib, foreign, heap) {
+ "use asm";
+ var HEAP32 = new stdlib.Int32Array(heap);
+ function f(i) {
+ i = i | 0;
+ return HEAP32[i >> 2 + 1] | 0;
+ }
+ return { f:f }
+ }
+ var buffer = new ArrayBuffer(1024);
+ var module = new Module(this, {}, buffer)
+ assertFalse(%IsAsmWasmCode(Module));
+ new Int32Array(buffer)[42 >> 3] = 23;
+ assertEquals(23, module.f(42));
+})();
+
+(function TestLeftOnly() {
+ function Module(stdlib, foreign, heap) {
+ "use asm";
+ var HEAP32 = new stdlib.Int32Array(heap);
+ function f(i) {
+ i = i | 0;
+ return HEAP32[i << 2] | 0;
+ }
+ return { f:f }
+ }
+ var buffer = new ArrayBuffer(1024);
+ var module = new Module(this, {}, buffer)
+ assertFalse(%IsAsmWasmCode(Module));
+ new Int32Array(buffer)[42 << 2] = 23;
+ assertEquals(23, module.f(42));
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-670147.js b/src/v8/test/mjsunit/regress/regress-670147.js
new file mode 100644
index 0000000..916c13d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-670147.js
@@ -0,0 +1,33 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function XXX(x) {
+ var k = delete x;
+ return k;
+}
+
+assertFalse(XXX('Hello'));
diff --git a/src/v8/test/mjsunit/regress/regress-670671.js b/src/v8/test/mjsunit/regress/regress-670671.js
new file mode 100644
index 0000000..06925de
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-670671.js
@@ -0,0 +1,23 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Trigger an infinite loop through RegExp.prototype[@@match], which results
+// in unbounded growth of the results array.
+
+// Limit the number of iterations to avoid OOM while still triggering large
+// object space allocation.
+const min_ptr_size = 4;
+const max_regular_heap_object_size = 507136;
+const num_iterations = max_regular_heap_object_size / min_ptr_size;
+
+let i = 0;
+
+const re = /foo.bar/;
+const RegExpPrototypeExec = RegExp.prototype.exec;
+re.exec = (str) => {
+ return (i++ < num_iterations) ? RegExpPrototypeExec.call(re, str) : null;
+};
+re.__defineGetter__("global", () => true); // Triggers infinite loop.
+
+"foo*bar".match(re); // Should not crash.
diff --git a/src/v8/test/mjsunit/regress/regress-6707.js b/src/v8/test/mjsunit/regress/regress-6707.js
new file mode 100644
index 0000000..1a8984a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-6707.js
@@ -0,0 +1,13 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var a = [0, 1];
+a.constructor = {
+ [Symbol.species]: function(len) {
+ var arr = {length: 0};
+ Object.defineProperty(arr, "length", {writable: false});
+ return arr;
+ }
+}
+assertThrows(() => { Array.prototype.concat.call(a) }, TypeError);
diff --git a/src/v8/test/mjsunit/regress/regress-6708.js b/src/v8/test/mjsunit/regress/regress-6708.js
new file mode 100644
index 0000000..06b6835
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-6708.js
@@ -0,0 +1,12 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var a = [0, 1];
+a.constructor = {
+ [Symbol.species]: function(len) {
+ var arr = Array(20);
+ return arr;
+ }
+};
+assertEquals([0, 1], Array.prototype.concat.call(a));
diff --git a/src/v8/test/mjsunit/regress/regress-670808.js b/src/v8/test/mjsunit/regress/regress-670808.js
new file mode 100644
index 0000000..d5e0b51
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-670808.js
@@ -0,0 +1,22 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var sym = Symbol();
+function asm(stdlib, ffi) {
+ "use asm";
+ var get_sym = ffi.get_sym;
+ function crash() {
+ get_sym()|0;
+ }
+ return {crash: crash};
+}
+function get_sym() {
+ return sym;
+}
+try {
+ asm(null, {get_sym: get_sym}).crash();
+} catch (e) {
+ if (!(e instanceof TypeError))
+ throw e;
+}
diff --git a/src/v8/test/mjsunit/regress/regress-670981-array-push.js b/src/v8/test/mjsunit/regress/regress-670981-array-push.js
new file mode 100644
index 0000000..c0afe7f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-670981-array-push.js
@@ -0,0 +1,8 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var array = [];
+array.length = .6e+7;
+array.push( );
+assertEquals(array.length, .6e+7);
diff --git a/src/v8/test/mjsunit/regress/regress-672041.js b/src/v8/test/mjsunit/regress/regress-672041.js
new file mode 100644
index 0000000..ceea4fd
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-672041.js
@@ -0,0 +1,23 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Trigger an infinite loop through RegExp.prototype[@@match], which results
+// in unbounded growth of the results array.
+
+// Limit the number of iterations to avoid OOM while still triggering large
+// object space allocation.
+const min_ptr_size = 4;
+const max_regular_heap_object_size = 507136;
+const num_iterations = max_regular_heap_object_size / min_ptr_size;
+
+const RegExpPrototypeExec = RegExp.prototype.exec;
+
+let i = 0;
+
+RegExp.prototype.__defineGetter__("global", () => true);
+RegExp.prototype.exec = function(str) {
+ return (i++ < num_iterations) ? RegExpPrototypeExec.call(this, str) : null;
+};
+
+"a".match();
diff --git a/src/v8/test/mjsunit/regress/regress-673241.js b/src/v8/test/mjsunit/regress/regress-673241.js
new file mode 100644
index 0000000..a4d6ffe
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-673241.js
@@ -0,0 +1,13 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --validate-asm
+
+function generateAsmJs() {
+ 'use asm';
+ function fun() { fun(); }
+ return fun;
+}
+
+assertThrows(generateAsmJs());
diff --git a/src/v8/test/mjsunit/regress/regress-673242.js b/src/v8/test/mjsunit/regress/regress-673242.js
new file mode 100644
index 0000000..ceb60f5
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-673242.js
@@ -0,0 +1,31 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --mark-shared-functions-for-tier-up --allow-natives-syntax --expose-gc
+
+function foo() {
+ function bar() {
+ }
+ return bar;
+}
+
+// Mark bar's shared function info for tier-up
+// (but don't optimize).
+var bar = foo();
+%OptimizeFunctionOnNextCall(bar);
+
+// Avoid flushing foo (and thereby making bar's shared function info
+// dead) by marking it to be optimized.
+%OptimizeFunctionOnNextCall(foo);
+
+// Throw away the JSFunction we have for bar and GC until its code has
+// been flushed.
+bar = null;
+for (var i = 0; i < 6; i++) {
+ gc();
+}
+
+// Now create a new JSFunction from bar's shared function info and call it,
+// we should not optimize without recompiling the baseline code.
+foo()();
diff --git a/src/v8/test/mjsunit/regress/regress-673297.js b/src/v8/test/mjsunit/regress/regress-673297.js
new file mode 100644
index 0000000..9a00a90
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-673297.js
@@ -0,0 +1,13 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --validate-asm
+
+function generateAsmJs() {
+ 'use asm';
+ function fun() { fun(); }
+ return fun;
+}
+
+assertThrows(generateAsmJs(), RangeError);
diff --git a/src/v8/test/mjsunit/regress/regress-6733.js b/src/v8/test/mjsunit/regress/regress-6733.js
new file mode 100644
index 0000000..76a6911
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-6733.js
@@ -0,0 +1,22 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let x;
+Realm.eval(Realm.current(), "let y");
+assertFalse(delete x);
+assertFalse(delete y);
+assertFalse(eval("delete x"));
+assertFalse(eval("delete y"));
+
+(function() {
+ let z;
+ assertFalse(delete x);
+ assertFalse(delete y);
+ assertFalse(delete z);
+ assertFalse(eval("delete x"));
+ assertFalse(eval("delete y"));
+ assertFalse(eval("delete z"));
+})();
+
+assertFalse(eval("let z; delete z"));
diff --git a/src/v8/test/mjsunit/regress/regress-674232.js b/src/v8/test/mjsunit/regress/regress-674232.js
new file mode 100644
index 0000000..424ac85
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-674232.js
@@ -0,0 +1,16 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function getRandomProperty(v, rand) { var properties = Object.getOwnPropertyNames(v); var proto = Object.getPrototypeOf(v); if (proto) {; } if ("constructor" && v.constructor.hasOwnProperty()) {; } if (properties.length == 0) { return "0"; } return properties[rand % properties.length]; }
+function __f_11() {
+ var __v_8 = new Array();
+ var __v_9 = __v_8.entries();
+ __v_9.__p_118574531 = __v_9[ 118574531];
+ __v_9.__defineGetter__(getRandomProperty(__v_9, 1442724132), function() {; __v_0[getRandomProperty()] = __v_1[getRandomProperty()]; return __v_9.__p_118574531; });
+}
+function __f_10() {
+ __f_11();
+}
+__f_10();
+__f_10();
diff --git a/src/v8/test/mjsunit/regress/regress-674753.js b/src/v8/test/mjsunit/regress/regress-674753.js
new file mode 100644
index 0000000..d8a504a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-674753.js
@@ -0,0 +1,162 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var undetectable = %GetUndetectable();
+
+// Number
+assertTrue(typeof 0 == 'number');
+assertTrue(typeof 0 === 'number');
+assertFalse(typeof 0 != 'number');
+assertFalse(typeof 0 !== 'number');
+assertTrue(typeof 1.2 == 'number');
+assertTrue(typeof 1.2 === 'number');
+assertFalse(typeof 1.2 != 'number');
+assertFalse(typeof 1.2 !== 'number');
+assertTrue(typeof 'x' != 'number');
+assertTrue(typeof 'x' !== 'number');
+assertFalse(typeof 'x' == 'number');
+assertFalse(typeof 'x' === 'number');
+assertTrue(typeof Object() != 'number');
+assertTrue(typeof Object() !== 'number');
+assertFalse(typeof Object() == 'number');
+assertFalse(typeof Object() === 'number');
+
+// String
+assertTrue(typeof 'x' == 'string');
+assertTrue(typeof 'x' === 'string');
+assertFalse(typeof 'x' != 'string');
+assertFalse(typeof 'x' !== 'string');
+assertTrue(typeof ('x' + 'x') == 'string');
+assertTrue(typeof ('x' + 'x') === 'string');
+assertFalse(typeof ('x' + 'x') != 'string');
+assertFalse(typeof ('x' + 'x') !== 'string');
+assertTrue(typeof 1 != 'string');
+assertTrue(typeof 1 !== 'string');
+assertFalse(typeof 1 == 'string');
+assertFalse(typeof 1 === 'string');
+assertTrue(typeof Object() != 'string');
+assertTrue(typeof Object() !== 'string');
+assertFalse(typeof Object() == 'string');
+assertFalse(typeof Object() === 'string');
+
+// Boolean
+assertTrue(typeof true == 'boolean');
+assertTrue(typeof true === 'boolean');
+assertFalse(typeof true != 'boolean');
+assertFalse(typeof true !== 'boolean');
+assertTrue(typeof false == 'boolean');
+assertTrue(typeof false === 'boolean');
+assertFalse(typeof false != 'boolean');
+assertFalse(typeof false !== 'boolean');
+assertTrue(typeof 1 != 'boolean');
+assertTrue(typeof 1 !== 'boolean');
+assertFalse(typeof 1 == 'boolean');
+assertFalse(typeof 1 === 'boolean');
+assertTrue(typeof 'x' != 'boolean');
+assertTrue(typeof 'x' !== 'boolean');
+assertFalse(typeof 'x' == 'boolean');
+assertFalse(typeof 'x' === 'boolean');
+assertTrue(typeof Object() != 'boolean');
+assertTrue(typeof Object() !== 'boolean');
+assertFalse(typeof Object() == 'boolean');
+assertFalse(typeof Object() === 'boolean');
+
+// Undefined
+assertTrue(typeof void 0 == 'undefined');
+assertTrue(typeof void 0 === 'undefined');
+assertFalse(typeof void 0 != 'undefined');
+assertFalse(typeof void 0 !== 'undefined');
+assertTrue(typeof 1 != 'undefined');
+assertTrue(typeof 1 !== 'undefined');
+assertFalse(typeof 1 == 'undefined');
+assertFalse(typeof 1 === 'undefined');
+assertTrue(typeof null != 'undefined');
+assertTrue(typeof null !== 'undefined');
+assertFalse(typeof null == 'undefined');
+assertFalse(typeof null === 'undefined');
+assertTrue(typeof Object() != 'undefined');
+assertTrue(typeof Object() !== 'undefined');
+assertFalse(typeof Object() == 'undefined');
+assertFalse(typeof Object() === 'undefined');
+assertTrue(typeof undetectable == 'undefined');
+assertTrue(typeof undetectable === 'undefined');
+assertFalse(typeof undetectable != 'undefined');
+assertFalse(typeof undetectable !== 'undefined');
+
+// Function
+assertTrue(typeof Object == 'function');
+assertTrue(typeof Object === 'function');
+assertFalse(typeof Object != 'function');
+assertFalse(typeof Object !== 'function');
+assertTrue(typeof 1 != 'function');
+assertTrue(typeof 1 !== 'function');
+assertFalse(typeof 1 == 'function');
+assertFalse(typeof 1 === 'function');
+assertTrue(typeof Object() != 'function');
+assertTrue(typeof Object() !== 'function');
+assertFalse(typeof Object() == 'function');
+assertFalse(typeof Object() === 'function');
+assertTrue(typeof undetectable != 'function');
+assertTrue(typeof undetectable !== 'function');
+assertFalse(typeof undetectable == 'function');
+assertFalse(typeof undetectable === 'function');
+
+// Object
+assertTrue(typeof Object() == 'object');
+assertTrue(typeof Object() === 'object');
+assertFalse(typeof Object() != 'object');
+assertFalse(typeof Object() !== 'object');
+assertTrue(typeof new String('x') == 'object');
+assertTrue(typeof new String('x') === 'object');
+assertFalse(typeof new String('x') != 'object');
+assertFalse(typeof new String('x') !== 'object');
+assertTrue(typeof ['x'] == 'object');
+assertTrue(typeof ['x'] === 'object');
+assertFalse(typeof ['x'] != 'object');
+assertFalse(typeof ['x'] !== 'object');
+assertTrue(typeof null == 'object');
+assertTrue(typeof null === 'object');
+assertFalse(typeof null != 'object');
+assertFalse(typeof null !== 'object');
+assertTrue(typeof 1 != 'object');
+assertTrue(typeof 1 !== 'object');
+assertFalse(typeof 1 == 'object');
+assertFalse(typeof 1 === 'object');
+assertTrue(typeof 'x' != 'object');
+assertTrue(typeof 'x' !== 'object');
+assertFalse(typeof 'x' == 'object'); // bug #674753
+assertFalse(typeof 'x' === 'object');
+assertTrue(typeof Object != 'object');
+assertTrue(typeof Object !== 'object');
+assertFalse(typeof Object == 'object');
+assertFalse(typeof Object === 'object');
+assertTrue(typeof undetectable != 'object');
+assertTrue(typeof undetectable !== 'object');
+assertFalse(typeof undetectable == 'object');
+assertFalse(typeof undetectable === 'object');
diff --git a/src/v8/test/mjsunit/regress/regress-675.js b/src/v8/test/mjsunit/regress/regress-675.js
new file mode 100644
index 0000000..bef7b27
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-675.js
@@ -0,0 +1,60 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Regression test for http://code.google.com/p/v8/issues/detail?id=675.
+//
+// Test that load ICs for nonexistent properties check global
+// property cells.
+
+function f() { return this.x; }
+
+// Initialize IC for nonexistent x property on global object.
+f();
+f();
+
+// Assign to global property cell for x.
+this.x = 23;
+
+// Check that we bail out from the IC.
+assertEquals(23, f());
+
+
+// Same test, but test that the global property cell is also checked
+// if the global object is the last object in the prototype chain for
+// the load.
+this.__proto__ = null;
+function g() { return this.y; }
+
+// Initialize IC.
+g();
+g();
+
+// Update global property cell.
+this.y = 42;
+
+// Check that IC bails out.
+assertEquals(42, g());
diff --git a/src/v8/test/mjsunit/regress/regress-676025.js b/src/v8/test/mjsunit/regress/regress-676025.js
new file mode 100644
index 0000000..15157f2
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-676025.js
@@ -0,0 +1,31 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var result;
+try { eval('a=/(/'); } catch (e) { result = e; }
+assertEquals('object', typeof result);
+assertTrue(result instanceof SyntaxError);
diff --git a/src/v8/test/mjsunit/regress/regress-677055.js b/src/v8/test/mjsunit/regress/regress-677055.js
new file mode 100644
index 0000000..d65cec8
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-677055.js
@@ -0,0 +1,11 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+if (this.Intl) {
+ v5 = new Intl.NumberFormat();
+ v9 = new Intl.DateTimeFormat();
+ v52 = v9["formatToParts"];
+ var v55 = {};
+ assertThrows(() => Reflect.apply(v52, v5, v55), TypeError);
+}
diff --git a/src/v8/test/mjsunit/regress/regress-677685.js b/src/v8/test/mjsunit/regress/regress-677685.js
new file mode 100644
index 0000000..59076a9
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-677685.js
@@ -0,0 +1,32 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --stack-size=100
+
+function Module(stdlib) {
+ "use asm";
+
+ var fround = stdlib.Math.fround;
+
+ // f: double -> float
+ function f(a) {
+ a = +a;
+ return fround(a);
+ }
+
+ return { f: f };
+}
+
+var f = Module({ Math: Math }).f;
+
+function runNearStackLimit() {
+ function g() { try { g(); } catch(e) { f(); } };
+ g();
+}
+
+(function () {
+ function g() {}
+
+ runNearStackLimit(g);
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-678525.js b/src/v8/test/mjsunit/regress/regress-678525.js
new file mode 100644
index 0000000..49059c6
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-678525.js
@@ -0,0 +1,57 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+assertEquals(0, '\0'.charCodeAt(0));
+assertEquals(1, '\1'.charCodeAt(0));
+assertEquals(2, '\2'.charCodeAt(0));
+assertEquals(3, '\3'.charCodeAt(0));
+assertEquals(4, '\4'.charCodeAt(0));
+assertEquals(5, '\5'.charCodeAt(0));
+assertEquals(6, '\6'.charCodeAt(0));
+assertEquals(7, '\7'.charCodeAt(0));
+assertEquals(56, '\8'.charCodeAt(0));
+
+assertEquals('\010', '\10');
+assertEquals('\011', '\11');
+assertEquals('\012', '\12');
+assertEquals('\013', '\13');
+assertEquals('\014', '\14');
+assertEquals('\015', '\15');
+assertEquals('\016', '\16');
+assertEquals('\017', '\17');
+
+assertEquals('\020', '\20');
+assertEquals('\021', '\21');
+assertEquals('\022', '\22');
+assertEquals('\023', '\23');
+assertEquals('\024', '\24');
+assertEquals('\025', '\25');
+assertEquals('\026', '\26');
+assertEquals('\027', '\27');
+
+assertEquals(73, '\111'.charCodeAt(0));
+assertEquals(105, '\151'.charCodeAt(0));
diff --git a/src/v8/test/mjsunit/regress/regress-678917.js b/src/v8/test/mjsunit/regress/regress-678917.js
new file mode 100644
index 0000000..0e302e5
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-678917.js
@@ -0,0 +1,26 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --max-old-space-size=1600
+
+s1 = 'xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx';
+s1 += s1;
+s1 += s1;
+s1 += s1;
+s1 += s1;
+
+s0 = 'a';
+
+function g() {
+ for (var j = 0; j < 1000000; j++) {
+ s0 += s1;
+ }
+}
+
+try {
+ g();
+} catch (e) {
+}
+
+assertEquals('x', s0[10]);
diff --git a/src/v8/test/mjsunit/regress/regress-679727.js b/src/v8/test/mjsunit/regress/regress-679727.js
new file mode 100644
index 0000000..40931ca
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-679727.js
@@ -0,0 +1,6 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+f = (e=({} = {} = 1)) => {}; f(1);
+((e = ({} = {} = {})) => {})(1)
diff --git a/src/v8/test/mjsunit/regress/regress-681.js b/src/v8/test/mjsunit/regress/regress-681.js
new file mode 100644
index 0000000..6708d05
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-681.js
@@ -0,0 +1,44 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Regression test for http://code.google.com/p/v8/issues/detail?id=681.
+//
+// Test that load ICs for nonexistent properties bail out on smi receiver.
+
+
+var x = {};
+function f() { return x.y; }
+
+// Initialize IC for nonexistent y property on x.
+f();
+f();
+
+// Make x a smi.
+x = 23;
+
+// Check that we bail out from the IC.
+assertEquals(undefined, f());
diff --git a/src/v8/test/mjsunit/regress/regress-681171-1.js b/src/v8/test/mjsunit/regress/regress-681171-1.js
new file mode 100644
index 0000000..41c91e8
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-681171-1.js
@@ -0,0 +1,13 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --always-opt --function-context-specialization --verify-heap
+
+bar = function() { }
+
+try {
+ (function() {
+ bar(...(function*(){ yield 1; yield 2; yield 3; })());
+ })();
+} catch(e) {}
diff --git a/src/v8/test/mjsunit/regress/regress-681171-2.js b/src/v8/test/mjsunit/regress/regress-681171-2.js
new file mode 100644
index 0000000..2f69b68
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-681171-2.js
@@ -0,0 +1,12 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --always-opt --function-context-specialization --verify-heap
+
+function* gen() {
+ for (var i = 0; i < 3; ++i) {
+ yield i
+ }
+}
+gen().next();
diff --git a/src/v8/test/mjsunit/regress/regress-681171-3.js b/src/v8/test/mjsunit/regress/regress-681171-3.js
new file mode 100644
index 0000000..a299e8e
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-681171-3.js
@@ -0,0 +1,11 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --always-opt --function-context-specialization --verify-heap
+
+(function __f_5() {
+ var __v_0 = { *['a']() { yield 2; } };
+ var __v_3 = __v_0.a();
+ __v_3.next();
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-681383.js b/src/v8/test/mjsunit/regress/regress-681383.js
new file mode 100644
index 0000000..e8c3593
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-681383.js
@@ -0,0 +1,19 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f(deopt) {
+ let array = [42];
+ let it = array[Symbol.iterator]();
+ if (deopt) {
+ %_DeoptimizeNow();
+ return it.next().value;
+ }
+}
+
+f(false);
+f(false);
+%OptimizeFunctionOnNextCall(f);
+assertEquals(f(true), 42);
diff --git a/src/v8/test/mjsunit/regress/regress-681984.js b/src/v8/test/mjsunit/regress/regress-681984.js
new file mode 100644
index 0000000..ffc51f3
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-681984.js
@@ -0,0 +1,13 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function __f_0() {
+ try {
+ __f_0();
+ } catch(e) {
+
+ Realm.create();
+ }
+}
+__f_0();
diff --git a/src/v8/test/mjsunit/regress/regress-682242.js b/src/v8/test/mjsunit/regress/regress-682242.js
new file mode 100644
index 0000000..c22d976
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-682242.js
@@ -0,0 +1,18 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --es-staging
+
+class BaseClass {
+ method() {
+ return 1;
+ }
+}
+class SubClass extends BaseClass {
+ method(...args) {
+ return super.method(...args);
+ }
+}
+var a = new SubClass();
+a.method();
diff --git a/src/v8/test/mjsunit/regress/regress-682349.js b/src/v8/test/mjsunit/regress/regress-682349.js
new file mode 100644
index 0000000..d94e069
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-682349.js
@@ -0,0 +1,13 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+let success = false;
+function f() {
+ success = (f.caller === null);
+}
+Promise.resolve().then(f);
+%RunMicrotasks();
+assertTrue(success);
diff --git a/src/v8/test/mjsunit/regress/regress-682649.js b/src/v8/test/mjsunit/regress/regress-682649.js
new file mode 100644
index 0000000..f23aed5
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-682649.js
@@ -0,0 +1,30 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Should return [object global], v8 returns [object Object]
+
+assertEquals(this.toString(), eval("this.toString()"));
diff --git a/src/v8/test/mjsunit/regress/regress-683617.js b/src/v8/test/mjsunit/regress/regress-683617.js
new file mode 100644
index 0000000..18da682
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-683617.js
@@ -0,0 +1,17 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+global = 'n';
+function f(deopt) {
+ let it = global[Symbol.iterator]();
+ if (deopt) {
+ return it.next().value;
+ }
+}
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+assertEquals('n', f(true));
diff --git a/src/v8/test/mjsunit/regress/regress-6838-1.js b/src/v8/test/mjsunit/regress/regress-6838-1.js
new file mode 100644
index 0000000..bab6a19
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-6838-1.js
@@ -0,0 +1,33 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function TestMathMaxOnLargeInt() {
+ function Module(stdlib) {
+ "use asm";
+ var max = stdlib.Math.max;
+ function f() {
+ return max(42,0xffffffff);
+ }
+ return f;
+ }
+ var f = Module(this);
+ assertEquals(0xffffffff, f());
+ assertFalse(%IsAsmWasmCode(Module));
+})();
+
+(function TestMathMinOnLargeInt() {
+ function Module(stdlib) {
+ "use asm";
+ var min = stdlib.Math.min;
+ function f() {
+ return min(42,0xffffffff);
+ }
+ return f;
+ }
+ var f = Module(this);
+ assertEquals(42, f());
+ assertFalse(%IsAsmWasmCode(Module));
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-6838-2.js b/src/v8/test/mjsunit/regress/regress-6838-2.js
new file mode 100644
index 0000000..31b94b4
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-6838-2.js
@@ -0,0 +1,101 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function TestMathCeilReturningFloatish() {
+ function Module(stdlib) {
+ "use asm";
+ var ceil = stdlib.Math.ceil;
+ var fround = stdlib.Math.fround;
+ function f(a) {
+ a = fround(a);
+ return ceil(a);
+ }
+ return f;
+ }
+ var f = Module(this);
+ assertEquals(3, f(2.2));
+ assertFalse(%IsAsmWasmCode(Module));
+})();
+
+(function TestMathFloorReturningFloatish() {
+ function Module(stdlib) {
+ "use asm";
+ var floor = stdlib.Math.floor;
+ var fround = stdlib.Math.fround;
+ function f(a) {
+ a = fround(a);
+ return floor(a);
+ }
+ return f;
+ }
+ var f = Module(this);
+ assertEquals(2, f(2.2));
+ assertFalse(%IsAsmWasmCode(Module));
+})();
+
+(function TestMathSqrtReturningFloatish() {
+ function Module(stdlib) {
+ "use asm";
+ var sqrt = stdlib.Math.sqrt;
+ var fround = stdlib.Math.fround;
+ function f(a) {
+ a = fround(a);
+ return sqrt(a);
+ }
+ return f;
+ }
+ var f = Module(this);
+ assertEquals(Math.sqrt(Math.fround(2.2)), f(2.2));
+ assertFalse(%IsAsmWasmCode(Module));
+})();
+
+(function TestMathAbsReturningFloatish() {
+ function Module(stdlib) {
+ "use asm";
+ var abs = stdlib.Math.abs;
+ var fround = stdlib.Math.fround;
+ function f(a) {
+ a = fround(a);
+ return abs(a);
+ }
+ return f;
+ }
+ var f = Module(this);
+ assertEquals(Math.fround(2.2), f(-2.2));
+ assertFalse(%IsAsmWasmCode(Module));
+})();
+
+(function TestMathMinReturningFloat() {
+ function Module(stdlib) {
+ "use asm";
+ var min = stdlib.Math.min;
+ var fround = stdlib.Math.fround;
+ function f(a) {
+ a = fround(a);
+ return min(a, a);
+ }
+ return f;
+ }
+ var f = Module(this);
+ assertEquals(Math.fround(2.2), f(2.2));
+ assertTrue(%IsAsmWasmCode(Module));
+})();
+
+(function TestMathMaxReturningFloat() {
+ function Module(stdlib) {
+ "use asm";
+ var max = stdlib.Math.max;
+ var fround = stdlib.Math.fround;
+ function f(a) {
+ a = fround(a);
+ return max(a, a);
+ }
+ return f;
+ }
+ var f = Module(this);
+ assertEquals(Math.fround(2.2), f(2.2));
+ assertTrue(%IsAsmWasmCode(Module));
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-6838-3.js b/src/v8/test/mjsunit/regress/regress-6838-3.js
new file mode 100644
index 0000000..639ffa5
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-6838-3.js
@@ -0,0 +1,39 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function TestMathAbsReturningUnsigned() {
+ function Module(stdlib) {
+ "use asm";
+ var abs=stdlib.Math.abs;
+ function f(a, b) {
+ a = a | 0;
+ b = b | 0;
+ return (abs(a >> 0) == (b >>> 0)) | 0;
+ }
+ return f;
+ }
+ var f = Module(this);
+ assertEquals(0, f(1, 2));
+ assertEquals(1, f(23, 23));
+ assertEquals(1, f(-42, 42));
+ assertEquals(1, f(-0x7fffffff, 0x7fffffff));
+ assertEquals(1, f(-0x80000000, 0x80000000));
+ assertTrue(%IsAsmWasmCode(Module));
+})();
+
+(function TestMathAbsOverflowSignedValue() {
+ function Module(stdlib) {
+ "use asm";
+ var abs=stdlib.Math.abs;
+ function f() {
+ return (abs(-0x80000000) > 0) | 0;
+ }
+ return f;
+ }
+ var f = Module(this);
+ assertEquals(1, f());
+ assertTrue(%IsAsmWasmCode(Module));
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-685.js b/src/v8/test/mjsunit/regress/regress-685.js
new file mode 100644
index 0000000..d77d61b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-685.js
@@ -0,0 +1,43 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Regression test for http://code.google.com/p/v8/issues/detail?id=685.
+//
+// Test that keyed load IC generic stub uses unsigned comparison for
+// for the length field of arrays.
+//
+// The test passes if it does not crash.
+
+function test() {
+ var N = 0xFFFFFFFF;
+ var a = [];
+ a[N - 1] = 0;
+ a[N - 2] = 1;
+ a.reverse();
+}
+
+test();
diff --git a/src/v8/test/mjsunit/regress/regress-685086.js b/src/v8/test/mjsunit/regress/regress-685086.js
new file mode 100644
index 0000000..2cdaec4
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-685086.js
@@ -0,0 +1,8 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+try {
+ Math.max(...0);
+} catch (e) {
+}
diff --git a/src/v8/test/mjsunit/regress/regress-687.js b/src/v8/test/mjsunit/regress/regress-687.js
new file mode 100644
index 0000000..a917a44
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-687.js
@@ -0,0 +1,75 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// This regression includes a number of cases where we did not correctly
+// update a accessor property to a data property using Object.defineProperty.
+
+var obj = { get value() {}, set value (v) { throw "Error";} };
+assertDoesNotThrow(
+ Object.defineProperty(obj, "value",
+ { value: 5, writable:true, configurable: true }));
+var desc = Object.getOwnPropertyDescriptor(obj, "value");
+assertEquals(obj.value, 5);
+assertTrue(desc.configurable);
+assertTrue(desc.enumerable);
+assertTrue(desc.writable);
+assertEquals(desc.get, undefined);
+assertEquals(desc.set, undefined);
+
+
+var proto = {
+ get value() {},
+ set value(v) { Object.defineProperty(this, "value", {value: v}); }
+};
+
+var create = Object.create(proto);
+
+assertEquals(create.value, undefined);
+assertDoesNotThrow(create.value = 4);
+assertEquals(create.value, 4);
+
+// These tests where provided in bug 959, but are all related to the this issue.
+var obj1 = {};
+Object.defineProperty(obj1, 'p', {get: undefined, set: undefined});
+assertTrue("p" in obj1);
+desc = Object.getOwnPropertyDescriptor(obj1, "p");
+assertFalse(desc.configurable);
+assertFalse(desc.enumerable);
+assertEquals(desc.value, undefined);
+assertEquals(desc.get, undefined);
+assertEquals(desc.set, undefined);
+
+
+var obj2 = { get p() {}};
+Object.defineProperty(obj2, 'p', {get: undefined})
+assertTrue("p" in obj2);
+desc = Object.getOwnPropertyDescriptor(obj2, "p");
+assertTrue(desc.configurable);
+assertTrue(desc.enumerable);
+assertEquals(desc.value, undefined);
+assertEquals(desc.get, undefined);
+assertEquals(desc.set, undefined);
diff --git a/src/v8/test/mjsunit/regress/regress-688690.js b/src/v8/test/mjsunit/regress/regress-688690.js
new file mode 100644
index 0000000..ac4eb77
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-688690.js
@@ -0,0 +1,16 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var foo = "01234567";
+
+foo += foo;
+foo += foo;
+foo += foo;
+foo += foo;
+foo += foo; // foo.length = 256;
+
+// Create an adaptor frame, and take the StringReplaceOneCharWithString runtime
+// fast path. This crashed originally since TailCallRuntime could not handle
+// adaptor frames.
+var bar = foo.replace('x', 'y', 'z');
diff --git a/src/v8/test/mjsunit/regress/regress-689016.js b/src/v8/test/mjsunit/regress/regress-689016.js
new file mode 100644
index 0000000..da31350
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-689016.js
@@ -0,0 +1,12 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(function() {
+ function f() {}
+
+ assertThrows(function() {
+ f(...Array(1000000));
+ }, RangeError);
+
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-69.js b/src/v8/test/mjsunit/regress/regress-69.js
new file mode 100644
index 0000000..3fb1f76
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-69.js
@@ -0,0 +1,43 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// This tests a switch statement with only default clause leaves
+// balanced stack. It should not trigger the break point when --debug_code
+// flag is turned on.
+// See issue: http://code.google.com/p/v8/issues/detail?id=69
+
+// Flags: --debug-code --expose-gc
+function unbalanced_switch(a) {
+ try {
+ switch (a) {
+ default: break;
+ }
+ } catch (e) {}
+ gc();
+}
+
+unbalanced_switch(1);
diff --git a/src/v8/test/mjsunit/regress/regress-693500.js b/src/v8/test/mjsunit/regress/regress-693500.js
new file mode 100644
index 0000000..89b8088
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-693500.js
@@ -0,0 +1,5 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+Reflect.get(new Error(), "stack", 0);
diff --git a/src/v8/test/mjsunit/regress/regress-696.js b/src/v8/test/mjsunit/regress/regress-696.js
new file mode 100644
index 0000000..e443c42
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-696.js
@@ -0,0 +1,36 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// See: http://code.google.com/p/v8/issues/detail?id=696
+// Because of the change in dateparser in revision 4557 to support time
+// only strings in Date.parse we also misleadingly supported strings with non
+// leading numbers.
+
+assertTrue(isNaN(Date.parse('x')));
+assertTrue(isNaN(Date.parse('1x')));
+assertTrue(isNaN(Date.parse('xT10:00:00')));
+assertTrue(isNaN(Date.parse('This is a relatively long string')));
diff --git a/src/v8/test/mjsunit/regress/regress-696251.js b/src/v8/test/mjsunit/regress/regress-696251.js
new file mode 100644
index 0000000..b31a876
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-696251.js
@@ -0,0 +1,7 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var a = new Uint8Array(1000);
+a.fill(255);
+a.sort();
diff --git a/src/v8/test/mjsunit/regress/regress-696332.js b/src/v8/test/mjsunit/regress/regress-696332.js
new file mode 100644
index 0000000..6d8241a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-696332.js
@@ -0,0 +1,12 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+try {
+ throw 1
+} catch (v) {
+ function foo() { return v; }
+ foo();
+ v = 2
+}
+assertEquals(2, foo());
diff --git a/src/v8/test/mjsunit/regress/regress-696651.js b/src/v8/test/mjsunit/regress/regress-696651.js
new file mode 100644
index 0000000..650c978
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-696651.js
@@ -0,0 +1,22 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function get_a() { return "aaaaaaaaaaaaaa"; }
+function get_b() { return "bbbbbbbbbbbbbb"; }
+
+function get_string() {
+ return get_a() + get_b();
+}
+
+function prefix(s) {
+ return s + get_string();
+}
+
+prefix("");
+prefix("");
+%OptimizeFunctionOnNextCall(prefix);
+var s = prefix("");
+assertFalse(s === "aaaaaaaaaaaaaabbbbbbbbbbbbbc");
diff --git a/src/v8/test/mjsunit/regress/regress-697.js b/src/v8/test/mjsunit/regress/regress-697.js
new file mode 100644
index 0000000..a59e2b2
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-697.js
@@ -0,0 +1,34 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// See: http://code.google.com/p/v8/issues/detail?id=697
+
+try {
+ Object.create(function(){});
+} catch (e) {
+ assertTrue(false);
+}
diff --git a/src/v8/test/mjsunit/regress/regress-698790.js b/src/v8/test/mjsunit/regress/regress-698790.js
new file mode 100644
index 0000000..8791cb5
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-698790.js
@@ -0,0 +1,18 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Call RegExp constructor with a cons string.
+
+var cons_string = %ConstructConsString("", "aaaaaaaaaaaaaa");
+new RegExp(cons_string);
+
+// Same thing but using TF lowering.
+
+function make_cons_string(s) { return s + "aaaaaaaaaaaaaa"; }
+make_cons_string("");
+%OptimizeFunctionOnNextCall(make_cons_string);
+var cons_str = make_cons_string("");
+new RegExp(cons_str);
diff --git a/src/v8/test/mjsunit/regress/regress-70066.js b/src/v8/test/mjsunit/regress/regress-70066.js
new file mode 100644
index 0000000..8787b76
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-70066.js
@@ -0,0 +1,142 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Regression test for Chromium issue 70066. Delete should work properly
+// from inside 'with' scopes.
+// http://code.google.com/p/chromium/issues/detail?id=70066
+
+x = 0;
+
+// Delete on a slot from a function's own context.
+function test1() {
+ var value = 1;
+ var status;
+ with ({}) { status = delete value; }
+ return value + ":" + status;
+}
+
+assertEquals("1:false", test1(), "test1");
+assertEquals(0, x, "test1"); // Global x is undisturbed.
+
+
+// Delete on a slot from an outer context.
+function test2() {
+ function f() {
+ with ({}) { return delete value; }
+ }
+ var value = 2;
+ var status = f();
+ return value + ":" + status;
+}
+
+assertEquals("2:false", test2(), "test2");
+assertEquals(0, x, "test2"); // Global x is undisturbed.
+
+
+// Delete on a parameter.
+function test3(value) {
+ var status;
+ with ({}) { status = delete value; }
+ return value + ":" + status;
+}
+
+assertEquals("3:false", test3(3), "test3");
+assertEquals(0, x, "test3"); // Global x is undisturbed.
+
+
+// Delete on a parameter found in an outer context.
+function test4(value) {
+ function f() {
+ with ({}) { return delete value; }
+ }
+ var status = f();
+ return value + ":" + status;
+}
+
+assertEquals("4:false", test4(4), "test4");
+assertEquals(0, x, "test4"); // Global x is undisturbed.
+
+
+// Delete on a parameter, arguments object should be unaffected.
+function test5(value) {
+ var status;
+ with ({}) { status = delete value; }
+ return arguments[0] + ":" + status;
+}
+
+assertEquals("5:false", test5(5), "test5");
+assertEquals(0, x, "test5"); // Global x is undisturbed.
+
+function test6(value) {
+ function f() {
+ with ({}) { return delete value; }
+ }
+ var status = f();
+ return arguments[0] + ":" + status;
+}
+
+assertEquals("6:false", test6(6), "test6");
+assertEquals(0, x, "test6"); // Global x is undisturbed.
+
+
+// Delete on a property found on 'with' object.
+function test7(object) {
+ with (object) { return delete value; }
+}
+
+var o = {value: 7};
+assertEquals(true, test7(o), "test7");
+assertEquals(void 0, o.value, "test7");
+assertEquals(0, x, "test7"); // Global x is undisturbed.
+
+
+// Delete on a global property.
+function test8() {
+ with ({}) { return delete x; }
+}
+
+assertEquals(true, test8(), "test8");
+assertThrows("x"); // Global x should be deleted.
+
+
+// Delete on a property that is not found anywhere.
+function test9() {
+ with ({}) { return delete x; }
+}
+
+assertThrows("x"); // Make sure it's not there.
+assertEquals(true, test9(), "test9");
+
+
+// Delete on a DONT_DELETE property of the global object.
+var y = 10;
+function test10() {
+ with ({}) { return delete y; }
+}
+
+assertEquals(false, test10(), "test10");
+assertEquals(10, y, "test10");
diff --git a/src/v8/test/mjsunit/regress/regress-704811.js b/src/v8/test/mjsunit/regress/regress-704811.js
new file mode 100644
index 0000000..dcdeb4e
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-704811.js
@@ -0,0 +1,88 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// The bug was that destructuring assignments which occur inside a lazy arrow
+// function parameter list were not rewritten.
+
+// Repro from the bug (slightly modified so that it doesn't produce a run-time
+// exception).
+(({x = {} = {}}) => {})({});
+
+// ... and without the parens.
+let a0 = ({x = {} = {}}) => {};
+a0({});
+
+// Testing that the destructuring assignments also work properly. The semantics
+// are: The value of the destructuring assignment is an object {myprop: 2115}
+// and 2115 also gets assigned to global_side_assignment. So the default value
+// for x is {myprop: 2115}. This is the value which x will have if the function
+// is called with an object which doesn't have property x.
+let called = false;
+let global_side_assignment = undefined;
+(({x = {myprop: global_side_assignment} = {myprop: 2115}}) => {
+ assertTrue('myprop' in x);
+ assertEquals(2115, x.myprop);
+ called = true;
+})({});
+assertTrue(called);
+assertEquals(2115, global_side_assignment);
+
+// If the parameter is an object which has property x, the default value is not
+// used.
+called = false;
+global_side_assignment = undefined;
+(({x = {myprop: global_side_assignment} = {myprop: 2115}}) => {
+ assertEquals(3000, x);
+ called = true;
+})({x: 3000});
+assertTrue(called);
+// Global side assignment doesn't happen, since the default value was not used.
+assertEquals(undefined, global_side_assignment);
+
+// Different kinds of lazy arrow functions (it's actually a bit weird that the
+// above functions are lazy, since they are parenthesized).
+called = false;
+global_side_assignment = undefined;
+let a1 = ({x = {myprop: global_side_assignment} = {myprop: 2115}}) => {
+ assertTrue('myprop' in x);
+ assertEquals(2115, x.myprop);
+ called = true;
+}
+a1({});
+assertTrue(called);
+assertEquals(2115, global_side_assignment);
+
+called = false;
+global_side_assignment = undefined;
+let a2 = ({x = {myprop: global_side_assignment} = {myprop: 2115}}) => {
+ assertEquals(3000, x);
+ called = true;
+}
+a2({x: 3000});
+assertTrue(called);
+assertEquals(undefined, global_side_assignment);
+
+// We never had a problem with non-arrow functions, but testing them too for
+// completeness.
+called = false;
+global_side_assignment = undefined;
+function f1({x = {myprop: global_side_assignment} = {myprop: 2115}}) {
+ assertTrue('myprop' in x);
+ assertEquals(2115, x.myprop);
+ assertEquals(2115, global_side_assignment);
+ called = true;
+}
+f1({});
+assertTrue(called);
+assertEquals(2115, global_side_assignment);
+
+called = false;
+global_side_assignment = undefined;
+function f2({x = {myprop: global_side_assignment} = {myprop: 2115}}) {
+ assertEquals(3000, x);
+ called = true;
+}
+f2({x: 3000});
+assertTrue(called);
+assertEquals(undefined, global_side_assignment);
diff --git a/src/v8/test/mjsunit/regress/regress-705934.js b/src/v8/test/mjsunit/regress/regress-705934.js
new file mode 100644
index 0000000..7dfc5bd
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-705934.js
@@ -0,0 +1,15 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-regexp-named-captures --stack-size=100
+
+function call_replace_close_to_stack_overflow() {
+ try {
+ call_replace_close_to_stack_overflow();
+ } catch(e) {
+ "b".replace(/(b)/g);
+ }
+}
+
+call_replace_close_to_stack_overflow();
diff --git a/src/v8/test/mjsunit/regress/regress-706234-2.js b/src/v8/test/mjsunit/regress/regress-706234-2.js
new file mode 100644
index 0000000..ed5facf
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-706234-2.js
@@ -0,0 +1,37 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Lazy top-level arrow function which must be re-parsed and eagerly compiled.
+var f = ({ x } = { x: 1 }) => {
+ x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;
+ x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;
+ x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;
+ x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;
+ x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;
+ x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;
+ x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;
+ x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;
+ x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;
+ x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;
+ x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;
+ x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;
+ x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;
+ x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;
+ x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;
+ x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;
+ x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;
+ x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;
+ x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;
+ x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;
+ x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;
+ x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;
+ x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;
+ x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;
+ x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;
+ x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;
+ x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;
+ x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;
+};
+
+f();
diff --git a/src/v8/test/mjsunit/regress/regress-706234.js b/src/v8/test/mjsunit/regress/regress-706234.js
new file mode 100644
index 0000000..aee31ae
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-706234.js
@@ -0,0 +1,8 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var fn = ({foo = {} = {}}) => { return foo; }
+if (true) {
+ fn({});
+}
diff --git a/src/v8/test/mjsunit/regress/regress-707066.js b/src/v8/test/mjsunit/regress/regress-707066.js
new file mode 100644
index 0000000..b33b585
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-707066.js
@@ -0,0 +1,25 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --harmony-function-tostring
+
+// There was a bug in CreateDynamicFunction where a stack overflow
+// situation caused an assertion failure.
+
+function test(api) {
+ function f() {
+ try {
+ // induce a stack overflow
+ f();
+ } catch(e) {
+ // this might result in even more stack overflows
+ api();
+ }
+ }
+ f();
+}
+
+test(( function (){}).constructor); // Function
+test(( function*(){}).constructor); // GeneratorFunction
+test((async function (){}).constructor); // AsyncFunction
diff --git a/src/v8/test/mjsunit/regress/regress-707187.js b/src/v8/test/mjsunit/regress/regress-707187.js
new file mode 100644
index 0000000..31a73e2
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-707187.js
@@ -0,0 +1,12 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let i = 0;
+let re = /./g;
+re.exec = () => {
+ if (i++ == 0) return { length: 2147483648 };
+ return null;
+};
+
+"".replace(re);
diff --git a/src/v8/test/mjsunit/regress/regress-707410.js b/src/v8/test/mjsunit/regress/regress-707410.js
new file mode 100644
index 0000000..4bacf8c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-707410.js
@@ -0,0 +1,10 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var a = new Uint8Array(1024*1024);
+%ArrayBufferNeuter(a.buffer);
+var b = new Uint8Array(a);
+assertEquals(0, b.length);
diff --git a/src/v8/test/mjsunit/regress/regress-707675.js b/src/v8/test/mjsunit/regress/regress-707675.js
new file mode 100644
index 0000000..0cbfd69
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-707675.js
@@ -0,0 +1,8 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --enable-slow-asserts
+
+Array.prototype.__proto__ = null;
+new Uint8Array(Array.prototype);
diff --git a/src/v8/test/mjsunit/regress/regress-708247.js b/src/v8/test/mjsunit/regress/regress-708247.js
new file mode 100644
index 0000000..7512791
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-708247.js
@@ -0,0 +1,26 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --predictable
+
+const str = '2016-01-02';
+
+function t() {
+ var re;
+ function toDictMode() {
+ for (var i = 0; i < 100; i++) { // Loop is required.
+ re.x = 42;
+ delete re.x;
+ }
+ return 0;
+ }
+
+ re = /-/g; // Needs to be global to trigger lastIndex accesses.
+ re.lastIndex = { valueOf : toDictMode };
+ return re.exec(str);
+}
+
+for (var q = 0; q < 10000; q++) {
+ t(); // Needs repetitions to trigger a crash.
+}
diff --git a/src/v8/test/mjsunit/regress/regress-708598.js b/src/v8/test/mjsunit/regress/regress-708598.js
new file mode 100644
index 0000000..74fe71f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-708598.js
@@ -0,0 +1,10 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Regression test for hitting a DCHECK; if we just get a syntax error, it's ok.
+
+assertThrows(`function lazy_does_not_compile(x) {
+ break;
+ }
+ new lazy_does_not_compile();`, SyntaxError);
diff --git a/src/v8/test/mjsunit/regress/regress-709029.js b/src/v8/test/mjsunit/regress/regress-709029.js
new file mode 100644
index 0000000..b9bcabb
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-709029.js
@@ -0,0 +1,38 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Changes the map of obj.
+function mutateObjectOnStringConversion(obj) {
+ return { toString: () => { obj.x = 42;return "";}};
+}
+
+{
+ const re = /./;
+ re.exec(mutateObjectOnStringConversion(re));
+}
+
+{
+ const re = /./;
+ re.test(mutateObjectOnStringConversion(re));
+}
+
+{
+ const re = /./;
+ re[Symbol.match](mutateObjectOnStringConversion(re));
+}
+
+{
+ const re = /./;
+ re[Symbol.search](mutateObjectOnStringConversion(re));
+}
+
+{
+ const re = /./;
+ re[Symbol.split](mutateObjectOnStringConversion(re));
+}
+
+{
+ const re = /./;
+ re[Symbol.replace](mutateObjectOnStringConversion(re));
+}
diff --git a/src/v8/test/mjsunit/regress/regress-709782.js b/src/v8/test/mjsunit/regress/regress-709782.js
new file mode 100644
index 0000000..e33f694
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-709782.js
@@ -0,0 +1,14 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var a = [0];
+function bar(x) { return x; }
+function foo() { return a.reduce(bar); }
+
+assertEquals(0, foo());
+assertEquals(0, foo());
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(0, foo());
diff --git a/src/v8/test/mjsunit/regress/regress-711165.js b/src/v8/test/mjsunit/regress/regress-711165.js
new file mode 100644
index 0000000..9a42451
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-711165.js
@@ -0,0 +1,9 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// This is testing a leak failure.
+
+try {
+ Realm.navigate(0);
+} catch(e) {}
diff --git a/src/v8/test/mjsunit/regress/regress-712.js b/src/v8/test/mjsunit/regress/regress-712.js
new file mode 100644
index 0000000..b26b94a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-712.js
@@ -0,0 +1,38 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// This regression test is used to ensure that Object.defineProperty
+// can't be called with an empty property descriptor on a non-configurable
+// existing property and override the existing property.
+// See: http://code.google.com/p/v8/issues/detail?id=712
+
+var obj = {};
+Object.defineProperty(obj, "x", { get: function() { return "42"; },
+ configurable: false });
+assertEquals(obj.x, "42");
+Object.defineProperty(obj, 'x', {});
+assertEquals(obj.x, "42");
diff --git a/src/v8/test/mjsunit/regress/regress-715582.js b/src/v8/test/mjsunit/regress/regress-715582.js
new file mode 100644
index 0000000..0e81a92
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-715582.js
@@ -0,0 +1,9 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Should not crash.
+//
+this.__defineGetter__(
+ "x", (a = (function f() { return; (function() {}); })()) => { });
+x;
diff --git a/src/v8/test/mjsunit/regress/regress-716044.js b/src/v8/test/mjsunit/regress/regress-716044.js
new file mode 100644
index 0000000..264424c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-716044.js
@@ -0,0 +1,25 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --verify-heap
+
+class Array1 extends Array {
+ constructor(len) {
+ super(1);
+ }
+};
+
+class MyArray extends Array {
+ static get [Symbol.species]() {
+ return Array1;
+ }
+}
+
+a = new MyArray();
+
+for (var i = 0; i < 100000; i++) {
+ a.push(1);
+}
+
+a.map(function(x) { return 42; });
diff --git a/src/v8/test/mjsunit/regress/regress-71647.js b/src/v8/test/mjsunit/regress/regress-71647.js
new file mode 100644
index 0000000..4451011
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-71647.js
@@ -0,0 +1,34 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var qe = 'object';
+
+function g() {
+ for (var i = 0; i < 10000; i++) typeof i === qe;
+}
+
+g();
diff --git a/src/v8/test/mjsunit/regress/regress-718285.js b/src/v8/test/mjsunit/regress/regress-718285.js
new file mode 100644
index 0000000..409f343
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-718285.js
@@ -0,0 +1,46 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function foo_reference(n) {
+ var array = new Int32Array(n + 1);
+ for (var i = 0; i < n; ++i) {
+ array[i] = i;
+ }
+ var array2 = new Int32Array(array);
+ array2.set(new Uint8Array(array.buffer, 0, n), 1);
+ return array2;
+}
+
+function foo(n) {
+ var array = new Int32Array(n + 1);
+ for (var i = 0; i < n; ++i) {
+ array[i] = i;
+ }
+ array.set(new Uint8Array(array.buffer, 0, n), 1);
+ return array;
+}
+
+function bar_reference(n) {
+ var array = new Int32Array(n + 1);
+ for (var i = 0; i < n; ++i) {
+ array[i] = i;
+ }
+ var array2 = new Int32Array(array);
+ array2.set(new Uint8Array(array.buffer, 34), 0);
+ return array2;
+}
+
+function bar(n) {
+ var array = new Int32Array(n + 1);
+ for (var i = 0; i < n; ++i) {
+ array[i] = i;
+ }
+ array.set(new Uint8Array(array.buffer, 34), 0);
+ return array;
+}
+
+foo(10);
+foo_reference(10);
+bar(10);
+bar_reference(10);
diff --git a/src/v8/test/mjsunit/regress/regress-718891.js b/src/v8/test/mjsunit/regress/regress-718891.js
new file mode 100644
index 0000000..209568d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-718891.js
@@ -0,0 +1,68 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --expose-gc
+
+function Data() {
+}
+Data.prototype = { x: 1 };
+
+function TriggerDeopt() {
+ Data.prototype = { x: 2 };
+}
+
+function TestDontSelfHealWithDeoptedCode(run_unoptimized, ClosureFactory) {
+ // Create some function closures which don't have
+ // optimized code.
+ var unoptimized_closure = ClosureFactory();
+ if (run_unoptimized) {
+ unoptimized_closure();
+ }
+
+ // Run and optimize the code (do this in a separate function
+ // so that the closure doesn't leak in a dead register).
+ (() => {
+ var optimized_closure = ClosureFactory();
+ // Use .call to avoid the CallIC retaining the JSFunction in the
+ // feedback vector via a weak map, which would mean it wouldn't be
+ // collected in the minor gc below.
+ optimized_closure.call(undefined);
+ %OptimizeFunctionOnNextCall(optimized_closure);
+ optimized_closure.call(undefined);
+ })();
+
+ // Optimize a dummy function, just so it gets linked into the
+ // Contexts optimized_functions list head, which is in the old
+ // space, and the link from to the optimized_closure's JSFunction
+ // moves to the inline link in dummy's JSFunction in the new space,
+ // otherwise optimized_closure's JSFunction will be retained by the
+ // old->new remember set.
+ (() => {
+ var dummy = function() { return 1; };
+ %OptimizeFunctionOnNextCall(dummy);
+ dummy();
+ })();
+
+ // GC the optimized closure with a minor GC - the optimized
+ // code will remain in the feedback vector.
+ gc(true);
+
+ // Trigger deoptimization by changing the prototype of Data. This
+ // will mark the code for deopt, but since no live JSFunction has
+ // optimized code, we won't clear the feedback vector.
+ TriggerDeopt();
+
+ // Call pre-existing functions, these will try to self-heal with the
+ // optimized code in the feedback vector op, but should bail-out
+ // since the code is marked for deoptimization.
+ unoptimized_closure();
+}
+
+// Run with the unoptimized closure both uncomplied and compiled for the
+// interpreter initially, to test self healing on both CompileLazy and
+// the InterpreterEntryTrampoline respectively.
+TestDontSelfHealWithDeoptedCode(false,
+ () => { return () => { return new Data() }});
+TestDontSelfHealWithDeoptedCode(true,
+ () => { return () => { return new Data() }});
diff --git a/src/v8/test/mjsunit/regress/regress-719380.js b/src/v8/test/mjsunit/regress/regress-719380.js
new file mode 100644
index 0000000..4d41609
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-719380.js
@@ -0,0 +1,7 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+TypeError.prototype.__defineGetter__("name", () => { throw 42; });
+try { console.log({ toString: () => { throw new TypeError() }}); } catch (e) {}
+try { new WebAssembly.Table({}); } catch (e) {}
diff --git a/src/v8/test/mjsunit/regress/regress-720.js b/src/v8/test/mjsunit/regress/regress-720.js
new file mode 100644
index 0000000..267b32d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-720.js
@@ -0,0 +1,36 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// This regression test is used to ensure that Object.defineProperty
+// keeps the existing value of the writable flag if none is given
+// in the provided descriptor.
+// See: http://code.google.com/p/v8/issues/detail?id=720
+
+var o = {x: 10};
+Object.defineProperty(o, "x", {value: 5});
+var desc = Object.getOwnPropertyDescriptor(o, "x");
+assertTrue(desc["writable"]);
diff --git a/src/v8/test/mjsunit/regress/regress-720247.js b/src/v8/test/mjsunit/regress/regress-720247.js
new file mode 100644
index 0000000..571e7e4
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-720247.js
@@ -0,0 +1,7 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertEquals('function', typeof (function() {
+ return eval('with ({a: 1}) { function a() {} }; a')
+})());
diff --git a/src/v8/test/mjsunit/regress/regress-722978.js b/src/v8/test/mjsunit/regress/regress-722978.js
new file mode 100644
index 0000000..082c1f8
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-722978.js
@@ -0,0 +1,15 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --always-opt
+
+var __v_3 = {};
+function __f_0() {
+ var __v_30 = -0;
+ __v_30.__defineGetter__("0", function() { return undefined; });
+ __v_30 = 0;
+ __v_3 = 0;
+ assertTrue(Object.is(0, __v_30));
+}
+__f_0();
diff --git a/src/v8/test/mjsunit/regress/regress-723366.js b/src/v8/test/mjsunit/regress/regress-723366.js
new file mode 100644
index 0000000..ba1915d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-723366.js
@@ -0,0 +1,14 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var o = {foo: 0, 0: 0, 2: 2, 3: 3};
+o.__defineSetter__("1", function(v) { this.foo = 0.1; });
+
+for(var i = 0; i < 4; i++) {
+ switch (i) {
+ case 0: o.p1 = 0; break;
+ case 1: o.p2 = 0; break;
+ }
+ o[i] = i;
+}
diff --git a/src/v8/test/mjsunit/regress/regress-725858.js b/src/v8/test/mjsunit/regress/regress-725858.js
new file mode 100644
index 0000000..466673f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-725858.js
@@ -0,0 +1,11 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f() {}
+var src = 'f(' + '0,'.repeat(0x201f) + ')';
+var boom = new Function(src);
+%OptimizeFunctionOnNextCall(boom);
+boom();
diff --git a/src/v8/test/mjsunit/regress/regress-726625.js b/src/v8/test/mjsunit/regress/regress-726625.js
new file mode 100644
index 0000000..6a368f4
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-726625.js
@@ -0,0 +1,6 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function abc() { return; }
+assertThrows("abc" + String.fromCharCode(65534) + "(1)");
diff --git a/src/v8/test/mjsunit/regress/regress-726636.js b/src/v8/test/mjsunit/regress/regress-726636.js
new file mode 100644
index 0000000..843cfdf
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-726636.js
@@ -0,0 +1,14 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax
+
+Object.defineProperty(Promise, Symbol.species, { value: 0 });
+var p = new Promise(function() {});
+try {
+ p.then();
+ assertUnreachable();
+} catch(e) {
+ assertTrue(e instanceof TypeError);
+}
diff --git a/src/v8/test/mjsunit/regress/regress-727218.js b/src/v8/test/mjsunit/regress/regress-727218.js
new file mode 100644
index 0000000..8b2aa06
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-727218.js
@@ -0,0 +1,12 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var f = ({ x } = { x: y }) => {
+ x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;
+ x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;
+ x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;
+ x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;
+ x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;
+ x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;x;
+};
diff --git a/src/v8/test/mjsunit/regress/regress-727662.js b/src/v8/test/mjsunit/regress/regress-727662.js
new file mode 100644
index 0000000..62b53b4
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-727662.js
@@ -0,0 +1,22 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --expose-gc
+
+(function() {
+ function thingo(i, b) {
+ var s = b ? "ac" : "abcd";
+ i = i >>> 0;
+ if (i < s.length) {
+ var c = s.charCodeAt(i);
+ gc();
+ return c;
+ }
+ }
+ thingo(0, true);
+ thingo(0, true);
+ %OptimizeFunctionOnNextCall(thingo);
+ thingo(0, true);
+
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-728.js b/src/v8/test/mjsunit/regress/regress-728.js
new file mode 100644
index 0000000..196b118
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-728.js
@@ -0,0 +1,42 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var obj = { 0: "obj0" };
+
+// Array index k is to big to fit into the string hash field.
+var k = 16777217;
+var h = "" + k;
+
+obj[k] = "obj" + k;
+
+// Force computation of hash for the string representation of array index.
+for (var i = 0; i < 10; i++) { ({})[h]; }
+
+function get(idx) { return obj[idx]; }
+
+assertEquals(get(0), "obj0");
+assertEquals(get(h), "obj" + h);
diff --git a/src/v8/test/mjsunit/regress/regress-729671.js b/src/v8/test/mjsunit/regress/regress-729671.js
new file mode 100644
index 0000000..90791c1
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-729671.js
@@ -0,0 +1,6 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var o = { 0: 11, 1: 9};
+assertThrows(() => JSON.parse('[0,0]', function() { this[1] = o; }), RangeError);
diff --git a/src/v8/test/mjsunit/regress/regress-730254.js b/src/v8/test/mjsunit/regress/regress-730254.js
new file mode 100644
index 0000000..2db49ce
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-730254.js
@@ -0,0 +1,37 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax --opt --no-always-opt
+
+var __v_0 = {};
+__v_0 = new Map();
+function __f_0() {
+ __v_0[0] --;
+}
+__f_0();
+%OptimizeFunctionOnNextCall(__f_0);
+__f_0();
diff --git a/src/v8/test/mjsunit/regress/regress-732.js b/src/v8/test/mjsunit/regress/regress-732.js
new file mode 100644
index 0000000..2b02ea6
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-732.js
@@ -0,0 +1,46 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// idx is a valid array index but is too big to be cached in hash field.
+var idx = 10000000;
+
+// Create a JSObject with NumberDictionary as a backing store for elements.
+var obj = { };
+for (var i = 0; i < 100000; i += 100) { obj[i] = "obj" + i; }
+
+// Set value using numeric index.
+obj[idx] = "obj" + idx;
+
+// Make a string from index.
+var str = "" + idx;
+
+// Force hash computation for the string representation of index.
+for (var i = 0; i < 10; i++) { ({})[str]; }
+
+// Try getting value back using string and number representations of
+// the same index.
+assertEquals(obj[str], obj[idx])
diff --git a/src/v8/test/mjsunit/regress/regress-732836.js b/src/v8/test/mjsunit/regress/regress-732836.js
new file mode 100644
index 0000000..20e852c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-732836.js
@@ -0,0 +1,11 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function boom() {
+ var args = [];
+ for (var i = 0; i < 125000; i++)
+ args.push(1.1);
+ return Array.apply(Array, args);
+}
+var array = boom();
diff --git a/src/v8/test/mjsunit/regress/regress-733059.js b/src/v8/test/mjsunit/regress/regress-733059.js
new file mode 100644
index 0000000..1da8413
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-733059.js
@@ -0,0 +1,25 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc --enable-slow-asserts
+
+a = new Proxy([], {
+ defineProperty() {
+ b.length = 1; gc();
+ return Object.defineProperty.apply(this, arguments);
+ }
+});
+
+class MyArray extends Array {
+ static get[Symbol.species](){
+ return function() {
+ return a;
+ }
+ };
+}
+
+b = new MyArray(65535);
+b[1] = 0.1;
+c = Array.prototype.concat.call(b);
+gc();
diff --git a/src/v8/test/mjsunit/regress/regress-734862.js b/src/v8/test/mjsunit/regress/regress-734862.js
new file mode 100644
index 0000000..40e5b1d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-734862.js
@@ -0,0 +1,36 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function catcher(o, p) {
+ try { o[p]; } catch (e) { return e; }
+ throw p;
+}
+
+assertTrue(catcher(null, 'foo') instanceof TypeError);
+assertTrue(catcher(void 0, 'foo') instanceof TypeError);
+assertTrue(catcher(null, 123) instanceof TypeError);
+assertTrue(catcher(void 0, 123) instanceof TypeError);
diff --git a/src/v8/test/mjsunit/regress/regress-737588.js b/src/v8/test/mjsunit/regress/regress-737588.js
new file mode 100644
index 0000000..0f71dfc
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-737588.js
@@ -0,0 +1,34 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var goog = goog || {} ;
+goog.global = this;
+goog.globalEval = function(script) {
+ return goog.global.eval(script);
+};
+
+assertEquals(125, goog.globalEval('var foofoofoo = 125; foofoofoo'));
diff --git a/src/v8/test/mjsunit/regress/regress-74.js b/src/v8/test/mjsunit/regress/regress-74.js
new file mode 100644
index 0000000..bdc3b5c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-74.js
@@ -0,0 +1,40 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test that the variable introduced by catch blocks is DontDelete.
+// See http://code.google.com/p/v8/issues/detail?id=74
+
+function test() {
+ try {
+ throw 42;
+ } catch(e) {
+ assertFalse(delete e, "deleting catch variable");
+ assertEquals(42, e);
+ }
+}
+
+test();
diff --git a/src/v8/test/mjsunit/regress/regress-740694.js b/src/v8/test/mjsunit/regress/regress-740694.js
new file mode 100644
index 0000000..f07eb1b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-740694.js
@@ -0,0 +1,22 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony --allow-natives-syntax --stack-size=100
+
+function __f_0() {
+ try {
+ return __f_0();
+ } catch(e) {
+ return import('no-such-file');
+ }
+}
+
+var done = false;
+var error;
+var promise = __f_0();
+promise.then(assertUnreachable,
+ err => { done = true; error = err });
+%RunMicrotasks();
+assertTrue(error.startsWith('Error reading'));
+assertTrue(done);
diff --git a/src/v8/test/mjsunit/regress/regress-740784.js b/src/v8/test/mjsunit/regress/regress-740784.js
new file mode 100644
index 0000000..920f9f1
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-740784.js
@@ -0,0 +1,33 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --expose-gc --turbo-inline-array-builtins
+
+"".stack;;var isNeverOptimize;var isAlwaysOptimize;var isInterpreted;var isOptimized;var isCrankshafted;var isTurboFanned;var failWithMessage;(function(){{;}
+function PrettyPrint(){switch(typeof value){case"string":return JSON.stringify();case"number":if(1/value<0);case"object":if(value===null);switch(objectClass){case"Number":case"String":case"Boolean":case"Date":return objectClass+"("+PrettyPrint();return objectClass+"(["+joined+"])";case"Object":break;default:return objectClass+"()";}
+var name=value.constructor.name;if(name)return name+"()";return"Object()";default:return"-- unknown value --";}}
+function fail(){var message="Fail"+"ure";if(name_opt){message+=" ("+name_opt+")";}
+return true;}
+assertSame=function assertSame(){if(found===expected){return;}else if((expected!==expected)&&(found!==found)){return;}
+};assertThrows=function assertThrows(code){try{if(typeof code==='function'){code();}else{;}}catch(e){if(typeof type_opt==='function'){;}else if(type_opt!==void 0){;}
+return;}
+;;}
+isTurboFanned=function isTurboFanned(){opt_status&V8OptimizationStatus.kOptimized!==0;}})();
+function __isPropertyOfType(){let desc;try{;}catch(e){return false;}
+return false;return typeof type==='undefined'||typeof desc.value===type;}
+function __getProperties(obj){if(typeof obj==="undefined"||obj===null)
+return[];let properties=[];for(let name of Object.getOwnPropertyNames(obj)){
+properties.push(name);}
+let proto=Object.getPrototypeOf(obj);while(proto&&proto!=Object.prototype){Object.getOwnPropertyNames(proto).forEach(name=>{if(name!=='constructor'){__isPropertyOfType()
+;}});proto=Object.getPrototypeOf(proto);}
+return properties;}
+function*__getObjects(root=this,level=0){if(level>4)
+return;let obj_names=__getProperties(root);for(let obj_name of obj_names){let obj=root[obj_name];if(obj===root)
+continue;yield obj;yield*__getObjects();}}
+function __getRandomObject(){let objects=[];for(let obj of __getObjects()){;}
+return objects[seed%objects.length];}
+for (var __v_0 = 0; __v_0 < 2000; __v_0++) {
+ Object.prototype['X'+__v_0] = true;
+}
+ assertThrows(function() { ; try { __getRandomObject(); } catch(e) {; };try {; } catch(e) {; } });
diff --git a/src/v8/test/mjsunit/regress/regress-743622.js b/src/v8/test/mjsunit/regress/regress-743622.js
new file mode 100644
index 0000000..6051258
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-743622.js
@@ -0,0 +1,13 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --validate-asm
+
+function Module(stdlib, foreign, heap) {
+ "use asm";
+ var a = stdlib.Math.PI;
+ function f() { return a }
+ return { f:f };
+}
+Module.length
diff --git a/src/v8/test/mjsunit/regress/regress-744292.js b/src/v8/test/mjsunit/regress/regress-744292.js
new file mode 100644
index 0000000..02c77ca
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-744292.js
@@ -0,0 +1,16 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --harmony-dynamic-import
+
+__v_1 = {
+};
+function __f_8() {
+ try {
+ __f_8();
+ } catch(e) {
+ import(__v_1);
+ }
+}
+__f_8();
diff --git a/src/v8/test/mjsunit/regress/regress-746909.js b/src/v8/test/mjsunit/regress/regress-746909.js
new file mode 100644
index 0000000..e3bd224
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-746909.js
@@ -0,0 +1,8 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-dynamic-import
+
+eval(`import('modules-skip-2.js');`);
+eval(`eval(import('modules-skip-2.js'));`);
diff --git a/src/v8/test/mjsunit/regress/regress-747.js b/src/v8/test/mjsunit/regress/regress-747.js
new file mode 100644
index 0000000..a3de131
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-747.js
@@ -0,0 +1,56 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-gc
+
+// This test makes sure that we do flush code with heap allocated locals.
+// This can be a problem if eval is used within the scope.
+// See: http://code.google.com/p/v8/issues/detail?id=747
+
+(function() {
+ var x = 42;
+ this.callEval = function() {eval('x');};
+})();
+
+try {
+ callEval();
+} catch (e) {
+ assertUnreachable();
+}
+
+gc();
+gc();
+gc();
+gc();
+gc();
+gc();
+
+try {
+ callEval();
+} catch (e) {
+ assertUnreachable();
+}
diff --git a/src/v8/test/mjsunit/regress/regress-747075.js b/src/v8/test/mjsunit/regress/regress-747075.js
new file mode 100644
index 0000000..3b5116a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-747075.js
@@ -0,0 +1,14 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+r = [
+ 14, 14, 14, 14, 14, 14, 14, 14, 14, 14, 14, 14, 14, 14, 14, 14, 14, 14,
+ 14, 14, 14, 14, 14, 14, 14, 14, 14, 14, 14, 14, 14, 14, 14, 14, 14, 14
+];
+
+
+for (i = -1; i < 100000; i++) {
+ r2 = r.map(function(y) {return y/64} );
+ assertTrue(r2[0] < 1);
+}
diff --git a/src/v8/test/mjsunit/regress/regress-747825.js b/src/v8/test/mjsunit/regress/regress-747825.js
new file mode 100644
index 0000000..f61693e
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-747825.js
@@ -0,0 +1,27 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var g = 0;
+g = function() {}
+
+function f() {
+ var r = /[abc]/i; // Optimized out.
+ g(r);
+}
+
+f(); f(); %OptimizeFunctionOnNextCall(f); // Warm-up.
+
+var re;
+g = function(r) { re = r; }
+f(); // Lazy deopt is forced here.
+
+assertNotEquals(undefined, re);
+assertEquals("[abc]", re.source);
+assertEquals("i", re.flags);
+assertEquals(0, re.lastIndex);
+assertArrayEquals(["a"], re.exec("a"));
+assertArrayEquals(["A"], re.exec("A"));
+assertNull(re.exec("d"));
diff --git a/src/v8/test/mjsunit/regress/regress-748069.js b/src/v8/test/mjsunit/regress/regress-748069.js
new file mode 100644
index 0000000..e652cca
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-748069.js
@@ -0,0 +1,12 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+try {
+ var a = 'a'.repeat(1 << 28);
+} catch (e) {
+ // If the allocation fails, we don't care, because we can't cause the
+ // overflow.
+}
+// Cause an overflow in worst-case calculation for string replacement.
+JSON.stringify(a);
diff --git a/src/v8/test/mjsunit/regress/regress-751789.js b/src/v8/test/mjsunit/regress/regress-751789.js
new file mode 100644
index 0000000..049acd7
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-751789.js
@@ -0,0 +1,5 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertThrows(() => eval('async A=>{s.await i}'));
diff --git a/src/v8/test/mjsunit/regress/regress-752.js b/src/v8/test/mjsunit/regress/regress-752.js
new file mode 100644
index 0000000..d38870e
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-752.js
@@ -0,0 +1,36 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test that JSON.stringify correctly unwraps Boolean objects.
+
+// See: http://code.google.com/p/v8/issues/detail?id=752
+
+function replacer(key, value) {
+ return value === 42 ? new Boolean(false) : value;
+}
+
+assertEquals("[false]", JSON.stringify([42], replacer));
diff --git a/src/v8/test/mjsunit/regress/regress-752764.js b/src/v8/test/mjsunit/regress/regress-752764.js
new file mode 100644
index 0000000..4963089
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-752764.js
@@ -0,0 +1,8 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+a = "a".repeat(%StringMaxLength() - 3);
+assertThrows(() => new RegExp("a" + a), SyntaxError);
diff --git a/src/v8/test/mjsunit/regress/regress-753.js b/src/v8/test/mjsunit/regress/regress-753.js
new file mode 100644
index 0000000..0253962
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-753.js
@@ -0,0 +1,35 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test that JSON.stringify correctly truncates floating point numbers.
+// This test is based on chapter15/15.12/15.12.3/15.12.3-6-a-2.js in the
+// ES5 conformance tests.
+
+// See: http://code.google.com/p/v8/issues/detail?id=753
+
+var obj = {a1: {b1: [1,2,3,4], b2: {c1: 1, c2: 2}},a2: 'a2'};
+assertEquals(JSON.stringify(obj, null, 5.99999), JSON.stringify(obj, null, 5));
diff --git a/src/v8/test/mjsunit/regress/regress-754.js b/src/v8/test/mjsunit/regress/regress-754.js
new file mode 100644
index 0000000..0b84416
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-754.js
@@ -0,0 +1,39 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test that Array.prototype.lastIndexOf correctly handles null and undefined
+// as fromIndex argument.
+
+// See: http://code.google.com/p/v8/issues/detail?id=754
+
+var a = new Array(1,2,1);
+assertEquals(1, a.lastIndexOf(2));
+assertEquals(2, a.lastIndexOf(1));
+assertEquals(0, a.lastIndexOf(1, undefined));
+assertEquals(0, a.lastIndexOf(1, null));
+assertEquals(-1, a.lastIndexOf(2, undefined));
+assertEquals(-1, a.lastIndexOf(2, null));
diff --git a/src/v8/test/mjsunit/regress/regress-756608.js b/src/v8/test/mjsunit/regress/regress-756608.js
new file mode 100644
index 0000000..50377be
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-756608.js
@@ -0,0 +1,7 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertThrows(function() {
+ 'foo' in new Proxy({}, {has: 0});
+}, TypeError);
diff --git a/src/v8/test/mjsunit/regress/regress-758763.js b/src/v8/test/mjsunit/regress/regress-758763.js
new file mode 100644
index 0000000..87839c2
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-758763.js
@@ -0,0 +1,7 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+const re = /./g;
+function toSlowMode() { re.slow = true; }
+re[Symbol.split]("abc", { valueOf: toSlowMode });
diff --git a/src/v8/test/mjsunit/regress/regress-760-1.js b/src/v8/test/mjsunit/regress/regress-760-1.js
new file mode 100644
index 0000000..081c993
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-760-1.js
@@ -0,0 +1,49 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Check that when valueOf for a String object is overwritten it is called and
+// the result used when that object is added with a string.
+
+// See: http://code.google.com/p/v8/issues/detail?id=760
+
+String.prototype.valueOf = function() { return 'y' };
+
+function test() {
+ var o = Object('x');
+ assertEquals('y', o + '');
+ assertEquals('y', '' + o);
+}
+
+for (var i = 0; i < 10; i++) {
+ var o = Object('x');
+ assertEquals('y', o + '');
+ assertEquals('y', '' + o);
+}
+
+for (var i = 0; i < 10; i++) {
+ test()
+}
diff --git a/src/v8/test/mjsunit/regress/regress-760-2.js b/src/v8/test/mjsunit/regress/regress-760-2.js
new file mode 100644
index 0000000..549ed4e
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-760-2.js
@@ -0,0 +1,49 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Check that when valueOf for a String object is overwritten it is called and
+// the result used when that object is added with a string.
+
+// See: http://code.google.com/p/v8/issues/detail?id=760
+
+function test() {
+ var o = Object('x');
+ o.valueOf = function() { return 'y' };
+ assertEquals('y', o + '');
+ assertEquals('y', '' + o);
+}
+
+for (var i = 0; i < 10; i++) {
+ var o = Object('x');
+ o.valueOf = function() { return 'y' };
+ assertEquals('y', o + '');
+ assertEquals('y', '' + o);
+}
+
+for (var i = 0; i < 10; i++) {
+ test()
+}
diff --git a/src/v8/test/mjsunit/regress/regress-760268.js b/src/v8/test/mjsunit/regress/regress-760268.js
new file mode 100644
index 0000000..6884ae1
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-760268.js
@@ -0,0 +1,11 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var obj = this;
+var handler = {
+ has: function() { return false; }
+}
+var proxy = new Proxy(obj, handler);
+Object.defineProperty(obj, "nonconf", {});
+assertThrows("'nonconf' in proxy");
diff --git a/src/v8/test/mjsunit/regress/regress-760790.js b/src/v8/test/mjsunit/regress/regress-760790.js
new file mode 100644
index 0000000..75770ba
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-760790.js
@@ -0,0 +1,11 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function g() {
+ var a = Array(0);
+ a[0]++;
+}
+g();
+g();
+g();
diff --git a/src/v8/test/mjsunit/regress/regress-761639.js b/src/v8/test/mjsunit/regress/regress-761639.js
new file mode 100644
index 0000000..a5fa69f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-761639.js
@@ -0,0 +1,10 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Regression test for hitting a DCHECK in StoreProxy.
+
+
+for (var i = 0; i < 10; i++) {
+ __proto__ = new Proxy({}, { getPrototypeOf() { } });
+}
diff --git a/src/v8/test/mjsunit/regress/regress-761831.js b/src/v8/test/mjsunit/regress/regress-761831.js
new file mode 100644
index 0000000..80ae256
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-761831.js
@@ -0,0 +1,13 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function OrigReproCase() {
+ assertThrows('var f = ([x=[a=undefined]=[]]) => {}; f();', TypeError);
+}
+OrigReproCase();
+
+function SimpleReproCase() {
+ assertThrows('var f = ([x=[]=[]]) => {}; f()', TypeError);
+}
+SimpleReproCase();
diff --git a/src/v8/test/mjsunit/regress/regress-780423.js b/src/v8/test/mjsunit/regress/regress-780423.js
new file mode 100644
index 0000000..862db32
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-780423.js
@@ -0,0 +1,39 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var Class = {
+ create: function() {
+ return function kurt() {
+ }
+ }
+};
+
+var o1 = Class.create();
+var o2 = Class.create();
+
+assertTrue(o1 !== o2, "different functions");
+assertTrue(o1.prototype !== o2.prototype, "different protos");
diff --git a/src/v8/test/mjsunit/regress/regress-78270.js b/src/v8/test/mjsunit/regress/regress-78270.js
new file mode 100644
index 0000000..b9ce286
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-78270.js
@@ -0,0 +1,37 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+for (var i = 0; i < 10000; i++) {
+ try {
+ var object = { };
+ function g(f0) {
+ var f0 = (object instanceof encodeURI)('foo');
+ }
+ g(75);
+ } catch (g) {
+ }
+}
diff --git a/src/v8/test/mjsunit/regress/regress-784.js b/src/v8/test/mjsunit/regress/regress-784.js
new file mode 100644
index 0000000..4ba0227
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-784.js
@@ -0,0 +1,42 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test that CallApplyLazy, generating optimized code for apply calls of the
+// form x.apply(y, arguments), does not leave an extra copy of the result
+// on the stack.
+
+// See http://code.google.com/p/v8/issues/detail?id=784
+
+A = {x:{y:function(i){return i;}}};
+B = function(x){return 17;};
+
+foo = function () {
+ A.x.y(B.apply(this, arguments));
+};
+
+foo();
+foo("Hello", "There");
diff --git a/src/v8/test/mjsunit/regress/regress-794.js b/src/v8/test/mjsunit/regress/regress-794.js
new file mode 100644
index 0000000..409b2ef
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-794.js
@@ -0,0 +1,31 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test the a bound function does not have a prototype.
+
+function foo() {}
+assertFalse("prototype" in foo.bind());
diff --git a/src/v8/test/mjsunit/regress/regress-798.js b/src/v8/test/mjsunit/regress/regress-798.js
new file mode 100644
index 0000000..182eb4d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-798.js
@@ -0,0 +1,108 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var x = {};
+
+// Add property a with getter/setter.
+x.__defineGetter__("a", function() {
+ try {
+ y.x = 40;
+ } catch (e) {
+ assertEquals(3, e.stack.split('\n').length);
+ }
+ return 40;
+});
+
+x.__defineSetter__("a", function(val) {
+ try {
+ y.x = 40;
+ } catch(e) {
+ assertEquals(3, e.stack.split('\n').length);
+ }
+});
+
+// Add property b with getter/setter.
+function getB() {
+ try {
+ y.x = 30;
+ } catch (e) {
+ assertEquals(3, e.stack.split('\n').length);
+ }
+ return 30;
+}
+
+function setB(val) {
+ try {
+ y.x = 30;
+ } catch(e) {
+ assertEquals(3, e.stack.split('\n').length);
+ }
+}
+
+x.__defineGetter__("b", getB);
+x.__defineSetter__("b", setB);
+
+// Add property c with getter/setter.
+var descriptor = {
+ get: function() {
+ try {
+ y.x = 40;
+ } catch (e) {
+ assertEquals(3, e.stack.split('\n').length);
+ }
+ return 40;
+ },
+ set: function(val) {
+ try {
+ y.x = 40;
+ } catch(e) {
+ assertEquals(3, e.stack.split('\n').length);
+ }
+ }
+}
+
+Object.defineProperty(x, 'c', descriptor)
+
+// Check that the stack for an exception in a getter and setter produce the
+// expected stack height.
+x.a;
+x.b;
+x.c;
+x.a = 1;
+x.b = 1;
+x.c = 1;
+
+// Do the same with the getters/setters on the a prototype object.
+xx = {}
+xx.__proto__ = x
+
+xx.a;
+xx.b;
+xx.c;
+xx.a = 1;
+xx.b = 1;
+xx.c = 1;
diff --git a/src/v8/test/mjsunit/regress/regress-806.js b/src/v8/test/mjsunit/regress/regress-806.js
new file mode 100644
index 0000000..1bb3e0f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-806.js
@@ -0,0 +1,51 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test that we do no use r12 as a receiver in inlined NamedStores on x64.
+
+// See: http://code.google.com/p/v8/issues/detail?id=806
+
+function foo(a) {
+ for (var o = 1; o < 2; o++) {
+ for (var n = 1; n < 2; n++) {
+ for (var m = 1; m < 2; m++) {
+ for (var l = 1; l < 2; l++) {
+ for (var i = 1; i < 2; i++) {
+ for (var j = 1; j < 2; j++) {
+ for (var k = 1; k < 2; k++) {
+ var z = a.foo;
+ z.foo = i * j * k * m * n * o;
+ }
+ }
+ }
+ }
+ }
+ }
+ }
+}
+
+foo({foo: {foo: 1}});
diff --git a/src/v8/test/mjsunit/regress/regress-806473.js b/src/v8/test/mjsunit/regress/regress-806473.js
new file mode 100644
index 0000000..91c9a9f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-806473.js
@@ -0,0 +1,58 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-gc
+
+function catchThese() {
+ L: {
+ try {
+ break L;
+ } catch (e) {}
+ }
+}
+
+function finallyThese() {
+ L: {
+ try {
+ break L;
+ } finally {}
+ }
+}
+
+
+for (var i = 0; i < 10; i++) {
+ catchThese();
+ gc();
+}
+
+for (var j = 0; j < 10; j++) {
+ finallyThese();
+ gc();
+}
+
+assertEquals(10, i);
+assertEquals(10, j);
diff --git a/src/v8/test/mjsunit/regress/regress-815.js b/src/v8/test/mjsunit/regress/regress-815.js
new file mode 100644
index 0000000..803c0fb
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-815.js
@@ -0,0 +1,49 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// 815 describes a situation in which the ARM code generator could
+// end up in a spilled scope in code that only worked in a register
+// allocated scope. Test that this no longer happens.
+//
+// The code generated for unary + assumes that we are not in a spilled
+// scope.
+
+var o = new Object();
+
+// The code for the iterated-over object in for-in used to be emitted
+// in a spilled scope:
+for (x in +o) { }
+
+// Emitting code for the left hand side of a for-in.
+for (a[+o] in o) {}
+
+// The receiver in an obj[index](1, 2, 3) call:
+try {
+ o[+o](1,2,3)
+} catch(e) {
+ // It's OK as long as it does not hit an assert.
+}
diff --git a/src/v8/test/mjsunit/regress/regress-82769.js b/src/v8/test/mjsunit/regress/regress-82769.js
new file mode 100644
index 0000000..6a95e9a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-82769.js
@@ -0,0 +1,34 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --noinline-new
+
+x = -1;
+y = -0;
+for (var i = 0; i < 5; i++) {
+ assertEquals(0xFFFFFFFF, (x >>> y));
+}
diff --git a/src/v8/test/mjsunit/regress/regress-842.js b/src/v8/test/mjsunit/regress/regress-842.js
new file mode 100644
index 0000000..18ad6d3
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-842.js
@@ -0,0 +1,42 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// 842 describes a scenario where Object.prototype or Array.prototype is
+// changed (a property is added) after which freeze and seal would fail
+// since that property would be listed when doing a "for (var key in names)"
+
+Array.prototype.myfunc = function() {};
+Array.prototype[10] = 42;
+Array.prototype.length = 3000;
+
+var obj = { name: "n1" };
+
+try {
+ obj = Object.freeze(obj);
+} catch (e) {
+ assertUnreachable();
+}
diff --git a/src/v8/test/mjsunit/regress/regress-842017.js b/src/v8/test/mjsunit/regress/regress-842017.js
new file mode 100644
index 0000000..3a367bb
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-842017.js
@@ -0,0 +1,60 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-gc
+
+function break_from_for_in() {
+ L: {
+ try {
+ for (var x in [1,2,3]) {
+ break L;
+ }
+ } finally {}
+ }
+}
+
+function break_from_finally() {
+ L: {
+ try {
+ } finally {
+ break L;
+ }
+ }
+}
+
+for (var i = 0; i < 10; i++) {
+ break_from_for_in();
+ gc();
+}
+
+for (var j = 0; j < 10; j++) {
+ break_from_finally();
+ gc();
+}
+
+assertEquals(10, i);
+assertEquals(10, j);
diff --git a/src/v8/test/mjsunit/regress/regress-84234.js b/src/v8/test/mjsunit/regress/regress-84234.js
new file mode 100644
index 0000000..6377fb3
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-84234.js
@@ -0,0 +1,55 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-gc --noopt
+
+var gTestcases = new Array();
+
+function TestCase(n, d, e, a) {
+ gTestcases[gTc++] = this;
+ for ( gTc=0; gTc < gTestcases.length; gTc++ );
+}
+
+for ( var i = 0x0530; i <= 0x058F; i++ ) {
+ new TestCase("15.5.4.11-6",
+ eval("var s = new String(String.fromCharCode(i)); s.toLowerCase().charCodeAt(0)"));
+}
+var gTc= 0;
+
+
+for (var j = 0; j < 10; j++) {
+ test();
+ function test() {
+ for ( 0; gTc < gTestcases.length; gTc++ ) {
+ var MYOBJECT = new MyObject();
+ }
+ gc();
+ }
+ function MyObject( n ) {
+ this.__proto__ = Number.prototype;
+ }
+}
diff --git a/src/v8/test/mjsunit/regress/regress-851.js b/src/v8/test/mjsunit/regress/regress-851.js
new file mode 100644
index 0000000..d8f693e
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-851.js
@@ -0,0 +1,32 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var i = 0;
+for (var i = 0; i < 10000; i++) {
+ Object.freeze({});
+ assertNull(JSON.stringify({x: null}).match(/\0/));
+}
diff --git a/src/v8/test/mjsunit/regress/regress-85177.js b/src/v8/test/mjsunit/regress/regress-85177.js
new file mode 100644
index 0000000..aa938f5
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-85177.js
@@ -0,0 +1,64 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+gW=gH=175;
+g=[];
+
+for(var n=0; n<gW; n++){
+ var l=[];
+ for(var p=0; p<gH; p++){
+ l.push(1)
+ }
+ g.push(l)
+}
+
+function k(a,b){
+ if(a<0||b<0||a>=gW||b>=gH)
+ return 0;
+ return g[a][b];
+}
+
+function f(){
+ for(var a=[],f=0; f<gW; f++){
+ var b=[];
+ for(var h=0; h<gH; h++){
+ var e=0;
+ for(var i=-1; i<=1; i++)
+ for(var j=-1; j<=1; j++)
+ e+=k(f+i,h+j);
+ e=k(f,h)==1?1:0;
+ b.push(e)
+ }
+ a.push(b)
+ }
+}
+
+f();
+%OptimizeFunctionOnNextCall(f);
+f();
diff --git a/src/v8/test/mjsunit/regress/regress-857.js b/src/v8/test/mjsunit/regress/regress-857.js
new file mode 100644
index 0000000..183248d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-857.js
@@ -0,0 +1,37 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Make sure ES5 15.9.1.15 (ISO 8601 / RFC 3339) time zone offsets of
+// the form "+09:00" & "-09:00" get parsed as expected
+assertEquals(1283326536000, Date.parse("2010-08-31T22:35:36-09:00"));
+assertEquals(1283261736000, Date.parse("2010-08-31T22:35:36+09:00"));
+assertEquals(1283326536000, Date.parse("2010-08-31T22:35:36.0-09:00"));
+assertEquals(1283261736000, Date.parse("2010-08-31T22:35:36.0+09:00"));
+// colon-less time expressions in time zone offsets are not conformant
+// with ES5 15.9.1.15 but are nonetheless supported in V8
+assertEquals(1283326536000, Date.parse("2010-08-31T22:35:36-0900"));
+assertEquals(1283261736000, Date.parse("2010-08-31T22:35:36+0900"));
diff --git a/src/v8/test/mjsunit/regress/regress-86.js b/src/v8/test/mjsunit/regress/regress-86.js
new file mode 100644
index 0000000..a33b60b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-86.js
@@ -0,0 +1,46 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var aList = [1, 2, 3];
+var loopCount = 0;
+var leftThroughFinally = false;
+var enteredFinally = false;
+for (x in aList) {
+ leftThroughFinally = true;
+ try {
+ throw "ex1";
+ } catch(er1) {
+ loopCount += 1;
+ } finally {
+ enteredFinally = true;
+ continue;
+ }
+ leftThroughFinally = false;
+}
+assertEquals(3, loopCount);
+assertTrue(enteredFinally);
+assertTrue(leftThroughFinally);
diff --git a/src/v8/test/mjsunit/regress/regress-87.js b/src/v8/test/mjsunit/regress/regress-87.js
new file mode 100644
index 0000000..10446fd
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-87.js
@@ -0,0 +1,53 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// In Issue 87, we allowed unicode escape sequences in RegExp flags.
+// However, according to ES5, they should not be interpreted, but passed
+// verbatim to the RegExp constructor.
+// (On top of that, the original test was bugged and never tested anything).
+// The behavior was changed in r8969 to not interpret escapes, but this
+// test didn't test that, and only failed when making invalid flag characters
+// an error too.
+
+assertThrows("/x/\\u0067");
+assertThrows("/x/\\u0069");
+assertThrows("/x/\\u006d");
+
+assertThrows("/x/\\u0067i");
+assertThrows("/x/\\u0069m");
+assertThrows("/x/\\u006dg");
+
+assertThrows("/x/m\\u0067");
+assertThrows("/x/g\\u0069");
+assertThrows("/x/i\\u006d");
+
+assertThrows("/x/m\\u0067i");
+assertThrows("/x/g\\u0069m");
+assertThrows("/x/i\\u006dg");
+
+assertThrows("/x/\\u0068");
+assertThrows("/x/\\u0020");
diff --git a/src/v8/test/mjsunit/regress/regress-874.js b/src/v8/test/mjsunit/regress/regress-874.js
new file mode 100644
index 0000000..384d9c7
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-874.js
@@ -0,0 +1,37 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var x = { };
+
+var getter = function(){ return 42; };
+var setter = function(value){ };
+x.__defineGetter__(0, getter);
+x.__defineSetter__(0, setter);
+
+assertEquals (undefined, Object.getOwnPropertyDescriptor(x, 0).value);
+assertEquals (getter, Object.getOwnPropertyDescriptor(x, 0).get);
+assertEquals (setter, Object.getOwnPropertyDescriptor(x, 0).set);
diff --git a/src/v8/test/mjsunit/regress/regress-874178.js b/src/v8/test/mjsunit/regress/regress-874178.js
new file mode 100644
index 0000000..0ed5434
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-874178.js
@@ -0,0 +1,32 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function foo(){}
+assertTrue(Function.prototype.isPrototypeOf(foo));
+
+foo.bar = 'hello';
+assertTrue(foo.propertyIsEnumerable('bar'));
diff --git a/src/v8/test/mjsunit/regress/regress-875031.js b/src/v8/test/mjsunit/regress/regress-875031.js
new file mode 100644
index 0000000..f18b084
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-875031.js
@@ -0,0 +1,37 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Regression test for issue 875031.
+
+var caught = false;
+try {
+ eval("return;");
+ assertTrue(false); // should not reach here
+} catch (e) {
+ caught = true;
+}
+assertTrue(caught);
diff --git a/src/v8/test/mjsunit/regress/regress-877615.js b/src/v8/test/mjsunit/regress/regress-877615.js
new file mode 100644
index 0000000..bec5a4d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-877615.js
@@ -0,0 +1,37 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+Number.prototype.toLocaleString = function() { return 'invalid'; };
+assertEquals('invalid', [1].toLocaleString()); // invalid
+
+Number.prototype.toLocaleString = 'invalid';
+assertThrows(function() { [1].toLocaleString(); }); // Not callable.
+
+delete Number.prototype.toLocaleString;
+Number.prototype.toString = function() { return 'invalid' };
+assertEquals([1].toLocaleString(), 'invalid'); // Uses ToObject on elements.
+assertEquals([1].toString(), '1'); // Uses ToString directly on elements.
diff --git a/src/v8/test/mjsunit/regress/regress-88591.js b/src/v8/test/mjsunit/regress/regress-88591.js
new file mode 100644
index 0000000..878e791
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-88591.js
@@ -0,0 +1,42 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Regression test for a crash. A data property in the global object's
+// prototype shadowed by a setter in the global object's prototype's
+// prototype would crash or assert when seen by Runtime_DeclareContextSlot.
+var called = false;
+Object.prototype.__defineSetter__('x', function(x) { called = true; });
+Object.prototype.__defineGetter__('x', function () { return 0; });
+
+this.__proto__ = { x: 1 };
+
+try { fail; } catch (e) { eval('var x = 2'); }
+
+var o = Object.getOwnPropertyDescriptor(this, 'x');
+assertFalse(called);
+assertEquals(2, o.value);
+assertEquals(true, o.writable);
diff --git a/src/v8/test/mjsunit/regress/regress-88858.js b/src/v8/test/mjsunit/regress/regress-88858.js
new file mode 100644
index 0000000..ba33f87
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-88858.js
@@ -0,0 +1,65 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-gc
+
+// Verify that JSObject::PreventExtensions works for arguments objects.
+
+try {
+ function make_watcher(name) { }
+ var o, p;
+ function f(flag) {
+ if (flag) {
+ o = arguments;
+ } else {
+ p = arguments;
+ o.watch(0, (arguments-1901)('o'));
+ p.watch(0, make_watcher('p'));
+ p.unwatch(0);
+ o.unwatch(0);
+ p[0] = 4;
+ assertEq(flag, 4);
+ }
+ }
+ f(true);
+ f(false);
+ reportCompare(true, true);
+} catch(exc1) { }
+
+try {
+ function __noSuchMethod__() {
+ if (anonymous == "1")
+ return NaN;
+ return __construct__;
+ }
+ f.p = function() { };
+ Object.freeze(p);
+ new new freeze().p;
+ reportCompare(0, 0, "ok");
+} catch(exc2) { }
+
+gc();
diff --git a/src/v8/test/mjsunit/regress/regress-892742.js b/src/v8/test/mjsunit/regress/regress-892742.js
new file mode 100644
index 0000000..fd79fc0
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-892742.js
@@ -0,0 +1,47 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function f() {
+ return/* Counts as non-line-terminating whitespace */1;
+};
+
+// According to ECMA-262, this comment should be parsed as a
+// line terminator making g() return undefined.
+function g() {
+ return/* Counts as line-terminator whitespace.
+ */2;
+};
+
+function h() {
+ return// Comment doesn't include line-terminator at end.
+ 3;
+};
+
+
+assertEquals(1, f());
+assertEquals(undefined, g());
+assertEquals(undefined, h());
diff --git a/src/v8/test/mjsunit/regress/regress-900.js b/src/v8/test/mjsunit/regress/regress-900.js
new file mode 100644
index 0000000..9f94348
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-900.js
@@ -0,0 +1,46 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Check that we allow accessors on JSArray elements.
+
+var a = [];
+var b = {}
+Object.defineProperty(a, "1", {get: function() {return "foo";}});
+Object.defineProperty(
+ b, "1", {get: function() {return "bar";}, set: function() {this.x = 42;}});
+assertEquals(a[1], 'foo');
+assertEquals(b[1], 'bar');
+// Make sure we can't overwrite an accessor, but that the setter is
+// instead called.
+b[1] = 'foobar';
+assertEquals(b[1], 'bar');
+assertEquals(b.x, 42);
+
+var desc = Object.getOwnPropertyDescriptor(b, "1");
+assertEquals(desc['writable'], undefined);
+assertFalse(desc['enumerable']);
+assertFalse(desc['configurable']);
diff --git a/src/v8/test/mjsunit/regress/regress-900055.js b/src/v8/test/mjsunit/regress/regress-900055.js
new file mode 100644
index 0000000..9a02f22
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-900055.js
@@ -0,0 +1,42 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var alias = eval;
+function e(s) { return alias(s); }
+
+assertEquals(42, e("42"));
+assertEquals(Object, e("Object"));
+assertEquals(e, e("e"));
+
+var caught = false;
+try {
+ e('s'); // should throw exception since aliased eval is global
+} catch (e) {
+ caught = true;
+ assertTrue(e instanceof ReferenceError);
+}
+assertTrue(caught);
diff --git a/src/v8/test/mjsunit/regress/regress-900966.js b/src/v8/test/mjsunit/regress/regress-900966.js
new file mode 100644
index 0000000..99603c12
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-900966.js
@@ -0,0 +1,49 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+assertTrue('abc'[10] === undefined);
+String.prototype[10] = 'x';
+assertEquals('abc'[10], 'x');
+
+// Test that the fast case character-at stub handles an out-of-bound
+// index correctly. We need to call the function twice to initialize
+// the character-at stub.
+function f() {
+ assertEquals('abc'[10], 'x');
+}
+f();
+f();
+f();
+f();
+
+assertTrue(2[11] === undefined);
+Number.prototype[11] = 'y';
+assertEquals(2[11], 'y');
+
+assertTrue(true[12] === undefined);
+Boolean.prototype[12] = 'z';
+assertEquals(true[12], 'z');
diff --git a/src/v8/test/mjsunit/regress/regress-91.js b/src/v8/test/mjsunit/regress/regress-91.js
new file mode 100644
index 0000000..7f6263d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-91.js
@@ -0,0 +1,38 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var date = new Date();
+var year = date.getYear();
+date.setMilliseconds(Number.NaN);
+date.setYear(1900 + year);
+assertEquals(year, date.getYear());
+assertEquals(0, date.getMonth());
+assertEquals(1, date.getDate());
+assertEquals(0, date.getHours());
+assertEquals(0, date.getMinutes());
+assertEquals(0, date.getSeconds());
+assertEquals(0, date.getMilliseconds());
diff --git a/src/v8/test/mjsunit/regress/regress-91008.js b/src/v8/test/mjsunit/regress/regress-91008.js
new file mode 100644
index 0000000..d7ea2df
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-91008.js
@@ -0,0 +1,43 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function testsort(n) {
+ var numbers=new Array(n);
+ for (var i=0;i<n;i++) numbers[i]=i;
+ delete numbers[50];
+ delete numbers[150];
+ delete numbers[25000];
+ delete numbers[n-1];
+ delete numbers[n-2];
+ delete numbers[30];
+ delete numbers[2];
+ delete numbers[1];
+ delete numbers[0];
+ numbers.sort();
+}
+
+testsort(100000)
diff --git a/src/v8/test/mjsunit/regress/regress-91010.js b/src/v8/test/mjsunit/regress/regress-91010.js
new file mode 100644
index 0000000..a077999
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-91010.js
@@ -0,0 +1,36 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+try {
+ try {
+ var N = 100*1000;
+ var array = Array(N);
+ for (var i = 0; i != N; ++i)
+ array[i] = i;
+ } catch(ex) {}
+ array.unshift('Kibo');
+} catch(ex) {}
diff --git a/src/v8/test/mjsunit/regress/regress-91013.js b/src/v8/test/mjsunit/regress/regress-91013.js
new file mode 100644
index 0000000..cec3322
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-91013.js
@@ -0,0 +1,51 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test that KeyedStore stub for unboxed double arrays backing store
+// correctly returns stored value as the result.
+
+// Flags: --allow-natives-syntax --unbox-double-arrays
+
+// Create array with unboxed double array backing store.
+var i = 100000;
+var a = new Array(i);
+for (var j = 0; j < i; j++) {
+ a[j] = 0.5;
+}
+
+assertTrue(%HasDoubleElements(a));
+
+// Store some smis into it.
+for (var j = 0; j < 10; j++) {
+ assertEquals(j, a[j] = j);
+}
+
+// Store some heap numbers into it.
+for (var j = 0; j < 10; j++) {
+ var v = j + 0.5;
+ assertEquals(v, a[j] = v);
+}
diff --git a/src/v8/test/mjsunit/regress/regress-91120.js b/src/v8/test/mjsunit/regress/regress-91120.js
new file mode 100644
index 0000000..73f5456
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-91120.js
@@ -0,0 +1,50 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// With ES2015 function hoisting semantics, functions are only "hoisted" out
+// of blocks by writing their values into var-scoped declarations. Therefore,
+// they access the catch binding when it syntactically appears so.
+// This is a potentially breaking change vs the old semantics, which would
+// return 'function' from g() everywhere.
+
+var x = 'global';
+
+function f() {
+ var x = 'function';
+ assertEquals(undefined, g);
+ try {
+ assertEquals(undefined, g);
+ throw 'catch';
+ } catch (x) {
+ function g() { return x; }
+ assertEquals('catch', g());
+ }
+ assertEquals('catch', g());
+ return g;
+}
+
+assertEquals('catch', f()());
diff --git a/src/v8/test/mjsunit/regress/regress-91787.js b/src/v8/test/mjsunit/regress/regress-91787.js
new file mode 100644
index 0000000..96310d0
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-91787.js
@@ -0,0 +1,35 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Unterminated non-ASCII string literals in JSON code were not
+// detected correctly.
+
+// Shouldn't crash (due to stack overflow).
+// Should throw due to invalid syntax.
+assertThrows(function() {
+ JSON.parse('"\x80unterminated');
+});
diff --git a/src/v8/test/mjsunit/regress/regress-918.js b/src/v8/test/mjsunit/regress/regress-918.js
new file mode 100644
index 0000000..871e9d9
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-918.js
@@ -0,0 +1,33 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Parser should not accept parentheses around labels.
+// See http://code.google.com/p/v8/issues/detail?id=918
+
+// The label was parsed as an expression and then tested for being a
+// single identifier. This threw away the parentheses.
+assertThrows("(label):42;");
diff --git a/src/v8/test/mjsunit/regress/regress-925537.js b/src/v8/test/mjsunit/regress/regress-925537.js
new file mode 100644
index 0000000..6d75504
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-925537.js
@@ -0,0 +1,41 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function assertClose(expected, actual) {
+ var delta = 0.00001;
+ if (Math.abs(expected - actual) > delta) {
+ print('Failure: Expected <' + actual + '> to be close to <' +
+ expected + '>');
+ }
+}
+
+assertEquals(1, Math.pow(NaN, 0));
+var pinf = Number.POSITIVE_INFINITY, ninf = Number.NEGATIVE_INFINITY;
+assertClose( Math.PI / 4, Math.atan2(pinf, pinf));
+assertClose(-Math.PI / 4, Math.atan2(ninf, pinf));
+assertClose( 3 * Math.PI / 4, Math.atan2(pinf, ninf));
+assertClose(-3 * Math.PI / 4, Math.atan2(ninf, ninf));
diff --git a/src/v8/test/mjsunit/regress/regress-927.js b/src/v8/test/mjsunit/regress/regress-927.js
new file mode 100644
index 0000000..c671f7d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-927.js
@@ -0,0 +1,33 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function a1() {
+ var a2 = -1756315459;
+ return ((((a2 & a2) ^ 1) * a2) << -10);
+}
+
+assertEquals(a1(), -2147483648);
diff --git a/src/v8/test/mjsunit/regress/regress-931.js b/src/v8/test/mjsunit/regress/regress-931.js
new file mode 100644
index 0000000..d2fb8cc
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-931.js
@@ -0,0 +1,48 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// See http://code.google.com/p/v8/issues/detail?id=931.
+
+var sequence = '';
+
+var o = { f: function (x, y) { return x + y; },
+ 2: function (x, y) { return x - y} };
+
+function first() { sequence += "1"; return o; }
+function second() { sequence += "2"; return "f"; }
+function third() { sequence += "3"; return 3; }
+function fourth() { sequence += "4"; return 4; }
+
+var result = (first()[second()](third(), fourth()))
+assertEquals(7, result);
+assertEquals("1234", sequence);
+
+function second_prime() { sequence += "2'"; return 2; }
+
+var result = (first()[second_prime()](third(), fourth()))
+assertEquals(-1, result);
+assertEquals("123412'34", sequence);
diff --git a/src/v8/test/mjsunit/regress/regress-937896.js b/src/v8/test/mjsunit/regress/regress-937896.js
new file mode 100644
index 0000000..e7831da
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-937896.js
@@ -0,0 +1,50 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// This used to crash because the label collector in the parser didn't
+// discard duplicates which caused the outer-most continue statement
+// to try to unlink the inner try-handler that wasn't on the stack.
+
+function f() {
+ try {
+ for (var i = 0; i < 2; i++) {
+ continue;
+ try {
+ continue;
+ continue;
+ } catch (ex) {
+ // Empty.
+ }
+ }
+ } catch (e) {
+ // Empty.
+ }
+ return 42;
+}
+
+
+assertEquals(42, f());
diff --git a/src/v8/test/mjsunit/regress/regress-944.js b/src/v8/test/mjsunit/regress/regress-944.js
new file mode 100644
index 0000000..d165336
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-944.js
@@ -0,0 +1,46 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Check for parsing of proper ES5 15.9.1.15 (ISO 8601 / RFC 3339) time
+// strings that contain millisecond values with exactly 3 digits (as is
+// required by the spec format if the string has milliseconds at all).
+assertEquals(1290722550521, Date.parse("2010-11-25T22:02:30.521Z"));
+
+// Check for parsing of extension/generalization of the ES5 15.9.1.15 spec
+// format where millisecond values have only 1 or 2 digits.
+assertEquals(1290722550500, Date.parse("2010-11-25T22:02:30.5Z"));
+assertEquals(1290722550520, Date.parse("2010-11-25T22:02:30.52Z"));
+assertFalse(Date.parse("2010-11-25T22:02:30.5Z") === Date.parse("2010-11-25T22:02:30.005Z"));
+
+// Check that we truncate millisecond values having more than 3 digits.
+assertEquals(Date.parse("2010-11-25T22:02:30.1005Z"), Date.parse("2010-11-25T22:02:30.100Z"));
+
+// Check that we accept lots of digits.
+assertEquals(Date.parse("2010-11-25T22:02:30.999Z"), Date.parse("2010-11-25T22:02:30.99999999999999999999999999999999999999999999999999999999999999999999999999999999999999Z"));
+
+// Fail if there's a decimal point but zero digits for (expected) milliseconds.
+assertTrue(isNaN(Date.parse("2010-11-25T22:02:30.Z")));
diff --git a/src/v8/test/mjsunit/regress/regress-94425.js b/src/v8/test/mjsunit/regress/regress-94425.js
new file mode 100644
index 0000000..4a48f4a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-94425.js
@@ -0,0 +1,46 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-gc
+
+var N = 2040 - 2 + 10;
+var arr = new Array(N);
+
+gc();
+gc();
+gc();
+
+// arr is in the large object space now.
+// Write new space object into it.
+arr[arr.length - 2] = new Object;
+
+// Shift array multiple times to ensure that young
+// object crosses region boundary.
+for (var i = 0; i < 9; i++) arr.shift();
+
+// Do a GC to verify region dirty marks.
+gc();
diff --git a/src/v8/test/mjsunit/regress/regress-95113.js b/src/v8/test/mjsunit/regress/regress-95113.js
new file mode 100644
index 0000000..9d5a631
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-95113.js
@@ -0,0 +1,48 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function get_double_array() {
+ var a = new Array(100000);
+ var i = 0;
+ while (!%HasDoubleElements(a)) {
+ a[i] = i + 0.1;
+ i += 1;
+ }
+ assertTrue(%HasDoubleElements(a));
+ a.length = 1;
+ a[0] = 1.5;
+ a.length = 2;
+ a[1] = 2.5;
+ assertEquals(a[0], 1.5);
+ assertEquals(a[1], 2.5);
+ assertTrue(%HasDoubleElements(a));
+ return a;
+}
+
+var a = get_double_array();
diff --git a/src/v8/test/mjsunit/regress/regress-95485.js b/src/v8/test/mjsunit/regress/regress-95485.js
new file mode 100644
index 0000000..2510072
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-95485.js
@@ -0,0 +1,42 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function Test() {
+ var left = 'XXX';
+ var right = 'YYY';
+ for (var i = 0; i < 3; i++) {
+ var cons = left + right;
+ var substring = cons.substring(2, 4);
+ try {
+ with ({Test: i})
+ continue;
+ } finally { }
+ }
+ return substring;
+}
+
+assertEquals('XY', Test());
diff --git a/src/v8/test/mjsunit/regress/regress-955.js b/src/v8/test/mjsunit/regress/regress-955.js
new file mode 100644
index 0000000..9a9a0b0
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-955.js
@@ -0,0 +1,44 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// See: http://code.google.com/p/v8/issues/detail?id=955
+
+// Correctly parse signed numbers.
+assertEquals(-0, parseInt("-0"));
+assertEquals(0, parseInt("+0"));
+
+// Don't allow whitespace after signs in parseInt.
+assertEquals(NaN, parseInt("- 0"));
+assertEquals(NaN, parseInt("+ 0"));
+assertEquals(NaN, parseInt("-\t0"));
+assertEquals(NaN, parseInt("+\t0"));
+
+// Do allow whitespace at start.
+assertEquals(-0, parseInt(" -0"));
+assertEquals(0, parseInt(" +0"));
+assertEquals(-0, parseInt("\t-0"));
+assertEquals(0, parseInt("\t+0"));
diff --git a/src/v8/test/mjsunit/regress/regress-95920.js b/src/v8/test/mjsunit/regress/regress-95920.js
new file mode 100644
index 0000000..5584965
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-95920.js
@@ -0,0 +1,50 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Tests that objects with external arrays cannot be sealed or have their
+// properties redefined.
+
+Object.preventExtensions(new Int8Array(42));
+Object.seal(new Int8Array(42));
+
+// No elements, so should succeed.
+Object.freeze(new Int8Array(0));
+
+var o = new Int8Array(42);
+assertThrows(function() {
+ Object.freeze(o);
+ assertUnreable();
+ }, TypeError);
+
+// Freeze should still have managed to preventExtensions o.
+assertFalse(Object.isExtensible(o));
+
+assertThrows(function() {
+ Object.defineProperty(new Int8Array(42), "1",
+ { writable: false, value: "1" });
+ assertUnreable();
+ });
diff --git a/src/v8/test/mjsunit/regress/regress-962.js b/src/v8/test/mjsunit/regress/regress-962.js
new file mode 100644
index 0000000..85ada0c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-962.js
@@ -0,0 +1,57 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function L(scope) { this.s = new Object(); }
+
+L.prototype.c = function() { return true; }
+
+function F() {
+ this.l = [new L, new L];
+}
+
+F.prototype.foo = function () {
+ var f, d = arguments,
+ e, b = this.l,
+ g;
+ for (e = 0; e < b.length; e++) {
+ g = b[e];
+ f = g.c.apply(g.s, d);
+ if (f === false) {
+ break
+ }
+ }
+ return f
+}
+
+
+var ctx = new F;
+
+for (var i = 0; i < 5; i++) ctx.foo();
+%OptimizeFunctionOnNextCall(F.prototype.foo);
+ctx.foo();
diff --git a/src/v8/test/mjsunit/regress/regress-96523.js b/src/v8/test/mjsunit/regress/regress-96523.js
new file mode 100644
index 0000000..e611ce3
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-96523.js
@@ -0,0 +1,37 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+with ({x:'outer'}) {
+ (function() {
+ var x = 'inner';
+ try {
+ throw 'Exception';
+ } catch (e) {
+ assertEquals('inner', x);
+ }
+ })()
+}
diff --git a/src/v8/test/mjsunit/regress/regress-969.js b/src/v8/test/mjsunit/regress/regress-969.js
new file mode 100644
index 0000000..c2ba0ac
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-969.js
@@ -0,0 +1,127 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Regression test for bugs when deoptimizing after assignments in effect
+// contexts.
+
+// Bug 989 is that there was an extra value on the expression stack when
+// deoptimizing after an assignment in effect context (the value of the
+// assignment was lingering). This is hard to observe in the unoptimized
+// code.
+//
+// This test uses comma expressions to put assignments in effect contexts,
+// references to deleted global variables to force deoptimization, and
+// function calls to observe an extra value.
+
+function first(x, y) { return x; }
+var y = 0;
+var o = {};
+o.x = 0;
+o[0] = 0;
+
+// Assignment to global variable.
+x0 = 0;
+function test0() { return first((y = 1, typeof x0), 2); }
+// Call the function once to compile it.
+assertEquals('number', test0());
+// Delete to force deoptimization on the next call.
+delete x0;
+assertEquals('undefined', test0());
+
+// Compound assignment to global variable.
+x1 = 0;
+function test1() { return first((y += 1, typeof x1), 2); }
+assertEquals('number', test1(), 'test1 before');
+delete x1;
+assertEquals('undefined', test1(), 'test1 after');
+
+// Pre and post-increment of global variable.
+x2 = 0;
+function test2() { return first((++y, typeof x2), 2); }
+assertEquals('number', test2(), 'test2 before');
+delete x2;
+assertEquals('undefined', test2(), 'test2 after');
+
+x3 = 0;
+function test3() { return first((y++, typeof x3), 2); }
+assertEquals('number', test3(), 'test3 before');
+delete x3;
+assertEquals('undefined', test3(), 'test3 after');
+
+
+// Assignment, compound assignment, and pre and post-increment of named
+// properties.
+x4 = 0;
+function test4() { return first((o.x = 1, typeof x4), 2); }
+assertEquals('number', test4());
+delete x4;
+assertEquals('undefined', test4());
+
+x5 = 0;
+function test5() { return first((o.x += 1, typeof x5), 2); }
+assertEquals('number', test5());
+delete x5;
+assertEquals('undefined', test5());
+
+x6 = 0;
+function test6() { return first((++o.x, typeof x6), 2); }
+assertEquals('number', test6());
+delete x6;
+assertEquals('undefined', test6());
+
+x7 = 0;
+function test7() { return first((o.x++, typeof x7), 2); }
+assertEquals('number', test7());
+delete x7;
+assertEquals('undefined', test7());
+
+
+// Assignment, compound assignment, and pre and post-increment of indexed
+// properties.
+x8 = 0;
+function test8(index) { return first((o[index] = 1, typeof x8), 2); }
+assertEquals('number', test8());
+delete x8;
+assertEquals('undefined', test8());
+
+x9 = 0;
+function test9(index) { return first((o[index] += 1, typeof x9), 2); }
+assertEquals('number', test9());
+delete x9;
+assertEquals('undefined', test9());
+
+x10 = 0;
+function test10(index) { return first((++o[index], typeof x10), 2); }
+assertEquals('number', test10());
+delete x10;
+assertEquals('undefined', test10());
+
+x11 = 0;
+function test11(index) { return first((o[index]++, typeof x11), 2); }
+assertEquals('number', test11());
+delete x11;
+assertEquals('undefined', test11());
diff --git a/src/v8/test/mjsunit/regress/regress-97116.js b/src/v8/test/mjsunit/regress/regress-97116.js
new file mode 100644
index 0000000..b858ca5
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-97116.js
@@ -0,0 +1,50 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-gc --allow-natives-syntax
+
+// Check that we are not flushing code for inlined functions that
+// have a pending lazy deoptimization on the stack.
+
+function deopt() {
+ try { } catch (e) { } // Avoid inlining.
+ %DeoptimizeFunction(outer);
+ for (var i = 0; i < 10; i++) gc(); // Force code flushing.
+}
+
+function outer(should_deopt) {
+ inner(should_deopt);
+}
+
+function inner(should_deopt) {
+ if (should_deopt) deopt();
+}
+
+outer(false);
+outer(false);
+%OptimizeFunctionOnNextCall(outer);
+outer(true);
diff --git a/src/v8/test/mjsunit/regress/regress-97116b.js b/src/v8/test/mjsunit/regress/regress-97116b.js
new file mode 100644
index 0000000..91e7d6e
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-97116b.js
@@ -0,0 +1,50 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-gc --allow-natives-syntax
+
+// Check that we are not flushing code for inlined functions that
+// have a pending lazy deoptimization on the stack.
+
+%NeverOptimizeFunction(deopt);
+function deopt() {
+ %DeoptimizeFunction(outer);
+ for (var i = 0; i < 10; i++) gc(); // Force code flushing.
+}
+
+function outer(should_deopt) {
+ inner(should_deopt);
+}
+
+function inner(should_deopt) {
+ if (should_deopt) deopt();
+}
+
+outer(false);
+outer(false);
+%OptimizeFunctionOnNextCall(outer);
+outer(true);
diff --git a/src/v8/test/mjsunit/regress/regress-974.js b/src/v8/test/mjsunit/regress/regress-974.js
new file mode 100644
index 0000000..d6362cd
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-974.js
@@ -0,0 +1,32 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-gc
+
+// Verify that GC is safe in a finally block entered by falling off the try
+// block.
+eval("(function(){try { } catch(x) { } finally { gc() }})")();
diff --git a/src/v8/test/mjsunit/regress/regress-982.js b/src/v8/test/mjsunit/regress/regress-982.js
new file mode 100644
index 0000000..d88543a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-982.js
@@ -0,0 +1,45 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function f(a) {
+ return {className: 'xxx'};
+};
+
+var x = 1;
+
+function g(active) {
+ for (i = 1; i <= 20000; i++) {
+ if (i == active) {
+ x = i;
+ if (f("" + i) != null) { }
+ } else {
+ if (f("" + i) != null) { }
+ }
+ }
+}
+
+g(0);
diff --git a/src/v8/test/mjsunit/regress/regress-98773.js b/src/v8/test/mjsunit/regress/regress-98773.js
new file mode 100644
index 0000000..eb24eb5
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-98773.js
@@ -0,0 +1,39 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Calling Array.sort on an external array is not supposed to crash.
+
+var array = new Int16Array(23);
+array[7] = 7; array[9] = 9;
+assertEquals(23, array.length);
+assertEquals(7, array[7]);
+assertEquals(9, array[9]);
+
+Array.prototype.sort.call(array);
+assertEquals(23, array.length);
+assertEquals(7, array[21]);
+assertEquals(9, array[22]);
diff --git a/src/v8/test/mjsunit/regress/regress-990205.js b/src/v8/test/mjsunit/regress/regress-990205.js
new file mode 100644
index 0000000..7eb66f0
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-990205.js
@@ -0,0 +1,38 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// We throw syntax errors early for invalid break and continue statements.
+// (Notice that the example isn't valid ECMAScript due to the
+// function declaration that is not at top level.)
+
+function f() {
+ // Force eager compilation of x through the use of eval. The break
+ // in function x should not try to break out of the enclosing while.
+ return eval("while(0) function x() { break; }; 42");
+};
+
+assertThrows("f()");
diff --git a/src/v8/test/mjsunit/regress/regress-99167.js b/src/v8/test/mjsunit/regress/regress-99167.js
new file mode 100644
index 0000000..eac49d1
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-99167.js
@@ -0,0 +1,33 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-gc --max-semi-space-size=1
+
+eval("function Node() { this.a = 1; this.a = 3; }");
+new Node;
+for (var i = 0; i < 4; ++i) gc();
+for (var i = 0; i < 100000; ++i) new Node;
diff --git a/src/v8/test/mjsunit/regress/regress-992.js b/src/v8/test/mjsunit/regress/regress-992.js
new file mode 100644
index 0000000..dbe25a5
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-992.js
@@ -0,0 +1,43 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Object.defineProperty with generic desc on existing property
+// should just update enumerable/configurable flags.
+
+var obj = { get p() { return 42; } };
+var desc = Object.getOwnPropertyDescriptor(obj, 'p');
+var getter = desc.get;
+
+Object.defineProperty(obj, 'p', {enumerable: false });
+assertEquals(obj.p, 42);
+desc = Object.getOwnPropertyDescriptor(obj, 'p');
+assertFalse(desc.enumerable);
+assertTrue(desc.configurable);
+assertEquals(desc.get, getter);
+assertEquals(desc.set, undefined);
+assertFalse(desc.hasOwnProperty('value'));
+assertFalse(desc.hasOwnProperty('writable'));
diff --git a/src/v8/test/mjsunit/regress/regress-992733.js b/src/v8/test/mjsunit/regress/regress-992733.js
new file mode 100644
index 0000000..d0f7511
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-992733.js
@@ -0,0 +1,35 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+assertEquals("object", typeof this);
+var threw = false;
+try {
+ this();
+} catch (e) {
+ threw = true;
+}
+assertTrue(threw);
diff --git a/src/v8/test/mjsunit/regress/regress-995.js b/src/v8/test/mjsunit/regress/regress-995.js
new file mode 100644
index 0000000..3f99179
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-995.js
@@ -0,0 +1,56 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+//
+// A number of hydrogen instructions did not correctly compare its
+// data during GVN.
+//
+// Flags: --allow-natives-syntax
+
+// HHasInstance.
+function f(value) {
+ if (%_IsJSReceiver(value)) {
+ if ((%_IsArray(value))) assertTrue(false);
+ }
+}
+f(new String("bar"));
+
+// HClassOf.
+function g(value) {
+ if (%_ClassOf(value) === 'Date') {
+ if (%_ClassOf(value) === 'String') assertTrue(false);
+ }
+}
+g(new Date());
+
+// HIsNull.
+function h(value) {
+ if (value == null) {
+ if (value === null) assertTrue(false);
+ }
+}
+h(undefined);
diff --git a/src/v8/test/mjsunit/regress/regress-996542.js b/src/v8/test/mjsunit/regress/regress-996542.js
new file mode 100644
index 0000000..8fc704e
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-996542.js
@@ -0,0 +1,40 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var zero = 0;
+var one = 1;
+var minus_one = -1;
+
+assertEquals(-Infinity, 1 / (0 / -1));
+assertEquals(-Infinity, one / (zero / minus_one));
+assertEquals(Infinity, 1 / (0 / 1));
+assertEquals(Infinity, one / (zero / one));
+
+assertEquals(-Infinity, 1 / (-1 % 1));
+assertEquals(-Infinity, one / (minus_one % one))
+assertEquals(Infinity, 1 / (1 % 1));
+assertEquals(Infinity, one / (one % one));
diff --git a/src/v8/test/mjsunit/regress/regress-abort-context-allocate-params.js b/src/v8/test/mjsunit/regress/regress-abort-context-allocate-params.js
new file mode 100644
index 0000000..3089f78
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-abort-context-allocate-params.js
@@ -0,0 +1,941 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function f(getter) {
+ arguments = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+}
diff --git a/src/v8/test/mjsunit/regress/regress-abort-preparsing-params.js b/src/v8/test/mjsunit/regress/regress-abort-preparsing-params.js
new file mode 100644
index 0000000..d535321
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-abort-preparsing-params.js
@@ -0,0 +1,946 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var outer_a;
+
+function f(a, b, a) {
+ outer_a = a;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+ x = 1;
+}
+f(1, 2, 1);
+assertEquals(1, outer_a);
diff --git a/src/v8/test/mjsunit/regress/regress-add-minus-zero.js b/src/v8/test/mjsunit/regress/regress-add-minus-zero.js
new file mode 100644
index 0000000..cb77cdf
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-add-minus-zero.js
@@ -0,0 +1,37 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var o = { a: 0 };
+
+function f(x) { return -o.a + 0; };
+
+assertEquals("Infinity", String(1/f()));
+assertEquals("Infinity", String(1/f()));
+%OptimizeFunctionOnNextCall(f);
+assertEquals("Infinity", String(1/f()));
diff --git a/src/v8/test/mjsunit/regress/regress-alloc-smi-check.js b/src/v8/test/mjsunit/regress/regress-alloc-smi-check.js
new file mode 100644
index 0000000..295048a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-alloc-smi-check.js
@@ -0,0 +1,16 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax
+
+var x = {};
+
+function f(a) {
+ a[200000000] = x;
+}
+
+f(new Array(100000));
+f([]);
+%OptimizeFunctionOnNextCall(f);
+f([]);
diff --git a/src/v8/test/mjsunit/regress/regress-arg-materialize-store.js b/src/v8/test/mjsunit/regress/regress-arg-materialize-store.js
new file mode 100644
index 0000000..2a30dc8
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-arg-materialize-store.js
@@ -0,0 +1,22 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f() {
+ return f.arguments;
+}
+
+function g(deopt) {
+ var o = { x : 2 };
+ f();
+ o.x = 1;
+ deopt + 0;
+ return o.x;
+}
+
+g(0);
+g(0);
+%OptimizeFunctionOnNextCall(g);
+assertEquals(1, g({}));
diff --git a/src/v8/test/mjsunit/regress/regress-arguments-gc.js b/src/v8/test/mjsunit/regress/regress-arguments-gc.js
new file mode 100644
index 0000000..b5ed608
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-arguments-gc.js
@@ -0,0 +1,37 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-gc --nocleanup-code-caches-at-gc
+
+function f(x) {
+ gc();
+ arguments[0] = {};
+}
+
+f(1);
+f(1);
+f(1);
diff --git a/src/v8/test/mjsunit/regress/regress-arguments-liveness-analysis.js b/src/v8/test/mjsunit/regress/regress-arguments-liveness-analysis.js
new file mode 100644
index 0000000..95c2c00
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-arguments-liveness-analysis.js
@@ -0,0 +1,20 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function r(v) { return v.f }
+function h() { }
+function y(v) {
+ var x = arguments;
+ h.apply(r(v), x);
+};
+
+y({f:3});
+y({f:3});
+y({f:3});
+
+%OptimizeFunctionOnNextCall(y);
+
+y({ f : 3, u : 4 });
diff --git a/src/v8/test/mjsunit/regress/regress-arguments-slice.js b/src/v8/test/mjsunit/regress/regress-arguments-slice.js
new file mode 100644
index 0000000..f7cd8c6
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-arguments-slice.js
@@ -0,0 +1,8 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function f() { return arguments; }
+var o = f();
+o.length = -100;
+Array.prototype.slice.call(o);
diff --git a/src/v8/test/mjsunit/regress/regress-arm64-spillslots.js b/src/v8/test/mjsunit/regress/regress-arm64-spillslots.js
new file mode 100644
index 0000000..1791b24
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-arm64-spillslots.js
@@ -0,0 +1,34 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+"use strict";
+
+function Message(message) {
+ this.message = message;
+}
+
+function Inlined(input) {
+ var dummy = arguments[1] === undefined;
+ if (input instanceof Message) {
+ return input;
+ }
+ print("unreachable, but we must create register allocation complexity");
+ return [];
+}
+
+function Process(input) {
+ var ret = [];
+ ret.push(Inlined(input[0], 1, 2));
+ return ret;
+}
+
+var input = [new Message("TEST PASS")];
+
+Process(input);
+Process(input);
+%OptimizeFunctionOnNextCall(Process);
+var result = Process(input);
+assertEquals("TEST PASS", result[0].message);
diff --git a/src/v8/test/mjsunit/regress/regress-array-pop-deopt.js b/src/v8/test/mjsunit/regress/regress-array-pop-deopt.js
new file mode 100644
index 0000000..9a0d35d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-array-pop-deopt.js
@@ -0,0 +1,41 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var o = [6,7,8,9];
+
+function f(b) {
+ var v = o.pop() + b;
+ return v;
+}
+
+assertEquals(10, f(1));
+assertEquals(9, f(1));
+assertEquals(8, f(1));
+%OptimizeFunctionOnNextCall(f);
+assertEquals("61", f("1"));
diff --git a/src/v8/test/mjsunit/regress/regress-array-pop-nonconfigurable.js b/src/v8/test/mjsunit/regress/regress-array-pop-nonconfigurable.js
new file mode 100644
index 0000000..823bb6b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-array-pop-nonconfigurable.js
@@ -0,0 +1,30 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var a = [];
+Object.defineProperty(a, 0, {});
+assertThrows(function() { a.pop(); });
diff --git a/src/v8/test/mjsunit/regress/regress-assignment-in-test-context.js b/src/v8/test/mjsunit/regress/regress-assignment-in-test-context.js
new file mode 100644
index 0000000..61ca220
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-assignment-in-test-context.js
@@ -0,0 +1,19 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --always-opt --turbo-filter=*
+
+function assertEquals() {}
+
+function f(o) {
+ if (o.setterProperty = 0) {
+ return 1;
+ }
+ return 2;
+}
+
+function deopt() { %DeoptimizeFunction(f); }
+
+assertEquals(2,
+ f(Object.defineProperty({}, "setterProperty", { set: deopt })));
diff --git a/src/v8/test/mjsunit/regress/regress-bce-underflow.js b/src/v8/test/mjsunit/regress/regress-bce-underflow.js
new file mode 100644
index 0000000..daa7760
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-bce-underflow.js
@@ -0,0 +1,35 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f(a, i, bool) {
+ var result;
+ if (bool) {
+ // Make sure i - -0x80000000 doesn't overflow in BCE, missing a check for
+ // x-0 later on.
+ result = f2(a, 0x7fffffff, i, i, -0x80000000);
+ } else {
+ result = f2(a, -3, 4, i, 0);
+ }
+ return result;
+}
+
+function f2(a, c, x, i, d) {
+ return a[x + c] + a[x - 0] + a[i - d];
+}
+
+
+var a = [];
+var i = 0;
+a.push(i++);
+a.push(i++);
+a.push(i++);
+a.push(i++);
+a.push(i++);
+f(a, 0, false);
+f(a, 0, false);
+f(a, 0, false);
+%OptimizeFunctionOnNextCall(f);
+%DebugPrint(f(a, -0x7fffffff, true));
diff --git a/src/v8/test/mjsunit/regress/regress-bind-receiver.js b/src/v8/test/mjsunit/regress/regress-bind-receiver.js
new file mode 100644
index 0000000..fc83a4e
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-bind-receiver.js
@@ -0,0 +1,44 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function strict() { 'use strict'; return this; }
+function lenient() { return this; }
+var obj = {};
+
+assertEquals(true, strict.bind(true)());
+assertEquals(42, strict.bind(42)());
+assertEquals("", strict.bind("")());
+assertEquals(null, strict.bind(null)());
+assertEquals(undefined, strict.bind(undefined)());
+assertEquals(obj, strict.bind(obj)());
+
+assertEquals(true, lenient.bind(true)() instanceof Boolean);
+assertEquals(true, lenient.bind(42)() instanceof Number);
+assertEquals(true, lenient.bind("")() instanceof String);
+assertEquals(this, lenient.bind(null)());
+assertEquals(this, lenient.bind(undefined)());
+assertEquals(obj, lenient.bind(obj)());
diff --git a/src/v8/test/mjsunit/regress/regress-binop.js b/src/v8/test/mjsunit/regress/regress-binop.js
new file mode 100644
index 0000000..7a8b419
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-binop.js
@@ -0,0 +1,181 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// general tests
+var e31 = Math.pow(2, 31);
+
+assertEquals(-e31, -1*e31);
+assertEquals(e31, -1*e31*(-1));
+assertEquals(e31, -1*-e31);
+assertEquals(e31, -e31*(-1));
+
+var x = {toString : function() {return 1}}
+function add(a,b){return a+b;}
+add(1,x);
+add(1,x);
+%OptimizeFunctionOnNextCall(add);
+add(1,x);
+x.toString = function() {return "2"};
+
+assertEquals(add(1,x), "12");
+
+// Test the correct placement of the simulates in TruncateToNumber:
+function Checker() {
+ this.str = "1";
+ var toStringCalled = 0;
+ var toStringExpected = 0;
+ this.toString = function() {
+ toStringCalled++;
+ return this.str;
+ };
+ this.check = function() {
+ toStringExpected++;
+ assertEquals(toStringExpected, toStringCalled);
+ };
+};
+var left = new Checker();
+var right = new Checker();
+
+function test(fun,check_fun,a,b,does_throw) {
+ left.str = a;
+ right.str = b;
+ try {
+ assertEquals(check_fun(a,b), fun(left, right));
+ assertTrue(!does_throw);
+ } catch(e) {
+ if (e instanceof TypeError) {
+ assertTrue(!!does_throw);
+ } else {
+ throw e;
+ }
+ } finally {
+ left.check();
+ if (!does_throw || does_throw>1) {
+ right.check();
+ }
+ }
+}
+
+function minus(a,b) { return a-b };
+function check_minus(a,b) { return a-b };
+function mod(a,b) { return a%b };
+function check_mod(a,b) { return a%b };
+
+test(minus,check_minus,1,2);
+// Bailout on left
+test(minus,check_minus,1<<30,1);
+// Bailout on right
+test(minus,check_minus,1,1<<30);
+// Bailout on result
+test(minus,check_minus,1<<30,-(1<<30));
+
+// Some more interesting things
+test(minus,check_minus,1,1.4);
+test(minus,check_minus,1.3,4);
+test(minus,check_minus,1.3,1.4);
+test(minus,check_minus,1,2);
+test(minus,check_minus,1,undefined);
+test(minus,check_minus,1,2);
+test(minus,check_minus,1,true);
+test(minus,check_minus,1,2);
+test(minus,check_minus,1,null);
+test(minus,check_minus,1,2);
+test(minus,check_minus,1,"");
+test(minus,check_minus,1,2);
+
+// Throw on left
+test(minus,check_minus,{},1,1);
+// Throw on right
+test(minus,check_minus,1,{},2);
+// Throw both
+test(minus,check_minus,{},{},1);
+
+test(minus,check_minus,1,2);
+
+// Now with optimized code
+test(mod,check_mod,1,2);
+%OptimizeFunctionOnNextCall(mod);
+test(mod,check_mod,1,2);
+
+test(mod,check_mod,1<<30,1);
+%OptimizeFunctionOnNextCall(mod);
+test(mod,check_mod,1<<30,1);
+test(mod,check_mod,1,1<<30);
+%OptimizeFunctionOnNextCall(mod);
+test(mod,check_mod,1,1<<30);
+test(mod,check_mod,1<<30,-(1<<30));
+%OptimizeFunctionOnNextCall(mod);
+test(mod,check_mod,1<<30,-(1<<30));
+
+test(mod,check_mod,1,{},2);
+%OptimizeFunctionOnNextCall(mod);
+test(mod,check_mod,1,{},2);
+
+test(mod,check_mod,1,2);
+
+
+// test oddballs
+function t1(a, b) {return a-b}
+assertEquals(t1(1,2), 1-2);
+assertEquals(t1(2,true), 2-1);
+assertEquals(t1(false,2), 0-2);
+assertEquals(t1(1,2.4), 1-2.4);
+assertEquals(t1(1.3,2.4), 1.3-2.4);
+assertEquals(t1(true,2.4), 1-2.4);
+assertEquals(t1(1,undefined), 1-NaN);
+assertEquals(t1(1,1<<30), 1-(1<<30));
+assertEquals(t1(1,2), 1-2);
+
+function t2(a, b) {return a/b}
+assertEquals(t2(1,2), 1/2);
+assertEquals(t2(null,2), 0/2);
+assertEquals(t2(null,-2), 0/-2);
+assertEquals(t2(2,null), 2/0);
+assertEquals(t2(-2,null), -2/0);
+assertEquals(t2(1,2.4), 1/2.4);
+assertEquals(t2(1.3,2.4), 1.3/2.4);
+assertEquals(t2(null,2.4), 0/2.4);
+assertEquals(t2(1.3,null), 1.3/0);
+assertEquals(t2(undefined,2), NaN/2);
+assertEquals(t2(1,1<<30), 1/(1<<30));
+assertEquals(t2(1,2), 1/2);
+
+
+// Assert that the hole is not truncated to nan for string add.
+function string_add(a,i) {
+ var d = [0.1, ,0.3];
+ return a + d[i];
+}
+
+string_add(1.1, 0);
+string_add("", 0);
+%OptimizeFunctionOnNextCall(string_add);
+string_add(1.1, 0);
+// There comes the hole
+assertEquals("undefined", string_add("", 1));
diff --git a/src/v8/test/mjsunit/regress/regress-builtin-array-op.js b/src/v8/test/mjsunit/regress/regress-builtin-array-op.js
new file mode 100644
index 0000000..ea5891f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-builtin-array-op.js
@@ -0,0 +1,37 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test that we invoke the correct sort function in
+// array operations.
+
+var foo = "hest";
+Array.prototype.sort = function(fn) { foo = "fisk"; };
+Function.prototype.call = function() { foo = "caramel"; };
+var a = [2,3,1];
+a[100000] = 0;
+a.join();
+assertEquals("hest", foo);
diff --git a/src/v8/test/mjsunit/regress/regress-builtinbust-1.js b/src/v8/test/mjsunit/regress/regress-builtinbust-1.js
new file mode 100644
index 0000000..33a7563
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-builtinbust-1.js
@@ -0,0 +1,14 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function nope() { return false; }
+var a = [ 1, 2, 3 ];
+Object.seal(a);
+Object.isSealed = nope;
+
+assertThrows(function() { a.pop(); }, TypeError);
+assertThrows(function() { a.push(5); }, TypeError);
+assertThrows(function() { a.shift(); }, TypeError);
+assertThrows(function() { a.unshift(5); }, TypeError);
+assertThrows(function() { a.splice(0, 1); }, TypeError);
diff --git a/src/v8/test/mjsunit/regress/regress-builtinbust-3.js b/src/v8/test/mjsunit/regress/regress-builtinbust-3.js
new file mode 100644
index 0000000..f5a0c39
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-builtinbust-3.js
@@ -0,0 +1,15 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function produce_object() {
+ var real_length = 1;
+ function set_length() { real_length = "boom"; }
+ function get_length() { return real_length; }
+ var o = { __proto__:Array.prototype , 0:"x" };
+ Object.defineProperty(o, "length", { set:set_length, get:get_length })
+ return o;
+}
+
+assertEquals(2, produce_object().push("y"));
+assertEquals(2, produce_object().unshift("y"));
diff --git a/src/v8/test/mjsunit/regress/regress-builtinbust-4.js b/src/v8/test/mjsunit/regress/regress-builtinbust-4.js
new file mode 100644
index 0000000..dbaa245
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-builtinbust-4.js
@@ -0,0 +1,16 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var o = { __proto__:Array.prototype, 0:"x" };
+function boomer() { return 0; }
+Object.defineProperty(o, "length", { get:boomer, set:boomer });
+Object.seal(o);
+
+assertDoesNotThrow(function() { o.push(1); });
+assertEquals(0, o.length);
+assertEquals(1, o[0]);
+
+assertDoesNotThrow(function() { o.unshift(2); });
+assertEquals(0, o.length);
+assertEquals(2, o[0]);
diff --git a/src/v8/test/mjsunit/regress/regress-builtinbust-5.js b/src/v8/test/mjsunit/regress/regress-builtinbust-5.js
new file mode 100644
index 0000000..266e4d4
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-builtinbust-5.js
@@ -0,0 +1,13 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var a = [ 1, 2, 3 ];
+var was_called = false;
+function poison() { was_called = true; }
+a.hasOwnProperty = poison;
+Object.freeze(a);
+
+assertThrows("a.unshift()", TypeError);
+assertEquals(3, a.length);
+assertFalse(was_called);
diff --git a/src/v8/test/mjsunit/regress/regress-builtinbust-6.js b/src/v8/test/mjsunit/regress/regress-builtinbust-6.js
new file mode 100644
index 0000000..d926bd0
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-builtinbust-6.js
@@ -0,0 +1,40 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Test that Array builtins can be called on primitive values.
+var values = [ 23, 4.2, true, false, 0/0 ];
+for (var i = 0; i < values.length; ++i) {
+ var v = values[i];
+ Array.prototype.join.call(v);
+ Array.prototype.pop.call(v);
+ Array.prototype.push.call(v);
+ Array.prototype.reverse.call(v);
+ Array.prototype.shift.call(v);
+ Array.prototype.slice.call(v);
+ Array.prototype.splice.call(v);
+ Array.prototype.unshift.call(v);
+}
+
+// Test that ToObject on primitive values is only called once.
+var length_receiver, element_receiver;
+function length() { length_receiver = this; return 2; }
+function element() { element_receiver = this; return "x"; }
+Object.defineProperty(Number.prototype, "length", { get:length, set:length });
+Object.defineProperty(Number.prototype, "0", { get:element, set:element });
+Object.defineProperty(Number.prototype, "1", { get:element, set:element });
+Object.defineProperty(Number.prototype, "2", { get:element, set:element });
+function test_receiver(expected, call_string) {
+ assertDoesNotThrow(call_string);
+ assertEquals(new Number(expected), length_receiver);
+ assertSame(length_receiver, element_receiver);
+}
+
+test_receiver(11, "Array.prototype.join.call(11)")
+test_receiver(23, "Array.prototype.pop.call(23)");
+test_receiver(42, "Array.prototype.push.call(42, 'y')");
+test_receiver(49, "Array.prototype.reverse.call(49)");
+test_receiver(65, "Array.prototype.shift.call(65)");
+test_receiver(77, "Array.prototype.slice.call(77, 1)");
+test_receiver(88, "Array.prototype.splice.call(88, 1, 1)");
+test_receiver(99, "Array.prototype.unshift.call(99, 'z')");
diff --git a/src/v8/test/mjsunit/regress/regress-builtinbust-7.js b/src/v8/test/mjsunit/regress/regress-builtinbust-7.js
new file mode 100644
index 0000000..8581eea
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-builtinbust-7.js
@@ -0,0 +1,32 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+if ("Intl" in this) {
+ function overflow() {
+ return overflow() + 1;
+ }
+ Object.defineProperty = overflow;
+ assertDoesNotThrow(function() { Intl.Collator.supportedLocalesOf("en"); });
+
+ var date = new Date(Date.UTC(2004, 12, 25, 3, 0, 0));
+ var options = {
+ weekday: "long",
+ year: "numeric",
+ month: "long",
+ day: "numeric"
+ };
+
+ Object.apply = overflow;
+ assertDoesNotThrow(function() { date.toLocaleDateString("de-DE", options); });
+
+ var options_incomplete = {};
+ assertDoesNotThrow(function() {
+ date.toLocaleDateString("de-DE", options_incomplete);
+ });
+ assertFalse(options_incomplete.hasOwnProperty("year"));
+
+ assertDoesNotThrow(function() { date.toLocaleDateString("de-DE", undefined); });
+ assertDoesNotThrow(function() { date.toLocaleDateString("de-DE"); });
+ assertThrows(function() { date.toLocaleDateString("de-DE", null); }, TypeError);
+}
diff --git a/src/v8/test/mjsunit/regress/regress-calls-with-migrating-prototypes.js b/src/v8/test/mjsunit/regress/regress-calls-with-migrating-prototypes.js
new file mode 100644
index 0000000..a306e5d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-calls-with-migrating-prototypes.js
@@ -0,0 +1,49 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function f() {
+ return 1;
+}
+function C1(f) {
+ this.f = f;
+}
+var o1 = new C1(f);
+var o2 = {__proto__: new C1(f) }
+function foo(o) {
+ return o.f();
+}
+foo(o1);
+foo(o1);
+foo(o2);
+foo(o1);
+var o3 = new C1(function() { return 2; });
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(1, foo(o2));
+o2.__proto__.f = function() { return 3; };
+assertEquals(3, foo(o2));
diff --git a/src/v8/test/mjsunit/regress/regress-captured-object-no-dummy-use.js b/src/v8/test/mjsunit/regress/regress-captured-object-no-dummy-use.js
new file mode 100644
index 0000000..cdf548d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-captured-object-no-dummy-use.js
@@ -0,0 +1,18 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax
+
+var global = "10.1";
+function f() { }
+function g(a) { this.d = a; }
+function h() {
+ var x = new f();
+ global.dummy = this;
+ var y = new g(x);
+}
+h();
+h();
+%OptimizeFunctionOnNextCall(h);
+h();
diff --git a/src/v8/test/mjsunit/regress/regress-check-eliminate-loop-phis.js b/src/v8/test/mjsunit/regress/regress-check-eliminate-loop-phis.js
new file mode 100644
index 0000000..3791c35
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-check-eliminate-loop-phis.js
@@ -0,0 +1,21 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f() {
+ var o = {x:1};
+ var y = {y:2.5, x:0};
+ var result;
+ for (var i = 0; i < 2; i++) {
+ result = o.x + 3;
+ o = y;
+ }
+ return result;
+}
+
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+assertEquals(3, f());
diff --git a/src/v8/test/mjsunit/regress/regress-clobbered-fp-regs.js b/src/v8/test/mjsunit/regress/regress-clobbered-fp-regs.js
new file mode 100644
index 0000000..7795ae9
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-clobbered-fp-regs.js
@@ -0,0 +1,54 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+//
+// Flags: --allow-natives-syntax
+
+function store(a, x, y) {
+ var f1 = 0.1 * y;
+ var f2 = 0.2 * y;
+ var f3 = 0.3 * y;
+ var f4 = 0.4 * y;
+ var f5 = 0.5 * y;
+ var f6 = 0.6 * y;
+ var f7 = 0.7 * y;
+ var f8 = 0.8 * y;
+ a[0] = x;
+ var sum = (f1 + f2 + f3 + f4 + f5 + f6 + f7 + f8);
+ assertEquals(1, y);
+ var expected = 3.6;
+ if (Math.abs(expected - sum) > 0.01) {
+ assertEquals(expected, sum);
+ }
+}
+
+// Generate TransitionElementsKindStub.
+store([1], 1, 1);
+store([1], 1.1, 1);
+store([1], 1.1, 1);
+%OptimizeFunctionOnNextCall(store);
+// This will trap on allocation site in TransitionElementsKindStub.
+store([1], 1, 1)
diff --git a/src/v8/test/mjsunit/regress/regress-cnlt-elements.js b/src/v8/test/mjsunit/regress/regress-cnlt-elements.js
new file mode 100644
index 0000000..634534c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-cnlt-elements.js
@@ -0,0 +1,43 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-gc
+
+var a = JSON.parse('{"b":1,"c":2,"d":3,"e":4}');
+var b = JSON.parse('{"12040200":1, "a":2, "b":2}');
+var c = JSON.parse('{"24050300":1}');
+b = null;
+gc();
+gc();
+c.a1 = 2;
+c.a2 = 2;
+c.a3 = 2;
+c.a4 = 2;
+c.a5 = 2;
+c.a6 = 2;
+c.a7 = 2;
+c.a8 = 2;
diff --git a/src/v8/test/mjsunit/regress/regress-cnlt-enum-indices.js b/src/v8/test/mjsunit/regress/regress-cnlt-enum-indices.js
new file mode 100644
index 0000000..03582bb
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-cnlt-enum-indices.js
@@ -0,0 +1,45 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax --expose-gc
+
+var o = {};
+var o2 = {};
+
+o.a = 1;
+o2.a = 1;
+function f() { return 10; }
+// Adds a non-field enumerable property.
+Object.defineProperty(o, "b", { get: f, enumerable: true });
+Object.defineProperty(o2, "b", { get: f, enumerable: true });
+assertTrue(%HaveSameMap(o, o2));
+o.c = 2;
+
+for (var x in o) { }
+o = null;
+
+gc();
diff --git a/src/v8/test/mjsunit/regress/regress-cntl-descriptors-enum.js b/src/v8/test/mjsunit/regress/regress-cntl-descriptors-enum.js
new file mode 100644
index 0000000..fd4ac6d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-cntl-descriptors-enum.js
@@ -0,0 +1,46 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax --expose-gc
+
+DontEnum = 2;
+
+var o = {};
+%AddNamedProperty(o, "a", 0, DontEnum);
+
+var o2 = {};
+%AddNamedProperty(o2, "a", 0, DontEnum);
+
+assertTrue(%HaveSameMap(o, o2));
+
+o.y = 2;
+
+for (var v in o) { print(v); }
+o = {};
+gc();
+
+for (var v in o2) { print(v); }
diff --git a/src/v8/test/mjsunit/regress/regress-compare-constant-doubles.js b/src/v8/test/mjsunit/regress/regress-compare-constant-doubles.js
new file mode 100644
index 0000000..0f8ffe3
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-compare-constant-doubles.js
@@ -0,0 +1,58 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var left = 1.5;
+var right;
+
+var keepalive;
+
+function foo() {
+ // Fill XMM registers with cruft.
+ var a1 = Math.sin(1) + 10;
+ var a2 = a1 + 1;
+ var a3 = a2 + 1;
+ var a4 = a3 + 1;
+ var a5 = a4 + 1;
+ var a6 = a5 + 1;
+ keepalive = [a1, a2, a3, a4, a5, a6];
+
+ // Actual test.
+ if (left < right) return "ok";
+ return "bad";
+}
+
+function prepare(base) {
+ right = 0.5 * base;
+}
+
+prepare(21);
+assertEquals("ok", foo());
+assertEquals("ok", foo());
+%OptimizeFunctionOnNextCall(foo);
+assertEquals("ok", foo());
diff --git a/src/v8/test/mjsunit/regress/regress-conditional-position.js b/src/v8/test/mjsunit/regress/regress-conditional-position.js
new file mode 100644
index 0000000..c9badd6
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-conditional-position.js
@@ -0,0 +1,95 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --noopt
+
+var functionToCatch;
+var lineNumber;
+
+function catchLineNumber () {
+ var x = {};
+
+ Error.prepareStackTrace = function (error, stackTrace) {
+ stackTrace.some(function (frame) {
+ if (frame.getFunction() == functionToCatch) {
+ lineNumber = frame.getLineNumber();
+ return true;
+ }
+ return false;
+ });
+ return lineNumber;
+ };
+
+ Error.captureStackTrace(x);
+ return x.stack;
+}
+
+function log() {
+ catchLineNumber();
+}
+
+function foo() {}
+
+function test1() {
+ log(foo() == foo()
+ ? 'a'
+ : 'b');
+}
+
+function test2() {
+ var o = { foo: function () {}}
+ log(o.foo() == o.foo()
+ ? 'a'
+ : 'b');
+}
+
+function test3() {
+ var o = { log: log, foo: function() { } };
+ o.log(o.foo() == o.foo()
+ ? 'a'
+ : 'b');
+
+}
+
+function test(f, expectedLineNumber) {
+ functionToCatch = f;
+ f();
+
+ assertEquals(expectedLineNumber, lineNumber);
+}
+
+test(test1, 58);
+test(test2, 65);
+test(test3, 72);
+
+eval(test1.toString() + "//@ sourceUrl=foo");
+eval(test2.toString() + "//@ sourceUrl=foo");
+eval(test3.toString() + "//@ sourceUrl=foo");
+
+test(test1, 2);
+test(test2, 3);
+test(test3, 3);
diff --git a/src/v8/test/mjsunit/regress/regress-context-osr.js b/src/v8/test/mjsunit/regress/regress-context-osr.js
new file mode 100644
index 0000000..b74907d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-context-osr.js
@@ -0,0 +1,39 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+"use strict";
+function f() {
+ try { } catch (e) { }
+}
+
+for (this.x = 0; this.x < 1; ++this.x) {
+ for (this.y = 0; this.y < 1; ++this.y) {
+ for (this.ll = 0; this.ll < 70670; ++this.ll) {
+ f();
+ }
+ }
+}
diff --git a/src/v8/test/mjsunit/regress/regress-convert-enum.js b/src/v8/test/mjsunit/regress/regress-convert-enum.js
new file mode 100644
index 0000000..c624cad
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-convert-enum.js
@@ -0,0 +1,60 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-gc
+
+// Create a transition tree A (no descriptors) -> B (descriptor for a) -> C
+// (descriptor for a and c), that all share the descriptor array [a,c]. C is the
+// owner of the descriptor array.
+var o = {};
+o.a = 1;
+o.c = 2;
+
+// Add a transition B -> D where D has its own descriptor array [a,b] where b is
+// a constant function.
+var o1 = {};
+o1.a = 1;
+
+// Install an enumeration cache in the descriptor array [a,c] at map B.
+for (var x in o1) { }
+o1.b = function() { return 1; };
+
+// Return ownership of the descriptor array [a,c] to B and trim it to [a].
+o = null;
+gc();
+
+// Convert the transition B -> D into a transition to B -> E so that E uses the
+// instance descriptors [a,b] with b being a field.
+var o2 = {};
+o2.a = 1;
+o2.b = 10;
+
+// Create an object with map B and iterate over it.
+var o3 = {};
+o3.a = 1;
+
+for (var y in o3) { }
diff --git a/src/v8/test/mjsunit/regress/regress-convert-enum2.js b/src/v8/test/mjsunit/regress/regress-convert-enum2.js
new file mode 100644
index 0000000..cdc7fbe
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-convert-enum2.js
@@ -0,0 +1,46 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var o = {};
+o.a = 1;
+o.b = function() { return 1; };
+o.d = 2;
+
+for (var x in o) { }
+
+var o1 = {};
+o1.a = 1;
+o1.b = 10;
+o1.c = 20;
+
+var keys = ["a", "b", "c"];
+
+var i = 0;
+for (var y in o1) {
+ assertEquals(keys[i], y);
+ i += 1;
+}
diff --git a/src/v8/test/mjsunit/regress/regress-convert-function-to-double.js b/src/v8/test/mjsunit/regress/regress-convert-function-to-double.js
new file mode 100644
index 0000000..fca44f9
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-convert-function-to-double.js
@@ -0,0 +1,36 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function f(v) {
+ this.func = v;
+}
+
+var o1 = new f(f);
+var d = 1.4;
+var o2 = new f(d);
+o2.func = 1.8;
+assertEquals(1.4, d)
diff --git a/src/v8/test/mjsunit/regress/regress-convert-hole.js b/src/v8/test/mjsunit/regress/regress-convert-hole.js
new file mode 100644
index 0000000..1e9c3f3
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-convert-hole.js
@@ -0,0 +1,109 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function f_store(test, test2, a, i) {
+ var o = [0.5,1,,3];
+ var d;
+ if (test) {
+ d = 1.5;
+ } else {
+ d = o[i];
+ }
+ if (test2) {
+ d += 1;
+ }
+ a[i] = d;
+ return d;
+}
+
+var a1 = [0, 0, 0, {}];
+f_store(true, false, a1, 0);
+f_store(true, true, a1, 0);
+f_store(false, false, a1, 1);
+f_store(false, true, a1, 1);
+%OptimizeFunctionOnNextCall(f_store);
+f_store(false, false, a1, 2);
+assertEquals(undefined, a1[2]);
+
+function test_arg(expected) {
+ return function(v) {
+ assertEquals(expected, v);
+ }
+}
+
+function f_call(f, test, test2, i) {
+ var o = [0.5,1,,3];
+ var d;
+ if (test) {
+ d = 1.5;
+ } else {
+ d = o[i];
+ }
+ if (test2) {
+ d += 1;
+ }
+ f(d);
+ return d;
+}
+
+f_call(test_arg(1.5), true, false, 0);
+f_call(test_arg(2.5), true, true, 0);
+f_call(test_arg(1), false, false, 1);
+f_call(test_arg(2), false, true, 1);
+%OptimizeFunctionOnNextCall(f_call);
+f_call(test_arg(undefined), false, false, 2);
+
+
+function f_external(test, test2, test3, a, i) {
+ var o = [0.5,1,,3];
+ var d;
+ if (test) {
+ d = 1.5;
+ } else {
+ d = o[i];
+ }
+ if (test2) {
+ d += 1;
+ }
+ if (test3) {
+ d = d|0;
+ }
+ a[d] = 1;
+ assertEquals(1, a[d]);
+ return d;
+}
+
+var a2 = new Int32Array(10);
+f_external(true, false, true, a2, 0);
+f_external(true, true, true, a2, 0);
+f_external(false, false, true, a2, 1);
+f_external(false, true, true, a2, 1);
+%OptimizeFunctionOnNextCall(f_external);
+f_external(false, false, false, a2, 2);
+assertEquals(1, a2[undefined]);
diff --git a/src/v8/test/mjsunit/regress/regress-convert-hole2.js b/src/v8/test/mjsunit/regress/regress-convert-hole2.js
new file mode 100644
index 0000000..02ef4dd
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-convert-hole2.js
@@ -0,0 +1,86 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+// Flags: --allow-natives-syntax
+
+// Test adding undefined from hole in double-holey to string.
+var a = [1.5, , 1.8];
+
+function f(a, i, l) {
+ var v = a[i];
+ return l + v;
+}
+
+assertEquals("test1.5", f(a, 0, "test"));
+assertEquals("test1.5", f(a, 0, "test"));
+%OptimizeFunctionOnNextCall(f);
+assertEquals("testundefined", f(a, 1, "test"));
+
+// Test double-hole going through a phi to a string-add.
+function f2(b, a1, a2) {
+ var v;
+ if (b) {
+ v = a1[0];
+ } else {
+ v = a2[0];
+ }
+ x = v * 2;
+ return "test" + v + x;
+}
+
+f2(true, [1.4,1.8,,1.9], [1.4,1.8,,1.9]);
+f2(true, [1.4,1.8,,1.9], [1.4,1.8,,1.9]);
+f2(false, [1.4,1.8,,1.9], [1.4,1.8,,1.9]);
+f2(false, [1.4,1.8,,1.9], [1.4,1.8,,1.9]);
+%OptimizeFunctionOnNextCall(f2);
+assertEquals("testundefinedNaN", f2(false, [,1.8,,1.9], [,1.9,,1.9]));
+
+// Test converting smi-hole to double-hole.
+function t_smi(a) {
+ a[0] = 1.5;
+}
+
+t_smi([1,,3]);
+t_smi([1,,3]);
+t_smi([1,,3]);
+%OptimizeFunctionOnNextCall(t_smi);
+var ta = [1,,3];
+t_smi(ta);
+ta.__proto__ = [6,6,6];
+assertEquals([1.5,6,3], ta);
+
+// Test converting double-hole to tagged-hole.
+function t(b) {
+ b[1] = {};
+}
+
+t([1.4, 1.6,,1.8, NaN]);
+t([1.4, 1.6,,1.8, NaN]);
+%OptimizeFunctionOnNextCall(t);
+var a = [1.6, 1.8,,1.9, NaN];
+t(a);
+a.__proto__ = [6,6,6,6,6];
+assertEquals([1.6, {}, 6, 1.9, NaN], a);
diff --git a/src/v8/test/mjsunit/regress/regress-convert-transition.js b/src/v8/test/mjsunit/regress/regress-convert-transition.js
new file mode 100644
index 0000000..057dc80
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-convert-transition.js
@@ -0,0 +1,40 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var input = '{ "a1":1, "a2":1, "a3":1, "a4":1, "a5":1, "a6":1, "a7":1,\
+ "a8":1, "a9":1, "a10":1, "a11":1, "a12":1, "a13":1}';
+var a = JSON.parse(input);
+a.a = function() { return 10; };
+
+// Force conversion of field to slow mode.
+var b = JSON.parse(input);
+b.a = 10;
+
+// Add another property to the object that would transition to a.
+var c = JSON.parse(input);
+c.x = 10;
+assertEquals(undefined, c.a);
diff --git a/src/v8/test/mjsunit/regress/regress-copy-hole-to-field.js b/src/v8/test/mjsunit/regress/regress-copy-hole-to-field.js
new file mode 100644
index 0000000..fa3db92
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-copy-hole-to-field.js
@@ -0,0 +1,57 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// Copy a hole from HOLEY_DOUBLE to double field.
+var a = [1.5,,1.7];
+var o = {a:1.8};
+
+function f1(o,a,i) {
+ o.a = a[i];
+}
+
+f1(o,a,0);
+f1(o,a,0);
+assertEquals(1.5, o.a);
+%OptimizeFunctionOnNextCall(f1);
+f1(o,a,1);
+assertEquals(undefined, o.a);
+
+// Copy a hole from HOLEY_SMI to smi field.
+var a = [1,,3];
+var o = {ab:5};
+
+function f2(o,a,i) {
+ o.ab = a[i];
+}
+
+f2(o,a,0);
+f2(o,a,0);
+%OptimizeFunctionOnNextCall(f2);
+f2(o,a,1);
+assertEquals(undefined, o.ab);
diff --git a/src/v8/test/mjsunit/regress/regress-cr-344285.js b/src/v8/test/mjsunit/regress/regress-cr-344285.js
new file mode 100644
index 0000000..42e8bd1
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-cr-344285.js
@@ -0,0 +1,37 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function __f_1(g) { return (g/-1) ^ 1; }
+var __v_0 = 1 << 31;
+var __v_2 = __f_1(__v_0);
+caught = false;
+try {
+ Realm.eval(__v_2, "Realm.global(0).y = 1");
+} catch (e) {
+ caught = true;
+}
+assertTrue(caught, "exception not caught");
diff --git a/src/v8/test/mjsunit/regress/regress-cr-658267.js b/src/v8/test/mjsunit/regress/regress-cr-658267.js
new file mode 100644
index 0000000..9caada7
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-cr-658267.js
@@ -0,0 +1,5 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertThrows("class D extends async() =>", SyntaxError);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-100859.js b/src/v8/test/mjsunit/regress/regress-crbug-100859.js
new file mode 100644
index 0000000..6824426
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-100859.js
@@ -0,0 +1,39 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// This used to trigger a crash because of an unhandled stack overflow.
+function setx() {
+ setx(typeof new Uint16Array('x') === 'object');
+}
+var exception = false;
+try {
+ setx();
+} catch (ex) {
+ assertTrue(ex instanceof RangeError);
+ exception = true;
+}
+assertTrue(exception);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-109362.js b/src/v8/test/mjsunit/regress/regress-crbug-109362.js
new file mode 100644
index 0000000..20285f6
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-109362.js
@@ -0,0 +1,59 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+
+function test(expectation, f) {
+ var stack;
+ try {
+ f();
+ } catch (e) {
+ stack = e.stack;
+ }
+ assertTrue(stack.indexOf("at eval (evaltest:" + expectation + ")") > 0);
+}
+
+/*
+(function() {
+1 + reference_error //@ sourceURL=evaltest
+})
+*/
+test("2:5", new Function(
+ '1 + reference_error //@ sourceURL=evaltest'));
+/*
+(function(x
+/\**\/) {
+
+ 1 + reference_error //@ sourceURL=evaltest
+})
+*/
+test("4:6", new Function(
+ 'x', '\n 1 + reference_error //@ sourceURL=evaltest'));
+/*
+(function(x
+
+,z//
+,y
+/\**\/) {
+
+ 1 + reference_error //@ sourceURL=evaltest
+})
+*/
+test("7:6", new Function(
+ 'x\n\n', "z//\n", "y", '\n 1 + reference_error //@ sourceURL=evaltest'));
+/*
+(function(x/\*,z//
+,y*\/
+/\**\/) {
+1 + reference_error //@ sourceURL=evaltest
+})
+*/
+test("4:5", new Function(
+ 'x/*', "z//\n", "y*/", '1 + reference_error //@ sourceURL=evaltest'));
+/*
+(function () {
+ 1 + reference_error //@ sourceURL=evaltest5
+})
+*/
+test("2:6", eval(
+ '(function () {\n 1 + reference_error //@ sourceURL=evaltest\n})'));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-119926.js b/src/v8/test/mjsunit/regress/regress-crbug-119926.js
new file mode 100644
index 0000000..1ad250a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-119926.js
@@ -0,0 +1,35 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --gc-global
+
+// Test that array elements don't break upon garbage collection.
+
+var a = new Array(500);
+for (var i = 0; i < 100000; i++) {
+ a[i] = new Object();
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-122271.js b/src/v8/test/mjsunit/regress/regress-crbug-122271.js
new file mode 100644
index 0000000..8fb9923
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-122271.js
@@ -0,0 +1,49 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// Tests that ElementsKind transitions and regular transitions don't
+// interfere badly with each other.
+
+var a = [0, 0, 0, 1];
+var b = [0, 0, 0, "one"];
+var c = [0, 0, 0, 1];
+c.foo = "baz";
+
+function foo(array) {
+ array.foo = "bar";
+}
+
+assertTrue(%HasSmiElements(a));
+assertTrue(%HasObjectElements(b));
+
+foo(a);
+foo(b);
+
+assertTrue(%HasSmiElements(a));
+assertTrue(%HasObjectElements(b));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-125148.js b/src/v8/test/mjsunit/regress/regress-crbug-125148.js
new file mode 100644
index 0000000..0f7bcd8
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-125148.js
@@ -0,0 +1,90 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function ToDictionaryMode(x) {
+ %OptimizeObjectForAddingMultipleProperties(x, 100);
+}
+
+var A, B, C;
+
+// The initial bug report was about calling a know function...
+A = {};
+Object.defineProperty(A, "foo", { value: function() { assertUnreachable(); }});
+
+B = Object.create(A);
+Object.defineProperty(B, "foo", { value: function() { return 111; }});
+
+C = Object.create(B);
+
+function bar(x) { return x.foo(); }
+
+assertEquals(111, bar(C));
+assertEquals(111, bar(C));
+ToDictionaryMode(B);
+%OptimizeFunctionOnNextCall(bar);
+assertEquals(111, bar(C));
+
+// Although this was not in the initial bug report: The same for getters...
+A = {};
+Object.defineProperty(A, "baz", { get: function() { assertUnreachable(); }});
+
+B = Object.create(A);
+Object.defineProperty(B, "baz", { get: function() { return 111; }});
+
+C = Object.create(B);
+
+function boo(x) { return x.baz; }
+
+assertEquals(111, boo(C));
+assertEquals(111, boo(C));
+ToDictionaryMode(B);
+%OptimizeFunctionOnNextCall(boo);
+assertEquals(111, boo(C));
+
+// And once more for setters...
+A = {};
+Object.defineProperty(A, "huh", { set: function(x) { assertUnreachable(); }});
+
+B = Object.create(A);
+var setterValue;
+Object.defineProperty(B, "huh", { set: function(x) { setterValue = x; }});
+
+C = Object.create(B);
+
+function fuu(x) {
+ setterValue = 222;
+ x.huh = 111;
+ return setterValue;
+}
+
+assertEquals(111, fuu(C));
+assertEquals(111, fuu(C));
+ToDictionaryMode(B);
+%OptimizeFunctionOnNextCall(fuu);
+assertEquals(111, fuu(C));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-126414.js b/src/v8/test/mjsunit/regress/regress-crbug-126414.js
new file mode 100644
index 0000000..6674267
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-126414.js
@@ -0,0 +1,32 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function foo(bar) {
+ return arguments[bar];
+}
+foo(0); // Handled in runtime.
+foo(-536870912); // Triggers bug.
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-134055.js b/src/v8/test/mjsunit/regress/regress-crbug-134055.js
new file mode 100644
index 0000000..9b658fb
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-134055.js
@@ -0,0 +1,63 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function crash(obj) {
+ return obj.foo;
+}
+
+function base(number_of_properties) {
+ var result = new Array();
+ for (var i = 0; i < number_of_properties; i++) {
+ result["property" + i] = "value" + i;
+ }
+ result.foo = number_of_properties;
+ return result;
+}
+
+var a = base(12);
+var b = base(13);
+var c = base(14);
+var d = base(15);
+
+crash(a); // Premonomorphic.
+crash(a);
+crash(b);
+crash(c);
+crash(d); // Polymorphic, degree 4.
+
+//Prepare ElementsKind transition map chain.
+var x = base(13);
+x[0] = "object";
+x = base(14);
+x[0] = "object";
+x = base(15);
+x[0] = "object";
+
+%OptimizeFunctionOnNextCall(crash);
+crash(a);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-134609.js b/src/v8/test/mjsunit/regress/regress-crbug-134609.js
new file mode 100644
index 0000000..da7d85d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-134609.js
@@ -0,0 +1,59 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax --inline-accessors
+
+var forceDeopt = {x:0};
+
+var objectWithGetterProperty = (function (value) {
+ var obj = {};
+ Object.defineProperty(obj, "getterProperty", {
+ get: function foo() {
+ forceDeopt.x;
+ return value;
+ },
+ });
+ return obj;
+})("bad");
+
+function test() {
+ var iAmContextAllocated = "good";
+ objectWithGetterProperty.getterProperty;
+ return iAmContextAllocated;
+
+ // Make sure that the local variable is context allocated.
+ function unused() { iAmContextAllocated; }
+}
+
+assertEquals("good", test());
+assertEquals("good", test());
+%OptimizeFunctionOnNextCall(test);
+assertEquals("good", test());
+
+// At this point, foo should have been inlined into test. Let's deopt...
+delete forceDeopt.x;
+assertEquals("good", test());
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-135008.js b/src/v8/test/mjsunit/regress/regress-crbug-135008.js
new file mode 100644
index 0000000..2be396e
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-135008.js
@@ -0,0 +1,45 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Filler long enough to trigger lazy parsing.
+var filler = "//" + new Array(1024).join('x');
+
+var scope = { x:23 };
+
+with(scope) {
+ eval(
+ "scope.f = (function outer() {" +
+ " function inner() {" +
+ " return x;" +
+ " }" +
+ " return inner;" +
+ "})();" +
+ filler
+ );
+};
+
+assertSame(23, scope.f());
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-135066.js b/src/v8/test/mjsunit/regress/regress-crbug-135066.js
new file mode 100644
index 0000000..35e9ff8
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-135066.js
@@ -0,0 +1,55 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Filler long enough to trigger lazy parsing.
+var filler = "//" + new Array(1024).join('x');
+
+// Test strict eval in global context.
+assertEquals(23, eval(
+ "'use strict';" +
+ "var x = 23;" +
+ "var f = function bozo1() {" +
+ " return x;" +
+ "};" +
+ "assertSame(23, f());" +
+ "f;" +
+ filler
+)());
+
+// Test default eval in strict context.
+assertEquals(42, (function() {
+ "use strict";
+ return eval(
+ "var y = 42;" +
+ "var g = function bozo2() {" +
+ " return y;" +
+ "};" +
+ "assertSame(42, g());" +
+ "g;" +
+ filler
+ )();
+})());
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-137689.js b/src/v8/test/mjsunit/regress/regress-crbug-137689.js
new file mode 100644
index 0000000..ef79d24
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-137689.js
@@ -0,0 +1,47 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function getter() { return 10; }
+function setter(v) { }
+function getter2() { return 20; }
+
+var o = {};
+var o2 = {};
+
+Object.defineProperty(o, "foo", { get: getter, configurable: true });
+Object.defineProperty(o2, "foo", { get: getter, configurable: true });
+assertTrue(%HaveSameMap(o, o2));
+
+Object.defineProperty(o, "bar", { get: getter2 });
+Object.defineProperty(o2, "bar", { get: getter2 });
+assertTrue(%HaveSameMap(o, o2));
+
+Object.defineProperty(o, "foo", { set: setter, configurable: true });
+Object.defineProperty(o2, "foo", { set: setter, configurable: true });
+assertTrue(%HaveSameMap(o, o2));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-138887.js b/src/v8/test/mjsunit/regress/regress-crbug-138887.js
new file mode 100644
index 0000000..8d8e169
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-138887.js
@@ -0,0 +1,48 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function worker1(ignored) {
+ return 100;
+}
+
+function factory(worker) {
+ return function(call_depth) {
+ if (call_depth == 0) return 10;
+ return 1 + worker(call_depth - 1);
+ }
+}
+
+var f1 = factory(worker1);
+var f2 = factory(f1);
+assertEquals(11, f2(1)); // Result: 1 + f1(0) == 1 + 10.
+assertEquals(11, f2(1));
+%OptimizeFunctionOnNextCall(f1);
+assertEquals(10, f1(0)); // Terminates immediately -> returns 10.
+%OptimizeFunctionOnNextCall(f2);
+assertEquals(102, f2(1000)); // 1 + f1(999) == 1 + 1 + worker1(998) == 102
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-140083.js b/src/v8/test/mjsunit/regress/regress-crbug-140083.js
new file mode 100644
index 0000000..e38192c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-140083.js
@@ -0,0 +1,44 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// Test that the absence of a setter in a compound/count operation works.
+
+Object.defineProperty(Object.prototype, "foo",
+ { get: function() { return 123; } });
+
+function bar(o) {
+ o.foo += 42;
+ o.foo++;
+}
+
+var baz = {};
+bar(baz);
+bar(baz);
+%OptimizeFunctionOnNextCall(bar)
+bar(baz);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-142087.js b/src/v8/test/mjsunit/regress/regress-crbug-142087.js
new file mode 100644
index 0000000..881ca60
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-142087.js
@@ -0,0 +1,38 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var string = "What are you looking for?";
+
+var expected_match = [""];
+for (var i = 0; i < string.length; i++) {
+ expected_match.push("");
+}
+
+string.replace(/(_)|(_|)/g, "");
+assertArrayEquals(expected_match, string.match(/(_)|(_|)/g, ""));
+
+'***************************************'.match(/((\\)|(\*)|(\$))/g, ".");
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-142218.js b/src/v8/test/mjsunit/regress/regress-crbug-142218.js
new file mode 100644
index 0000000..373f83b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-142218.js
@@ -0,0 +1,44 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+length = 1 << 16;
+a = new Array(length);
+
+function insert_element(key) {
+ a[key] = 42;
+}
+
+insert_element(1);
+%OptimizeFunctionOnNextCall(insert_element);
+insert_element(new Object());
+count = 0;
+for (var i = 0; i < length; i++) {
+ if (a[i] != undefined) count++;
+}
+assertEquals(1, count);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-145961.js b/src/v8/test/mjsunit/regress/regress-crbug-145961.js
new file mode 100644
index 0000000..eb88945
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-145961.js
@@ -0,0 +1,39 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// This test causes the operands to be passed in as Integer32 registers.
+// Flags: --allow-natives-syntax
+function test() {
+ var a = new Int32Array(2);
+ var x = a[0];
+ return Math.min(x, x);
+}
+
+assertEquals(0, test());
+assertEquals(0, test());
+%OptimizeFunctionOnNextCall(test);
+assertEquals(0, test());
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-146910.js b/src/v8/test/mjsunit/regress/regress-crbug-146910.js
new file mode 100644
index 0000000..120f809
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-146910.js
@@ -0,0 +1,38 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var x = [];
+assertSame(0, x.length);
+assertSame(undefined, x[0]);
+
+Object.defineProperty(x, '0', { value: 7, configurable: false });
+assertSame(1, x.length);
+assertSame(7, x[0]);
+
+x.length = 0;
+assertSame(1, x.length);
+assertSame(7, x[0]);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-147475.js b/src/v8/test/mjsunit/regress/regress-crbug-147475.js
new file mode 100644
index 0000000..180744c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-147475.js
@@ -0,0 +1,48 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function worker1(ignored) {
+ return 100;
+}
+
+function factory(worker) {
+ return function(call_depth) {
+ if (call_depth == 0) return 10;
+ return 1 + worker(call_depth - 1);
+ }
+}
+
+var f1 = factory(worker1);
+var f2 = factory(f1);
+assertEquals(11, f2(1));
+%OptimizeFunctionOnNextCall(f1);
+assertEquals(10, f1(0));
+%OptimizeFunctionOnNextCall(f2);
+assertEquals(102, f2(2));
+assertEquals(102, f2(2));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-148376.js b/src/v8/test/mjsunit/regress/regress-crbug-148376.js
new file mode 100644
index 0000000..55bb5f1
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-148376.js
@@ -0,0 +1,35 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function defineSetter(o) {
+ o.__defineSetter__('property', function() {});
+}
+
+defineSetter(Object.prototype);
+property = 0;
+defineSetter(this);
+var keys = Object.keys(this);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-150545.js b/src/v8/test/mjsunit/regress/regress-crbug-150545.js
new file mode 100644
index 0000000..cfee061
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-150545.js
@@ -0,0 +1,52 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// Test that we do not generate OSR entry points that have an arguments
+// stack height different from zero. The OSR machinery cannot generate
+// frames for that.
+
+(function() {
+ "use strict";
+
+ var instantReturn = false;
+ function inner() {
+ if (instantReturn) return;
+ assertSame(3, arguments.length);
+ assertSame(1, arguments[0]);
+ assertSame(2, arguments[1]);
+ assertSame(3, arguments[2]);
+ }
+
+ function outer() {
+ inner(1,2,3);
+ for (var i = 0; i < 3; i++) %OptimizeOsr();
+ }
+
+ outer();
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-150729.js b/src/v8/test/mjsunit/regress/regress-crbug-150729.js
new file mode 100644
index 0000000..15aa587
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-150729.js
@@ -0,0 +1,39 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var t = 0;
+function burn() {
+ i = [t, 1];
+ var M = [i[0], Math.cos(t) + i[7074959]];
+ t += .05;
+}
+for (var j = 0; j < 5; j++) {
+ if (j == 2) %OptimizeFunctionOnNextCall(burn);
+ burn();
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-157019.js b/src/v8/test/mjsunit/regress/regress-crbug-157019.js
new file mode 100644
index 0000000..66eb41b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-157019.js
@@ -0,0 +1,54 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax --noopt
+
+function makeConstructor() {
+ return function() {
+ this.a = 1;
+ this.b = 2;
+ };
+}
+
+var c1 = makeConstructor();
+var o1 = new c1();
+
+c1.prototype = {};
+
+for (var i = 0; i < 10; i++) {
+ var o = new c1();
+ for (var j = 0; j < 8; j++) {
+ o["x" + j] = 0;
+ }
+}
+
+var c2 = makeConstructor();
+var o2 = new c2();
+
+for (var i = 0; i < 50000; i++) {
+ new c2();
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-157520.js b/src/v8/test/mjsunit/regress/regress-crbug-157520.js
new file mode 100644
index 0000000..9570085
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-157520.js
@@ -0,0 +1,38 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --noopt
+
+(function(){
+ var f = function(arg) {
+ arg = 2;
+ return arguments[0];
+ };
+ for (var i = 0; i < 50000; i++) {
+ assertSame(2, f(1));
+ }
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-158185.js b/src/v8/test/mjsunit/regress/regress-crbug-158185.js
new file mode 100644
index 0000000..5cb5900
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-158185.js
@@ -0,0 +1,38 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+assertEquals("0023456",
+ Object.keys(JSON.parse('{"0023456": 1}'))[0]);
+assertEquals("1234567890123",
+ Object.keys(JSON.parse('{"1234567890123": 1}'))[0]);
+assertEquals("123456789ABCD",
+ Object.keys(JSON.parse('{"123456789ABCD": 1}'))[0]);
+assertEquals("12A",
+ Object.keys(JSON.parse('{"12A": 1}'))[0]);
+
+assertEquals(1, JSON.parse('{"0":1}')[0]);
+assertEquals(undefined, JSON.parse('{"00":1}')[0]);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-160010.js b/src/v8/test/mjsunit/regress/regress-crbug-160010.js
new file mode 100644
index 0000000..586bddd
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-160010.js
@@ -0,0 +1,35 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var str = "a";
+for (var i = 0; i < 28; i++) {
+ str += str;
+ %FlattenString(str); // Evil performance hack
+}
+JSON.stringify(str);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-162085.js b/src/v8/test/mjsunit/regress/regress-crbug-162085.js
new file mode 100644
index 0000000..a53b2c9
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-162085.js
@@ -0,0 +1,71 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Ensure extending an empty packed smi array with a double initializes the
+// array with holes.
+var a = [1,2,3];
+a.length = 0;
+a[0] = 1.4;
+assertEquals(1.4, a[0]);
+assertEquals(undefined, a[1]);
+assertEquals(undefined, a[2]);
+assertEquals(undefined, a[3]);
+
+// Ensure the double array growstub initializes the array with holes.
+function grow_store(a,i,v) {
+ a[i] = v;
+}
+
+var a2 = [1.3];
+grow_store(a2,1,1.4);
+a2.length = 0;
+grow_store(a2,0,1.5);
+assertEquals(1.5, a2[0]);
+assertEquals(undefined, a2[1]);
+assertEquals(undefined, a2[2]);
+assertEquals(undefined, a2[3]);
+
+// Check storing objects using the double grow stub.
+var a3 = [1.3];
+var o = {};
+grow_store(a3, 1, o);
+assertEquals(1.3, a3[0]);
+assertEquals(o, a3[1]);
+
+// Ensure the double array growstub initializes the array with holes.
+function grow_store2(a,i,v) {
+ a[i] = v;
+}
+
+var a4 = [1.3];
+grow_store2(a4,1,1.4);
+a4.length = 0;
+grow_store2(a4,0,1);
+assertEquals(1, a4[0]);
+assertEquals(undefined, a4[1]);
+assertEquals(undefined, a4[2]);
+assertEquals(undefined, a4[3]);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-163530.js b/src/v8/test/mjsunit/regress/regress-crbug-163530.js
new file mode 100644
index 0000000..7abae14
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-163530.js
@@ -0,0 +1,80 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// Test materialization of an arguments object with unknown argument
+// values in non-strict mode (length has to be zero).
+(function() {
+ var deoptimize = { deopt:true };
+ var object = {};
+
+ object.a = function A(x, y, z) {
+ assertSame(0, arguments.length);
+ return this.b();
+ };
+
+ object.b = function B() {
+ assertSame(0, arguments.length);
+ deoptimize.deopt;
+ return arguments.length;
+ };
+
+ assertSame(0, object.a());
+ assertSame(0, object.a());
+ %OptimizeFunctionOnNextCall(object.a);
+ assertSame(0, object.a());
+ delete deoptimize.deopt;
+ assertSame(0, object.a());
+})();
+
+
+// Test materialization of an arguments object with unknown argument
+// values in strict mode (length is allowed to exceed stack size).
+(function() {
+ 'use strict';
+ var deoptimize = { deopt:true };
+ var object = {};
+
+ object.a = function A(x, y, z) {
+ assertSame(0, arguments.length);
+ return this.b(1, 2, 3, 4, 5, 6, 7, 8);
+ };
+
+ object.b = function B(a, b, c, d, e, f, g, h) {
+ assertSame(8, arguments.length);
+ deoptimize.deopt;
+ return arguments.length;
+ };
+
+ assertSame(8, object.a());
+ assertSame(8, object.a());
+ %OptimizeFunctionOnNextCall(object.a);
+ assertSame(8, object.a());
+ delete deoptimize.deopt;
+ assertSame(8, object.a());
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-168545.js b/src/v8/test/mjsunit/regress/regress-crbug-168545.js
new file mode 100644
index 0000000..acc065e
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-168545.js
@@ -0,0 +1,34 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var o = {};
+Object.defineProperty(o, "length", { get: function() { throw "bail"; }});
+assertThrows("new Int16Array(o);");
+
+var a = [];
+Object.defineProperty(a, "0", { get: function() { throw "bail"; }});
+assertThrows("new Int16Array(a);");
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-170856.js b/src/v8/test/mjsunit/regress/regress-crbug-170856.js
new file mode 100644
index 0000000..2e73b12
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-170856.js
@@ -0,0 +1,33 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+r = new RegExp("a");
+for (var i = 0; i < 100; i++) {
+ r["abc" + i] = i;
+}
+"zzzz".replace(r, "");
+assertEquals(0, r.lastIndex);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-172345.js b/src/v8/test/mjsunit/regress/regress-crbug-172345.js
new file mode 100644
index 0000000..711501c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-172345.js
@@ -0,0 +1,34 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function f(a,i) {
+ return a[i];
+}
+
+f([1,2,3], "length");
+f([1,2,3], "length");
+f([1,2,3], 2);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-173907.js b/src/v8/test/mjsunit/regress/regress-crbug-173907.js
new file mode 100644
index 0000000..9f92fef
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-173907.js
@@ -0,0 +1,88 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var X = 1.1;
+var K = 0.5;
+
+var O = 0;
+var result = new Float64Array(2);
+
+function spill() {
+ try { } catch (e) { }
+}
+
+function buggy() {
+ var v = X;
+ var phi1 = v + K;
+ var phi2 = v - K;
+
+ spill(); // At this point initial values for phi1 and phi2 are spilled.
+
+ var xmm1 = v;
+ var xmm2 = v*v*v;
+ var xmm3 = v*v*v*v;
+ var xmm4 = v*v*v*v*v;
+ var xmm5 = v*v*v*v*v*v;
+ var xmm6 = v*v*v*v*v*v*v;
+ var xmm7 = v*v*v*v*v*v*v*v;
+ var xmm8 = v*v*v*v*v*v*v*v*v;
+
+ // All registers are blocked and phis for phi1 and phi2 are spilled because
+ // their left (incoming) value is spilled, there are no free registers,
+ // and phis themselves have only ANY-policy uses.
+
+ for (var x = 0; x < 2; x++) {
+ xmm1 += xmm1 * xmm6;
+ xmm2 += xmm1 * xmm5;
+ xmm3 += xmm1 * xmm4;
+ xmm4 += xmm1 * xmm3;
+ xmm5 += xmm1 * xmm2;
+
+ // Now swap values of phi1 and phi2 to create cycle between phis.
+ var t = phi1;
+ phi1 = phi2;
+ phi2 = t;
+ }
+
+ // Now we want to get values of phi1 and phi2. However we would like to
+ // do it in a way that does not produce any uses of phi1&phi2 that have
+ // a register beneficial policy. How? We just hide these uses behind phis.
+ result[0] = (O === 0) ? phi1 : phi2;
+ result[1] = (O !== 0) ? phi1 : phi2;
+}
+
+function test() {
+ buggy();
+ assertArrayEquals([X + K, X - K], result);
+}
+
+test();
+test();
+%OptimizeFunctionOnNextCall(buggy);
+test();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-173907b.js b/src/v8/test/mjsunit/regress/regress-crbug-173907b.js
new file mode 100644
index 0000000..4ecfd64
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-173907b.js
@@ -0,0 +1,88 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var X = 1.1;
+var K = 0.5;
+
+var O = 0;
+var result = new Float64Array(2);
+
+%NeverOptimizeFunction(spill);
+function spill() {
+}
+
+function buggy() {
+ var v = X;
+ var phi1 = v + K;
+ var phi2 = v - K;
+
+ spill(); // At this point initial values for phi1 and phi2 are spilled.
+
+ var xmm1 = v;
+ var xmm2 = v*v*v;
+ var xmm3 = v*v*v*v;
+ var xmm4 = v*v*v*v*v;
+ var xmm5 = v*v*v*v*v*v;
+ var xmm6 = v*v*v*v*v*v*v;
+ var xmm7 = v*v*v*v*v*v*v*v;
+ var xmm8 = v*v*v*v*v*v*v*v*v;
+
+ // All registers are blocked and phis for phi1 and phi2 are spilled because
+ // their left (incoming) value is spilled, there are no free registers,
+ // and phis themselves have only ANY-policy uses.
+
+ for (var x = 0; x < 2; x++) {
+ xmm1 += xmm1 * xmm6;
+ xmm2 += xmm1 * xmm5;
+ xmm3 += xmm1 * xmm4;
+ xmm4 += xmm1 * xmm3;
+ xmm5 += xmm1 * xmm2;
+
+ // Now swap values of phi1 and phi2 to create cycle between phis.
+ var t = phi1;
+ phi1 = phi2;
+ phi2 = t;
+ }
+
+ // Now we want to get values of phi1 and phi2. However we would like to
+ // do it in a way that does not produce any uses of phi1&phi2 that have
+ // a register beneficial policy. How? We just hide these uses behind phis.
+ result[0] = (O === 0) ? phi1 : phi2;
+ result[1] = (O !== 0) ? phi1 : phi2;
+}
+
+function test() {
+ buggy();
+ assertArrayEquals([X + K, X - K], result);
+}
+
+test();
+test();
+%OptimizeFunctionOnNextCall(buggy);
+test();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-173974.js b/src/v8/test/mjsunit/regress/regress-crbug-173974.js
new file mode 100644
index 0000000..905bd60
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-173974.js
@@ -0,0 +1,36 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function f() {
+ var count = "";
+ count[0] --;
+}
+f();
+%OptimizeFunctionOnNextCall(f);
+f();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-178790.js b/src/v8/test/mjsunit/regress/regress-crbug-178790.js
new file mode 100644
index 0000000..25cc96b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-178790.js
@@ -0,0 +1,51 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Create a regexp in the form of a?a?...a? so that fully
+// traversing the entire graph would be prohibitively expensive.
+// This should not cause time out.
+var r1 = "";
+for (var i = 0; i < 1000; i++) {
+ r1 += "a?";
+}
+"test".match(RegExp(r1));
+
+var r2 = "";
+for (var i = 0; i < 100; i++) {
+ r2 += "(a?|b?|c?|d?|e?|f?|g?)";
+}
+"test".match(RegExp(r2));
+
+// Create a regexp in the form of ((..(a)a..)a.
+// Compiling it causes EatsAtLeast to reach the maximum
+// recursion depth possible with a given budget.
+// This should not cause a stack overflow.
+var r3 = "a";
+for (var i = 0; i < 1000; i++) {
+ r3 = "(" + r3 + ")a";
+}
+"test".match(RegExp(r3));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-181422.js b/src/v8/test/mjsunit/regress/regress-crbug-181422.js
new file mode 100644
index 0000000..52826f3
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-181422.js
@@ -0,0 +1,32 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+assertArrayEquals(["\u00a0"], "ab\u00a0cd".match(/\s/));
+assertArrayEquals(["a", "b", "c", "d"], "ab\u00a0cd".match(/\S/g));
+
+assertArrayEquals(["\u00a0"], "\u2604b\u00a0cd".match(/\s/));
+assertArrayEquals(["\u2604", "b", "c", "d"], "\u2604b\u00a0cd".match(/\S/g));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-18639.js b/src/v8/test/mjsunit/regress/regress-crbug-18639.js
new file mode 100644
index 0000000..6c8e6ad
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-18639.js
@@ -0,0 +1,38 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// See http://crbug.com/18639
+
+try {
+ toString = toString;
+ __defineGetter__("z", (0).toLocaleString);
+ z;
+ z;
+ ((0).toLocaleString)();
+} catch (e) {
+ assertInstanceof(e, TypeError);
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-196583.js b/src/v8/test/mjsunit/regress/regress-crbug-196583.js
new file mode 100644
index 0000000..c486158
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-196583.js
@@ -0,0 +1,52 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var a = 1;
+a.__proto__.f = 1;
+a.__proto__.f = function() { return 1; }
+
+// Create some polymorphism.
+function B() {}
+B.prototype = {f: function() { return 2; }};
+var b = new B();
+function C() {}
+C.prototype = {g: "foo", f: function() { return 3; }};
+var c = new C();
+
+function crash(obj) {
+ return obj.f();
+}
+
+for (var i = 0; i < 2; i++) {
+ crash(a);
+ crash(b);
+ crash(c);
+}
+%OptimizeFunctionOnNextCall(crash);
+assertEquals(1, crash(a));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-217858.js b/src/v8/test/mjsunit/regress/regress-crbug-217858.js
new file mode 100644
index 0000000..d6d6e9f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-217858.js
@@ -0,0 +1,37 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --noanalyze-environment-liveness
+
+var r = /r/;
+function f() {
+ r[r] = function() {};
+}
+
+for (var i = 0; i < 300000; i++) {
+ f();
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-229923.js b/src/v8/test/mjsunit/regress/regress-crbug-229923.js
new file mode 100644
index 0000000..95c0ded
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-229923.js
@@ -0,0 +1,41 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-externalize-string
+
+var slice = "slow path of JSON.stringify for sliced string".substring(1);
+assertEquals('"' + slice + '"', JSON.stringify(slice, null, 0));
+
+var parent = "external string turned into two byte";
+var slice_of_external = parent.substring(1);
+try {
+ // Turn the string to a two-byte external string, so that the sliced
+ // string looks like one-byte, but its parent is actually two-byte.
+ externalizeString(parent, true);
+} catch (e) { }
+assertEquals('"' + slice_of_external + '"',
+ JSON.stringify(slice_of_external, null, 0));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-233737.js b/src/v8/test/mjsunit/regress/regress-crbug-233737.js
new file mode 100644
index 0000000..df8aa15
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-233737.js
@@ -0,0 +1,42 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var a = new Array(2);
+a[0] = 1;
+assertTrue(%HasSmiElements(a));
+assertTrue(%HasHoleyElements(a));
+
+function hole(i) {
+ return a[i] << 0;
+}
+
+assertEquals(1, hole(0));
+assertEquals(1, hole(0));
+%OptimizeFunctionOnNextCall(hole);
+assertEquals(0, hole(1));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-240032.js b/src/v8/test/mjsunit/regress/regress-crbug-240032.js
new file mode 100644
index 0000000..7ce95d3
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-240032.js
@@ -0,0 +1,48 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// Generate closures in that live in new-space.
+function mk() {
+ return function() {};
+}
+assertInstanceof(mk(), Function);
+assertInstanceof(mk(), Function);
+
+// Setup constant function using above closures.
+var o = {};
+o.func = mk();
+
+// Optimize object comparison with new-space RHS.
+function cmp(o, f) {
+ return f === o.func;
+}
+assertTrue(cmp(o, o.func));
+assertTrue(cmp(o, o.func));
+%OptimizeFunctionOnNextCall(cmp);
+assertTrue(cmp(o, o.func));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-242502.js b/src/v8/test/mjsunit/regress/regress-crbug-242502.js
new file mode 100644
index 0000000..8ee7640
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-242502.js
@@ -0,0 +1,66 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-gc --allow-natives-syntax
+
+function f() {
+ return 23;
+}
+
+function call(o) {
+ return o['']();
+}
+
+function test() {
+ var o1 = %ToFastProperties(Object.create({ foo:1 }, { '': { value:f }}));
+ var o2 = %ToFastProperties(Object.create({ bar:1 }, { '': { value:f }}));
+ var o3 = %ToFastProperties(Object.create({ baz:1 }, { '': { value:f }}));
+ var o4 = %ToFastProperties(Object.create({ qux:1 }, { '': { value:f }}));
+ var o5 = %ToFastProperties(Object.create({ loo:1 }, { '': { value:f }}));
+ // Called twice on o1 to turn monomorphic.
+ assertEquals(23, call(o1));
+ assertEquals(23, call(o1));
+ // Called on four other objects to turn megamorphic.
+ assertEquals(23, call(o2));
+ assertEquals(23, call(o3));
+ assertEquals(23, call(o4));
+ assertEquals(23, call(o5));
+ return o1;
+}
+
+// Fill stub cache with entries.
+test();
+
+// Clear stub cache during GC.
+gc();
+
+// Turn IC megamorphic again.
+var oboom = test();
+
+// Optimize with previously cleared stub cache.
+%OptimizeFunctionOnNextCall(call);
+assertEquals(23, call(oboom));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-242870.js b/src/v8/test/mjsunit/regress/regress-crbug-242870.js
new file mode 100644
index 0000000..7183375
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-242870.js
@@ -0,0 +1,43 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var non_const_true = true;
+
+function f() {
+ return (non_const_true || true && g());
+}
+
+function g() {
+ for (;;) {}
+}
+
+assertTrue(f());
+assertTrue(f());
+%OptimizeFunctionOnNextCall(f);
+assertTrue(f());
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-242924.js b/src/v8/test/mjsunit/regress/regress-crbug-242924.js
new file mode 100644
index 0000000..68ad7c6
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-242924.js
@@ -0,0 +1,48 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax --expose-gc --gc-global
+
+function f() {
+ return [,{}];
+}
+
+assertEquals([,{}], f());
+assertEquals([,{}], f());
+%OptimizeFunctionOnNextCall(f);
+assertEquals([,{}], f());
+gc();
+
+function g() {
+ return [[,1.5],{}];
+}
+
+assertEquals([[,1.5],{}], g());
+assertEquals([[,1.5],{}], g());
+%OptimizeFunctionOnNextCall(g);
+assertEquals([[,1.5],{}], g());
+gc();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-243868.js b/src/v8/test/mjsunit/regress/regress-crbug-243868.js
new file mode 100644
index 0000000..106d9cc
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-243868.js
@@ -0,0 +1,46 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var non_const_true = true;
+
+function f(o) {
+ return (non_const_true && (o.val == null || false));
+}
+
+// Create an object with a constant function in another realm.
+var realm = Realm.create();
+var realmObject = Realm.eval(realm, "function g() {}; var o = { val:g }; o;")
+
+// Make the CompareNil IC in the function monomorphic.
+assertFalse(f(realmObject));
+assertFalse(f(realmObject));
+
+// Optimize the function containing the CompareNil IC.
+%OptimizeFunctionOnNextCall(f);
+assertFalse(f(realmObject));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-244461.js b/src/v8/test/mjsunit/regress/regress-crbug-244461.js
new file mode 100644
index 0000000..2afb76a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-244461.js
@@ -0,0 +1,40 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function foo(arg) {
+ var a = arg();
+ return a;
+}
+
+
+foo(Array);
+foo(Array);
+%OptimizeFunctionOnNextCall(foo);
+// Compilation of foo will crash without the bugfix for 244461
+foo(Array);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-245424.js b/src/v8/test/mjsunit/regress/regress-crbug-245424.js
new file mode 100644
index 0000000..005c8ba
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-245424.js
@@ -0,0 +1,41 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function boom() {
+ var a = {
+ foo: "bar",
+ foo: "baz"
+ };
+ return a;
+}
+
+assertEquals("baz", boom().foo);
+assertEquals("baz", boom().foo);
+%OptimizeFunctionOnNextCall(boom);
+assertEquals("baz", boom().foo);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-245480.js b/src/v8/test/mjsunit/regress/regress-crbug-245480.js
new file mode 100644
index 0000000..b8557c9
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-245480.js
@@ -0,0 +1,67 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax --expose-gc --noalways-opt
+
+function isHoley(obj) {
+ if (%HasHoleyElements(obj)) return true;
+ return false;
+}
+
+function assertHoley(obj, name_opt) {
+ assertEquals(true, isHoley(obj), name_opt);
+}
+
+function create_array(arg) {
+ return new Array(arg);
+}
+
+obj = create_array(0);
+assertHoley(obj);
+create_array(0);
+%OptimizeFunctionOnNextCall(create_array);
+obj = create_array(10);
+assertHoley(obj);
+
+// The code below would assert in debug or crash in release
+function f(length) {
+ return new Array(length)
+}
+
+f(0);
+f(0);
+%OptimizeFunctionOnNextCall(f);
+var a = f(10);
+
+function g(a) {
+ return a[0];
+}
+
+var b = [0];
+g(b);
+g(b);
+assertEquals(undefined, g(a));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-258519.js b/src/v8/test/mjsunit/regress/regress-crbug-258519.js
new file mode 100644
index 0000000..b2015a8
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-258519.js
@@ -0,0 +1,45 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var a = {
+ compare_null: function(x) { return null != x; },
+ kaboom: function() {}
+}
+
+function crash(x) {
+ var b = a;
+ b.compare_null(x) && b.kaboom();
+ return "ok";
+}
+
+assertEquals("ok", crash(null));
+assertEquals("ok", crash(null));
+%OptimizeFunctionOnNextCall(crash);
+// Used to throw: "TypeError: Cannot call method 'kaboom' of undefined".
+assertEquals("ok", crash(1));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-260345.js b/src/v8/test/mjsunit/regress/regress-crbug-260345.js
new file mode 100644
index 0000000..75832ab
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-260345.js
@@ -0,0 +1,59 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var steps = 100000;
+var undefined_values = [undefined, "go on"];
+var null_values = [null, "go on"];
+
+function get_undefined_object(i) {
+ return undefined_values[(i / steps) | 0];
+}
+
+function test_undefined() {
+ var objects = 0;
+ for (var i = 0; i < 2 * steps; i++) {
+ undefined == get_undefined_object(i) && objects++;
+ }
+ return objects;
+}
+
+assertEquals(steps, test_undefined());
+
+
+function get_null_object(i) {
+ return null_values[(i / steps) | 0];
+}
+
+function test_null() {
+ var objects = 0;
+ for (var i = 0; i < 2 * steps; i++) {
+ null == get_null_object(i) && objects++;
+ }
+ return objects;
+}
+
+assertEquals(steps, test_null());
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-263276.js b/src/v8/test/mjsunit/regress/regress-crbug-263276.js
new file mode 100644
index 0000000..05aa94c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-263276.js
@@ -0,0 +1,46 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var array1 = [];
+array1.foo = true;
+
+var array2 = [];
+array2.bar = true;
+
+function bad(array) {
+ array[array.length] = 1;
+}
+
+bad(array1);
+bad(array1);
+bad(array2); // Length is now 1.
+bad(array2); // Length is now 2.
+%OptimizeFunctionOnNextCall(bad);
+bad(array2); // Length is now 3.
+assertEquals(3, array2.length);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-272564.js b/src/v8/test/mjsunit/regress/regress-crbug-272564.js
new file mode 100644
index 0000000..5475298
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-272564.js
@@ -0,0 +1,49 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function Bb(w) {
+ this.width = w;
+}
+
+function ce(a, b) {
+ "number" == typeof a && (a = (b ? Math.round(a) : a) + "px");
+ return a
+}
+
+function pe(a, b, c) {
+ if (b instanceof Bb) b = b.width;
+ a.width = ce(b, !0);
+}
+
+var a = new Bb(1);
+var b = new Bb(5);
+pe(a, b, 0);
+pe(a, b, 0);
+%OptimizeFunctionOnNextCall(pe);
+pe(a, b, 0);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-274438.js b/src/v8/test/mjsunit/regress/regress-crbug-274438.js
new file mode 100644
index 0000000..5d6817d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-274438.js
@@ -0,0 +1,43 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function f(a, b) {
+ var x = { a:a };
+ switch(b) { case "string": }
+ var y = { b:b };
+ return y;
+}
+
+f("a", "b");
+f("a", "b");
+%OptimizeFunctionOnNextCall(f);
+f("a", "b");
+%SetAllocationTimeout(100, 0);
+var killer = f("bang", "bo" + "om");
+assertEquals("boom", killer.b);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-280333.js b/src/v8/test/mjsunit/regress/regress-crbug-280333.js
new file mode 100644
index 0000000..ca3fdc7
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-280333.js
@@ -0,0 +1,47 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function funky() { return false; }
+var global;
+
+function foo(x, fun) {
+ var a = x + 1;
+ var b = x + 2; // Need another Simulate to fold the first one into.
+ global = true; // Need a side effect to deopt to.
+ if (fun()) {
+ return a;
+ }
+ return 0;
+}
+
+assertEquals(0, foo(1, funky));
+assertEquals(0, foo(1, funky));
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(0, foo(1, funky));
+assertEquals(2, foo(1, function() { return true; }));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-285355.js b/src/v8/test/mjsunit/regress/regress-crbug-285355.js
new file mode 100644
index 0000000..ebd480a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-285355.js
@@ -0,0 +1,43 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function inverted_index() {
+ return ~1;
+}
+
+%NeverOptimizeFunction(inverted_index);
+
+function crash(array) {
+ return array[~inverted_index()] = 2;
+}
+
+assertEquals(2, crash(new Array(1)));
+assertEquals(2, crash(new Array(1)));
+%OptimizeFunctionOnNextCall(crash)
+assertEquals(2, crash(new Array(1)));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-305309.js b/src/v8/test/mjsunit/regress/regress-crbug-305309.js
new file mode 100644
index 0000000..cd89bed
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-305309.js
@@ -0,0 +1,49 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function BadProto() {
+ this.constant_function = function() {};
+ this.one = 1;
+ this.two = 2;
+}
+var b1 = new BadProto();
+var b2 = new BadProto();
+
+function Ctor() {}
+Ctor.prototype = b1;
+var a = new Ctor();
+
+function Two(x) {
+ return x.two;
+}
+assertEquals(2, Two(a));
+assertEquals(2, Two(a));
+b2.constant_function = "no longer constant!";
+%OptimizeFunctionOnNextCall(Two);
+assertEquals(2, Two(a));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-306220.js b/src/v8/test/mjsunit/regress/regress-crbug-306220.js
new file mode 100644
index 0000000..a481ee9
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-306220.js
@@ -0,0 +1,38 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var CustomError = function(x) { this.x = x; };
+CustomError.prototype = new Error();
+CustomError.prototype.x = "prototype";
+
+Object.defineProperties(CustomError.prototype, {
+ 'message': {
+ 'get': function() { return this.x; }
+ }
+});
+
+assertEquals("Error: instance", String(new CustomError("instance")));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-306851.js b/src/v8/test/mjsunit/regress/regress-crbug-306851.js
new file mode 100644
index 0000000..77b711a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-306851.js
@@ -0,0 +1,52 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function Counter() {
+ this.value = 0;
+};
+
+Object.defineProperty(Counter.prototype, 'count', {
+ get: function() { return this.value; },
+ set: function(value) { this.value = value; }
+});
+
+var obj = new Counter();
+
+function bummer() {
+ obj.count++;
+ return obj.count;
+}
+
+assertEquals(1, bummer());
+assertEquals(2, bummer());
+assertEquals(3, bummer());
+%OptimizeFunctionOnNextCall(bummer);
+assertEquals(4, bummer());
+assertEquals(5, bummer());
+assertEquals(6, bummer());
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-309623.js b/src/v8/test/mjsunit/regress/regress-crbug-309623.js
new file mode 100644
index 0000000..c77611a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-309623.js
@@ -0,0 +1,46 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var u = new Uint32Array(2);
+u[0] = 1;
+u[1] = 0xEE6B2800;
+
+var a = [0, 1, 2];
+a[0] = 0; // Kill the COW.
+assertTrue(%HasSmiElements(a));
+
+function foo(i) {
+ a[0] = u[i];
+ return a[0];
+}
+
+assertEquals(u[0], foo(0));
+assertEquals(u[0], foo(0));
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(u[1], foo(1));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-315252.js b/src/v8/test/mjsunit/regress/regress-crbug-315252.js
new file mode 100644
index 0000000..51454bf
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-315252.js
@@ -0,0 +1,61 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function f(a, b, c) {
+ this.a = a;
+ this.b = b;
+ this.c = c;
+}
+var o3 = new f(1, 2, 3.5);
+var o4 = new f(1, 2.5, 3);
+var o1 = new f(1.5, 2, 3);
+var o2 = new f(1.5, 2, 3);
+function migrate(o) {
+ return o.a;
+}
+// Use migrate to stabilize o1, o2 and o4 in [double, double, smi].
+migrate(o4);
+migrate(o1);
+migrate(o2);
+function store_transition(o) {
+ o.d = 1;
+}
+// Optimize "store_transition" to transition from [double, double, smi] to
+// [double, double, smi, smi]. This adds a dependency on the
+// [double, double, smi] map.
+store_transition(o4);
+store_transition(o1);
+store_transition(o2);
+%OptimizeFunctionOnNextCall(store_transition);
+// Pass in a deprecated object of format [smi, smi, double]. This will migrate
+// the instance, forcing a merge with [double, double, smi], ending up with
+// [double, double, double], which deprecates [double, double, smi] and
+// deoptimizes all dependencies of [double, double, smi], including
+// store_transition itself.
+store_transition(o3);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-3184.js b/src/v8/test/mjsunit/regress/regress-crbug-3184.js
new file mode 100644
index 0000000..054668e
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-3184.js
@@ -0,0 +1,82 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+Object.extend = function (dest, source) {
+ for (property in source) dest[property] = source[property];
+ return dest;
+};
+
+Object.extend ( Function.prototype,
+{
+ wrap : function (wrapper) {
+ var method = this;
+ var bmethod = (function(_method) {
+ return function () {
+ this.$$$parentMethodStore$$$ = this.$proceed;
+ this.$proceed = function() { return _method.apply(this, arguments); };
+ };
+ })(method);
+ var amethod = function () {
+ this.$proceed = this.$$$parentMethodStore$$$;
+ if (this.$proceed == undefined) delete this.$proceed;
+ delete this.$$$parentMethodStore$$$;
+ };
+ var value = function() { bmethod.call(this); retval = wrapper.apply(this, arguments); amethod.call(this); return retval; };
+ return value;
+ }
+});
+
+String.prototype.cap = function() {
+ return this.charAt(0).toUpperCase() + this.substring(1).toLowerCase();
+};
+
+String.prototype.cap = String.prototype.cap.wrap(
+ function(each) {
+ if (each && this.indexOf(" ") != -1) {
+ return this.split(" ").map(
+ function (value) {
+ return value.cap();
+ }
+ ).join(" ");
+ } else {
+ return this.$proceed();
+ }
+});
+
+Object.extend( Array.prototype,
+{
+ map : function(fun) {
+ if (typeof fun != "function") throw new TypeError();
+ var len = this.length;
+ var res = new Array(len);
+ var thisp = arguments[1];
+ for (var i = 0; i < len; i++) { if (i in this) res[i] = fun.call(thisp, this[i], i, this); }
+ return res;
+ }
+});
+assertEquals("Test1 test1", "test1 test1".cap());
+assertEquals("Test2 Test2", "test2 test2".cap(true));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-318671.js b/src/v8/test/mjsunit/regress/regress-crbug-318671.js
new file mode 100644
index 0000000..54a7d5e
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-318671.js
@@ -0,0 +1,38 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function add(x, y) { return x + y; }
+
+print(add({ a: 1 }, "a"));
+print(add({ b: 1 }, "b"));
+print(add({ c: 1 }, "c"));
+
+%OptimizeFunctionOnNextCall(add);
+
+print(add("a", 1));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-319835.js b/src/v8/test/mjsunit/regress/regress-crbug-319835.js
new file mode 100644
index 0000000..48f871f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-319835.js
@@ -0,0 +1,51 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+try {} catch(e) {} // No need to optimize the top level.
+
+var size = 0x20000;
+var a = new Float64Array(size);
+var training = new Float64Array(10);
+function store(a, index) {
+ var offset = 0x20000000;
+ for (var i = 0; i < 1; i++) {
+ a[index + offset] = 0xcc;
+ }
+}
+
+store(training, -0x20000000);
+store(training, -0x20000000 + 1);
+store(training, -0x20000000);
+store(training, -0x20000000 + 1);
+%OptimizeFunctionOnNextCall(store);
+
+// Segfault maybe?
+for (var i = -0x20000000; i < -0x20000000 + size; i++) {
+ store(a, i);
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-319860.js b/src/v8/test/mjsunit/regress/regress-crbug-319860.js
new file mode 100644
index 0000000..b81fb85
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-319860.js
@@ -0,0 +1,47 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function read(a, index) {
+ var offset = 0x2000000;
+ var result;
+ for (var i = 0; i < 1; i++) {
+ result = a[index + offset];
+ }
+ return result;
+}
+
+var a = new Int8Array(0x2000001);
+read(a, 0);
+read(a, 0);
+%OptimizeFunctionOnNextCall(read);
+
+// Segfault maybe?
+for (var i = 0; i > -1000000; --i) {
+ read(a, i);
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-323942.js b/src/v8/test/mjsunit/regress/regress-crbug-323942.js
new file mode 100644
index 0000000..15af494
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-323942.js
@@ -0,0 +1,57 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+"use strict";
+
+// Function is defined on the prototype chain.
+var holder = { f: function() { return 42; } };
+var receiver = { };
+receiver.__proto__ = { };
+receiver.__proto__.__proto__ = holder;
+
+// Inline two levels.
+function h(o) { return o.f.apply(this, arguments); }
+function g(o) { return h(o); }
+
+// Collect type information for apply call.
+assertEquals(42, g(receiver));
+assertEquals(42, g(receiver));
+
+// Sneakily remove the function from the prototype chain.
+// The receiver map does not change.
+receiver.__proto__.__proto__ = {};
+
+// Lookup of o.f during graph creation fails.
+%OptimizeFunctionOnNextCall(g);
+
+assertThrows(function() { g(receiver); });
+
+// Put function back.
+receiver.__proto__.__proto__ = holder;
+assertEquals(42, g(receiver));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-325225.js b/src/v8/test/mjsunit/regress/regress-crbug-325225.js
new file mode 100644
index 0000000..798d548
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-325225.js
@@ -0,0 +1,46 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function f1(a) {
+ a[0](0);
+}
+
+function do1() {
+ f1([f1]);
+}
+
+assertThrows(do1, TypeError);
+
+function f2(a) {
+ a[0](true);
+}
+
+function do2() {
+ f2([function(a) { return f2("undefined", typeof f2(42, 0)); }]);
+}
+
+assertThrows(do2, TypeError);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-329709.js b/src/v8/test/mjsunit/regress/regress-crbug-329709.js
new file mode 100644
index 0000000..c5316f3
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-329709.js
@@ -0,0 +1,41 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function boom(x) {
+ switch(x) {
+ case 1: return "one";
+ case 1500000000: return "non-smi int32";
+ default: return "default";
+ }
+}
+
+assertEquals("one", boom(1));
+assertEquals("one", boom(1));
+%OptimizeFunctionOnNextCall(boom)
+assertEquals("non-smi int32", boom(1500000000));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-336148.js b/src/v8/test/mjsunit/regress/regress-crbug-336148.js
new file mode 100644
index 0000000..8157c9f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-336148.js
@@ -0,0 +1,56 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function f(o) {
+ var a = 1;
+ if (true) return o.v && a;
+}
+
+f({});
+f({});
+%OptimizeFunctionOnNextCall(f);
+assertEquals(1, f({ v: 1 }));
+
+
+function f1() { return 1 && 2; };
+function f2() { return 1 || 2; };
+function f3() { return 0 && 2; };
+function f4() { return 0 || 2; };
+
+function test() {
+ assertEquals(2, f1());
+ assertEquals(1, f2());
+ assertEquals(0, f3());
+ assertEquals(2, f4());
+}
+
+test();
+test();
+[f1, f2, f3, f4].forEach(function(f) { %OptimizeFunctionOnNextCall(f); });
+test();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-340064.js b/src/v8/test/mjsunit/regress/regress-crbug-340064.js
new file mode 100644
index 0000000..f2ab1d6
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-340064.js
@@ -0,0 +1,38 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function f(v) {
+ return v.length;
+}
+
+assertEquals(4, f("test"));
+assertEquals(4, f("test"));
+assertEquals(undefined, f(true));
+%OptimizeFunctionOnNextCall(f);
+assertEquals(undefined, f(true));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-344186.js b/src/v8/test/mjsunit/regress/regress-crbug-344186.js
new file mode 100644
index 0000000..6486f38
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-344186.js
@@ -0,0 +1,20 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var dummy = new Int32Array(100);
+var array = new Int32Array(128);
+function fun(base) {
+ array[base - 95] = 1;
+ array[base - 99] = 2;
+ array[base + 4] = 3;
+}
+fun(100);
+%OptimizeFunctionOnNextCall(fun);
+fun(0);
+
+for (var i = 0; i < dummy.length; i++) {
+ assertEquals(0, dummy[i]);
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-345715.js b/src/v8/test/mjsunit/regress/regress-crbug-345715.js
new file mode 100644
index 0000000..a375341
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-345715.js
@@ -0,0 +1,26 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+a = {y:1.5};
+a.y = 0;
+b = a.y;
+c = {y:{}};
+
+function f() {
+ return 1;
+}
+
+function g() {
+ var e = {y: b};
+ var d = {x:f()};
+ var d = {x:f()};
+ return [e, d];
+}
+
+g();
+g();
+%OptimizeFunctionOnNextCall(g);
+assertEquals(1, g()[1].x);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-345820.js b/src/v8/test/mjsunit/regress/regress-crbug-345820.js
new file mode 100644
index 0000000..bdd0af9
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-345820.js
@@ -0,0 +1,18 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --debug-code
+
+var __v_6 = {};
+__v_6 = new Int32Array(5);
+for (var i = 0; i < __v_6.length; i++) __v_6[i] = 0;
+
+function __f_7(N) {
+ for (var i = -1; i < N; i++) {
+ __v_6[i] = i;
+ }
+}
+__f_7(1);
+%OptimizeFunctionOnNextCall(__f_7);
+__f_7(__v_6.length);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-346636.js b/src/v8/test/mjsunit/regress/regress-crbug-346636.js
new file mode 100644
index 0000000..247f8be
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-346636.js
@@ -0,0 +1,31 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function assertSame(expected, found) {
+ if (found === expected) {
+ if (expected !== 0 || (1 / expected) == (1 / found)) return;
+ }
+ return;
+};
+
+function foo(x) {
+ return x.bar;
+}
+
+function getter1() {
+ assertSame(this, this);
+}
+var o1 = Object.defineProperty({}, "bar", { get: getter1 });
+foo(o1);
+foo(o1);
+
+function getter2() {
+ assertSame(this, this);
+}
+var o2 = Object.defineProperty({}, "bar", { get: getter2 });
+foo(o2);
+%OptimizeFunctionOnNextCall(foo);
+foo(o2);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-347903.js b/src/v8/test/mjsunit/regress/regress-crbug-347903.js
new file mode 100644
index 0000000..b5174da
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-347903.js
@@ -0,0 +1,19 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --use-allocation-folding --verify-heap
+
+function f() {
+ var a = new Array(84632);
+ // Allocation folding will bail out trying to fold the elements alloc of
+ // array "b."
+ var b = new Array(84632);
+ var c = new Array(84632);
+ return [a, b, c];
+}
+f(); f();
+%OptimizeFunctionOnNextCall(f);
+for(var i = 0; i < 10; i++) {
+ f();
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-349079.js b/src/v8/test/mjsunit/regress/regress-crbug-349079.js
new file mode 100644
index 0000000..b1076ea
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-349079.js
@@ -0,0 +1,23 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function assertEquals(expected, found) {
+ return found === expected;
+};
+%NeverOptimizeFunction(assertEquals);
+
+function crash() {
+ var a = 1;
+ var b = -0;
+ var c = 1.5;
+ assertEquals(b, Math.max(b++, c++));
+ assertEquals(c, Math.min(b++, c++));
+ assertEquals(b, Math.max(b++, a++));
+}
+crash();
+crash();
+%OptimizeFunctionOnNextCall(crash);
+crash();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-349465.js b/src/v8/test/mjsunit/regress/regress-crbug-349465.js
new file mode 100644
index 0000000..2188750
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-349465.js
@@ -0,0 +1,17 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --debug-code
+
+function f(a, base) {
+ a[base] = 1;
+ a[base + 4] = 2;
+ a[base] = 3;
+}
+var a1 = new Array(1024);
+var a2 = new Array(128);
+f(a1, 1);
+f(a2, -2);
+%OptimizeFunctionOnNextCall(f);
+f(a1, -2);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-349853.js b/src/v8/test/mjsunit/regress/regress-crbug-349853.js
new file mode 100644
index 0000000..53af64c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-349853.js
@@ -0,0 +1,21 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var a = ["string"];
+function funky(array) { return array[0] = 1; }
+funky(a);
+
+function crash() {
+ var q = [0];
+ // The failing ASSERT was only triggered when compiling for OSR.
+ for (var i = 0; i < 100000; i++) {
+ funky(q);
+ }
+ q[0] = 0;
+ funky(q)
+}
+
+crash();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-349878.js b/src/v8/test/mjsunit/regress/regress-crbug-349878.js
new file mode 100644
index 0000000..5ed048f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-349878.js
@@ -0,0 +1,33 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f(a, b) {
+ a == b;
+}
+
+f({}, {});
+
+var a = { y: 1.5 };
+a.y = 777;
+var b = a.y;
+
+function h() {
+ var d = 1;
+ var e = 777;
+ while (d-- > 0) e++;
+ f(1, e);
+}
+
+var global;
+function g() {
+ global = b;
+ return h(b);
+}
+
+g();
+g();
+%OptimizeFunctionOnNextCall(g);
+g();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-350434.js b/src/v8/test/mjsunit/regress/regress-crbug-350434.js
new file mode 100644
index 0000000..8a9a8e5
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-350434.js
@@ -0,0 +1,33 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --gc-global --noincremental-marking --allow-natives-syntax
+
+function Ctor() {
+ this.foo = 1;
+}
+
+var o = new Ctor();
+var p = new Ctor();
+
+
+function crash(o, timeout) {
+ var s = "4000111222"; // Outside Smi range.
+ %SetAllocationTimeout(100000, timeout);
+ // This allocates a heap number, causing a GC, triggering lazy deopt.
+ var end = s >>> 0;
+ s = s.substring(0, end);
+ // This creates a map dependency, which gives the GC a reason to trigger
+ // a lazy deopt when that map dies.
+ o.bar = 2;
+}
+
+crash(o, 100000);
+crash(o, 100000);
+crash(p, 100000);
+%OptimizeFunctionOnNextCall(crash);
+crash(o, 100000);
+o = null;
+p = null;
+crash({}, 0);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-350864.js b/src/v8/test/mjsunit/regress/regress-crbug-350864.js
new file mode 100644
index 0000000..510834b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-350864.js
@@ -0,0 +1,34 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var v0 = new WeakMap;
+var v1 = {};
+v0.set(v1, 1);
+var sym = Symbol();
+v1[sym] = 1;
+var symbols = Object.getOwnPropertySymbols(v1);
+assertArrayEquals([sym], symbols);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-350867.js b/src/v8/test/mjsunit/regress/regress-crbug-350867.js
new file mode 100644
index 0000000..d8b826c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-350867.js
@@ -0,0 +1,15 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function f1(a, i) {
+ return a[i];
+}
+function f2(a, b, c, index) {
+ return f1(arguments, index);
+}
+
+f2(2, 3, 4, "foo");
+f2(2, 3, 4, "foo");
+assertEquals(11, f1([11, 22, 33], 0));
+assertEquals(22, f2(22, 33, 44, 0));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-350890.js b/src/v8/test/mjsunit/regress/regress-crbug-350890.js
new file mode 100644
index 0000000..b60a2aa
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-350890.js
@@ -0,0 +1,42 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function set_length(a, l) {
+ a.length = l;
+}
+
+function test1() {
+ var l = {};
+ var a = Array(l);
+ set_length(a, 3);
+ set_length(a, 3);
+ assertEquals(3, a.length);
+}
+
+function test2() {
+ var a = [];
+ set_length(a, 10);
+ set_length(a, 10);
+ Object.freeze(a);
+ set_length(a, 3);
+ set_length(a, 3);
+ assertEquals(10, a.length);
+}
+
+function test3() {
+ var a = [2];
+ Object.defineProperty(a, "length", {value:2, writable: false});
+ %ToFastProperties(a);
+ set_length([], 10);
+ set_length([], 10);
+ set_length(a, 10);
+ set_length(a, 10);
+ assertEquals(2, a.length);
+}
+
+test1();
+test2();
+test3();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-351262.js b/src/v8/test/mjsunit/regress/regress-crbug-351262.js
new file mode 100644
index 0000000..a2f4ead
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-351262.js
@@ -0,0 +1,6 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+for (var x in this) {};
+JSON.stringify(this);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-351320.js b/src/v8/test/mjsunit/regress/regress-crbug-351320.js
new file mode 100644
index 0000000..3ffef0b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-351320.js
@@ -0,0 +1,21 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var result = 0;
+var o1 = {};
+o2 = {y:1.5};
+o2.y = 0;
+o3 = o2.y;
+
+function crash() {
+ for (var i = 0; i < 10; i++) {
+ result += o1.x + o3.foo;
+ }
+}
+
+crash();
+%OptimizeFunctionOnNextCall(crash);
+crash();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-351658.js b/src/v8/test/mjsunit/regress/regress-crbug-351658.js
new file mode 100644
index 0000000..ae6b50e
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-351658.js
@@ -0,0 +1,14 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+try {
+ var f = eval("(function(){0 = y + y})");
+ %OptimizeFunctionOnNextCall(f);
+ f();
+ assertUnreachable();
+} catch(e) {
+ assertTrue(e instanceof ReferenceError);
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-351787.js b/src/v8/test/mjsunit/regress/regress-crbug-351787.js
new file mode 100644
index 0000000..74cabf2
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-351787.js
@@ -0,0 +1,42 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var ab1 = new ArrayBuffer(8);
+ab1.__defineGetter__("byteLength", function() { return 1000000; });
+var ab2 = ab1.slice(800000, 900000);
+var array = new Uint8Array(ab2);
+for (var i = 0; i < array.length; i++) {
+ assertEquals(0, array[i]);
+}
+assertEquals(0, array.length);
+
+
+var ab3 = new ArrayBuffer(8);
+ab3.__defineGetter__("byteLength", function() { return 0xFFFFFFFC; });
+var aaa = new DataView(ab3);
+
+for (var i = 10; i < aaa.length; i++) {
+ aaa.setInt8(i, 0xcc);
+}
+assertEquals(8, aaa.byteLength);
+
+
+var a = new Int8Array(4);
+a.__defineGetter__("length", function() { return 0xFFFF; });
+var b = new Int8Array(a);
+for (var i = 0; i < b.length; i++) {
+ assertEquals(0, b[i]);
+}
+
+
+var ab4 = new ArrayBuffer(8);
+ab4.__defineGetter__("byteLength", function() { return 0xFFFFFFFC; });
+var aaaa = new Uint32Array(ab4);
+
+for (var i = 10; i < aaaa.length; i++) {
+ aaaa[i] = 0xcccccccc;
+}
+assertEquals(2, aaaa.length);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-352058.js b/src/v8/test/mjsunit/regress/regress-crbug-352058.js
new file mode 100644
index 0000000..e270d83
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-352058.js
@@ -0,0 +1,17 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --check-elimination --stress-opt
+
+var v0 = this;
+var v2 = this;
+function f() {
+ v2 = [1.2, 2.3];
+ v0 = [12, 23];
+}
+
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+f();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-352586.js b/src/v8/test/mjsunit/regress/regress-crbug-352586.js
new file mode 100644
index 0000000..18b5390
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-352586.js
@@ -0,0 +1,15 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var a = {};
+
+function getter() {
+ do {
+ return a + 1;
+ } while (false);
+}
+
+a.__proto__ = Error("");
+a.__defineGetter__('message', getter);
+assertThrows(()=>a.message, RangeError);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-352929.js b/src/v8/test/mjsunit/regress/regress-crbug-352929.js
new file mode 100644
index 0000000..a5872c1
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-352929.js
@@ -0,0 +1,33 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var dummy = new Int32Array(100);
+array = new Int32Array(100);
+var dummy2 = new Int32Array(100);
+
+array[-17] = 0;
+function fun(base,cond) {
+ array[base - 1] = 1;
+ array[base - 2] = 2;
+ if (cond) {
+ array[base - 4] = 3;
+ array[base - 5] = 4;
+ } else {
+ array[base - 6] = 5;
+ array[base - 100] = 777;
+ }
+}
+fun(5,true);
+fun(7,false);
+%OptimizeFunctionOnNextCall(fun);
+fun(7,false);
+
+for (var i = 0; i < dummy.length; i++) {
+ assertEquals(0, dummy[i]);
+}
+for (var i = 0; i < dummy2.length; i++) {
+ assertEquals(0, dummy2[i]);
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-354391.js b/src/v8/test/mjsunit/regress/regress-crbug-354391.js
new file mode 100644
index 0000000..e652bd3
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-354391.js
@@ -0,0 +1,21 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function load(a, i) {
+ return a[i];
+}
+
+function f2(a, b, c, d, index) {
+ return load(arguments, index);
+}
+
+f2(1, 2, 3, 4, "foo");
+f2(1, 2, 3, 4, "foo");
+load([11, 22, 33], 0);
+assertEquals(11, f2(11, 22, 33, 44, 0));
+
+%OptimizeFunctionOnNextCall(load);
+assertEquals(11, f2(11, 22, 33, 44, 0));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-357052.js b/src/v8/test/mjsunit/regress/regress-crbug-357052.js
new file mode 100644
index 0000000..7a58396
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-357052.js
@@ -0,0 +1,12 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function f() {
+ var str = "";
+ for (var i = 0; i < 30; i++) {
+ str += "abcdefgh12345678" + str;
+ }
+ return str;
+}
+assertThrows(f);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-357137.js b/src/v8/test/mjsunit/regress/regress-crbug-357137.js
new file mode 100644
index 0000000..a780426
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-357137.js
@@ -0,0 +1,8 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var locals = "";
+for (var i = 0; i < 1024; i++) locals += "var v" + i + ";";
+eval("function f() {" + locals + "f();}");
+assertThrows("f()", RangeError);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-357330.js b/src/v8/test/mjsunit/regress/regress-crbug-357330.js
new file mode 100644
index 0000000..b3edf00
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-357330.js
@@ -0,0 +1,16 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f(foo) {
+ var g;
+ true ? (g = foo + 0) : g = null;
+ if (null != g) {}
+};
+
+f(1.4);
+f(1.4);
+%OptimizeFunctionOnNextCall(f);
+f(1.4);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-364374.js b/src/v8/test/mjsunit/regress/regress-crbug-364374.js
new file mode 100644
index 0000000..d8ae91f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-364374.js
@@ -0,0 +1,56 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+if (this.Intl) {
+ // chromium:364374
+
+ // Locations with 2 underscores are accepted and normalized.
+ // 'of' and 'es' are always lowercased.
+ df = new Intl.DateTimeFormat('en-US', {'timeZone': 'eUrope/isLe_OF_man'})
+ assertEquals('Europe/Isle_of_Man', df.resolvedOptions().timeZone);
+
+ df = new Intl.DateTimeFormat('en-US', {'timeZone': 'africa/Dar_eS_salaam'})
+ assertEquals('Africa/Dar_es_Salaam', df.resolvedOptions().timeZone);
+
+ df = new Intl.DateTimeFormat('en-US', {'timeZone': 'America/port_of_spain'})
+ assertEquals('America/Port_of_Spain', df.resolvedOptions().timeZone);
+
+ // Zone ids with more than 2 parts are accepted and normalized.
+ df = new Intl.DateTimeFormat('en-US', {'timeZone': 'America/north_Dakota/new_salem'})
+ assertEquals('America/North_Dakota/New_Salem', df.resolvedOptions().timeZone);
+
+ // 3-part zone IDs are accepted and normalized.
+ // Two Buenose Aires aliases are identical.
+ df1 = new Intl.DateTimeFormat('en-US', {'timeZone': 'America/aRgentina/buenos_aIres'})
+ df2 = new Intl.DateTimeFormat('en-US', {'timeZone': 'America/Argentina/Buenos_Aires'})
+ assertEquals(df1.resolvedOptions().timeZone, df2.resolvedOptions().timeZone);
+
+ df2 = new Intl.DateTimeFormat('en-US', {'timeZone': 'America/Buenos_Aires'})
+ assertEquals(df1.resolvedOptions().timeZone, df2.resolvedOptions().timeZone);
+
+ df1 = new Intl.DateTimeFormat('en-US', {'timeZone': 'America/Indiana/Indianapolis'})
+ df2 = new Intl.DateTimeFormat('en-US', {'timeZone': 'America/Indianapolis'})
+ assertEquals(df1.resolvedOptions().timeZone, df2.resolvedOptions().timeZone);
+
+ // ICU does not recognize East-Indiana. Add later when it does.
+ // df2 = new Intl.DateTimeFormat('en-US', {'timeZone': 'America/East-Indiana'})
+ // assertEquals(df1.resolvedOptions().timeZone, df2.resolvedOptions().timeZone);
+
+
+ // Zone IDs with hyphens. 'au' has to be in lowercase.
+ df = new Intl.DateTimeFormat('en-US', {'timeZone': 'America/port-aU-pRince'})
+ assertEquals('America/Port-au-Prince', df.resolvedOptions().timeZone);
+
+ // Accepts Ho_Chi_Minh and treats it as identical to Saigon
+ df1 = new Intl.DateTimeFormat('en-US', {'timeZone': 'Asia/Ho_Chi_Minh'})
+ df2 = new Intl.DateTimeFormat('en-US', {'timeZone': 'Asia/Saigon'})
+ assertEquals(df1.resolvedOptions().timeZone, df2.resolvedOptions().timeZone);
+
+ // Throws for invalid timezone ids.
+ assertThrows(() => Intl.DateTimeFormat(undefined, {timeZone: 'Europe/_Paris'}));
+ assertThrows(() => Intl.DateTimeFormat(undefined, {timeZone: 'America/New__York'}));
+ assertThrows(() => Intl.DateTimeFormat(undefined, {timeZone: 'America//New_York'}));
+ assertThrows(() => Intl.DateTimeFormat(undefined, {timeZone: 'America/New_York_'}));
+ assertThrows(() => Intl.DateTimeFormat(undefined, {timeZone: 'America/New_Y0rk'}));
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-374838.js b/src/v8/test/mjsunit/regress/regress-crbug-374838.js
new file mode 100644
index 0000000..614b4d9
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-374838.js
@@ -0,0 +1,20 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo() {
+ var a = [0];
+ result = 0;
+ for (var i = 0; i < 4; i++) {
+ result += a.length;
+ a.shift();
+ }
+ return result;
+}
+
+assertEquals(1, foo());
+assertEquals(1, foo());
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(1, foo());
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-37853.js b/src/v8/test/mjsunit/regress/regress-crbug-37853.js
new file mode 100644
index 0000000..047fbcb
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-37853.js
@@ -0,0 +1,34 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// See http://crbug.com/37853
+
+function f(o, k) { return o[k]; }
+a = {'a':1, 1:'a'}
+f(a, 'a')
+f(a, 'a')
+f(a, 1);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-380512.js b/src/v8/test/mjsunit/regress/regress-crbug-380512.js
new file mode 100644
index 0000000..af78ba7
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-380512.js
@@ -0,0 +1,12 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f() { [].lastIndexOf(42); }
+
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+f();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-380671.js b/src/v8/test/mjsunit/regress/regress-crbug-380671.js
new file mode 100644
index 0000000..3b03064
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-380671.js
@@ -0,0 +1,13 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --mock-arraybuffer-allocator --expose-gc
+
+var buffer = new ArrayBuffer(0xc0000000);
+assertEquals(0xc0000000, buffer.byteLength);
+// We call the GC here to free up the large array buffer. Otherwise, the
+// mock allocator would allow us to allocate more than the physical memory
+// available on 32bit platforms, leaving the internal counters in an invalid
+// state.
+gc();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-381534.js b/src/v8/test/mjsunit/regress/regress-crbug-381534.js
new file mode 100644
index 0000000..2aa3929
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-381534.js
@@ -0,0 +1,40 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var obj = {};
+
+function f(v) {
+ var v1 = -(4/3);
+ var v2 = 1;
+ var arr = new Array(+0, true, 0, -0, false, undefined, null, "0", obj, v1, -(4/3), -1.3333333333333, "str", v2, 1, false);
+ assertEquals(10, arr.lastIndexOf(-(4/3)));
+ assertEquals(9, arr.indexOf(-(4/3)));
+
+ assertEquals(10, arr.lastIndexOf(v));
+ assertEquals(9, arr.indexOf(v));
+
+ assertEquals(8, arr.lastIndexOf(obj));
+ assertEquals(8, arr.indexOf(obj));
+}
+
+function g(v, x, index) {
+ var arr = new Array({}, x-1.1, x-2, x-3.1);
+ assertEquals(index, arr.indexOf(0));
+ assertEquals(index, arr.lastIndexOf(0));
+
+ assertEquals(index, arr.indexOf(v));
+ assertEquals(index, arr.lastIndexOf(v));
+}
+
+f(-(4/3));
+f(-(4/3));
+%OptimizeFunctionOnNextCall(f);
+f(-(4/3));
+
+g(0, 2, 2);
+g(0, 3.1, 3);
+%OptimizeFunctionOnNextCall(g);
+g(0, 1.1, 1);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-382143.js b/src/v8/test/mjsunit/regress/regress-crbug-382143.js
new file mode 100644
index 0000000..9f37b2e
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-382143.js
@@ -0,0 +1,16 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function A() {
+ Object.defineProperty(this, "x", { set: function () {}, get: function () {}});
+ this.a = function () { return 1; }
+}
+
+function B() {
+ A.apply( this );
+ this.a = function () { return 2; }
+}
+
+var b = new B();
+assertTrue(Object.getOwnPropertyDescriptor(b, "a").enumerable);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-382513.js b/src/v8/test/mjsunit/regress/regress-crbug-382513.js
new file mode 100644
index 0000000..59d2dca
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-382513.js
@@ -0,0 +1,11 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo() { return [+0,false].indexOf(-(4/3)); }
+foo();
+foo();
+%OptimizeFunctionOnNextCall(foo);
+foo();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-385002.js b/src/v8/test/mjsunit/regress/regress-crbug-385002.js
new file mode 100644
index 0000000..e9023e1
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-385002.js
@@ -0,0 +1,15 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --stack-size=200 --allow-natives-syntax
+
+%ScheduleBreak(); // Schedule an interrupt that does not go away.
+
+function f() { f(); }
+assertThrows(f, RangeError);
+
+var locals = "";
+for (var i = 0; i < 1024; i++) locals += "var v" + i + ";";
+eval("function g() {" + locals + "f();}");
+assertThrows("g()", RangeError);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-3867.js b/src/v8/test/mjsunit/regress/regress-crbug-3867.js
new file mode 100644
index 0000000..03001b6
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-3867.js
@@ -0,0 +1,77 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function props(x) {
+ var result = [];
+ for (var p in x) result.push(p);
+ return result;
+}
+
+function A() {
+ this.a1 = 1234;
+ this.a2 = "D";
+ this.a3 = false;
+}
+
+function B() {
+ this.b3 = false;
+ this.b2 = "D";
+ this.b1 = 1234;
+}
+
+function C() {
+ this.c3 = false;
+ this.c1 = 1234;
+ this.c2 = "D";
+}
+
+assertArrayEquals(["a1", "a2", "a3"], props(new A()));
+assertArrayEquals(["b3", "b2", "b1"], props(new B()));
+assertArrayEquals(["c3", "c1", "c2"], props(new C()));
+assertArrayEquals(["s1", "s2", "s3"], props({s1: 0, s2: 0, s3: 0}));
+assertArrayEquals(["s3", "s2", "s1"], props({s3: 0, s2: 0, s1: 0}));
+assertArrayEquals(["s3", "s1", "s2"], props({s3: 0, s1: 0, s2: 0}));
+
+var a = new A()
+a.a0 = 0;
+a.a4 = 0;
+assertArrayEquals(["a1", "a2", "a3", "a0", "a4"], props(a));
+
+var b = new B()
+b.b4 = 0;
+b.b0 = 0;
+assertArrayEquals(["b3", "b2", "b1", "b4", "b0"], props(b));
+
+var o1 = {s1: 0, s2: 0, s3: 0}
+o1.s0 = 0;
+o1.s4 = 0;
+assertArrayEquals(["s1", "s2", "s3", "s0", "s4"], props(o1));
+
+var o2 = {s3: 0, s2: 0, s1: 0}
+o2.s4 = 0;
+o2.s0 = 0;
+assertArrayEquals(["s3", "s2", "s1", "s4", "s0"], props(o2));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-387031.js b/src/v8/test/mjsunit/regress/regress-crbug-387031.js
new file mode 100644
index 0000000..77f52a9
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-387031.js
@@ -0,0 +1,15 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+a = [1];
+b = [];
+a.__defineGetter__(0, function () {
+ b.length = 0xffffffff;
+});
+c = a.concat(b);
+for (var i = 0; i < 20; i++) {
+ assertEquals(undefined, (c[i]));
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-387636.js b/src/v8/test/mjsunit/regress/regress-crbug-387636.js
new file mode 100644
index 0000000..1e50ace
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-387636.js
@@ -0,0 +1,14 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f() {
+ [].indexOf(0x40000000);
+}
+
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+f();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-390918.js b/src/v8/test/mjsunit/regress/regress-crbug-390918.js
new file mode 100644
index 0000000..4c202b3
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-390918.js
@@ -0,0 +1,18 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f(scale) {
+ var arr = {a: 1.1};
+
+ for (var i = 0; i < 2; i++) {
+ arr[2 * scale] = 0;
+ }
+}
+
+f({});
+f({});
+%OptimizeFunctionOnNextCall(f);
+f(1004);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-39160.js b/src/v8/test/mjsunit/regress/regress-crbug-39160.js
new file mode 100644
index 0000000..a8a8567
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-39160.js
@@ -0,0 +1,41 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// See http://crbug.com/39160
+
+// To reproduce the bug we need an inlined comparison (i.e. in a loop) where
+// the left hand side is known to be a smi (max smi value is 1073741823). This
+// test crashes with the bug.
+function f(a) {
+ for (var i = 1073741820; i < 1073741822; i++) {
+ if (a < i) {
+ a += i;
+ }
+ }
+}
+
+f(5)
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-393988.js b/src/v8/test/mjsunit/regress/regress-crbug-393988.js
new file mode 100644
index 0000000..9543e1e
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-393988.js
@@ -0,0 +1,8 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var o = {};
+Error.captureStackTrace(o);
+Object.defineProperty(o, "stack", { value: 1 });
+assertEquals(1, o.stack);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-403409.js b/src/v8/test/mjsunit/regress/regress-crbug-403409.js
new file mode 100644
index 0000000..ffd100b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-403409.js
@@ -0,0 +1,18 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+Array.prototype[0] = 777;
+var kElements = 10;
+
+var input_array = [];
+for (var i = 1; i < kElements; i++) {
+ input_array[i] = 0.5;
+}
+var output_array = input_array.concat(0.5);
+
+assertEquals(kElements + 1, output_array.length);
+assertEquals(777, output_array[0]);
+for (var j = 1; j < kElements; j++) {
+ assertEquals(0.5, output_array[j]);
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-405517.js b/src/v8/test/mjsunit/regress/regress-crbug-405517.js
new file mode 100644
index 0000000..578e76a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-405517.js
@@ -0,0 +1,16 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --gc-interval=203
+
+function f() {
+ var e = [0];
+ Object.preventExtensions(e);
+ for (var i = 0; i < 4; i++) e.shift();
+}
+
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+f();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-407946.js b/src/v8/test/mjsunit/regress/regress-crbug-407946.js
new file mode 100644
index 0000000..d5687cc
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-407946.js
@@ -0,0 +1,12 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f(n) { return [0].indexOf((n - n) + 0); }
+
+assertEquals(0, f(.1));
+assertEquals(0, f(.1));
+%OptimizeFunctionOnNextCall(f);
+assertEquals(0, f(.1));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-40931.js b/src/v8/test/mjsunit/regress/regress-crbug-40931.js
new file mode 100644
index 0000000..2dbff6e
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-40931.js
@@ -0,0 +1,45 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// See http://crbug.com/40931
+
+// To reproduce this we need to split a comma separated string and check the
+// indices which should only contain the numeric indices corresponding to the
+// number of values of the split.
+
+var names = "a,b,c,d";
+
+for(var i = 0; i < 10; i++) {
+ var splitNames = names.split(/,/);
+ var forInNames = [];
+ var count = 0;
+ for (name in splitNames) {
+ forInNames[count++] = name;
+ }
+ forInNames.sort();
+ assertEquals("0,1,2,3", forInNames.join());
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-410033.js b/src/v8/test/mjsunit/regress/regress-crbug-410033.js
new file mode 100644
index 0000000..63693e6
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-410033.js
@@ -0,0 +1,7 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --expose-gc
+
+%GetScript('v8/gc');
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-412203.js b/src/v8/test/mjsunit/regress/regress-crbug-412203.js
new file mode 100644
index 0000000..f150859
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-412203.js
@@ -0,0 +1,36 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var b = [];
+b[10000] = 1;
+// Required to reproduce the bug.
+assertTrue(%HasDictionaryElements(b));
+
+var a1 = [1.5];
+b.__proto__ = a1;
+assertEquals(1.5, ([].concat(b))[0]);
+
+var a2 = new Int32Array(2);
+a2[0] = 3;
+b.__proto__ = a2
+assertEquals(3, ([].concat(b))[0]);
+
+function foo(x, y) {
+ var a = [];
+ a[10000] = 1;
+ assertTrue(%HasDictionaryElements(a));
+
+ a.__proto__ = arguments;
+ var c = [].concat(a);
+ for (var i = 0; i < arguments.length; i++) {
+ assertEquals(i + 2, c[i]);
+ }
+ assertEquals(undefined, c[arguments.length]);
+ assertEquals(undefined, c[arguments.length + 1]);
+}
+foo(2);
+foo(2, 3);
+foo(2, 3, 4);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-412208.js b/src/v8/test/mjsunit/regress/regress-crbug-412208.js
new file mode 100644
index 0000000..a194f85
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-412208.js
@@ -0,0 +1,16 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var non_const_true = true;
+
+function f() {
+ return non_const_true || (f() = this);
+}
+
+assertTrue(f());
+assertTrue(f());
+%OptimizeFunctionOnNextCall(f);
+assertTrue(f());
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-412210.js b/src/v8/test/mjsunit/regress/regress-crbug-412210.js
new file mode 100644
index 0000000..6ec7d62
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-412210.js
@@ -0,0 +1,12 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f(x) {
+ return (x ? "" >> 0 : "") + /a/;
+};
+
+%OptimizeFunctionOnNextCall(f);
+f();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-412215.js b/src/v8/test/mjsunit/regress/regress-crbug-412215.js
new file mode 100644
index 0000000..ad926fc
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-412215.js
@@ -0,0 +1,33 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var dummy = {foo: "true"};
+
+var a = {y:0.5};
+a.y = 357;
+var b = a.y;
+
+var d;
+function f( ) {
+ d = 357;
+ return {foo: b};
+}
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+var x = f();
+
+// With the bug, x is now an invalid object; the code below
+// triggers a crash.
+
+function g(obj) {
+ return obj.foo.length;
+}
+
+g(dummy);
+g(dummy);
+%OptimizeFunctionOnNextCall(g);
+g(x);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-412319.js b/src/v8/test/mjsunit/regress/regress-crbug-412319.js
new file mode 100644
index 0000000..158fc59
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-412319.js
@@ -0,0 +1,19 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function __f_6() {
+ var __v_7 = [0];
+ Object.preventExtensions(__v_7);
+ for (var __v_6 = -2; __v_6 < 19; __v_6++) __v_7.shift();
+ __f_7(__v_7);
+}
+__f_6();
+__f_6();
+%OptimizeFunctionOnNextCall(__f_6);
+__f_6();
+function __f_7(__v_7) {
+ __v_7.pop();
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-416558.js b/src/v8/test/mjsunit/regress/regress-crbug-416558.js
new file mode 100644
index 0000000..375ad40
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-416558.js
@@ -0,0 +1,115 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(function() {
+ function store(x) { x[0] = 0; }
+ store([]);
+ var c = /x/;
+ store(c);
+ function get_hole() {
+ var b = /x/;
+ store(b);
+ return b[1];
+ }
+ assertEquals(undefined, get_hole());
+ assertEquals(undefined, get_hole());
+})();
+
+(function() {
+ function store(x) { x[0] = 0; }
+ store([]);
+ var c = new Date();
+ store(c);
+ function get_hole() {
+ var b = new Date();
+ store(b);
+ return b[1];
+ }
+ assertEquals(undefined, get_hole());
+ assertEquals(undefined, get_hole());
+})();
+
+(function() {
+ function store(x) { x[0] = 0; }
+ store([]);
+ var c = new Number(1);
+ store(c);
+ function get_hole() {
+ var b = new Number(1);
+ store(b);
+ return b[1];
+ }
+ assertEquals(undefined, get_hole());
+ assertEquals(undefined, get_hole());
+})();
+
+(function() {
+ function store(x) { x[0] = 0; }
+ store([]);
+ var c = new Boolean();
+ store(c);
+ function get_hole() {
+ var b = new Boolean();
+ store(b);
+ return b[1];
+ }
+ assertEquals(undefined, get_hole());
+ assertEquals(undefined, get_hole());
+})();
+
+(function() {
+ function store(x) { x[0] = 0; }
+ store([]);
+ var c = new Map();
+ store(c);
+ function get_hole() {
+ var b = new Map();
+ store(b);
+ return b[1];
+ }
+ assertEquals(undefined, get_hole());
+ assertEquals(undefined, get_hole());
+})();
+
+(function() {
+ function store(x) { x[0] = 0; }
+ store([]);
+ var c = new Set();
+ store(c);
+ function get_hole() {
+ var b = new Set();
+ store(b);
+ return b[1];
+ }
+ assertEquals(undefined, get_hole());
+ assertEquals(undefined, get_hole());
+})();
+
+(function() {
+ function store(x) { x[0] = 0; }
+ store([]);
+ var c = new WeakMap();
+ store(c);
+ function get_hole() {
+ var b = new WeakMap();
+ store(b);
+ return b[1];
+ }
+ assertEquals(undefined, get_hole());
+ assertEquals(undefined, get_hole());
+})();
+
+(function() {
+ function store(x) { x[0] = 0; }
+ store([]);
+ var c = new WeakSet();
+ store(c);
+ function get_hole() {
+ var b = new WeakSet();
+ store(b);
+ return b[1];
+ }
+ assertEquals(undefined, get_hole());
+ assertEquals(undefined, get_hole());
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-417508.js b/src/v8/test/mjsunit/regress/regress-crbug-417508.js
new file mode 100644
index 0000000..589fb88
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-417508.js
@@ -0,0 +1,29 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(x) {
+ var k = "value";
+ return x[k] = 1;
+}
+var obj = {};
+Object.defineProperty(obj, "value", {set: function(x) { throw "nope"; }});
+try { foo(obj); } catch(e) {}
+try { foo(obj); } catch(e) {}
+%OptimizeFunctionOnNextCall(foo);
+try { foo(obj); } catch(e) {}
+
+function bar(x) {
+ var k = "value";
+ return (x[k] = 1) ? "ok" : "nope";
+}
+var obj2 = {};
+Object.defineProperty(obj2, "value",
+ {set: function(x) { throw "nope"; return true; } });
+
+try { bar(obj2); } catch(e) {}
+try { bar(obj2); } catch(e) {}
+%OptimizeFunctionOnNextCall(bar);
+try { bar(obj2); } catch(e) {}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-422858.js b/src/v8/test/mjsunit/regress/regress-crbug-422858.js
new file mode 100644
index 0000000..ba75fc0
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-422858.js
@@ -0,0 +1,23 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var date = new Date("2016/01/02 10:00 GMT-8")
+assertEquals(0, date.getMinutes());
+assertEquals(18, date.getUTCHours());
+
+date = new Date("2016/01/02 10:00 GMT-12")
+assertEquals(0, date.getMinutes());
+assertEquals(22, date.getUTCHours());
+
+date = new Date("2016/01/02 10:00 GMT-123")
+assertEquals(23, date.getMinutes());
+assertEquals(11, date.getUTCHours());
+
+date = new Date("2016/01/02 10:00 GMT-0856")
+assertEquals(56, date.getMinutes());
+assertEquals(18, date.getUTCHours());
+
+date = new Date("2016/01/02 10:00 GMT-08000")
+assertEquals(NaN, date.getMinutes());
+assertEquals(NaN, date.getUTCHours());
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-423687.js b/src/v8/test/mjsunit/regress/regress-crbug-423687.js
new file mode 100644
index 0000000..6000352
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-423687.js
@@ -0,0 +1,10 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var json = '{"a":{"c":2.1,"d":0},"b":{"c":7,"1024":8}}';
+var data = JSON.parse(json);
+
+data.b.c++;
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-425519.js b/src/v8/test/mjsunit/regress/regress-crbug-425519.js
new file mode 100644
index 0000000..d08e7b9
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-425519.js
@@ -0,0 +1,15 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function load(a, i) {
+ return a[i];
+}
+
+load([]);
+load(0);
+load("x", 0);
+%OptimizeFunctionOnNextCall(load);
+load([], 0);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-425585.js b/src/v8/test/mjsunit/regress/regress-crbug-425585.js
new file mode 100644
index 0000000..c27febb
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-425585.js
@@ -0,0 +1,48 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+var correct_result = "This is the correct result.";
+
+function foo(recursion_depth) {
+ if (recursion_depth > 0) return foo(recursion_depth - 1);
+ return new String(correct_result, 1, 2, 3, 4, 5, 6);
+}
+
+// Roll our own non-strict assertEquals replacement.
+function test(i) {
+ var actual = foo(i);
+ if (correct_result != actual) {
+ var msg = "Expected \"" + correct_result + "\", found " + actual;
+ throw new MjsUnitAssertionError(msg);
+ }
+}
+
+test(1);
+test(1);
+test(10);
+test(100);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-429159.js b/src/v8/test/mjsunit/regress/regress-crbug-429159.js
new file mode 100644
index 0000000..69f1856
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-429159.js
@@ -0,0 +1,12 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+try {
+ var src = "return " + Array(12000).join("src,") + "src";
+ var fun = Function(src);
+ assertEquals(src, fun());
+} catch (e) {
+ // Some architectures throw a RangeError, that is fine.
+ assertInstanceof(e, RangeError);
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-430846.js b/src/v8/test/mjsunit/regress/regress-crbug-430846.js
new file mode 100644
index 0000000..3047c7f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-430846.js
@@ -0,0 +1,14 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo() { return 1; };
+var o1 = {};
+o1.foo = foo;
+
+var json = '{"foo": {"x": 1}}';
+var o2 = JSON.parse(json);
+var o3 = JSON.parse(json);
+assertTrue(%HaveSameMap(o2, o3));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-431602.js b/src/v8/test/mjsunit/regress/regress-crbug-431602.js
new file mode 100644
index 0000000..2467aaf
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-431602.js
@@ -0,0 +1,23 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --always-opt
+
+var heap_number_producer = {y:1.5};
+heap_number_producer.y = 0;
+var heap_number_zero = heap_number_producer.y;
+var non_constant_eight = {};
+non_constant_eight = 8;
+
+function BreakIt() {
+ return heap_number_zero | (1 | non_constant_eight);
+}
+
+function expose(a, b, c) {
+ return b;
+}
+
+assertEquals(9, expose(8, 9, 10));
+assertEquals(9, expose(8, BreakIt(), 10));
+assertEquals(9, BreakIt());
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-433332.js b/src/v8/test/mjsunit/regress/regress-crbug-433332.js
new file mode 100644
index 0000000..d763243
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-433332.js
@@ -0,0 +1,16 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f(foo) {
+ var g;
+ true ? (g = 0.1) : g |= null;
+ if (null != g) {}
+};
+
+f(1.4);
+f(1.4);
+%OptimizeFunctionOnNextCall(f);
+f(1.4);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-433766.js b/src/v8/test/mjsunit/regress/regress-crbug-433766.js
new file mode 100644
index 0000000..fae9483
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-433766.js
@@ -0,0 +1,16 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var filler = "//" + new Array(('@')).join('x');
+
+// Test strict eval in global context.
+eval(
+ "'use strict';" +
+ "var x = 23;" +
+ "var f = function bozo1() {" +
+ " return x;" +
+ "};" +
+ "f;" +
+ filler
+)();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-435825.js b/src/v8/test/mjsunit/regress/regress-crbug-435825.js
new file mode 100644
index 0000000..959535b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-435825.js
@@ -0,0 +1,11 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+Error.prepareStackTrace = function (a,b) { return b; };
+
+try {
+ /(invalid regexp/;
+} catch (e) {
+ assertEquals("[object global]", e.stack[0].getThis().toString());
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-436820.js b/src/v8/test/mjsunit/regress/regress-crbug-436820.js
new file mode 100644
index 0000000..eea386c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-436820.js
@@ -0,0 +1,13 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function c(p) {
+ return {__proto__: p};
+}
+var p = {};
+var o = c(p);
+p.x = 0.6;
+Object.defineProperty(p, "x", { writable: false });
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-450642.js b/src/v8/test/mjsunit/regress/regress-crbug-450642.js
new file mode 100644
index 0000000..7f821e0
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-450642.js
@@ -0,0 +1,5 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertThrows(function() { with (undefined) {} }, TypeError);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-450960.js b/src/v8/test/mjsunit/regress/regress-crbug-450960.js
new file mode 100644
index 0000000..28db6df
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-450960.js
@@ -0,0 +1,24 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --stack-size=100
+
+"a".replace(/a/g, "");
+
+var count = 0;
+function test() {
+ try {
+ test();
+ } catch(e) {
+ if (count < 50) {
+ count++;
+ "b".replace(/(b)/g, new []);
+ }
+ }
+}
+
+try {
+ test();
+} catch (e) {
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-451013.js b/src/v8/test/mjsunit/regress/regress-crbug-451013.js
new file mode 100644
index 0000000..d843d33
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-451013.js
@@ -0,0 +1,11 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertThrows(function testDeepArrayLiteral() {
+ testDeepArrayLiteral([], [], [[]]);
+}, RangeError);
+
+assertThrows(function testDeepObjectLiteral() {
+ testDeepObjectLiteral({}, {}, {x:[[]]});
+}, RangeError);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-451016.js b/src/v8/test/mjsunit/regress/regress-crbug-451016.js
new file mode 100644
index 0000000..93152c3
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-451016.js
@@ -0,0 +1,10 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --turbo-filter=STRICT_EQUALS
+
+var value = NaN;
+for (i = 0; i < 256; i++) {
+ value === "A" || value === "B";
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-451770.js b/src/v8/test/mjsunit/regress/regress-crbug-451770.js
new file mode 100644
index 0000000..b4f088d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-451770.js
@@ -0,0 +1,13 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertThrows(function f() {
+ var t = { toString: function() { throw new Error(); } };
+ var o = { [t]: 23 };
+}, Error);
+
+assertThrows(function f() {
+ var t = { toString: function() { throw new Error(); } };
+ class C { [t]() { return 23; } };
+}, Error);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-454091.js b/src/v8/test/mjsunit/regress/regress-crbug-454091.js
new file mode 100644
index 0000000..2705e96
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-454091.js
@@ -0,0 +1,9 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+this.__proto__ = Array.prototype;
+Object.freeze(this);
+this.length = 1;
+assertThrows('this.__proto__ = {}');
+assertEquals(Array.prototype, this.__proto__);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-455644.js b/src/v8/test/mjsunit/regress/regress-crbug-455644.js
new file mode 100644
index 0000000..4993d85
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-455644.js
@@ -0,0 +1,12 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(function f() {
+ do { return 23; } while(false);
+ with (0) {
+ try {
+ return 42;
+ } finally {}
+ }
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-465564.js b/src/v8/test/mjsunit/regress/regress-crbug-465564.js
new file mode 100644
index 0000000..ea0c8dc
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-465564.js
@@ -0,0 +1,7 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --cache=code
+
+assertEquals(-1, %StringCompare("a", "b"));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-467047.js b/src/v8/test/mjsunit/regress/regress-crbug-467047.js
new file mode 100644
index 0000000..373e984
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-467047.js
@@ -0,0 +1,17 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --stack-size=100
+
+function captureMatch(re) {
+ var local_variable = 0;
+ "abcd".replace(re, function() { });
+ assertEquals("abcd", RegExp.input);
+ assertEquals("a", RegExp.leftContext);
+ assertEquals("bc", RegExp.lastMatch);
+ assertEquals("d", RegExp.rightContext);
+ assertEquals("foo", captureMatch(/^bar/));
+}
+
+assertThrows(function() { captureMatch(/(bc)/) }, RangeError);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-467531.js b/src/v8/test/mjsunit/regress/regress-crbug-467531.js
new file mode 100644
index 0000000..73256c7
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-467531.js
@@ -0,0 +1,25 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --turbo-filter=* --always-opt
+
+assertThrows(function() {
+ "use strict";
+ try {
+ x = ref_error;
+ let x = 0;
+ } catch (e) {
+ throw e;
+ }
+}, ReferenceError);
+
+assertThrows(function() {
+ "use strict";
+ try {
+ x = ref_error;
+ let x = 0;
+ } finally {
+ // re-throw
+ }
+}, ReferenceError);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-469480.js b/src/v8/test/mjsunit/regress/regress-crbug-469480.js
new file mode 100644
index 0000000..8bb0c52
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-469480.js
@@ -0,0 +1,13 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --stress-compaction --verify-heap
+// Flags: --stack-size=100
+
+// Load the debug context to fill up code space.
+%GetDebugContext();
+%GetDebugContext();
+
+// Recurse and run regexp code.
+assertThrows(function f() { f(/./.test("a")); }, RangeError);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-469768.js b/src/v8/test/mjsunit/regress/regress-crbug-469768.js
new file mode 100644
index 0000000..e8a16b0
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-469768.js
@@ -0,0 +1,33 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Try several different argument counts to make sure none of them
+// sneak through the system of stack checks.
+
+try {
+ Array.prototype.concat.apply([], new Array(100000));
+} catch (e) {
+ // Throwing is fine, just don't crash.
+}
+
+
+try {
+ Array.prototype.concat.apply([], new Array(150000));
+} catch (e) {
+ // Throwing is fine, just don't crash.
+}
+
+
+try {
+ Array.prototype.concat.apply([], new Array(200000));
+} catch (e) {
+ // Throwing is fine, just don't crash.
+}
+
+
+try {
+ Array.prototype.concat.apply([], new Array(248000));
+} catch (e) {
+ // Throwing is fine, just don't crash.
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-471659.js b/src/v8/test/mjsunit/regress/regress-crbug-471659.js
new file mode 100644
index 0000000..fa27baa
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-471659.js
@@ -0,0 +1,22 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --stack-size=100
+
+var s = "0123456789ABCDEF";
+for (var i = 0; i < 16; i++) s += s;
+
+var count = 0;
+function f() {
+ try {
+ f();
+ if (count < 10) {
+ f();
+ }
+ } catch(e) {
+ s.replace("+", "-");
+ }
+ count++;
+}
+f();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-474297.js b/src/v8/test/mjsunit/regress/regress-crbug-474297.js
new file mode 100644
index 0000000..ce24025
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-474297.js
@@ -0,0 +1,12 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --gc-interval=33 --expose-gc --allow-natives-syntax
+
+var Debug = %GetDebugContext().Debug;
+Debug.setListener(function(){});
+
+%DebugGetLoadedScripts();
+
+Debug.setListener(null);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-476477-1.js b/src/v8/test/mjsunit/regress/regress-crbug-476477-1.js
new file mode 100644
index 0000000..881c602
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-476477-1.js
@@ -0,0 +1,21 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var obj = {
+ _leftTime: 12345678,
+ _divider: function() {
+ var s = Math.floor(this._leftTime / 3600);
+ var e = Math.floor(s / 24);
+ var i = s % 24;
+ return {
+ s: s,
+ e: e,
+ i: i,
+ }
+ }
+}
+
+for (var i = 0; i < 1000; i++) {
+ obj._divider();
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-476477-2.js b/src/v8/test/mjsunit/regress/regress-crbug-476477-2.js
new file mode 100644
index 0000000..4dbb41b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-476477-2.js
@@ -0,0 +1,16 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(x) {
+ var s = Math.floor(x / 3600);
+ Math.floor(s);
+ return s % 24;
+}
+
+foo(12345678);
+foo(12345678);
+%OptimizeFunctionOnNextCall(foo);
+foo(12345678);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-477924.js b/src/v8/test/mjsunit/regress/regress-crbug-477924.js
new file mode 100644
index 0000000..feaf2d0
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-477924.js
@@ -0,0 +1,16 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var dummy = new ReferenceError("dummy");
+
+constructors = [ ReferenceError, TypeError];
+
+for (var i in constructors) {
+ constructors[i].prototype.__defineGetter__("stack", function() {});
+}
+
+for (var i in constructors) {
+ var obj = new constructors[i];
+ obj.toString();
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-478011.js b/src/v8/test/mjsunit/regress/regress-crbug-478011.js
new file mode 100644
index 0000000..fcc0528
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-478011.js
@@ -0,0 +1,7 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var e = {};
+Object.preventExtensions(e);
+assertThrows(function() { Error.captureStackTrace(e) });
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-478612.js b/src/v8/test/mjsunit/regress/regress-crbug-478612.js
new file mode 100644
index 0000000..3419722
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-478612.js
@@ -0,0 +1,52 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// This is used to force binary operations below to have tagged representation.
+var z = {valueOf: function() { return 3; }};
+
+
+function f() {
+ var y = -2;
+ return (1 & z) - y++;
+}
+
+assertEquals(3, f());
+assertEquals(3, f());
+%OptimizeFunctionOnNextCall(f);
+assertEquals(3, f());
+
+
+function g() {
+ var y = 2;
+ return (1 & z) | y++;
+}
+
+assertEquals(3, g());
+assertEquals(3, g());
+%OptimizeFunctionOnNextCall(g);
+assertEquals(3, g());
+
+
+function h() {
+ var y = 3;
+ return (3 & z) & y++;
+}
+
+assertEquals(3, h());
+assertEquals(3, h());
+%OptimizeFunctionOnNextCall(h);
+assertEquals(3, h());
+
+
+function i() {
+ var y = 2;
+ return (1 & z) ^ y++;
+}
+
+assertEquals(3, i());
+assertEquals(3, i());
+%OptimizeFunctionOnNextCall(i);
+assertEquals(3, i());
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-480807.js b/src/v8/test/mjsunit/regress/regress-crbug-480807.js
new file mode 100644
index 0000000..a1448d6
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-480807.js
@@ -0,0 +1,22 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --use-osr --noalways-opt
+
+function foo() {
+ var c = 0;
+ for (var e = 0; e < 1; ++e) {
+ for (var a = 1; a > 0; a--) {
+ c += 1;
+ }
+ for (var b = 1; b > 0; b--) {
+ %OptimizeOsr();
+ }
+ }
+ return c;
+}
+try {
+ foo();
+} catch (e) {
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-480819.js b/src/v8/test/mjsunit/regress/regress-crbug-480819.js
new file mode 100644
index 0000000..086f6c8
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-480819.js
@@ -0,0 +1,10 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --turbo-filter=* --always-opt --noanalyze-environment-liveness
+
+(function() {
+ "use strict";
+ class C1 {}
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-482998.js b/src/v8/test/mjsunit/regress/regress-crbug-482998.js
new file mode 100644
index 0000000..80933a7
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-482998.js
@@ -0,0 +1,23 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Should not time out. Running time 0.5s vs. 120s before the change.
+function collapse(flags) {
+ var src = "(?:";
+ for (var i = 128; i < 0x1000; i++) {
+ src += String.fromCharCode(96 + i % 26) + String.fromCharCode(i) + "|";
+ }
+ src += "aa)";
+ var collapsible = new RegExp(src, flags);
+ var subject = "zzzzzzz" + String.fromCharCode(3000);
+ for (var i = 0; i < 1000; i++) {
+ subject += "xxxxxxx";
+ }
+ for (var i = 0; i < 2000; i++) {
+ assertFalse(collapsible.test(subject));
+ }
+}
+
+collapse("i");
+collapse("");
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-484077.js b/src/v8/test/mjsunit/regress/regress-crbug-484077.js
new file mode 100644
index 0000000..26fa7a2
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-484077.js
@@ -0,0 +1,7 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+assertEquals("", %FunctionGetInferredName((function(){}).bind({})));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-485410.js b/src/v8/test/mjsunit/regress/regress-crbug-485410.js
new file mode 100644
index 0000000..bb11c82
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-485410.js
@@ -0,0 +1,23 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var doubles = new Float64Array(1);
+function ToHeapNumber(i) {
+ doubles[0] = i;
+ return doubles[0];
+}
+for (var i = 0; i < 3; i++) ToHeapNumber(i);
+%OptimizeFunctionOnNextCall(ToHeapNumber);
+ToHeapNumber(1);
+
+function Fail(a, i, v) {
+ a[i] = v;
+}
+
+for (var i = 0; i < 3; i++) Fail(new Array(1), 1, i);
+%OptimizeFunctionOnNextCall(Fail);
+// 1050 > JSObject::kMaxGap, causing stub failure and runtime call.
+Fail(new Array(1), ToHeapNumber(1050), 3);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-485548-1.js b/src/v8/test/mjsunit/regress/regress-crbug-485548-1.js
new file mode 100644
index 0000000..6a25dcd
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-485548-1.js
@@ -0,0 +1,33 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --expose-gc
+
+var inner = new Array();
+inner.a = {x:1};
+inner[0] = 1.5;
+inner.b = {x:2};
+assertTrue(%HasDoubleElements(inner));
+
+function foo(o) {
+ return o.field.a.x;
+}
+
+var outer = {};
+outer.field = inner;
+foo(outer);
+foo(outer);
+foo(outer);
+%OptimizeFunctionOnNextCall(foo);
+foo(outer);
+
+// Generalize representation of field "a" of inner object.
+var v = { get x() { return 0x7fffffff; } };
+inner.a = v;
+
+gc();
+
+var boom = foo(outer);
+print(boom);
+assertEquals(0x7fffffff, boom);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-485548-2.js b/src/v8/test/mjsunit/regress/regress-crbug-485548-2.js
new file mode 100644
index 0000000..02c6326
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-485548-2.js
@@ -0,0 +1,33 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --expose-gc
+
+var inner = new Array();
+inner.a = {x:1};
+inner[0] = 1.5;
+inner.b = {x:2};
+assertTrue(%HasDoubleElements(inner));
+
+function foo(o) {
+ return o.field.b.x;
+}
+
+var outer = {};
+outer.field = inner;
+foo(outer);
+foo(outer);
+foo(outer);
+%OptimizeFunctionOnNextCall(foo);
+foo(outer);
+
+// Generalize representation of field "b" of inner object.
+var v = { get x() { return 0x7fffffff; } };
+inner.b = v;
+
+gc();
+
+var boom = foo(outer);
+print(boom);
+assertEquals(0x7fffffff, boom);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-487105.js b/src/v8/test/mjsunit/regress/regress-crbug-487105.js
new file mode 100644
index 0000000..160f9b0
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-487105.js
@@ -0,0 +1,9 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+function assertThrows() {
+ eval();
+};
+eval("delete this;")
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-487322.js b/src/v8/test/mjsunit/regress/regress-crbug-487322.js
new file mode 100644
index 0000000..6338cf4
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-487322.js
@@ -0,0 +1,25 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+if (this.Intl) {
+ // Normalizes Kat{h,}mandu (chromium:487322)
+ // According to the IANA timezone db, Kathmandu is the current canonical
+ // name, but ICU got it backward. To make this test robust against a future
+ // ICU change ( http://bugs.icu-project.org/trac/ticket/12044 ),
+ // just check that Kat(h)mandu is resolved identically.
+ df1 = new Intl.DateTimeFormat('en-US', {'timeZone': 'Asia/Katmandu'})
+ df2 = new Intl.DateTimeFormat('en-US', {'timeZone': 'Asia/Kathmandu'})
+ assertEquals(df1.resolvedOptions().timeZone, df2.resolvedOptions().timeZone);
+
+ // Normalizes Ulan_Bator to Ulaanbaatar. Unlike Kat(h)mandu, ICU got this
+ // right so that we make sure that Ulan_Bator is resolved to Ulaanbaatar.
+ df = new Intl.DateTimeFormat('en-US', {'timeZone': 'Asia/Ulaanbaatar'})
+ assertEquals('Asia/Ulaanbaatar', df.resolvedOptions().timeZone);
+
+ df = new Intl.DateTimeFormat('en-US', {'timeZone': 'Asia/Ulan_Bator'})
+ assertEquals('Asia/Ulaanbaatar', df.resolvedOptions().timeZone);
+
+ // Throws for unsupported time zones.
+ assertThrows(() => Intl.DateTimeFormat(undefined, {timeZone: 'Aurope/Paris'}));
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-487608.js b/src/v8/test/mjsunit/regress/regress-crbug-487608.js
new file mode 100644
index 0000000..c1eafce
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-487608.js
@@ -0,0 +1,22 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function inlined(a, i) {
+ return a[i + 1];
+}
+
+function foo(index) {
+ var a = [0, 1, 2, 3];
+ var result = 0;
+ result += a[index];
+ result += inlined(a, index);
+ return result;
+}
+
+foo(0);
+foo(0);
+%OptimizeFunctionOnNextCall(foo);
+foo(0);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-489293.js b/src/v8/test/mjsunit/regress/regress-crbug-489293.js
new file mode 100644
index 0000000..bcfc702
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-489293.js
@@ -0,0 +1,16 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turbo-filter=f
+// Flags: --noanalyze-environment-liveness
+
+function f() {
+ var x = 0;
+ for (var y = 0; y < 0; ++y) {
+ x = (x + y) | 0;
+ }
+ return unbound;
+}
+%OptimizeFunctionOnNextCall(f);
+assertThrows(f, ReferenceError);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-489597.js b/src/v8/test/mjsunit/regress/regress-crbug-489597.js
new file mode 100644
index 0000000..b10af92
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-489597.js
@@ -0,0 +1,12 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+try {
+ load("test/mjsunit/regress/regress-crbug-489597.js-script");
+} catch (e) {
+}
+
+var o = this;
+Error.captureStackTrace(o);
+o.stack;
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-489597.js-script b/src/v8/test/mjsunit/regress/regress-crbug-489597.js-script
new file mode 100644
index 0000000..cb4dd84
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-489597.js-script
@@ -0,0 +1,5 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+throw new Error("boom");
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-490021.js b/src/v8/test/mjsunit/regress/regress-crbug-490021.js
new file mode 100644
index 0000000..745c0a8
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-490021.js
@@ -0,0 +1,15 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var global = new Object(3);
+function f() {
+ global[0] = global[0] >>> 15.5;
+}
+
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+f();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-490680.js b/src/v8/test/mjsunit/regress/regress-crbug-490680.js
new file mode 100644
index 0000000..735f3b7
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-490680.js
@@ -0,0 +1,18 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var sentinel = null;
+
+try {
+ throw { toString: function() { sentinel = "observed"; } };
+} catch (e) {
+}
+
+L: try {
+ throw { toString: function() { sentinel = "observed"; } };
+} finally {
+ break L;
+}
+
+assertNull(sentinel);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-491062.js b/src/v8/test/mjsunit/regress/regress-crbug-491062.js
new file mode 100644
index 0000000..d2cd757
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-491062.js
@@ -0,0 +1,22 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --stack-size=100
+
+function g() {}
+
+var count = 0;
+function f() {
+ try {
+ f();
+ } catch(e) {
+ print(e.stack);
+ }
+ if (count < 100) {
+ count++;
+ %DebugGetLoadedScripts();
+ }
+}
+f();
+g();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-493284.js b/src/v8/test/mjsunit/regress/regress-crbug-493284.js
new file mode 100644
index 0000000..64f9463
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-493284.js
@@ -0,0 +1,10 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --invoke-weak-callbacks --omit-quit --no-test
+
+if (this.Intl) {
+ var coll = new Intl.Collator();
+ assertEquals(-1, coll.compare('a', 'c'));
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-493290.js b/src/v8/test/mjsunit/regress/regress-crbug-493290.js
new file mode 100644
index 0000000..6ff9fe1
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-493290.js
@@ -0,0 +1,9 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function f() {
+ throw "boom";
+ try {} catch (e) {}
+}
+assertThrows(f);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-493779.js b/src/v8/test/mjsunit/regress/regress-crbug-493779.js
new file mode 100644
index 0000000..1071ed2
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-493779.js
@@ -0,0 +1,11 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --enable-slow-asserts
+
+var s = "\u1234-------";
+for (var i = 0; i < 17; i++) {
+ s += s;
+}
+s.replace(/[\u1234]/g, "");
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-495493.js b/src/v8/test/mjsunit/regress/regress-crbug-495493.js
new file mode 100644
index 0000000..149ebdc
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-495493.js
@@ -0,0 +1,12 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --enable-slow-asserts --debug-code
+
+function foo(p) {
+ for (var i = 0; i < 100000; ++i) {
+ p = Math.min(-1, 0);
+ }
+}
+foo(0);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-498022.js b/src/v8/test/mjsunit/regress/regress-crbug-498022.js
new file mode 100644
index 0000000..178eb8e
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-498022.js
@@ -0,0 +1,15 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --debug-code
+
+"use strict";
+class Base {
+}
+class Derived extends Base {
+ constructor() {
+ eval();
+ }
+}
+assertThrows("new Derived()", ReferenceError);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-498811.js b/src/v8/test/mjsunit/regress/regress-crbug-498811.js
new file mode 100644
index 0000000..53f57b8
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-498811.js
@@ -0,0 +1,9 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// NO HARNESS
+
+"use strict";
+let l = 0;
+eval("eval('this')");
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-500435.js b/src/v8/test/mjsunit/regress/regress-crbug-500435.js
new file mode 100644
index 0000000..acc17ac
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-500435.js
@@ -0,0 +1,22 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function bar(a) {
+ delete a[1];
+}
+
+function foo(a) {
+ var d;
+ for (d in a) {
+ assertFalse(d === undefined);
+ bar(a);
+ }
+}
+
+foo([1,2]);
+foo([2,3]);
+%OptimizeFunctionOnNextCall(foo);
+foo([1,2]);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-500497.js b/src/v8/test/mjsunit/regress/regress-crbug-500497.js
new file mode 100644
index 0000000..4917193
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-500497.js
@@ -0,0 +1,36 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// New space must be at max capacity to trigger pretenuring decision.
+// Flags: --allow-natives-syntax --verify-heap --max-semi-space-size=1
+// Flags: --expose-gc --no-always-opt
+
+var global = []; // Used to keep some objects alive.
+
+function Ctor() {
+ var result = {a: {}, b: {}, c: {}, d: {}, e: {}, f: {}, g: {}};
+ return result;
+}
+
+gc();
+
+for (var i = 0; i < 120; i++) {
+ // Make the "a" property long-lived, while everything else is short-lived.
+ global.push(Ctor().a);
+ (function FillNewSpace() { new Array(10000); })();
+}
+
+// The bad situation is only triggered if Ctor wasn't optimized too early.
+assertUnoptimized(Ctor);
+// Optimized code for Ctor will pretenure the "a" property, so it will have
+// three allocations:
+// #1 Allocate the "result" object in new-space.
+// #2 Allocate the object stored in the "a" property in old-space.
+// #3 Allocate the objects for the "b" through "g" properties in new-space.
+%OptimizeFunctionOnNextCall(Ctor);
+for (var i = 0; i < 10000; i++) {
+ // At least one of these calls will run out of new space. The bug is
+ // triggered when it is allocation #3 that triggers GC.
+ Ctor();
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-500824.js b/src/v8/test/mjsunit/regress/regress-crbug-500824.js
new file mode 100644
index 0000000..08d0d10
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-500824.js
@@ -0,0 +1,23 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function get_thrower() {
+ "use strict";
+ return Object.getOwnPropertyDescriptor(arguments, "callee").get;
+}
+
+var f = (function(v) {
+ "use asm";
+ function fun() {
+ switch (v) {}
+ }
+ return {
+ fun: fun
+ };
+})(get_thrower()).fun;
+
+%OptimizeFunctionOnNextCall(f);
+f();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-501711.js b/src/v8/test/mjsunit/regress/regress-crbug-501711.js
new file mode 100644
index 0000000..b253e9c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-501711.js
@@ -0,0 +1,18 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --stack-size=100
+
+function f() {
+ try {
+ f();
+ } catch(e) {
+ try {
+ Realm.create();
+ } catch (e) {
+ quit();
+ }
+ }
+}
+f();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-501808.js b/src/v8/test/mjsunit/regress/regress-crbug-501808.js
new file mode 100644
index 0000000..f9b9784
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-501808.js
@@ -0,0 +1,6 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var r = Realm.create();
+assertEquals(0, "a".localeCompare("a"));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-501809.js b/src/v8/test/mjsunit/regress/regress-crbug-501809.js
new file mode 100644
index 0000000..aa235bc
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-501809.js
@@ -0,0 +1,11 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-sharedarraybuffer
+var sab = new SharedArrayBuffer(8);
+var ta = new Int32Array(sab);
+ta.__defineSetter__('length', function() {;});
+assertThrows(function() {
+ Atomics.compareExchange(ta, 4294967295, 0, 0);
+}, RangeError);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-502930.js b/src/v8/test/mjsunit/regress/regress-crbug-502930.js
new file mode 100644
index 0000000..ef21a1a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-502930.js
@@ -0,0 +1,27 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+
+var accessor_to_data_case = (function() {
+ var v = {};
+ Object.defineProperty(v, "foo", { get: function() { return 42; }, configurable: true});
+
+ var obj = {};
+ obj["boom"] = v;
+
+ Object.defineProperty(v, "foo", { value: 0, writable: true, configurable: true });
+ return obj;
+})();
+
+
+var data_to_accessor_case = (function() {
+ var v = {};
+ Object.defineProperty(v, "bar", { value: 0, writable: true, configurable: true });
+
+ var obj = {};
+ obj["bam"] = v;
+
+ Object.defineProperty(v, "bar", { get: function() { return 42; }, configurable: true});
+ return obj;
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-503578.js b/src/v8/test/mjsunit/regress/regress-crbug-503578.js
new file mode 100644
index 0000000..1274d91
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-503578.js
@@ -0,0 +1,14 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+if (this.Worker) {
+ function __f_0(byteLength) {
+ var __v_1 = new ArrayBuffer(byteLength);
+ var __v_5 = new Uint32Array(__v_1);
+ return __v_5;
+ }
+ var __v_6 = new Worker('onmessage = function() {}');
+ var __v_3 = __f_0(16);
+ __v_6.postMessage(__v_3);
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-503698.js b/src/v8/test/mjsunit/regress/regress-crbug-503698.js
new file mode 100644
index 0000000..415d1bc
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-503698.js
@@ -0,0 +1,9 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --invoke-weak-callbacks
+
+if (this.Worker) {
+ var __v_6 = new Worker('');
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-503968.js b/src/v8/test/mjsunit/regress/regress-crbug-503968.js
new file mode 100644
index 0000000..78d1c7b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-503968.js
@@ -0,0 +1,13 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+if (this.Worker) {
+ function __f_0() { this.s = new Object(); }
+ function __f_1() {
+ this.l = [new __f_0, new __f_0];
+ }
+ __v_6 = new __f_1;
+ var __v_9 = new Worker('');
+ __v_9.postMessage(__v_6);
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-503991.js b/src/v8/test/mjsunit/regress/regress-crbug-503991.js
new file mode 100644
index 0000000..6a3b0de
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-503991.js
@@ -0,0 +1,9 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+if (this.Worker) {
+ __v_3 = "";
+ var __v_6 = new Worker('');
+ __v_6.postMessage(__v_3);
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-504136.js b/src/v8/test/mjsunit/regress/regress-crbug-504136.js
new file mode 100644
index 0000000..4ed6843
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-504136.js
@@ -0,0 +1,9 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+if (this.Worker) {
+ var __v_10 = new Worker('');
+ __v_10.terminate();
+ __v_10.getMessage();
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-504727.js b/src/v8/test/mjsunit/regress/regress-crbug-504727.js
new file mode 100644
index 0000000..16d8ff1
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-504727.js
@@ -0,0 +1,9 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --no-test
+
+if (this.Worker) {
+ var __v_2 = new Worker('');
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-504729.js b/src/v8/test/mjsunit/regress/regress-crbug-504729.js
new file mode 100644
index 0000000..435cafe
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-504729.js
@@ -0,0 +1,9 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+if (this.Worker) {
+ Function.prototype.toString = "foo";
+ function __f_7() {}
+ assertThrows(function() { var __v_5 = new Worker(__f_7.toString()); });
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-504787.js b/src/v8/test/mjsunit/regress/regress-crbug-504787.js
new file mode 100644
index 0000000..ac592e0
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-504787.js
@@ -0,0 +1,13 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function f() {
+ "use asm";
+ function g() {
+ function f() {};
+ }
+ return g;
+}
+
+f()();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-505007-1.js b/src/v8/test/mjsunit/regress/regress-crbug-505007-1.js
new file mode 100644
index 0000000..910f4a6
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-505007-1.js
@@ -0,0 +1,18 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --stack-size=100 --allow-natives-syntax
+
+var count = 0;
+function f() {
+ try {
+ f();
+ } catch(e) {
+ if (count < 100) {
+ count++;
+ %GetDebugContext();
+ }
+ }
+}
+f();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-505354.js b/src/v8/test/mjsunit/regress/regress-crbug-505354.js
new file mode 100644
index 0000000..61c40c4
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-505354.js
@@ -0,0 +1,14 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turbo-filter=f
+
+function f() {
+ "use strict";
+ try {
+ for (let i = 0; i < 10; i++) {}
+ } catch(e) {}
+}
+%OptimizeFunctionOnNextCall(f);
+f();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-505370.js b/src/v8/test/mjsunit/regress/regress-crbug-505370.js
new file mode 100644
index 0000000..f67d82b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-505370.js
@@ -0,0 +1,22 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var o = {
+ get 0() { reference_error; },
+ get length() { return 1; }
+};
+
+var method_name;
+
+try {
+ o[0];
+} catch (e) {
+ thrown = true;
+ Error.prepareStackTrace = function(exception, frames) { return frames; };
+ var frames = e.stack;
+ Error.prepareStackTrace = undefined;
+ method_name = frames[0].getMethodName();
+}
+
+assertEquals("0", method_name);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-505778.js b/src/v8/test/mjsunit/regress/regress-crbug-505778.js
new file mode 100644
index 0000000..74d96ab
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-505778.js
@@ -0,0 +1,8 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+if (this.Worker) {
+ var __v_7 = new Worker('onmessage = function() {}');
+ __v_7.postMessage("");
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-505907.js b/src/v8/test/mjsunit/regress/regress-crbug-505907.js
new file mode 100644
index 0000000..ec7b80b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-505907.js
@@ -0,0 +1,12 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+try {
+ var p = new Proxy({}, {
+ getPropertyDescriptor: function() { return [] }
+ });
+ var o = Object.create(p);
+ with (o) { unresolved_name() }
+} catch(e) {
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-506443.js b/src/v8/test/mjsunit/regress/regress-crbug-506443.js
new file mode 100644
index 0000000..490edf0
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-506443.js
@@ -0,0 +1,89 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt --no-always-opt
+
+assertSame = function assertSame() {
+ if (found === expected) {
+ if (1 / expected) return;
+ } else if ((expected !== expected) && (found !== found)) {
+ return;
+ };
+};
+assertEquals = function assertEquals() {
+ if (expected) {;
+ }
+};
+assertArrayEquals = function assertArrayEquals() {
+ var start = "";
+ if (name_opt) {
+ start = name_opt + " - ";
+ };
+ if (expected.length == found.length) {
+ for (var i = 0; i < expected.length; ++i) {;
+ }
+ }
+};
+assertPropertiesEqual = function assertPropertiesEqual() {
+ if (found) {;
+ }
+};
+assertToStringEquals = function assertToStringEquals() {
+ if (found) {;
+ }
+};
+assertTrue = function assertTrue() {;
+};
+assertFalse = function assertFalse() {;
+};
+assertUnreachable = function assertUnreachable() {
+ var message = "Fail" + "ure: unreachable";
+ if (name_opt) {
+ message += " - " + name_opt;
+ }
+};
+OptimizationStatus = function() {}
+assertUnoptimized = function assertUnoptimized() {;
+}
+assertOptimized = function assertOptimized() {;
+}
+triggerAssertFalse = function() {}
+var __v_2 = {};
+var __v_3 = {};
+var __v_4 = {};
+var __v_5 = {};
+var __v_6 = 1073741823;
+var __v_7 = {};
+var __v_8 = {};
+var __v_9 = {};
+var __v_10 = {};
+var __v_11 = 2147483648;
+var __v_12 = 1073741823;
+var __v_13 = {};
+var __v_14 = {};
+var __v_15 = -2147483648;
+var __v_16 = {};
+var __v_17 = {};
+var __v_19 = {};
+var __v_20 = {};
+var __v_21 = {};
+var __v_22 = {};
+var __v_23 = {};
+var __v_24 = {};
+try {
+ (function() {
+ var Debug = %GetDebugContext().Debug;
+
+ function __f_0() {}
+ for (var __v_0 = 0; __v_0 < 3; __v_0++) {
+ var __v_2 = function() {
+ a = 1;
+ }
+ Debug.setListener(__f_0);
+ if (__v_0 < 2) Debug.setBreakPoint(__v_2);
+ }
+ })();
+} catch (e) {
+ print();
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-506549.js b/src/v8/test/mjsunit/regress/regress-crbug-506549.js
new file mode 100644
index 0000000..40e162c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-506549.js
@@ -0,0 +1,10 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+if (this.Worker) {
+ var __v_5 = {};
+ __v_5.__defineGetter__('byteLength', function() {foo();});
+ var __v_8 = new Worker('onmessage = function() {};');
+ assertThrows(function() { __v_8.postMessage(__v_5); });
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-506956.js b/src/v8/test/mjsunit/regress/regress-crbug-506956.js
new file mode 100644
index 0000000..8bca708
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-506956.js
@@ -0,0 +1,12 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+try {
+ var p = new Proxy({}, {
+ getPropertyDescriptor: function() { throw "boom"; }
+ });
+ var o = Object.create(p);
+ with (o) { delete unresolved_name; }
+} catch(e) {
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-507070.js b/src/v8/test/mjsunit/regress/regress-crbug-507070.js
new file mode 100644
index 0000000..0cb14b2
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-507070.js
@@ -0,0 +1,20 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --cache=code --no-debug-code
+
+try { } catch(e) { }
+try { try { } catch (e) { } } catch(e) { }
+try {
+ var Debug = %GetDebugContext().Debug;
+ Debug.setListener(function(){});
+} catch(e) { }
+(function() {
+ Debug.setBreakPoint(function(){}, 0, 0);
+})();
+
+var a = 1;
+a += a;
+Debug.setListener(null);
+assertEquals(2, a);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-510426.js b/src/v8/test/mjsunit/regress/regress-crbug-510426.js
new file mode 100644
index 0000000..c82dbac
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-510426.js
@@ -0,0 +1,7 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var s = new String('a');
+s[10000000] = 'bente';
+assertEquals(['0', '10000000'], Object.keys(s));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-510738.js b/src/v8/test/mjsunit/regress/regress-crbug-510738.js
new file mode 100644
index 0000000..0e154a9
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-510738.js
@@ -0,0 +1,17 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function check(f, result) {
+ %OptimizeFunctionOnNextCall(f);
+ assertEquals(result, f());
+}
+
+var x = 17;
+function generic_load() { return x; }
+check(generic_load, 17);
+
+function generic_store() { x = 13; return x; }
+check(generic_store, 13);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-511880.js b/src/v8/test/mjsunit/regress/regress-crbug-511880.js
new file mode 100644
index 0000000..f9b05ff
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-511880.js
@@ -0,0 +1,13 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+if (this.Worker) {
+ var __v_8 =
+ `var __v_9 = new Worker('postMessage(42)');
+ onmessage = function(parentMsg) {
+ __v_9.postMessage(parentMsg);
+ };`;
+ var __v_9 = new Worker(__v_8);
+ __v_9.postMessage(9);
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-513471.js b/src/v8/test/mjsunit/regress/regress-crbug-513471.js
new file mode 100644
index 0000000..48c793e
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-513471.js
@@ -0,0 +1,10 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var g = (function*(){});
+var f = g();
+%OptimizeFunctionOnNextCall(g);
+f.next();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-513472.js b/src/v8/test/mjsunit/regress/regress-crbug-513472.js
new file mode 100644
index 0000000..456fe0a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-513472.js
@@ -0,0 +1,7 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+this.__proto__ = Error();
+assertThrows(function() { NaN = 1; });
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-513507.js b/src/v8/test/mjsunit/regress/regress-crbug-513507.js
new file mode 100644
index 0000000..ae321ba
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-513507.js
@@ -0,0 +1,24 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// The following triggers a GC in Context::AddToOSROptimizedCodeCache.
+// Flags: --gc-interval=1234 --gc-global
+
+function makeFun() {
+ function fun(osr_fuse) {
+ for (var i = 0; i < 3; ++i) {
+ if (i == osr_fuse) %OptimizeOsr();
+ }
+ for (var i = 3; i < 6; ++i) {
+ if (i == osr_fuse) %OptimizeOsr();
+ }
+ }
+ return fun;
+}
+
+makeFun()(7); // Warm up.
+makeFun()(4); // Optimize once.
+makeFun()(1); // Optimize again.
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-513602.js b/src/v8/test/mjsunit/regress/regress-crbug-513602.js
new file mode 100644
index 0000000..ae0441c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-513602.js
@@ -0,0 +1,26 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function Parent() {}
+
+function Child() {}
+Child.prototype = new Parent();
+var child = new Child();
+
+function crash() {
+ return child.__proto__;
+}
+
+crash();
+crash();
+
+// Trigger a fast->slow->fast dance of Parent.prototype's map...
+Parent.prototype.__defineSetter__("foo", function() { print("A"); });
+Parent.prototype.__defineSetter__("foo", function() { print("B"); });
+// ...and collect more type feedback.
+crash();
+
+// Now modify the prototype chain. The right cell fails to get invalidated.
+delete Object.prototype.__proto__;
+crash();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-514081.js b/src/v8/test/mjsunit/regress/regress-crbug-514081.js
new file mode 100644
index 0000000..ee3ed81
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-514081.js
@@ -0,0 +1,18 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+if (this.Worker) {
+ var __v_7 = new Worker('onmessage = function() {};');
+ var e;
+ var ab = new ArrayBuffer(2 * 1000 * 1000);
+ try {
+ __v_7.postMessage(ab);
+ threw = false;
+ } catch (e) {
+ // postMessage failed, should be a DataCloneError message.
+ assertContains('cloned', e.message);
+ threw = true;
+ }
+ assertTrue(threw, 'Should throw when trying to serialize large message.');
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-515897.js b/src/v8/test/mjsunit/regress/regress-crbug-515897.js
new file mode 100644
index 0000000..45a812c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-515897.js
@@ -0,0 +1,9 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var r1 = new RegExp("\\\\/");
+assertTrue(r1.test("\\/"));
+var r2 = eval("/" + r1.source + "/");
+assertEquals("\\\\\\/", r1.source);
+assertEquals("\\\\\\/", r2.source);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-516592.js b/src/v8/test/mjsunit/regress/regress-crbug-516592.js
new file mode 100644
index 0000000..1887824
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-516592.js
@@ -0,0 +1,18 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var i = Math.pow(2, 31);
+var a = [];
+a[i] = 31;
+var b = [];
+b[i - 2] = 33;
+try {
+ // This is supposed to throw a RangeError.
+ var c = a.concat(b);
+ // If it didn't, ObservableSetLength will detect the problem.
+ Object.observe(c, function() {});
+ c.length = 1;
+} catch(e) {
+ assertTrue(e instanceof RangeError);
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-516775.js b/src/v8/test/mjsunit/regress/regress-crbug-516775.js
new file mode 100644
index 0000000..df190c1
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-516775.js
@@ -0,0 +1,53 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function arguments_with_length_getter(f) {
+ arguments.__defineGetter__('length', f);
+ return arguments;
+}
+
+var count = 0;
+function increment_count_return() { count++; return "boom"; }
+function increment_count_throw() { count++; throw "boom"; }
+
+// Do not read the length of an arguments object on the prototype chain of
+// an array.
+var a1 = [];
+%NormalizeElements(a1);
+a1.__proto__ = arguments_with_length_getter(increment_count_return);
+[].concat(a1);
+assertEquals(0, count);
+
+var a2 = [];
+%NormalizeElements(a2);
+a2.__proto__ = arguments_with_length_getter(increment_count_throw);
+[].concat(a2);
+assertEquals(0, count);
+
+// Do read the length of an arguments object if spreadable.
+var a3 = arguments_with_length_getter(increment_count_return);
+a3[Symbol.isConcatSpreadable] = true;
+[].concat(a3);
+assertEquals(1, count);
+
+var a4 = arguments_with_length_getter(increment_count_throw);
+a4[Symbol.isConcatSpreadable] = true;
+assertThrows(function() { [].concat(a4); });
+assertEquals(2, count);
+
+// Do read the length of an arguments object on the prototype chain of
+// an object.
+var a5 = {};
+a5.__proto__ = arguments_with_length_getter(increment_count_return);
+a5[Symbol.isConcatSpreadable] = true;
+[].concat(a5);
+assertEquals(3, count);
+
+var a6 = {};
+a6.__proto__ = arguments_with_length_getter(increment_count_throw);
+a6[Symbol.isConcatSpreadable] = true;
+assertThrows(function() { [].concat(a6); });
+assertEquals(4, count);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-518747.js b/src/v8/test/mjsunit/regress/regress-crbug-518747.js
new file mode 100644
index 0000000..f1787c4
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-518747.js
@@ -0,0 +1,9 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+if (this.Worker) {
+ Worker.prototype = 12;
+ var __v_6 = new Worker('');
+ __v_6.postMessage([]);
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-522380.js b/src/v8/test/mjsunit/regress/regress-crbug-522380.js
new file mode 100644
index 0000000..eba07f7
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-522380.js
@@ -0,0 +1,7 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var global = this;
+global.__defineSetter__('x', function(v) { x = v; });
+assertThrows("global.x = 0", RangeError);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-522496.js b/src/v8/test/mjsunit/regress/regress-crbug-522496.js
new file mode 100644
index 0000000..e47e0a0
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-522496.js
@@ -0,0 +1,9 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+if (this.Worker) {
+ var worker = new Worker("onmessage = function(){}");
+ var buf = new ArrayBuffer();
+ worker.postMessage(buf, [buf]);
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-522895.js b/src/v8/test/mjsunit/regress/regress-crbug-522895.js
new file mode 100644
index 0000000..f28f3a1
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-522895.js
@@ -0,0 +1,22 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --use-osr
+
+var body =
+ "function bar1( ) {" +
+ " var i = 35; " +
+ " while (i-- > 31) {" +
+ " %OptimizeOsr(); " +
+ " j = 9; " +
+ " while (j-- > 7);" +
+ " } " +
+ " return i; " +
+ "}";
+
+function gen() {
+ return eval("(" + body + ")");
+}
+
+gen()();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-523213.js b/src/v8/test/mjsunit/regress/regress-crbug-523213.js
new file mode 100644
index 0000000..15b16bb
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-523213.js
@@ -0,0 +1,21 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var v1 = [];
+var v2 = [];
+v1.__proto__ = v2;
+
+function f(){
+ var a = [];
+ for(var i=0; i<2; i++){
+ a.push([]);
+ a = v2;
+ }
+}
+
+f();
+%OptimizeFunctionOnNextCall(f);
+f();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-523307.js b/src/v8/test/mjsunit/regress/regress-crbug-523307.js
new file mode 100644
index 0000000..f290967
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-523307.js
@@ -0,0 +1,16 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f(x) {
+ var c = x * x << 366;
+ var a = c + c;
+ return a;
+}
+
+f(1);
+f(1);
+%OptimizeFunctionOnNextCall(f);
+f(1);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-523308.js b/src/v8/test/mjsunit/regress/regress-crbug-523308.js
new file mode 100644
index 0000000..3611479
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-523308.js
@@ -0,0 +1,9 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var error;
+try { reference_error(); } catch (e) { error = e; }
+toString = error.toString;
+error.__proto__ = [];
+assertEquals("Error: reference_error is not defined", toString.call(error));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-523919.js b/src/v8/test/mjsunit/regress/regress-crbug-523919.js
new file mode 100644
index 0000000..4b2a8fe
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-523919.js
@@ -0,0 +1,31 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --cache=code
+
+[1.5,
+[2.5,
+[3.5,
+[4.5,
+[5.5,
+[6.5,
+[7.5,
+[8.5,
+[9.5,
+[10.5,
+[11.5,
+[12.5,
+[13.5,
+[14.5,
+[15.5,
+[16.5,
+[17.5,
+[18.5,
+[19.5,
+[20.5,
+[21.5,
+[22.5,
+[23.5,
+[24.5,
+[25.5]]]]]]]]]]]]]]]]]]]]]]]]];
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-527364.js b/src/v8/test/mjsunit/regress/regress-crbug-527364.js
new file mode 100644
index 0000000..914bed0
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-527364.js
@@ -0,0 +1,26 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --stack-size=100 --allow-natives-syntax
+
+function module() {
+ "use asm";
+ var abs = Math.abs;
+ function f() {
+ return +abs();
+ }
+ return { f:f };
+}
+
+function run_close_to_stack_limit(f) {
+ try {
+ run_close_to_stack_limit(f);
+ f();
+ } catch(e) {
+ }
+}
+
+var boom = module().f;
+%OptimizeFunctionOnNextCall(boom)
+run_close_to_stack_limit(boom);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-528379.js b/src/v8/test/mjsunit/regress/regress-crbug-528379.js
new file mode 100644
index 0000000..f335f6a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-528379.js
@@ -0,0 +1,8 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --enable-slow-asserts
+
+Error.prepareStackTrace = function(e, frames) { return frames; }
+assertThrows(function() { new Error().stack[0].getMethodName.call({}); });
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-530598.js b/src/v8/test/mjsunit/regress/regress-crbug-530598.js
new file mode 100644
index 0000000..f385523
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-530598.js
@@ -0,0 +1,25 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turbo-inlining
+
+var f1 = (function() {
+ "use asm";
+ function g() { throw 0; }
+ function f() { return g(); }
+ return f;
+})();
+assertThrows("f1()");
+%OptimizeFunctionOnNextCall(f1);
+assertThrows("f1()");
+
+var f2 = (function() {
+ "use asm";
+ function g() { for (;;); }
+ function f(a) { return a || g(); }
+ return f;
+})();
+assertTrue(f2(true));
+%OptimizeFunctionOnNextCall(f2);
+assertTrue(f2(true));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-537444.js b/src/v8/test/mjsunit/regress/regress-crbug-537444.js
new file mode 100644
index 0000000..d6fe6b8
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-537444.js
@@ -0,0 +1,26 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --stress-inline
+
+"use strict";
+
+function f(x) {
+ return x;
+}
+
+function g(x) {
+ return false ? 0 : f(x, 1);
+}
+
+function h(x) {
+ var z = g(x, 1);
+ return z + 1;
+}
+
+
+h(1);
+h(1);
+%OptimizeFunctionOnNextCall(h);
+h("a");
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-538086.js b/src/v8/test/mjsunit/regress/regress-crbug-538086.js
new file mode 100644
index 0000000..537cbda
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-538086.js
@@ -0,0 +1,6 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+this[1]++;
+for (var x in this) {};
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-542101.js b/src/v8/test/mjsunit/regress/regress-crbug-542101.js
new file mode 100644
index 0000000..1a4c2b3
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-542101.js
@@ -0,0 +1,10 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(function() {
+ Error.prototype.toString.call({
+ get name() { return { __proto__: this }; },
+ get message() { }
+ });
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-545364.js b/src/v8/test/mjsunit/regress/regress-crbug-545364.js
new file mode 100644
index 0000000..4fe99d0
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-545364.js
@@ -0,0 +1,11 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(function() {
+ "use asm";
+ return function(x) {
+ for (var i = 0; i < 100000; ++i) {}
+ return x;
+ }
+})()(this + "i");
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-546968.js b/src/v8/test/mjsunit/regress/regress-crbug-546968.js
new file mode 100644
index 0000000..51f20c4
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-546968.js
@@ -0,0 +1,14 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --harmony-do-expressions
+
+function f() {
+ print(
+ do {
+ for (var i = 0; i < 10; i++) { if (i == 5) %OptimizeOsr(); }
+ }
+ );
+}
+f();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-548580.js b/src/v8/test/mjsunit/regress/regress-crbug-548580.js
new file mode 100644
index 0000000..cf0afff
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-548580.js
@@ -0,0 +1,15 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function store(v) {
+ var re = /(?=[d#.])/;
+ re.a = v;
+ return re;
+}
+
+var re1 = store(undefined);
+var re2 = store(42);
+
+assertEquals(re1.a, undefined);
+assertEquals(re2.a, 42);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-549162.js b/src/v8/test/mjsunit/regress/regress-crbug-549162.js
new file mode 100644
index 0000000..072bdd5
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-549162.js
@@ -0,0 +1,11 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var s = Symbol("foo");
+var __v_13 = {}
+Object.defineProperty( __v_13, s, {value: {}, enumerable: true});
+for (var __v_14 in __v_13) {}
+__v_13 = {}
+Object.defineProperty( __v_13, s, {value: {}, enumerable: true});
+var __v_14 = Object.create(Object.prototype, __v_13)
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-551287.js b/src/v8/test/mjsunit/regress/regress-crbug-551287.js
new file mode 100644
index 0000000..a85deef
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-551287.js
@@ -0,0 +1,17 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f() { do { } while (true); }
+
+function boom(x) {
+ switch(x) {
+ case 1:
+ case f(): return;
+ }
+}
+
+%OptimizeFunctionOnNextCall(boom)
+boom(1);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-552304.js b/src/v8/test/mjsunit/regress/regress-crbug-552304.js
new file mode 100644
index 0000000..fa3baa3
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-552304.js
@@ -0,0 +1,11 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(function() {
+ "use asm";
+ return function() {
+ for (var i = 0; i < 100000; delete unresolved_name) {++i}
+ return 0;
+ }
+})()(this + "i");
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-554831.js b/src/v8/test/mjsunit/regress/regress-crbug-554831.js
new file mode 100644
index 0000000..3d022b2
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-554831.js
@@ -0,0 +1,15 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+(function() {
+ var key = "s";
+ function f(object) { return object[key]; };
+ f("");
+ f("");
+ %OptimizeFunctionOnNextCall(f);
+ f("");
+ assertOptimized(f);
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-554946.js b/src/v8/test/mjsunit/regress/regress-crbug-554946.js
new file mode 100644
index 0000000..fbb79f6
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-554946.js
@@ -0,0 +1,61 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var array = [];
+var funky = {
+ toJSON: function() { array.length = 1; return "funky"; }
+};
+for (var i = 0; i < 10; i++) array[i] = i;
+array[0] = funky;
+assertEquals('["funky",null,null,null,null,null,null,null,null,null]',
+ JSON.stringify(array));
+
+array = [];
+funky = {
+ get value() { array.length = 1; return "funky"; }
+};
+for (var i = 0; i < 10; i++) array[i] = i;
+array[3] = funky;
+assertEquals('[0,1,2,{"value":"funky"},null,null,null,null,null,null]',
+ JSON.stringify(array));
+
+array = [];
+funky = {
+ get value() { array.pop(); return "funky"; }
+};
+for (var i = 0; i < 10; i++) array[i] = i;
+array[3] = funky;
+assertEquals('[0,1,2,{"value":"funky"},4,5,6,7,8,null]', JSON.stringify(array));
+
+array = [];
+funky = {
+ get value() { delete array[9]; return "funky"; }
+};
+for (var i = 0; i < 10; i++) array[i] = i;
+array[3] = funky;
+assertEquals('[0,1,2,{"value":"funky"},4,5,6,7,8,null]', JSON.stringify(array));
+
+array = [];
+funky = {
+ get value() { delete array[6]; return "funky"; }
+};
+for (var i = 0; i < 10; i++) array[i] = i;
+array[3] = funky;
+assertEquals('[0,1,2,{"value":"funky"},4,5,null,7,8,9]', JSON.stringify(array));
+
+array = [];
+funky = {
+ get value() { array[12] = 12; return "funky"; }
+};
+for (var i = 0; i < 10; i++) array[i] = i;
+array[3] = funky;
+assertEquals('[0,1,2,{"value":"funky"},4,5,6,7,8,9]', JSON.stringify(array));
+
+array = [];
+funky = {
+ get value() { array[10000000] = 12; return "funky"; }
+};
+for (var i = 0; i < 10; i++) array[i] = i;
+array[3] = funky;
+assertEquals('[0,1,2,{"value":"funky"},4,5,6,7,8,9]', JSON.stringify(array));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-557807.js b/src/v8/test/mjsunit/regress/regress-crbug-557807.js
new file mode 100644
index 0000000..a96bc99
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-557807.js
@@ -0,0 +1,11 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function bar() { return { __proto__: this }; }
+function foo(a) { a[0] = 0.3; }
+foo(bar());
+%OptimizeFunctionOnNextCall(foo);
+foo(bar());
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-561973.js b/src/v8/test/mjsunit/regress/regress-crbug-561973.js
new file mode 100644
index 0000000..51b6e61
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-561973.js
@@ -0,0 +1,7 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+Date.parse('Sat, 01 Jan 100 08:00:00 UT-59011430400000');
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-563929.js b/src/v8/test/mjsunit/regress/regress-crbug-563929.js
new file mode 100644
index 0000000..a9a112d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-563929.js
@@ -0,0 +1,31 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var x = 0;
+function a() {
+ eval("");
+ return (function() {
+ eval("");
+ return (function() {
+ eval("");
+ return (function() {
+ eval("");
+ return (function() {
+ eval("");
+ return (function() {
+ eval("");
+ return (function() {
+ eval("");
+ return (function() {
+ eval("");
+ return x;
+ })();
+ }) ();
+ })();
+ })();
+ })();
+ })();
+ })();
+}
+assertEquals(a(), 0);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-565917.js b/src/v8/test/mjsunit/regress/regress-crbug-565917.js
new file mode 100644
index 0000000..2cccedf
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-565917.js
@@ -0,0 +1,7 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+try {
+} catch(e) {; }
+new ArrayBuffer();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-568525.js b/src/v8/test/mjsunit/regress/regress-crbug-568525.js
new file mode 100644
index 0000000..c916bfe
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-568525.js
@@ -0,0 +1,7 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var a = /a/;
+a[4] = 1.5;
+for (var x in a) {}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-569534.js b/src/v8/test/mjsunit/regress/regress-crbug-569534.js
new file mode 100644
index 0000000..e1419ea
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-569534.js
@@ -0,0 +1,7 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var array = [,0.5];
+array.length = 0;
+for (var i in array) {}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-570241.js b/src/v8/test/mjsunit/regress/regress-crbug-570241.js
new file mode 100644
index 0000000..4fecba5
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-570241.js
@@ -0,0 +1,7 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-regexp-lookbehind
+
+assertTrue(/(?<=12345123451234512345)/.test("12345123451234512345"));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-571064.js b/src/v8/test/mjsunit/regress/regress-crbug-571064.js
new file mode 100644
index 0000000..a28a383
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-571064.js
@@ -0,0 +1,19 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --enable-slow-asserts
+
+Array.prototype.__proto__ = null;
+var func = Array.prototype.push;
+var prototype = Array.prototype;
+function CallFunc(a) {
+ func.call(a);
+}
+function CallFuncWithPrototype() {
+ CallFunc(prototype);
+}
+CallFunc([]);
+CallFunc([]);
+%OptimizeFunctionOnNextCall(CallFuncWithPrototype);
+CallFuncWithPrototype();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-571370.js b/src/v8/test/mjsunit/regress/regress-crbug-571370.js
new file mode 100644
index 0000000..5fd9a24
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-571370.js
@@ -0,0 +1,10 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var val = [0.5];
+var arr = [0.5];
+for (var i = -1; i < 1; i++) {
+ arr[i] = val;
+}
+assertEquals(val, arr[-1]);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-571517.js b/src/v8/test/mjsunit/regress/regress-crbug-571517.js
new file mode 100644
index 0000000..ca7d7f7
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-571517.js
@@ -0,0 +1,39 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function Receiver() { this.receiver = "receiver"; }
+function Proto() { this.proto = "proto"; }
+
+function f(a) {
+ return a.foo;
+}
+
+var rec = new Receiver();
+
+// Formerly, this mutated rec.__proto__.__proto__, but
+// the global object prototype chain is now immutable;
+// not sure if this test now hits the original hazard case.
+var proto = rec.__proto__;
+
+// Initialize prototype chain dependent IC (nonexistent load).
+assertEquals(undefined, f(rec));
+assertEquals(undefined, f(rec));
+
+// Add a new prototype to the end of the chain.
+var p2 = new Proto();
+p2.__proto__ = null;
+proto.__proto__ = p2;
+
+// Update the IC.
+assertEquals(undefined, f(rec));
+
+// Now modify the most recently added prototype by adding a property...
+p2.foo = "bar";
+assertEquals("bar", f(rec));
+
+// ...and removing it again. Due to missing prototype user registrations,
+// this fails to invalidate the IC.
+delete p2.foo;
+p2.secret = "GAME OVER";
+assertEquals(undefined, f(rec));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-572590.js b/src/v8/test/mjsunit/regress/regress-crbug-572590.js
new file mode 100644
index 0000000..5871005
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-572590.js
@@ -0,0 +1,10 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc --verify-heap
+
+function g() { }
+var f = g.bind();
+f.__defineGetter__('length', g);
+gc();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-573857.js b/src/v8/test/mjsunit/regress/regress-crbug-573857.js
new file mode 100644
index 0000000..d2892c9
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-573857.js
@@ -0,0 +1,13 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc --verify-heap
+
+function f() {}
+f = f.bind();
+f.x = f.name;
+f.__defineGetter__('name', function() { return f.x; });
+function g() {}
+g.prototype = f;
+gc();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-573858.js b/src/v8/test/mjsunit/regress/regress-crbug-573858.js
new file mode 100644
index 0000000..270df5a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-573858.js
@@ -0,0 +1,16 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var throw_type_error = Object.getOwnPropertyDescriptor(
+ (function() {"use strict"}).__proto__, "caller").get;
+
+function create_initial_map() { this instanceof throw_type_error }
+%OptimizeFunctionOnNextCall(create_initial_map);
+assertThrows(create_initial_map);
+
+function test() { new throw_type_error }
+%OptimizeFunctionOnNextCall(test);
+assertThrows(test);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-575080.js b/src/v8/test/mjsunit/regress/regress-crbug-575080.js
new file mode 100644
index 0000000..c549e9c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-575080.js
@@ -0,0 +1,16 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --es-staging
+
+class A extends Function {
+ constructor(...args) {
+ super(...args);
+ this.a = 42;
+ this.d = 4.2;
+ this.o = 0;
+ }
+}
+var obj = new A("'use strict';");
+obj.o = 0.1;
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-575082.js b/src/v8/test/mjsunit/regress/regress-crbug-575082.js
new file mode 100644
index 0000000..d9cc0f9
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-575082.js
@@ -0,0 +1,5 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var y = new Date("-1073741824");
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-575314.js b/src/v8/test/mjsunit/regress/regress-crbug-575314.js
new file mode 100644
index 0000000..7a5bd4e
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-575314.js
@@ -0,0 +1,15 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// https://code.google.com/p/chromium/issues/detail?id=575314
+
+// Overwriting the constructor of a Promise with something that doesn't have
+// @@species shouldn't result in a rejection, even if that constructor
+// is somewhat bogus.
+
+var test = new Promise(function(){});
+test.constructor = function(){};
+Promise.resolve(test).catch(e => %AbortJS(e + " FAILED!"));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-577112.js b/src/v8/test/mjsunit/regress/regress-crbug-577112.js
new file mode 100644
index 0000000..504f921
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-577112.js
@@ -0,0 +1,15 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+Array.prototype.__proto__ = null;
+var prototype = Array.prototype;
+function f() {
+ prototype.lastIndexOf({});
+}
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+f();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-578039-Proxy_construct_prototype_change.js b/src/v8/test/mjsunit/regress/regress-crbug-578039-Proxy_construct_prototype_change.js
new file mode 100644
index 0000000..30b3f21
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-578039-Proxy_construct_prototype_change.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+
+function target() {};
+
+var proxy = new Proxy(target, {
+ get() {
+ // Reset the initial map of the target.
+ target.prototype = 123;
+ }});
+
+new proxy();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-580506.js b/src/v8/test/mjsunit/regress/regress-crbug-580506.js
new file mode 100644
index 0000000..fb03698
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-580506.js
@@ -0,0 +1,22 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function() {
+ 'use strict';
+ class A extends Function {
+ constructor(...args) {
+ super(...args);
+ this.a = 42;
+ }
+ }
+ var v1 = new A("'use strict';");
+ function f(func) {
+ func.__defineSetter__('a', function() { });
+ }
+ var v2 = new A();
+ f(v2);
+ f(v1);
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-580584.js b/src/v8/test/mjsunit/regress/regress-crbug-580584.js
new file mode 100644
index 0000000..cb6776f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-580584.js
@@ -0,0 +1,19 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function f() { return arguments }
+
+// Reconfiguring function.name should update both the attributes and the value.
+Object.defineProperty(f, "name", {
+ writable: true, configurable: true, value: 10});
+assertEquals({value: 10, writable: true, enumerable: false, configurable: true},
+ Object.getOwnPropertyDescriptor(f, "name"));
+
+var args = f();
+
+// Setting a value for arguments[Symbol.iterator] should not affect the
+// attributes.
+args[Symbol.iterator] = 10;
+assertEquals({value: 10, writable: true, configurable: true, enumerable: false},
+ Object.getOwnPropertyDescriptor(args, Symbol.iterator));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-580934.js b/src/v8/test/mjsunit/regress/regress-crbug-580934.js
new file mode 100644
index 0000000..9f3ffd5
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-580934.js
@@ -0,0 +1,16 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+{
+ let one = () => {
+ return "example.com";
+ };
+
+ let two = () => {
+ return one();
+ };
+
+ assertEquals("example.com", two());
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-581577.js b/src/v8/test/mjsunit/regress/regress-crbug-581577.js
new file mode 100644
index 0000000..d95ada5
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-581577.js
@@ -0,0 +1,5 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertEquals("", RegExp.prototype.flags);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-582703.js b/src/v8/test/mjsunit/regress/regress-crbug-582703.js
new file mode 100644
index 0000000..792266f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-582703.js
@@ -0,0 +1,8 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+%FunctionGetScript({});
+%FunctionGetSourceCode({});
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-583257.js b/src/v8/test/mjsunit/regress/regress-crbug-583257.js
new file mode 100644
index 0000000..85a08c7
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-583257.js
@@ -0,0 +1,27 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+Object.defineProperty(String.prototype, "0", { __v_1: 1});
+Object.defineProperty(String.prototype, "3", { __v_1: 1});
+
+(function () {
+ var s = new String();
+ function set(object, index, value) { object[index] = value; }
+ set(s, 10, "value");
+ set(s, 1073741823, "value");
+})();
+
+function __f_11() {
+ Object.preventExtensions(new String());
+}
+__f_11();
+__f_11();
+
+(function() {
+ var i = 10;
+ var a = new String("foo");
+ for (var j = 0; j < i; j++) {
+ a[j] = {};
+ }
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-584188.js b/src/v8/test/mjsunit/regress/regress-crbug-584188.js
new file mode 100644
index 0000000..f54e559
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-584188.js
@@ -0,0 +1,10 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var x = {};
+try {
+Object.defineProperty(String.prototype, "3", { x: function() { x = v; }});
+string = "bla";
+} catch(e) {; }
+assertThrows("Array.prototype.sort.call(string);", TypeError);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-587068.js b/src/v8/test/mjsunit/regress/regress-crbug-587068.js
new file mode 100644
index 0000000..864f8ce
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-587068.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+// The Crankshaft fast case for String.fromCharCode used to unconditionally
+// deoptimize on non int32 indices.
+function foo(i) { return String.fromCharCode(i); }
+foo(33);
+foo(33);
+%OptimizeFunctionOnNextCall(foo);
+foo(33.3);
+assertOptimized(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-589472.js b/src/v8/test/mjsunit/regress/regress-crbug-589472.js
new file mode 100644
index 0000000..41a5bd6
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-589472.js
@@ -0,0 +1,94 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --stack-size=100
+
+// Not guaranteed to throw because the stack limits are different on all
+// architectures, hence we use try-catch instead of assertThrows here.
+try { f() } catch(e) { assertInstanceof(e, RangeError) }
+
+function f() {
+ return Math.max(
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" +
+ "boom", 1, 2, 3, 4, 5, 6, 7, 8, 9);
+};
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-589792.js b/src/v8/test/mjsunit/regress/regress-crbug-589792.js
new file mode 100644
index 0000000..f735afc
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-589792.js
@@ -0,0 +1,20 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var boom = (function(stdlib, foreign, heap) {
+ "use asm";
+ var MEM8 = new stdlib.Uint8Array(heap);
+ var MEM32 = new stdlib.Int32Array(heap);
+ function foo(i, j) {
+ j = MEM8[256];
+ // This following value '10' determines the value of 'rax'
+ MEM32[j >> 10] = 0xabcdefaa;
+ return MEM32[j >> 2] + j
+ }
+ return foo
+})(this, 0, new ArrayBuffer(256));
+%OptimizeFunctionOnNextCall(boom);
+boom(0, 0x1000);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-590989-1.js b/src/v8/test/mjsunit/regress/regress-crbug-590989-1.js
new file mode 100644
index 0000000..73118eb
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-590989-1.js
@@ -0,0 +1,18 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var o = {}
+var p = {foo: 1.5}
+
+function g(x) { return x.foo === +x.foo; }
+
+assertEquals(false, g(o));
+assertEquals(false, g(o));
+%OptimizeFunctionOnNextCall(g);
+assertEquals(false, g(o)); // Still fine here.
+assertEquals(true, g(p));
+%OptimizeFunctionOnNextCall(g);
+assertEquals(false, g(o)); // Confused by type feedback.
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-590989-2.js b/src/v8/test/mjsunit/regress/regress-crbug-590989-2.js
new file mode 100644
index 0000000..cae1d9d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-590989-2.js
@@ -0,0 +1,12 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f(x) { return x === +x; }
+
+assertEquals(false, f(undefined));
+assertEquals(false, f(undefined));
+%OptimizeFunctionOnNextCall(f);
+assertEquals(false, f(undefined)); // Interestingly this fails right away.
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-592340.js b/src/v8/test/mjsunit/regress/regress-crbug-592340.js
new file mode 100644
index 0000000..49794b8
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-592340.js
@@ -0,0 +1,13 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+class MyArray extends Array { }
+Object.prototype[Symbol.species] = MyArray;
+delete Array[Symbol.species];
+__v_1 = Math.pow(2, 31);
+__v_2 = [];
+__v_2[__v_1] = 31;
+__v_4 = [];
+__v_4[__v_1 - 2] = 33;
+assertThrows(() => __v_2.concat(__v_4), RangeError);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-592343.js b/src/v8/test/mjsunit/regress/regress-crbug-592343.js
new file mode 100644
index 0000000..c98e921
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-592343.js
@@ -0,0 +1,12 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var r = /[^\u{1}-\u{1000}\u{1002}-\u{2000}]/u;
+assertTrue(r.test("\u{0}"));
+assertFalse(r.test("\u{1}"));
+assertFalse(r.test("\u{1000}"));
+assertTrue(r.test("\u{1001}"));
+assertFalse(r.test("\u{1002}"));
+assertFalse(r.test("\u{2000}"));
+assertTrue(r.test("\u{2001}"));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-593282.js b/src/v8/test/mjsunit/regress/regress-crbug-593282.js
new file mode 100644
index 0000000..85c4e10
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-593282.js
@@ -0,0 +1,38 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc --stack-size=120
+
+var __v_11 = {};
+function __f_2(depth) {
+ try {
+ __f_5(depth, __v_11);
+ return true;
+ } catch (e) {
+ gc();
+ }
+}
+function __f_5(n, __v_4) {
+ if (--n == 0) {
+ __f_1(__v_4);
+ return;
+ }
+ __f_5(n, __v_4);
+}
+function __f_1(__v_4) {
+ var __v_5 = new RegExp(__v_4);
+}
+function __f_4() {
+ var __v_1 = 100;
+ var __v_8 = 100000;
+ while (__v_1 < __v_8 - 1) {
+ var __v_3 = Math.floor((__v_1 + __v_8) / 2);
+ if (__f_2(__v_3)) {
+ __v_1 = __v_3;
+ } else {
+ __v_8 = __v_3;
+ }
+ }
+}
+__f_4();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-593697-2.js b/src/v8/test/mjsunit/regress/regress-crbug-593697-2.js
new file mode 100644
index 0000000..c26fdfd
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-593697-2.js
@@ -0,0 +1,16 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --stress-inline
+
+"use strict";
+
+var f5 = (function f6(stdlib) {
+ "use asm";
+ var cos = stdlib.Math.cos;
+ function f5() {
+ return cos();
+ }
+ return { f5: f5 };
+})(this, {}).f5();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-594183.js b/src/v8/test/mjsunit/regress/regress-crbug-594183.js
new file mode 100644
index 0000000..cb80034
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-594183.js
@@ -0,0 +1,86 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt --no-always-opt
+
+var global = {}
+
+var fish = [
+ {'name': 'foo'},
+ {'name': 'bar'},
+];
+
+for (var i = 0; i < fish.length; i++) {
+ global[fish[i].name] = 1;
+}
+
+function load() {
+ var sum = 0;
+ for (var i = 0; i < fish.length; i++) {
+ var name = fish[i].name;
+ sum += global[name];
+ }
+ return sum;
+}
+
+load();
+load();
+%OptimizeFunctionOnNextCall(load);
+load();
+assertOptimized(load);
+
+function store() {
+ for (var i = 0; i < fish.length; i++) {
+ var name = fish[i].name;
+ global[name] = 1;
+ }
+}
+
+store();
+store();
+%OptimizeFunctionOnNextCall(store);
+store();
+assertOptimized(store);
+
+// Regression test for KeyedStoreIC bug: would use PROPERTY mode erroneously.
+
+function store_element(obj, key) {
+ obj[key] = 0;
+}
+
+var o1 = new Array(3);
+var o2 = new Array(3);
+o2.o2 = "o2";
+var o3 = new Array(3);
+o3.o3 = "o3";
+var o4 = new Array(3);
+o4.o4 = "o4";
+var o5 = new Array(3);
+o5.o5 = "o5";
+// Make the KeyedStoreIC megamorphic.
+store_element(o1, 0); // Premonomorphic
+store_element(o1, 0); // Monomorphic
+store_element(o2, 0); // 2-way polymorphic.
+store_element(o3, 0); // 3-way polymorphic.
+store_element(o4, 0); // 4-way polymorphic.
+store_element(o5, 0); // Megamorphic.
+
+function inferrable_store(key) {
+ store_element(o5, key);
+}
+
+inferrable_store(0);
+inferrable_store(0);
+%OptimizeFunctionOnNextCall(inferrable_store);
+inferrable_store(0);
+assertOptimized(inferrable_store);
+// If |inferrable_store| emitted a generic keyed store, it won't deopt upon
+// seeing a property name key. It should have inferred a receiver map and
+// emitted an elements store, however.
+inferrable_store("deopt");
+
+// TurboFan is not sophisticated enough to use key type provided by ICs.
+if (!isTurboFanned(inferrable_store)) {
+ assertUnoptimized(inferrable_store);
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-594574-concat-leak-1.js b/src/v8/test/mjsunit/regress/regress-crbug-594574-concat-leak-1.js
new file mode 100644
index 0000000..d5f51a4
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-594574-concat-leak-1.js
@@ -0,0 +1,36 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc
+
+array = new Array(10);
+array[0] = 0.1;
+// array[1] = THE_HOLE, reading through the prototype chain
+array[2] = 2.1;
+array[3] = 3.1;
+
+var copy = array.slice(0, array.length);
+
+// Change the array's prototype.
+var proto = {};
+array.__proto__ = proto;
+
+// Define [1] on the prototype to alter the array during concatenation.
+Object.defineProperty(
+ proto, 1, {
+ get() {
+ // Alter the array.
+ array.length = 1;
+ // Force gc to move the array.
+ gc();
+ return "value from proto";
+ },
+ set(new_value) { }
+});
+
+var concatted_array = Array.prototype.concat.call(array);
+assertEquals(concatted_array[0], 0.1);
+assertEquals(concatted_array[1], "value from proto");
+assertEquals(concatted_array[2], undefined);
+assertEquals(concatted_array[3], undefined);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-594574-concat-leak-2.js b/src/v8/test/mjsunit/regress/regress-crbug-594574-concat-leak-2.js
new file mode 100644
index 0000000..f359cfd
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-594574-concat-leak-2.js
@@ -0,0 +1,35 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc
+
+array = new Array(10);
+array[0] = 0.1;
+// array[1] = THE_HOLE, reading through the prototype chain
+array[2] = 2.1;
+array[3] = 3.1;
+
+var copy = array.slice(0, array.length);
+
+// Use the defaul array prototype.
+var proto = array.__proto__;
+
+// Define [1] on the prototype to alter the array during concatenation.
+Object.defineProperty(
+ proto, 1, {
+ get() {
+ // Alter the array.
+ array.length = 1;
+ // Force gc to move the array.
+ gc();
+ return "value from proto";
+ },
+ set(new_value) { }
+});
+
+var concatted_array = Array.prototype.concat.call(array);
+assertEquals(concatted_array[0], 0.1);
+assertEquals(concatted_array[1], "value from proto");
+assertEquals(concatted_array[2], undefined);
+assertEquals(concatted_array[3], undefined);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-594955.js b/src/v8/test/mjsunit/regress/regress-crbug-594955.js
new file mode 100644
index 0000000..69db053
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-594955.js
@@ -0,0 +1,11 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function g(s, key) { return s[key]; }
+
+assertEquals(g(new String("a"), "length"), 1);
+assertEquals(g(new String("a"), "length"), 1);
+assertEquals(g("a", 32), undefined);
+assertEquals(g("a", "length"), 1);
+assertEquals(g(new String("a"), "length"), 1);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-595615.js b/src/v8/test/mjsunit/regress/regress-crbug-595615.js
new file mode 100644
index 0000000..f5d0ee5
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-595615.js
@@ -0,0 +1,15 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+"use strict";
+
+function f(o) {
+ return o.x();
+}
+try { f({ x: 1 }); } catch(e) {}
+try { f({ x: 1 }); } catch(e) {}
+%OptimizeFunctionOnNextCall(f);
+try { f({ x: 1 }); } catch(e) {}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-595657.js b/src/v8/test/mjsunit/regress/regress-crbug-595657.js
new file mode 100644
index 0000000..6532597
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-595657.js
@@ -0,0 +1,15 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --stack-size=100
+
+function test() {
+ try {
+ test();
+ } catch(e) {
+ /(\2)(a)/.test("");
+ }
+}
+
+test();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-595738.js b/src/v8/test/mjsunit/regress/regress-crbug-595738.js
new file mode 100644
index 0000000..d2409ab
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-595738.js
@@ -0,0 +1,7 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function foo() { return 1; }
+var x = {toJSON: foo.bind()};
+assertEquals("1", JSON.stringify(x));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-596394.js b/src/v8/test/mjsunit/regress/regress-crbug-596394.js
new file mode 100644
index 0000000..37c8d27
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-596394.js
@@ -0,0 +1,13 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// In ES#sec-array.prototype.concat
+// When concat makes a new integer-indexed exotic object, the resulting properties
+// are non-configurable and cannot have CreateDataPropertyOrThrow called on them,
+// so it throws a TypeError on failure to make a new property.
+
+__v_0 = new Uint8Array(100);
+array = new Array(10);
+array.__proto__ = __v_0;
+assertThrows(() => Array.prototype.concat.call(array), TypeError);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-598998.js b/src/v8/test/mjsunit/regress/regress-crbug-598998.js
new file mode 100644
index 0000000..a2a0262
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-598998.js
@@ -0,0 +1,30 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --stress-inline
+
+"use strict";
+
+function deopt_function(func) {
+ %DeoptimizeFunction(func);
+}
+
+function f(x) {
+ return deopt_function(h);
+}
+
+function g(x) {
+ return f(x, 1);
+}
+
+function h(x) {
+ g(x, 1);
+}
+
+%NeverOptimizeFunction(deopt_function);
+
+h(1);
+h(1);
+%OptimizeFunctionOnNextCall(h);
+h(1);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-599003.js b/src/v8/test/mjsunit/regress/regress-crbug-599003.js
new file mode 100644
index 0000000..da29455
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-599003.js
@@ -0,0 +1,39 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --expose-gc --verify-heap
+
+function A() {}
+
+function g1() {
+ var obj = new A();
+ obj.v0 = 0;
+ obj.v1 = 0;
+ obj.v2 = 0;
+ obj.v3 = 0;
+ obj.v4 = 0;
+ obj.v5 = 0;
+ obj.v6 = 0;
+ obj.v7 = 0;
+ obj.v8 = 0;
+ obj.v9 = 0;
+ return obj;
+}
+
+function g2() {
+ return new A();
+}
+
+var o = g1();
+%OptimizeFunctionOnNextCall(g2);
+g2();
+o = null;
+gc();
+
+for (var i = 0; i < 20; i++) {
+ var o = new A();
+}
+g2();
+
+gc(); // Boom!
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-599067.js b/src/v8/test/mjsunit/regress/regress-crbug-599067.js
new file mode 100644
index 0000000..de3c99a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-599067.js
@@ -0,0 +1,11 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+try {
+ var o = {};
+ var p = new Proxy({}, o);
+ Error.captureStackTrace(p);
+} catch(e) {
+ assertEquals("invalid_argument", e.message);
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-599073-1.js b/src/v8/test/mjsunit/regress/regress-crbug-599073-1.js
new file mode 100644
index 0000000..fc89fe4
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-599073-1.js
@@ -0,0 +1,11 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+Object.defineProperty(Boolean.prototype, "v", {get:constructor});
+
+function foo(b) { return b.v; }
+
+foo(true);
+foo(true);
+foo(true);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-599073-2.js b/src/v8/test/mjsunit/regress/regress-crbug-599073-2.js
new file mode 100644
index 0000000..947468a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-599073-2.js
@@ -0,0 +1,11 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+Object.defineProperty(Boolean.prototype, "v", {set:constructor});
+
+function foo(b) { b.v = 1; }
+
+foo(true);
+foo(true);
+foo(true);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-599073-3.js b/src/v8/test/mjsunit/regress/regress-crbug-599073-3.js
new file mode 100644
index 0000000..2892f56
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-599073-3.js
@@ -0,0 +1,11 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+Object.defineProperty(Number.prototype, "v", {get:constructor});
+
+function foo(b) { return b.v; }
+
+foo(2);
+foo(3);
+foo(4);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-599073-4.js b/src/v8/test/mjsunit/regress/regress-crbug-599073-4.js
new file mode 100644
index 0000000..0d6854c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-599073-4.js
@@ -0,0 +1,11 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+Object.defineProperty(Number.prototype, "v", {set:constructor});
+
+function foo(b) { b.v = 1; }
+
+foo(2);
+foo(3);
+foo(4);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-599714.js b/src/v8/test/mjsunit/regress/regress-crbug-599714.js
new file mode 100644
index 0000000..98de340
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-599714.js
@@ -0,0 +1,13 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var custom_toString = function() {
+ var boom = custom_toString.caller;
+ return boom;
+}
+
+var object = {};
+object.toString = custom_toString;
+
+try { Object.hasOwnProperty(object); } catch (e) {}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-600257.js b/src/v8/test/mjsunit/regress/regress-crbug-600257.js
new file mode 100644
index 0000000..87bd2e3
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-600257.js
@@ -0,0 +1,13 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --stack-size=100
+
+(function rec() {
+ try {
+ rec();
+ } catch (e) {
+ /{/;
+ }
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-601617.js b/src/v8/test/mjsunit/regress/regress-crbug-601617.js
new file mode 100644
index 0000000..e1a5cbd
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-601617.js
@@ -0,0 +1,32 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function h() {
+ var res = g.arguments[0].x;
+ return res;
+}
+
+function g(o) {
+ var res = h();
+ return res;
+}
+
+function f1() {
+ var o = { x : 1 };
+ var res = g(o);
+ return res;
+}
+
+function f0() {
+ "use strict";
+ return f1(5);
+}
+
+%NeverOptimizeFunction(h);
+f0();
+f0();
+%OptimizeFunctionOnNextCall(f0);
+assertEquals(1, f0());
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-602184.js b/src/v8/test/mjsunit/regress/regress-crbug-602184.js
new file mode 100644
index 0000000..c7d793b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-602184.js
@@ -0,0 +1,17 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function f(test, a) {
+ var v;
+ if (test) {
+ v = v|0;
+ }
+ a[v] = 1;
+}
+var v = new String();
+f(false, v);
+f(false, v);
+
+v = new Int32Array(10);
+f(true, v);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-602595.js b/src/v8/test/mjsunit/regress/regress-crbug-602595.js
new file mode 100644
index 0000000..7f6d478
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-602595.js
@@ -0,0 +1,12 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turbo-escape
+
+function f(a) { return [a] }
+
+assertEquals([23], f(23));
+assertEquals([42], f(42));
+%OptimizeFunctionOnNextCall(f);
+assertEquals([65], f(65));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-603463.js b/src/v8/test/mjsunit/regress/regress-crbug-603463.js
new file mode 100644
index 0000000..20bfae6
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-603463.js
@@ -0,0 +1,16 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function load(a, i) {
+ return a[i];
+}
+
+function f() {
+ return load(new Proxy({}, {}), undefined);
+}
+
+f();
+f();
+load([11, 22, 33], 0);
+f();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-604299.js b/src/v8/test/mjsunit/regress/regress-crbug-604299.js
new file mode 100644
index 0000000..9908f2d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-604299.js
@@ -0,0 +1,9 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+Array.prototype.__defineSetter__(0,function(value){});
+
+if (this.Intl) {
+ var o = new Intl.DateTimeFormat('en-US', {'timeZone': 'Asia/Katmandu'})
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-604680.js b/src/v8/test/mjsunit/regress/regress-crbug-604680.js
new file mode 100644
index 0000000..8835807
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-604680.js
@@ -0,0 +1,45 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function h() {
+ var res = g.arguments;
+ return res;
+}
+
+function g(o) {
+ var res = h();
+ return res;
+}
+
+function f1() {
+ var o = { x : 42 };
+ var res = g(o);
+ return 1;
+}
+
+function f0(a, b) {
+ "use strict";
+ return f1(5);
+}
+
+function boom(b) {
+ if (b) throw new Error("boom!");
+}
+
+%NeverOptimizeFunction(h);
+f0();
+f0();
+%OptimizeFunctionOnNextCall(f0);
+
+boom(false);
+boom(false);
+%OptimizeFunctionOnNextCall(boom);
+
+try {
+ f0(1, 2, 3);
+ boom(true, 1, 2, 3);
+} catch (e) {
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-605060.js b/src/v8/test/mjsunit/regress/regress-crbug-605060.js
new file mode 100644
index 0000000..d2dc79a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-605060.js
@@ -0,0 +1,10 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+Array.prototype.__defineGetter__('map', function(){});
+Array.prototype.__defineGetter__('map', function(){});
+Array.prototype.__defineGetter__('map', function(){});
+assertTrue(%HasFastProperties(Array.prototype));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-605862.js b/src/v8/test/mjsunit/regress/regress-crbug-605862.js
new file mode 100644
index 0000000..82a5d45
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-605862.js
@@ -0,0 +1,6 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+/[]*1/u.exec("\u1234");
+/[^\u0000-\u{10ffff}]*1/u.exec("\u1234");
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-608278.js b/src/v8/test/mjsunit/regress/regress-crbug-608278.js
new file mode 100644
index 0000000..c8d2fcc
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-608278.js
@@ -0,0 +1,61 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --stress-inline
+
+"use strict";
+
+function h() {
+ var stack = (new Error("boom")).stack;
+ print(stack);
+ %DeoptimizeFunction(f1);
+ %DeoptimizeFunction(f2);
+ %DeoptimizeFunction(f3);
+ %DeoptimizeFunction(g);
+ %DeoptimizeFunction(h);
+ return 1;
+}
+%NeverOptimizeFunction(h);
+
+function g(v) {
+ return h();
+}
+
+
+function f1() {
+ var o = {};
+ o.__defineGetter__('p', g);
+ o.p;
+}
+
+f1();
+f1();
+%OptimizeFunctionOnNextCall(f1);
+f1();
+
+
+function f2() {
+ var o = {};
+ o.__defineSetter__('q', g);
+ o.q = 1;
+}
+
+f2();
+f2();
+%OptimizeFunctionOnNextCall(f2);
+f2();
+
+
+function A() {
+ return h();
+}
+
+function f3() {
+ new A();
+}
+
+f3();
+f3();
+%OptimizeFunctionOnNextCall(f3);
+f3();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-608279.js b/src/v8/test/mjsunit/regress/regress-crbug-608279.js
new file mode 100644
index 0000000..22c69f2
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-608279.js
@@ -0,0 +1,18 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --always-opt --no-lazy
+
+function __f_38() {
+ try {
+ throw 0;
+ } catch (e) {
+ eval();
+ var __v_38 = { a: 'hest' };
+ __v_38.m = function () { return __v_38.a; };
+ }
+ return __v_38;
+}
+var __v_40 = __f_38();
+__v_40.m();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-609029.js b/src/v8/test/mjsunit/regress/regress-crbug-609029.js
new file mode 100644
index 0000000..bd77de2
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-609029.js
@@ -0,0 +1,7 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --always-opt --function-context-specialization --gc-interval=14
+// Flags: --turbo-filter=match --verify-heap
+"xxx".match();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-610207.js b/src/v8/test/mjsunit/regress/regress-crbug-610207.js
new file mode 100644
index 0000000..4396a56
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-610207.js
@@ -0,0 +1,13 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+Error.prepareStackTrace = function(exception, frames) {
+ return frames[0].getEvalOrigin();
+}
+
+try {
+ Realm.eval(0, "throw new Error('boom');");
+} catch(e) {
+ print(e.stack);
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-612109.js b/src/v8/test/mjsunit/regress/regress-crbug-612109.js
new file mode 100644
index 0000000..202bd96
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-612109.js
@@ -0,0 +1,8 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+
+s = "string for triggering osr in __f_0";
+for (var i = 0; i < 16; i++) s = s + s;
+decodeURI(encodeURI(s));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-612142.js b/src/v8/test/mjsunit/regress/regress-crbug-612142.js
new file mode 100644
index 0000000..de2dc8d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-612142.js
@@ -0,0 +1,10 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var thrower = {[Symbol.toPrimitive]: function(e) { throw e }};
+try {
+ for (var i = 0; i < 10; i++) { }
+ for (var i = 0.5; i < 100000; ++i) { }
+ for (var i = 16 | 0 || 0 || this || 1; i;) { String.fromCharCode(thrower); }
+} catch (e) { }
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-613494.js b/src/v8/test/mjsunit/regress/regress-crbug-613494.js
new file mode 100644
index 0000000..6fcc1e9
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-613494.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turbo-escape --noanalyze-environment-liveness
+
+function f() {
+ var bound = 0;
+ function g() { return bound }
+}
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+f();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-613570.js b/src/v8/test/mjsunit/regress/regress-crbug-613570.js
new file mode 100644
index 0000000..3cd9857
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-613570.js
@@ -0,0 +1,6 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertEquals("[\n\u26031,\n\u26032\n]",
+ JSON.stringify([1, 2], null, "\u2603"));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-613905.js b/src/v8/test/mjsunit/regress/regress-crbug-613905.js
new file mode 100644
index 0000000..8bb38c9
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-613905.js
@@ -0,0 +1,11 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+Error.prepareStackTrace = (e,s) => s;
+var CallSiteConstructor = Error().stack[0].constructor;
+
+try {
+ (new CallSiteConstructor(3, 6)).toString();
+} catch (e) {
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-613919.js b/src/v8/test/mjsunit/regress/regress-crbug-613919.js
new file mode 100644
index 0000000..cbd3e43
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-613919.js
@@ -0,0 +1,18 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turbo-escape
+
+function g(a) {
+ if (a) return arguments;
+ %DeoptimizeNow();
+ return 23;
+}
+function f() {
+ return g(false);
+}
+assertEquals(23, f());
+assertEquals(23, f());
+%OptimizeFunctionOnNextCall(f);
+assertEquals(23, f());
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-614292.js b/src/v8/test/mjsunit/regress/regress-crbug-614292.js
new file mode 100644
index 0000000..3a67c17
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-614292.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo() {
+ return [] | 0 && values[0] || false;
+}
+
+%OptimizeFunctionOnNextCall(foo);
+try {
+ foo();
+} catch (e) {}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-614644.js b/src/v8/test/mjsunit/regress/regress-crbug-614644.js
new file mode 100644
index 0000000..d219cd3
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-614644.js
@@ -0,0 +1,15 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f(a, x) {
+ a.shift(2, a.length = 2);
+ a[0] = x;
+}
+
+f([ ], 1.1);
+f([1], 1.1);
+%OptimizeFunctionOnNextCall(f);
+f([1], 1.1);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-614727.js b/src/v8/test/mjsunit/regress/regress-crbug-614727.js
new file mode 100644
index 0000000..0845afc
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-614727.js
@@ -0,0 +1,23 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+
+function f(a, b, c) { return arguments }
+function g(...args) { return args }
+
+// On 64-bit machine this produces a 768K array which is sufficiently small to
+// not cause a stack overflow, but big enough to move the allocated arguments
+// object into large object space (kMaxRegularHeapObjectSize == 600K).
+var length = Math.pow(2, 15) * 3;
+var args = new Array(length);
+assertEquals(length, f.apply(null, args).length);
+assertEquals(length, g.apply(null, args).length);
+
+// On 32-bit machines this produces an equally sized array, however it might in
+// turn trigger a stack overflow on 64-bit machines, which we need to catch.
+var length = Math.pow(2, 16) * 3;
+var args = new Array(length);
+try { f.apply(null, args) } catch(e) {}
+try { g.apply(null, args) } catch(e) {}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-615774.js b/src/v8/test/mjsunit/regress/regress-crbug-615774.js
new file mode 100644
index 0000000..ea5e675
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-615774.js
@@ -0,0 +1,11 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+Error.prepareStackTrace = (e,s) => s;
+var CallSiteConstructor = Error().stack[0].constructor;
+
+try {
+ (new CallSiteConstructor(CallSiteConstructor, 6)).toString();
+} catch (e) {
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-616709-1.js b/src/v8/test/mjsunit/regress/regress-crbug-616709-1.js
new file mode 100644
index 0000000..75abe3c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-616709-1.js
@@ -0,0 +1,21 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Make the Object prototype have dictionary properties.
+for (var i = 0; i < 2000; i++) {
+ Object.prototype['X'+i] = true;
+}
+
+function boom(a1) {
+ return a1[0];
+}
+
+var a = new Array(1);
+a[0] = 0.1;
+boom(a);
+boom(a);
+%OptimizeFunctionOnNextCall(boom);
+boom(a);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-616709-2.js b/src/v8/test/mjsunit/regress/regress-crbug-616709-2.js
new file mode 100644
index 0000000..27e5d2d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-616709-2.js
@@ -0,0 +1,21 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Make the Array prototype have dictionary properties.
+for (var i = 0; i < 2000; i++) {
+ Array.prototype['X'+i] = true;
+}
+
+function boom(a1) {
+ return a1[0];
+}
+
+var a = new Array(1);
+a[0] = 0.1;
+boom(a);
+boom(a);
+%OptimizeFunctionOnNextCall(boom);
+boom(a);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-617524.js b/src/v8/test/mjsunit/regress/regress-crbug-617524.js
new file mode 100644
index 0000000..b32eeef
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-617524.js
@@ -0,0 +1,18 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc --always-opt
+
+function f(a,b,c) {
+ a.a = b;
+ a[1] = c;
+ return a;
+}
+
+f(new Array(5),.5,0);
+var o1 = f(new Array(5),0,.5);
+gc();
+var o2 = f(new Array(5),0,0);
+var o3 = f(new Array(5),0);
+assertEquals(0, o3.a);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-617527.js b/src/v8/test/mjsunit/regress/regress-crbug-617527.js
new file mode 100644
index 0000000..cf46628
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-617527.js
@@ -0,0 +1,8 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --enable-slow-asserts
+
+Object.defineProperty(Array.prototype, "1", { get: toLocaleString });
+assertThrows(_ => new RegExp(0, 0));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-617567.js b/src/v8/test/mjsunit/regress/regress-crbug-617567.js
new file mode 100644
index 0000000..f0c696e
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-617567.js
@@ -0,0 +1,24 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --turbo-filter=* --allow-natives-syntax
+
+var v1 = {};
+function g() {
+ v1 = [];
+ for (var i = 0; i < 1; i++) {
+ v1[i]();
+ }
+}
+
+var v2 = {};
+var v3 = {};
+function f() {
+ v3 = v2;
+ g();
+}
+
+assertThrows(g);
+%OptimizeFunctionOnNextCall(f);
+assertThrows(f);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-618788.js b/src/v8/test/mjsunit/regress/regress-crbug-618788.js
new file mode 100644
index 0000000..a104d8d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-618788.js
@@ -0,0 +1,21 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Slice and splice both try to set the length property of their return
+// value. Add a bogus setter to allow that.
+Object.defineProperty(Int32Array.prototype, 'length', { set(v) { } });
+
+(function testSlice() {
+ var a = new Array();
+ a.constructor = Int32Array;
+ a.length = 1000; // Make the length >= 1000 so UseSparseVariant returns true.
+ assertTrue(a.slice() instanceof Int32Array);
+})();
+
+(function testSplice() {
+ var a = new Array();
+ a.constructor = Int32Array;
+ a.length = 1000; // Make the length >= 1000 so UseSparseVariant returns true.
+ assertTrue(a.splice(1) instanceof Int32Array);
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-618845.js b/src/v8/test/mjsunit/regress/regress-crbug-618845.js
new file mode 100644
index 0000000..ea3baba
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-618845.js
@@ -0,0 +1,16 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function Foo() {}
+Object.defineProperty(Foo.prototype, "name",
+ {get: function() { return "FooName"; }});
+
+function ic(f) {
+ return f.prototype.name;
+}
+
+assertEquals("FooName", ic(Foo));
+assertEquals("FooName", ic(Foo)); // Don't crash, don't time out.
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-619476.js b/src/v8/test/mjsunit/regress/regress-crbug-619476.js
new file mode 100644
index 0000000..33204ae
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-619476.js
@@ -0,0 +1,7 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var x = {};
+// Crashes in debug mode if an erroneous DCHECK in dfb8d333 is not removed.
+eval, x[eval];
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-620119.js b/src/v8/test/mjsunit/regress/regress-crbug-620119.js
new file mode 100644
index 0000000..cbe5a78
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-620119.js
@@ -0,0 +1,8 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --no-lazy
+
+assertEquals(0, ((x, {[(x = function() { y = 0 }, "foo")]: y = eval(1)}) => { x(); return y })(42, {}));
+assertEquals(0, (function (x, {[(x = function() { y = 0 }, "foo")]: y = eval(1)}) { x(); return y })(42, {}));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-620253.js b/src/v8/test/mjsunit/regress/regress-crbug-620253.js
new file mode 100644
index 0000000..811a4e7
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-620253.js
@@ -0,0 +1,7 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --throws
+
+load("test/mjsunit/regress/regress-crbug-620253.js");
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-620650.js b/src/v8/test/mjsunit/regress/regress-crbug-620650.js
new file mode 100644
index 0000000..25a92ca
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-620650.js
@@ -0,0 +1,16 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(function() {
+ function f(src, dst, i) {
+ dst[i] = src[i];
+ }
+ var buf = new ArrayBuffer(16);
+ var view_int32 = new Int32Array(buf);
+ view_int32[1] = 0xFFF7FFFF;
+ var view_f64 = new Float64Array(buf);
+ var arr = [,0.1];
+ f(view_f64, arr, -1);
+ f(view_f64, arr, 0);
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-621611.js b/src/v8/test/mjsunit/regress/regress-crbug-621611.js
new file mode 100644
index 0000000..bf9a460
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-621611.js
@@ -0,0 +1,11 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertEquals(Math.E, Math.exp(1));
+assertEquals(Math.LN10, Math.log(10));
+assertEquals(Math.LN2, Math.log(2));
+assertEquals(Math.LOG10E, Math.log10(Math.E));
+assertEquals(Math.LOG2E, Math.log2(Math.E));
+assertEquals(Math.SQRT1_2, Math.sqrt(0.5));
+assertEquals(Math.SQRT2, Math.sqrt(2));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-621816.js b/src/v8/test/mjsunit/regress/regress-crbug-621816.js
new file mode 100644
index 0000000..8ef291a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-621816.js
@@ -0,0 +1,18 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f() {
+ var o = {};
+ o.a = 1;
+}
+function g() {
+ var o = { ['a']: function(){} };
+ f();
+}
+f();
+f();
+%OptimizeFunctionOnNextCall(g);
+g();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-621868.js b/src/v8/test/mjsunit/regress/regress-crbug-621868.js
new file mode 100644
index 0000000..dcd7b87
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-621868.js
@@ -0,0 +1,20 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --verify-heap
+
+function f(a) { // First parameter is tagged.
+ var n = 1 + a;
+}
+
+function g() {
+ f();
+ var d = {x : f()};
+ return [d];
+}
+
+g();
+g();
+%OptimizeFunctionOnNextCall(g);
+g();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-624747.js b/src/v8/test/mjsunit/regress/regress-crbug-624747.js
new file mode 100644
index 0000000..7927263
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-624747.js
@@ -0,0 +1,22 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --es-staging
+
+"use strict";
+
+function bar() {
+ try {
+ unref;
+ } catch (e) {
+ return (1 instanceof TypeError) && unref(); // Call in tail position!
+ }
+}
+
+function foo() {
+ return bar(); // Call in tail position!
+}
+
+%OptimizeFunctionOnNextCall(foo);
+foo();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-624919.js b/src/v8/test/mjsunit/regress/regress-crbug-624919.js
new file mode 100644
index 0000000..5a2b100
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-624919.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f(a, b, c, d, e) {
+ if (a && (b, c ? d() : e())) return 0;
+}
+
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+f();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-625547.js b/src/v8/test/mjsunit/regress/regress-crbug-625547.js
new file mode 100644
index 0000000..20eb85d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-625547.js
@@ -0,0 +1,21 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --expose-gc
+
+var v1 = {};
+v1 = 0;
+var v2 = {};
+v2 = 0;
+gc();
+
+var minus_zero = {z:-0.0}.z;
+var nan = undefined + 1;
+function f() {
+ v1 = minus_zero;
+ v2 = nan;
+};
+%OptimizeFunctionOnNextCall(f);
+f();
+gc(); // Boom!
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-625590.js b/src/v8/test/mjsunit/regress/regress-crbug-625590.js
new file mode 100644
index 0000000..aa9ff8a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-625590.js
@@ -0,0 +1,12 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var obj = {};
+function f() {}
+f.prototype = {
+ mSloppy() {
+ super[obj] = 15;
+ }
+};
+new f().mSloppy();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-626715.js b/src/v8/test/mjsunit/regress/regress-crbug-626715.js
new file mode 100644
index 0000000..e842fa6
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-626715.js
@@ -0,0 +1,28 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Create a prototype object which has a lot of fast properties.
+var body = "";
+for (var i = 0; i < 100; i++) {
+ body += `this.a${i} = 0;\n`;
+}
+var Proto = new Function(body);
+
+function A() {}
+A.prototype = new Proto();
+
+// Create a object and add properties that already exist in the prototype.
+// At some point the object will turn into a dictionary mode and one of
+// the fast details from the prototype will be reinterpreted as a details
+// for a new property ...
+var o = new A();
+for (var i = 0; i < 100; i++) {
+ o["a" + i] = i;
+}
+
+// ... which will break the enumeration order of the slow properties.
+var names = Object.getOwnPropertyNames(o);
+for (var i = 0; i < 100; i++) {
+ assertEquals("a" + i, names[i]);
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-627828.js b/src/v8/test/mjsunit/regress/regress-crbug-627828.js
new file mode 100644
index 0000000..12c59a3
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-627828.js
@@ -0,0 +1,71 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function TestDeoptFromComputedNameInObjectLiteral() {
+ function f() {
+ var o = {
+ toString: function() {
+ %DeoptimizeFunction(f);
+ return "x";
+ }
+ };
+ return { [o]() { return 23 } };
+ }
+ assertEquals(23, f().x());
+ assertEquals(23, f().x());
+ %OptimizeFunctionOnNextCall(f);
+ assertEquals(23, f().x());
+})();
+
+(function TestDeoptFromComputedNameInObjectLiteralWithModifiedPrototype() {
+ // The prototype chain should not be used if the definition
+ // happens in the object literal.
+
+ Object.defineProperty(Object.prototype, 'x_proto', {
+ get: function () {
+ return 21;
+ },
+ set: function () {
+ }
+ });
+
+
+ function f() {
+ var o = {
+ toString: function() {
+ %DeoptimizeFunction(f);
+ return "x_proto";
+ }
+ };
+ return { [o]() { return 23 } };
+ }
+ assertEquals(23, f().x_proto());
+ assertEquals(23, f().x_proto());
+ %OptimizeFunctionOnNextCall(f);
+ assertEquals(23, f().x_proto());
+
+ delete Object.prototype.c;
+
+})();
+
+(function TestDeoptFromComputedNameInClassLiteral() {
+ function g() {
+ var o = {
+ toString: function() {
+ %DeoptimizeFunction(g);
+ return "y";
+ }
+ };
+ class C {
+ [o]() { return 42 };
+ }
+ return new C();
+ }
+ assertEquals(42, g().y());
+ assertEquals(42, g().y());
+ %OptimizeFunctionOnNextCall(g);
+ assertEquals(42, g().y());
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-627934.js b/src/v8/test/mjsunit/regress/regress-crbug-627934.js
new file mode 100644
index 0000000..242dc4a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-627934.js
@@ -0,0 +1,12 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var x = "1".repeat(32 * 1024 * 1024);
+for (var z = x;;) {
+ try {
+ z += {toString: function() { return x; }};
+ } catch (e) {
+ break;
+ }
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-627935.js b/src/v8/test/mjsunit/regress/regress-crbug-627935.js
new file mode 100644
index 0000000..fdc4d2a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-627935.js
@@ -0,0 +1,12 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+if (this.Intl) {
+ assertThrows("Intl.DateTimeFormat('en-US', {timeZone: 0})", RangeError);
+ assertThrows("Intl.DateTimeFormat('en-US', {timeZone: true})", RangeError);
+ assertThrows("Intl.DateTimeFormat('en-US', {timeZone: null})", RangeError);
+
+ var object = { toString: function() { return "UTC" } };
+ assertDoesNotThrow("Intl.DateTimeFormat('en-US', {timeZone: object})");
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-628573.js b/src/v8/test/mjsunit/regress/regress-crbug-628573.js
new file mode 100644
index 0000000..5ba184d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-628573.js
@@ -0,0 +1,17 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var z = {valueOf: function() { return 3; }};
+
+(function() {
+ try {
+ var tmp = { x: 12 };
+ with (tmp) {
+ z++;
+ }
+ throw new Error("boom");
+ } catch(e) {}
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-629062.js b/src/v8/test/mjsunit/regress/regress-crbug-629062.js
new file mode 100644
index 0000000..228ae6d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-629062.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(x) {
+ return 1 + ((1 == 0) && undefined);
+}
+
+foo(false);
+foo(false);
+%OptimizeFunctionOnNextCall(foo);
+foo(true);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-629435.js b/src/v8/test/mjsunit/regress/regress-crbug-629435.js
new file mode 100644
index 0000000..b73f601
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-629435.js
@@ -0,0 +1,19 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function bar(v) {
+ v.constructor;
+}
+
+bar([]);
+bar([]);
+
+function foo() {
+ var x = -0;
+ bar(x + 1);
+}
+%OptimizeFunctionOnNextCall(foo);
+foo();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-629823.js b/src/v8/test/mjsunit/regress/regress-crbug-629823.js
new file mode 100644
index 0000000..bbf74b8
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-629823.js
@@ -0,0 +1,17 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var o = {}
+function bar() {
+ o[0] = +o[0];
+ o = /\u23a1|__v_4/;
+}
+bar();
+bar();
+bar();
+function foo() { bar(); }
+%OptimizeFunctionOnNextCall(foo);
+foo();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-630559.js b/src/v8/test/mjsunit/regress/regress-crbug-630559.js
new file mode 100644
index 0000000..f9623ed
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-630559.js
@@ -0,0 +1,7 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+assertThrows("try{}%");
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-630561.js b/src/v8/test/mjsunit/regress/regress-crbug-630561.js
new file mode 100644
index 0000000..798f33d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-630561.js
@@ -0,0 +1,13 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --gc-interval=30
+
+var dict_elements = {};
+
+for (var i= 0; i< 100; i++) {
+ dict_elements[2147483648 + i] = i;
+}
+
+var keys = Object.keys(dict_elements);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-630923.js b/src/v8/test/mjsunit/regress/regress-crbug-630923.js
new file mode 100644
index 0000000..ff0d2dd
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-630923.js
@@ -0,0 +1,16 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var o = {};
+function bar(o) {
+ return 1 + (o.t ? 1 : 2);
+}
+function foo() {
+ bar(o);
+}
+foo();
+%OptimizeFunctionOnNextCall(foo);
+foo();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-630951.js b/src/v8/test/mjsunit/regress/regress-crbug-630951.js
new file mode 100644
index 0000000..58af024
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-630951.js
@@ -0,0 +1,12 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo() {
+ "use asm";
+ var o = new Int32Array(64 * 1024);
+ return () => { o[i1 >> 2] | 0; }
+}
+assertThrows(foo());
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-630952.js b/src/v8/test/mjsunit/regress/regress-crbug-630952.js
new file mode 100644
index 0000000..42d30a3
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-630952.js
@@ -0,0 +1,25 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --always-opt
+try {
+function __f_4(sign_bit,
+ mantissa_29_bits) {
+}
+__f_4.prototype.returnSpecial = function() {
+ this.mantissa_29_bits * mantissa_29_shift;
+}
+__f_4.prototype.toSingle = function() {
+ if (-65535) return this.toSingleSubnormal();
+}
+__f_4.prototype.toSingleSubnormal = function() {
+ if (__v_15) {
+ var __v_7 = this.mantissa_29_bits == -1 &&
+ (__v_13 & __v_10 ) == 0;
+ }
+ __v_8 >>= __v_7;
+}
+__v_14 = new __f_4();
+__v_14.toSingle();
+} catch(e) {}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-631027.js b/src/v8/test/mjsunit/regress/regress-crbug-631027.js
new file mode 100644
index 0000000..f3d04b8
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-631027.js
@@ -0,0 +1,12 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turbo-escape
+
+function f() {
+ with ({ value:"foo" }) { return value; }
+}
+assertEquals("foo", f());
+%OptimizeFunctionOnNextCall(f);
+assertEquals("foo", f());
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-631318-1.js b/src/v8/test/mjsunit/regress/regress-crbug-631318-1.js
new file mode 100644
index 0000000..bd40dcd
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-631318-1.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(x) { return x < x; }
+foo(1);
+foo(2);
+
+function bar(x) { foo(x); }
+%OptimizeFunctionOnNextCall(bar);
+
+assertThrows(() => bar(Symbol.toPrimitive));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-631318-10.js b/src/v8/test/mjsunit/regress/regress-crbug-631318-10.js
new file mode 100644
index 0000000..1c4fcca
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-631318-10.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(x) { return x << x; }
+foo(1);
+foo(2);
+
+function bar(x) { foo(x); }
+%OptimizeFunctionOnNextCall(bar);
+
+assertThrows(() => bar(Symbol.toPrimitive));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-631318-11.js b/src/v8/test/mjsunit/regress/regress-crbug-631318-11.js
new file mode 100644
index 0000000..a03a125
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-631318-11.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(x) { return x >> x; }
+foo(1);
+foo(2);
+
+function bar(x) { foo(x); }
+%OptimizeFunctionOnNextCall(bar);
+
+assertThrows(() => bar(Symbol.toPrimitive));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-631318-12.js b/src/v8/test/mjsunit/regress/regress-crbug-631318-12.js
new file mode 100644
index 0000000..f710bd0
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-631318-12.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(x) { return x >>> x; }
+foo(1);
+foo(2);
+
+function bar(x) { foo(x); }
+%OptimizeFunctionOnNextCall(bar);
+
+assertThrows(() => bar(Symbol.toPrimitive));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-631318-13.js b/src/v8/test/mjsunit/regress/regress-crbug-631318-13.js
new file mode 100644
index 0000000..7a78448
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-631318-13.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(x) { return x & x; }
+foo(1);
+foo(2);
+
+function bar(x) { foo(x); }
+%OptimizeFunctionOnNextCall(bar);
+
+assertThrows(() => bar(Symbol.toPrimitive));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-631318-14.js b/src/v8/test/mjsunit/regress/regress-crbug-631318-14.js
new file mode 100644
index 0000000..829bf90
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-631318-14.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(x) { return x | x; }
+foo(1);
+foo(2);
+
+function bar(x) { foo(x); }
+%OptimizeFunctionOnNextCall(bar);
+
+assertThrows(() => bar(Symbol.toPrimitive));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-631318-15.js b/src/v8/test/mjsunit/regress/regress-crbug-631318-15.js
new file mode 100644
index 0000000..1257d79
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-631318-15.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(x) { return x ^ x; }
+foo(1);
+foo(2);
+
+function bar(x) { foo(x); }
+%OptimizeFunctionOnNextCall(bar);
+
+assertThrows(() => bar(Symbol.toPrimitive));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-631318-2.js b/src/v8/test/mjsunit/regress/regress-crbug-631318-2.js
new file mode 100644
index 0000000..ce46b27
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-631318-2.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(x) { return x > x; }
+foo(1);
+foo(2);
+
+function bar(x) { foo(x); }
+%OptimizeFunctionOnNextCall(bar);
+
+assertThrows(() => bar(Symbol.toPrimitive));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-631318-3.js b/src/v8/test/mjsunit/regress/regress-crbug-631318-3.js
new file mode 100644
index 0000000..4258b15
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-631318-3.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(x) { return x >= x; }
+foo(1);
+foo(2);
+
+function bar(x) { foo(x); }
+%OptimizeFunctionOnNextCall(bar);
+
+assertThrows(() => bar(Symbol.toPrimitive));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-631318-4.js b/src/v8/test/mjsunit/regress/regress-crbug-631318-4.js
new file mode 100644
index 0000000..7e8cdf8
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-631318-4.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(x) { return x <= x; }
+foo(1);
+foo(2);
+
+function bar(x) { foo(x); }
+%OptimizeFunctionOnNextCall(bar);
+
+assertThrows(() => bar(Symbol.toPrimitive));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-631318-5.js b/src/v8/test/mjsunit/regress/regress-crbug-631318-5.js
new file mode 100644
index 0000000..acdedcb
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-631318-5.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(x) { return x + x; }
+foo(1);
+foo(2);
+
+function bar(x) { foo(x); }
+%OptimizeFunctionOnNextCall(bar);
+
+assertThrows(() => bar(Symbol.toPrimitive));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-631318-6.js b/src/v8/test/mjsunit/regress/regress-crbug-631318-6.js
new file mode 100644
index 0000000..d17772f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-631318-6.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(x) { return x / x; }
+foo(1);
+foo(2);
+
+function bar(x) { foo(x); }
+%OptimizeFunctionOnNextCall(bar);
+
+assertThrows(() => bar(Symbol.toPrimitive));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-631318-7.js b/src/v8/test/mjsunit/regress/regress-crbug-631318-7.js
new file mode 100644
index 0000000..7d03fa8
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-631318-7.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(x) { return x * x; }
+foo(1);
+foo(2);
+
+function bar(x) { foo(x); }
+%OptimizeFunctionOnNextCall(bar);
+
+assertThrows(() => bar(Symbol.toPrimitive));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-631318-8.js b/src/v8/test/mjsunit/regress/regress-crbug-631318-8.js
new file mode 100644
index 0000000..474110b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-631318-8.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(x) { return x % x; }
+foo(1);
+foo(2);
+
+function bar(x) { foo(x); }
+%OptimizeFunctionOnNextCall(bar);
+
+assertThrows(() => bar(Symbol.toPrimitive));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-631318-9.js b/src/v8/test/mjsunit/regress/regress-crbug-631318-9.js
new file mode 100644
index 0000000..ad472e0
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-631318-9.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(x) { return x - x; }
+foo(1);
+foo(2);
+
+function bar(x) { foo(x); }
+%OptimizeFunctionOnNextCall(bar);
+
+assertThrows(() => bar(Symbol.toPrimitive));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-631917.js b/src/v8/test/mjsunit/regress/regress-crbug-631917.js
new file mode 100644
index 0000000..ca7a94c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-631917.js
@@ -0,0 +1,38 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var b = { toString: function() { return "b"; } };
+var c = { toString: function() { return "c"; } };
+
+(function() {
+ var expected_receiver;
+ var obj1 = {
+ a: 100,
+ b_: 200,
+ get b() { assertEquals(expected_receiver, this); return this.b_; },
+ set b(v) { assertEquals(expected_receiver, this); this.b_ = v; },
+ c_: 300,
+ get c() { assertEquals(expected_receiver, this); return this.c_; },
+ set c(v) { assertEquals(expected_receiver, this); this.c_ = v; },
+ };
+ var obj2 = {
+ boom() {
+ super.a++;
+ super[b]++;
+ super[c]++;
+ },
+ }
+ Object.setPrototypeOf(obj2, obj1);
+
+ expected_receiver = obj2;
+ obj2.boom();
+ assertEquals(101, obj2.a);
+ assertEquals(201, obj2[b]);
+ assertEquals(301, obj2[c]);
+
+ expected_receiver = obj1;
+ assertEquals(100, obj1.a);
+ assertEquals(200, obj1[b]);
+ assertEquals(300, obj1[c]);
+}());
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-632800.js b/src/v8/test/mjsunit/regress/regress-crbug-632800.js
new file mode 100644
index 0000000..9848a83
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-632800.js
@@ -0,0 +1,10 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --ignition-osr
+
+function osr() {
+ for (var i = 0; i < 50000; ++i) Math.random();
+}
+osr();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-633585.js b/src/v8/test/mjsunit/regress/regress-crbug-633585.js
new file mode 100644
index 0000000..5b2a52b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-633585.js
@@ -0,0 +1,18 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc --always-opt
+
+function f() { this.x = this.x.x; }
+gc();
+f.prototype.x = { x:1 }
+new f();
+new f();
+
+function g() {
+ function h() {};
+ h.prototype = { set x(value) { } };
+ new f();
+}
+g();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-633884.js b/src/v8/test/mjsunit/regress/regress-crbug-633884.js
new file mode 100644
index 0000000..6f46e96
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-633884.js
@@ -0,0 +1,15 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+try {
+ // Leave "blarg" as the hole in a new ScriptContext.
+ Realm.eval(Realm.current(), "throw Error(); let blarg");
+} catch (e) { }
+
+// Access "blarg" via a dynamic lookup. Should not crash!
+assertThrows(function() {
+ // Prevent full-codegen from optimizing away the %LoadLookupSlot call.
+ eval("var x = 5");
+ blarg;
+});
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-635798.js b/src/v8/test/mjsunit/regress/regress-crbug-635798.js
new file mode 100644
index 0000000..0a89aa1
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-635798.js
@@ -0,0 +1,15 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo() {
+ var x = [];
+ var y = [];
+ x.__proto__ = y;
+ for (var i = 0; i < 10000; ++i) {
+ y[i] = 1;
+ }
+}
+foo();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-635923.js b/src/v8/test/mjsunit/regress/regress-crbug-635923.js
new file mode 100644
index 0000000..5101b79
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-635923.js
@@ -0,0 +1,21 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turbo-filter=f
+
+function f(x) { return x + 23 }
+function g(x) { return f(x) + 42 }
+
+assertEquals(23, f(0));
+assertEquals(24, f(1));
+assertEquals(67, g(2));
+assertEquals(68, g(3));
+
+// Optimize {g} with Crankshaft, causing {f} to be inlined.
+%OptimizeFunctionOnNextCall(g);
+assertEquals(65, g(0));
+
+// Optimize {f} with Turbofan, after it has been inlined.
+%OptimizeFunctionOnNextCall(f);
+assertEquals(23, f(0));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-638551.js b/src/v8/test/mjsunit/regress/regress-crbug-638551.js
new file mode 100644
index 0000000..f812359
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-638551.js
@@ -0,0 +1,18 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --expose-gc --no-lazy
+
+function f() {
+ for (var i = 0; i < 10; i++) if (i == 5) %OptimizeOsr();
+ function g() {}
+ %OptimizeFunctionOnNextCall(g);
+ g();
+}
+f();
+gc(); // Make sure that ...
+gc(); // ... code flushing ...
+gc(); // ... clears code ...
+gc(); // ... attached to {g}.
+f();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-640369.js b/src/v8/test/mjsunit/regress/regress-crbug-640369.js
new file mode 100644
index 0000000..97982d1
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-640369.js
@@ -0,0 +1,15 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function A() {
+ this.x = 0;
+ for (var i = 0; i < max; ) {}
+}
+function foo() {
+ for (var i = 0; i < 1; i = 2) %OptimizeOsr();
+ return new A();
+}
+try { foo(); } catch (e) { }
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-640497.js b/src/v8/test/mjsunit/regress/regress-crbug-640497.js
new file mode 100644
index 0000000..3b90d1b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-640497.js
@@ -0,0 +1,19 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turbo-escape
+
+// Warm up {g} with arrays and strings.
+function g(v) { return v.length; }
+assertEquals(1, g("x"));
+assertEquals(2, g("xy"));
+assertEquals(1, g([1]));
+assertEquals(2, g([1,2]));
+
+// Inline into {f}, where we see only an array.
+function f() { assertEquals(0, g([])); }
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+f();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-642056.js b/src/v8/test/mjsunit/regress/regress-crbug-642056.js
new file mode 100644
index 0000000..ca9fc78
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-642056.js
@@ -0,0 +1,17 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f(o) {
+ return o.x instanceof Array;
+}
+
+var o = { x : 1.5 };
+o.x = 0;
+
+f(o);
+f(o);
+%OptimizeFunctionOnNextCall(f);
+f(o);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-643073.js b/src/v8/test/mjsunit/regress/regress-crbug-643073.js
new file mode 100644
index 0000000..1301ddd
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-643073.js
@@ -0,0 +1,13 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+for (i in [0,0]) {}
+function foo() {
+ i = 0;
+ return i < 0;
+}
+%OptimizeFunctionOnNextCall(foo);
+foo();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-644111.js b/src/v8/test/mjsunit/regress/regress-crbug-644111.js
new file mode 100644
index 0000000..285e3d1
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-644111.js
@@ -0,0 +1,11 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --validate-asm --always-opt
+
+function Module() {
+ "use asm";
+ return {};
+}
+var m = Module();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-644215.js b/src/v8/test/mjsunit/regress/regress-crbug-644215.js
new file mode 100644
index 0000000..969e672
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-644215.js
@@ -0,0 +1,13 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var arr = [...[],,];
+assertTrue(%HasHoleyElements(arr));
+assertEquals(1, arr.length);
+assertFalse(arr.hasOwnProperty(0));
+assertEquals(undefined, arr[0]);
+// Should not crash.
+assertThrows(() => arr[0][0], TypeError);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-644245.js b/src/v8/test/mjsunit/regress/regress-crbug-644245.js
new file mode 100644
index 0000000..8671490
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-644245.js
@@ -0,0 +1,18 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turbo-escape
+
+function f() {
+ try {
+ throw "boom";
+ } catch(e) {
+ %_DeoptimizeNow();
+ }
+}
+
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+f();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-644631.js b/src/v8/test/mjsunit/regress/regress-crbug-644631.js
new file mode 100644
index 0000000..2805fdb
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-644631.js
@@ -0,0 +1,13 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --always-opt
+
+function f() {
+ var obj = Object.freeze({});
+ %_CreateDataProperty(obj, "foo", "bar");
+}
+
+// Should not crash
+assertThrows(f, TypeError);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-644689-1.js b/src/v8/test/mjsunit/regress/regress-crbug-644689-1.js
new file mode 100644
index 0000000..49bf902
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-644689-1.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+for (var i = 0; i < 1024; ++i) Object.prototype["i" + i] = i;
+
+function foo() { [].push(1); }
+
+foo();
+foo();
+%OptimizeFunctionOnNextCall(foo);
+foo();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-644689-2.js b/src/v8/test/mjsunit/regress/regress-crbug-644689-2.js
new file mode 100644
index 0000000..03831b1
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-644689-2.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+for (var i = 0; i < 1024; ++i) Object.prototype["i" + i] = i;
+
+function foo() { [1].pop(); }
+
+foo();
+foo();
+%OptimizeFunctionOnNextCall(foo);
+foo();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-645103.js b/src/v8/test/mjsunit/regress/regress-crbug-645103.js
new file mode 100644
index 0000000..b81b9f2
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-645103.js
@@ -0,0 +1,17 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+class Base {}
+class Subclass extends Base {
+ constructor() {
+ %DeoptimizeNow();
+ super();
+ }
+}
+new Subclass();
+new Subclass();
+%OptimizeFunctionOnNextCall(Subclass);
+new Subclass();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-645438.js b/src/v8/test/mjsunit/regress/regress-crbug-645438.js
new file mode 100644
index 0000000..ff17152
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-645438.js
@@ -0,0 +1,16 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function n(x,y){
+ y = (y-(0x80000000|0)|0);
+ return (x/y)|0;
+};
+var x = -0x80000000;
+var y = 0x7fffffff;
+n(x,y);
+n(x,y);
+%OptimizeFunctionOnNextCall(n);
+assertEquals(x, n(x,y));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-645888.js b/src/v8/test/mjsunit/regress/regress-crbug-645888.js
new file mode 100644
index 0000000..0687972
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-645888.js
@@ -0,0 +1,18 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f() {
+ for (var i = 0; i < 3; ++i) {
+ if (i == 1) {
+ %OptimizeOsr();
+ break; // Trigger next loop.
+ }
+ }
+ while (true) {
+ throw "no loop, thank you";
+ }
+}
+assertThrows(f);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-647217.js b/src/v8/test/mjsunit/regress/regress-crbug-647217.js
new file mode 100644
index 0000000..ab45c9a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-647217.js
@@ -0,0 +1,12 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --stack-size=100 --stress-inline
+
+var source = "return 1" + new Array(2048).join(' + a') + "";
+eval("function g(a) {" + source + "}");
+
+function f(a) { return g(a) }
+%OptimizeFunctionOnNextCall(f);
+try { f(0) } catch(e) {}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-647887.js b/src/v8/test/mjsunit/regress/regress-crbug-647887.js
new file mode 100644
index 0000000..84e598d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-647887.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f(obj) {
+ var key;
+ for (key in obj) { }
+ return key === undefined;
+}
+
+%OptimizeFunctionOnNextCall(f);
+assertFalse(f({ foo:0 }));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-648539.js b/src/v8/test/mjsunit/regress/regress-crbug-648539.js
new file mode 100644
index 0000000..c12f16d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-648539.js
@@ -0,0 +1,17 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f() {
+ "use strict";
+ return undefined(0, 0);
+}
+function g() {
+ return f();
+}
+assertThrows(g, TypeError);
+assertThrows(g, TypeError);
+%OptimizeFunctionOnNextCall(g);
+assertThrows(g, TypeError);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-648737.js b/src/v8/test/mjsunit/regress/regress-crbug-648737.js
new file mode 100644
index 0000000..e78cb20
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-648737.js
@@ -0,0 +1,24 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turbo-escape
+
+function f(str) {
+ var s = "We turn {" + str + "} into a ConsString now";
+ return s.length;
+}
+assertEquals(33, f("a"));
+assertEquals(33, f("b"));
+%OptimizeFunctionOnNextCall(f);
+assertEquals(33, f("c"));
+
+function g(str) {
+ var s = "We also try to materalize {" + str + "} when deopting";
+ %DeoptimizeNow();
+ return s.length;
+}
+assertEquals(43, g("a"));
+assertEquals(43, g("b"));
+%OptimizeFunctionOnNextCall(g);
+assertEquals(43, g("c"));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-648740.js b/src/v8/test/mjsunit/regress/regress-crbug-648740.js
new file mode 100644
index 0000000..c32aa05
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-648740.js
@@ -0,0 +1,9 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(function () {
+ function foo() {
+ const arguments = 42;
+ }
+})()
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-650404.js b/src/v8/test/mjsunit/regress/regress-crbug-650404.js
new file mode 100644
index 0000000..ebf14e6
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-650404.js
@@ -0,0 +1,36 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function c4(w, h) {
+ var size = w * h;
+ if (size < 0) size = 0;
+ return new Uint32Array(size);
+}
+
+for (var i = 0; i < 3; i++) {
+ // Computing -0 as the result makes the "size = w * h" multiplication IC
+ // go into double mode.
+ c4(0, -1);
+}
+// Optimize Uint32ConstructFromLength.
+for (var i = 0; i < 1000; i++) c4(2, 2);
+
+// This array will have a HeapNumber as its length:
+var bomb = c4(2, 2);
+
+function reader(o, i) {
+ // Dummy try-catch, so that TurboFan is used to optimize this.
+ try {} catch(e) {}
+ return o[i];
+}
+// Optimize reader!
+for (var i = 0; i < 3; i++) reader(bomb, 0);
+%OptimizeFunctionOnNextCall(reader);
+reader(bomb, 0);
+
+for (var i = bomb.length; i < 100; i++) {
+ assertEquals(undefined, reader(bomb, i));
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-650933.js b/src/v8/test/mjsunit/regress/regress-crbug-650933.js
new file mode 100644
index 0000000..e579f0d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-650933.js
@@ -0,0 +1,8 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var a = [0, 1, 2, 3, 4, 5, 6, 7, 8];
+var o = {length: 1e40};
+try { new Uint8Array(o); } catch (e) { }
+new Float64Array(a);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-650973.js b/src/v8/test/mjsunit/regress/regress-crbug-650973.js
new file mode 100644
index 0000000..9c2d8c6
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-650973.js
@@ -0,0 +1,18 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var v = {p:0};
+// Turn the object into dictionary mode.
+v.__defineGetter__("p", function() { return 13; });
+
+function f() {
+ var boom = (v.foo = v);
+ assertEquals(v, boom.foo);
+}
+
+f();
+f();
+f();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-651403-global.js b/src/v8/test/mjsunit/regress/regress-crbug-651403-global.js
new file mode 100644
index 0000000..e27e076
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-651403-global.js
@@ -0,0 +1,20 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --always-opt
+
+x = "";
+
+function f () {
+ function g() {
+ try {
+ eval('');
+ return x;
+ } catch(e) {
+ }
+ }
+ return g();
+}
+
+f();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-651403.js b/src/v8/test/mjsunit/regress/regress-crbug-651403.js
new file mode 100644
index 0000000..c180e23
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-651403.js
@@ -0,0 +1,19 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --always-opt
+
+function f () {
+ var x = "";
+ function g() {
+ try {
+ eval('');
+ return x;
+ } catch(e) {
+ }
+ }
+ return g();
+}
+
+f();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-652186-global.js b/src/v8/test/mjsunit/regress/regress-crbug-652186-global.js
new file mode 100644
index 0000000..0e869e2
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-652186-global.js
@@ -0,0 +1,8 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --always-opt
+
+x = 1;
+print(eval("eval('var x = 2'); x;"));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-652186-local.js b/src/v8/test/mjsunit/regress/regress-crbug-652186-local.js
new file mode 100644
index 0000000..39f2834
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-652186-local.js
@@ -0,0 +1,11 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --always-opt
+
+function f() {
+ var x = 1;
+ return eval("eval('var x = 2'); x;");
+}
+f();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-654723.js b/src/v8/test/mjsunit/regress/regress-crbug-654723.js
new file mode 100644
index 0000000..fa81233
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-654723.js
@@ -0,0 +1,16 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var k = "0101010101010101" + "01010101";
+
+function foo(s) {
+ return k + s;
+}
+
+foo("a");
+foo("a");
+%OptimizeFunctionOnNextCall(foo);
+var x = foo("");
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-655004.js b/src/v8/test/mjsunit/regress/regress-crbug-655004.js
new file mode 100644
index 0000000..1cba1ef
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-655004.js
@@ -0,0 +1,15 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(a) {
+ a.x = 0;
+ if (a.x === 0) a[1] = 0.1;
+ a.x = {};
+}
+foo(new Array(1));
+foo(new Array(1));
+%OptimizeFunctionOnNextCall(foo);
+foo(new Array(1));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-656037.js b/src/v8/test/mjsunit/regress/regress-crbug-656037.js
new file mode 100644
index 0000000..47d09aa
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-656037.js
@@ -0,0 +1,15 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(a) {
+ return a.push(true);
+}
+
+var a = [];
+assertEquals(1, foo(a));
+assertEquals(2, foo(a));
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(3, foo(a));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-656275.js b/src/v8/test/mjsunit/regress/regress-crbug-656275.js
new file mode 100644
index 0000000..74b29c1
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-656275.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var a = 1;
+
+function foo(x) { a = Math.fround(x + 1); }
+
+foo(1);
+foo(1);
+%OptimizeFunctionOnNextCall(foo);
+foo(1.3);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-657478.js b/src/v8/test/mjsunit/regress/regress-crbug-657478.js
new file mode 100644
index 0000000..0827a7a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-657478.js
@@ -0,0 +1,13 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(o) { return %_ToLength(o.length); }
+
+foo(new Array(4));
+foo(new Array(Math.pow(2, 32) - 1));
+foo({length: 10});
+%OptimizeFunctionOnNextCall(foo);
+foo({length: 10});
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-658185.js b/src/v8/test/mjsunit/regress/regress-crbug-658185.js
new file mode 100644
index 0000000..60de8d6
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-658185.js
@@ -0,0 +1,20 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turbo-escape
+
+var t = 0;
+function foo() {
+ var o = {x:1};
+ var p = {y:2.5, x:0};
+ o = [];
+ for (var i = 0; i < 2; ++i) {
+ t = o.x;
+ o = p;
+ }
+}
+foo();
+foo();
+%OptimizeFunctionOnNextCall(foo);
+foo();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-658528.js b/src/v8/test/mjsunit/regress/regress-crbug-658528.js
new file mode 100644
index 0000000..a6b0748
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-658528.js
@@ -0,0 +1,10 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function f() {
+ eval("var x = 1");
+ const x = 2;
+}
+
+assertThrows(f, SyntaxError);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-658691.js b/src/v8/test/mjsunit/regress/regress-crbug-658691.js
new file mode 100644
index 0000000..4f226e7
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-658691.js
@@ -0,0 +1,24 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// The {f} function is compiled using TurboFan.
+// 1) The call to {Reflect.set} has no arguments adaptation.
+// 2) The call to {Reflect.set} is in tail position.
+function f(a, b, c) {
+ "use strict";
+ return Reflect.set({});
+}
+
+// The {g} function is compiled using Ignition.
+// 1) The call to {f} requires arguments adaptation.
+// 2) The call to {f} is not in tail position.
+function g() {
+ return f() + "-no-tail";
+}
+
+assertEquals("true-no-tail", g());
+%OptimizeFunctionOnNextCall(f);
+assertEquals("true-no-tail", g());
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-659475-1.js b/src/v8/test/mjsunit/regress/regress-crbug-659475-1.js
new file mode 100644
index 0000000..2648203
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-659475-1.js
@@ -0,0 +1,30 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var n;
+
+function Ctor() {
+ n = new Set();
+}
+
+function Check() {
+ n.xyz = 0x826852f4;
+}
+
+Ctor();
+Ctor();
+%OptimizeFunctionOnNextCall(Ctor);
+Ctor();
+
+Check();
+Check();
+%OptimizeFunctionOnNextCall(Check);
+Check();
+
+Ctor();
+Check();
+
+parseInt('AAAAAAAA');
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-659475-2.js b/src/v8/test/mjsunit/regress/regress-crbug-659475-2.js
new file mode 100644
index 0000000..49e02fd
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-659475-2.js
@@ -0,0 +1,31 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var n;
+
+function Ctor() {
+ try { } catch (e) {}
+ n = new Set();
+}
+
+function Check() {
+ n.xyz = 0x826852f4;
+}
+
+Ctor();
+Ctor();
+%OptimizeFunctionOnNextCall(Ctor);
+Ctor();
+
+Check();
+Check();
+%OptimizeFunctionOnNextCall(Check);
+Check();
+
+Ctor();
+Check();
+
+parseInt('AAAAAAAA');
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-659915a.js b/src/v8/test/mjsunit/regress/regress-crbug-659915a.js
new file mode 100644
index 0000000..507a0f1
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-659915a.js
@@ -0,0 +1,24 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+let x;
+function f(a) {
+ x += a;
+}
+function g(a) {
+ f(a); return x;
+}
+function h(a) {
+ x = a; return x;
+}
+
+function boom() { return g(1) }
+
+assertEquals(1, h(1));
+assertEquals(2, boom());
+assertEquals(3, boom());
+%OptimizeFunctionOnNextCall(boom);
+assertEquals(4, boom());
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-659915b.js b/src/v8/test/mjsunit/regress/regress-crbug-659915b.js
new file mode 100644
index 0000000..6fdb13f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-659915b.js
@@ -0,0 +1,20 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function() {
+ var x = 23;
+ function f() { return x; }
+ function g() { [x] = [x + 1]; }
+ function h() { g(); return x; }
+
+ function boom() { return h() }
+
+ assertEquals(24, boom());
+ assertEquals(25, boom());
+ assertEquals(26, boom());
+ %OptimizeFunctionOnNextCall(boom);
+ assertEquals(27, boom());
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-659967.js b/src/v8/test/mjsunit/regress/regress-crbug-659967.js
new file mode 100644
index 0000000..654f00d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-659967.js
@@ -0,0 +1,8 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function f() { null >> arguments; }
+
+f();
+f();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-660379.js b/src/v8/test/mjsunit/regress/regress-crbug-660379.js
new file mode 100644
index 0000000..8463462
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-660379.js
@@ -0,0 +1,42 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function InlinedThrowAtEndOfTry() {
+ function g() {
+ %DeoptimizeFunction(f);
+ throw "boom";
+ }
+ function f() {
+ try {
+ g(); // Right at the end of try.
+ } catch (e) {
+ assertEquals("boom", e)
+ }
+ }
+ assertDoesNotThrow(f);
+ assertDoesNotThrow(f);
+ %OptimizeFunctionOnNextCall(f);
+ assertDoesNotThrow(f);
+})();
+
+(function InlinedThrowInFrontOfTry() {
+ function g() {
+ %DeoptimizeFunction(f);
+ throw "boom";
+ }
+ function f() {
+ g(); // Right in front of try.
+ try {
+ Math.random();
+ } catch (e) {
+ assertUnreachable();
+ }
+ }
+ assertThrows(f);
+ assertThrows(f);
+ %OptimizeFunctionOnNextCall(f);
+ assertThrows(f);
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-661949.js b/src/v8/test/mjsunit/regress/regress-crbug-661949.js
new file mode 100644
index 0000000..e083cae
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-661949.js
@@ -0,0 +1,15 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var foo = (function() {
+ 'use asm';
+ function foo() { ''[0]; }
+ return foo;
+})();
+
+foo();
+%OptimizeFunctionOnNextCall(foo);
+foo();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-662367.js b/src/v8/test/mjsunit/regress/regress-crbug-662367.js
new file mode 100644
index 0000000..fcaf545
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-662367.js
@@ -0,0 +1,37 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var zero = 0;
+
+(function ConstantFoldZeroDivZero() {
+ function f() {
+ return 0 / zero;
+ }
+ assertTrue(isNaN(f()));
+ assertTrue(isNaN(f()));
+ %OptimizeFunctionOnNextCall(f);
+ assertTrue(isNaN(f()));
+})();
+
+(function ConstantFoldMinusZeroDivZero() {
+ function f() {
+ return -0 / zero;
+ }
+ assertTrue(isNaN(f()));
+ assertTrue(isNaN(f()));
+ %OptimizeFunctionOnNextCall(f);
+ assertTrue(isNaN(f()));
+})();
+
+(function ConstantFoldNaNDivZero() {
+ function f() {
+ return NaN / 0;
+ }
+ assertTrue(isNaN(f()));
+ assertTrue(isNaN(f()));
+ %OptimizeFunctionOnNextCall(f);
+ assertTrue(isNaN(f()));
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-662410.js b/src/v8/test/mjsunit/regress/regress-crbug-662410.js
new file mode 100644
index 0000000..f1cbc6b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-662410.js
@@ -0,0 +1,21 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function g(v) { return v.constructor; }
+
+g({});
+g({});
+
+function f() {
+ var i = 0;
+ do {
+ i = i + 1;
+ g(i);
+ } while (i < 1);
+}
+
+%OptimizeFunctionOnNextCall(f);
+f();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-662830.js b/src/v8/test/mjsunit/regress/regress-crbug-662830.js
new file mode 100644
index 0000000..3126978
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-662830.js
@@ -0,0 +1,19 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f() {
+ %_DeoptimizeNow();
+ throw 1;
+}
+
+function g() {
+ try { f(); } catch(e) { }
+ for (var i = 0; i < 3; ++i) if (i === 1) %OptimizeOsr();
+ %_DeoptimizeNow();
+}
+
+%OptimizeFunctionOnNextCall(g);
+g();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-662854.js b/src/v8/test/mjsunit/regress/regress-crbug-662854.js
new file mode 100644
index 0000000..ecfc990
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-662854.js
@@ -0,0 +1,10 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function f() {
+ typeof boom;
+ boom;
+}
+
+assertThrows(()=>f());
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-662907.js b/src/v8/test/mjsunit/regress/regress-crbug-662907.js
new file mode 100644
index 0000000..3cc3b60
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-662907.js
@@ -0,0 +1,53 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --expose-gc
+
+(function() {
+ function foo() {
+ var a = new Array();
+ a[0] = 10;
+ return a;
+ }
+
+ assertEquals(1, foo().length);
+
+ gc();
+ gc();
+ gc();
+ gc();
+
+ // Change prototype elements from fast smi to slow elements dictionary.
+ // The validity cell is invalidated by the change of Array.prototype's
+ // map.
+ Array.prototype.__defineSetter__("0", function() {});
+
+ assertEquals(0, foo().length);
+})();
+
+
+(function() {
+ function foo() {
+ var a = new Array();
+ a[0] = 10;
+ return a;
+ }
+
+ // Change prototype elements from fast smi to dictionary.
+ Array.prototype[123456789] = 42;
+ Array.prototype.length = 0;
+
+ assertEquals(1, foo().length);
+
+ gc();
+ gc();
+ gc();
+ gc();
+
+ // Change prototype elements from dictionary to slow elements dictionary.
+ // The validity cell is invalidated by making the elements dictionary slow.
+ Array.prototype.__defineSetter__("0", function() {});
+
+ assertEquals(0, foo().length);
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-663340.js b/src/v8/test/mjsunit/regress/regress-crbug-663340.js
new file mode 100644
index 0000000..37d285d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-663340.js
@@ -0,0 +1,32 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var expected = undefined;
+
+function foo() {
+ var a = [0,,{}];
+ a.shift();
+ assertEquals(expected, a[0]);
+}
+foo();
+foo();
+%OptimizeFunctionOnNextCall(foo);
+foo();
+
+expected = 42;
+Array.prototype[0] = 153;
+Array.prototype[1] = expected;
+foo();
+
+function bar() {
+ var a = [0,,{}];
+ a.shift();
+ assertEquals(expected, a[0]);
+}
+bar();
+bar();
+%OptimizeFunctionOnNextCall(bar);
+bar();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-663402.js b/src/v8/test/mjsunit/regress/regress-crbug-663402.js
new file mode 100644
index 0000000..5368bd6
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-663402.js
@@ -0,0 +1,40 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var g_eval = eval;
+function emit_f(size) {
+ var body = "function f(x) {" +
+ " if (x < 0) return x;" +
+ " var a = [1];" +
+ " if (x > 0) return [";
+ for (var i = 0; i < size; i++) {
+ body += "0.1, ";
+ }
+ body += " ];" +
+ " return a;" +
+ "}";
+ g_eval(body);
+}
+
+// Length must be big enough to make the backing store's size not fit into
+// a single instruction's immediate field (2^12).
+var kLength = 701;
+emit_f(kLength);
+f(1);
+f(1);
+%OptimizeFunctionOnNextCall(f);
+var a = f(1);
+
+// Allocating something else should not disturb |a|.
+var b = new Object();
+for (var i = 0; i < kLength; i++) {
+ assertEquals(0.1, a[i]);
+}
+
+// Allocating more should not crash.
+for (var i = 0; i < 300; i++) {
+ f(1);
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-663410.js b/src/v8/test/mjsunit/regress/regress-crbug-663410.js
new file mode 100644
index 0000000..5bef089
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-663410.js
@@ -0,0 +1,8 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function alert(x) {};
+assertThrows(
+ Function("a=`","`,xss=1){alert(xss)")
+);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-663750.js b/src/v8/test/mjsunit/regress/regress-crbug-663750.js
new file mode 100644
index 0000000..1b3b531
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-663750.js
@@ -0,0 +1,26 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var v = 0;
+function foo(a) {
+ v = a;
+}
+this.x = 0;
+delete x;
+
+foo();
+foo();
+%OptimizeFunctionOnNextCall(foo);
+foo();
+assertEquals(undefined, v);
+
+Object.freeze(this);
+
+foo(4);
+foo(5);
+%OptimizeFunctionOnNextCall(foo);
+foo(6);
+assertEquals(undefined, v);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-664084.js b/src/v8/test/mjsunit/regress/regress-crbug-664084.js
new file mode 100644
index 0000000..79e221e
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-664084.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo() {
+ return +({} + 1);
+}
+
+assertEquals(NaN, foo());
+assertEquals(NaN, foo());
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(NaN, foo());
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-664469.js b/src/v8/test/mjsunit/regress/regress-crbug-664469.js
new file mode 100644
index 0000000..e163391
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-664469.js
@@ -0,0 +1,21 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function f(a, i) {
+ a[i] = "object";
+}
+
+f("make it generic", 0);
+
+// Nearly kMaxRegularHeapObjectSize's worth of doubles.
+var kLength = 500000 / 8;
+var kValue = 0.1;
+var a = new Array(kLength);
+for (var i = 0; i < kLength; i++) {
+ a[i] = kValue;
+}
+f(a, 0);
+for (var i = 1; i < kLength; i++) {
+ assertEquals(kValue, a[i]);
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-664506.js b/src/v8/test/mjsunit/regress/regress-crbug-664506.js
new file mode 100644
index 0000000..b0bf5e7
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-664506.js
@@ -0,0 +1,11 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc --predictable --random-seed=-1109634722
+
+gc();
+gc();
+assertEquals("[object Object]", Object.prototype.toString.call({}));
+gc();
+assertEquals("[object Array]", Object.prototype.toString.call([]));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-664802.js b/src/v8/test/mjsunit/regress/regress-crbug-664802.js
new file mode 100644
index 0000000..3395f4c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-664802.js
@@ -0,0 +1,10 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var o = {};
+o.__proto__ = new Proxy({}, {});
+
+var m = new Map();
+m.set({});
+m.set(o);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-664942.js b/src/v8/test/mjsunit/regress/regress-crbug-664942.js
new file mode 100644
index 0000000..3b76990
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-664942.js
@@ -0,0 +1,12 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo() {
+ return 'x'[0];
+}
+foo();
+%OptimizeFunctionOnNextCall(foo);
+assertEquals("x", foo());
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-664974.js b/src/v8/test/mjsunit/regress/regress-crbug-664974.js
new file mode 100644
index 0000000..37ad4f9
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-664974.js
@@ -0,0 +1,13 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+for (var i = 0; i < 2000; i++) {
+ Object.prototype['X'+i] = true;
+}
+
+var m = new Map();
+m.set(Object.prototype, 23);
+
+var o = {};
+m.set(o, 42);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-665587.js b/src/v8/test/mjsunit/regress/regress-crbug-665587.js
new file mode 100644
index 0000000..a9b3841
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-665587.js
@@ -0,0 +1,16 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --expose-gc
+
+var a = new (function() { this[0] = 1 });
+function f() {
+ for (var i = 0; i < 4; ++i) {
+ var x = a[0];
+ (function() { return x });
+ if (i == 1) %OptimizeOsr();
+ gc();
+ }
+}
+f();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-665793.js b/src/v8/test/mjsunit/regress/regress-crbug-665793.js
new file mode 100644
index 0000000..d445d51
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-665793.js
@@ -0,0 +1,12 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo() {
+ return 'x'[1];
+}
+assertEquals(undefined, foo());
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(undefined, foo());
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-665886.js b/src/v8/test/mjsunit/regress/regress-crbug-665886.js
new file mode 100644
index 0000000..b3309c2
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-665886.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+[1].toLocaleString();
+delete Number.prototype.toLocaleString;
+[1].toLocaleString();
+var o = {};
+o.__proto__ = { toString: Array.prototype.toString };
+o.toString();
+Number.prototype.arrayToString = Array.prototype.toString;
+(42).arrayToString();
+var a = [7];
+a.toLocaleString();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-666308.js b/src/v8/test/mjsunit/regress/regress-crbug-666308.js
new file mode 100644
index 0000000..5e0e374
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-666308.js
@@ -0,0 +1,9 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function foo() {}
+foo.prototype = 1;
+v = new foo();
+function bar() { return v instanceof foo; }
+assertThrows(bar);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-666742.js b/src/v8/test/mjsunit/regress/regress-crbug-666742.js
new file mode 100644
index 0000000..d3fba61
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-666742.js
@@ -0,0 +1,15 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc
+
+var p = {x:1};
+__proto__ = p;
+assertEquals(x, 1);
+__proto__ = {x:13};
+assertEquals(x, 13);
+__proto__ = {x:42};
+p = null;
+gc();
+assertEquals(x, 42);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-667689.js b/src/v8/test/mjsunit/regress/regress-crbug-667689.js
new file mode 100644
index 0000000..e83c40e
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-667689.js
@@ -0,0 +1,16 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo() {}
+foo.__defineGetter__(undefined, function() {})
+
+function bar() {}
+function baz(x) { return x instanceof bar };
+%OptimizeFunctionOnNextCall(baz);
+baz();
+Object.setPrototypeOf(bar, null);
+bar[Symbol.hasInstance] = function() { return true };
+assertTrue(baz());
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-668101.js b/src/v8/test/mjsunit/regress/regress-crbug-668101.js
new file mode 100644
index 0000000..5645dce
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-668101.js
@@ -0,0 +1,21 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f(a, i, v) {
+ a[i] = v;
+}
+
+f("make it generic", 0, 0);
+
+var a = new Array(3);
+// Fast properties.
+f(a, "length", 2);
+assertEquals(2, a.length);
+
+// Dictionary properties.
+%OptimizeObjectForAddingMultipleProperties(a, 1);
+f(a, "length", 1);
+assertEquals(1, a.length);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-668414.js b/src/v8/test/mjsunit/regress/regress-crbug-668414.js
new file mode 100644
index 0000000..c374420
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-668414.js
@@ -0,0 +1,58 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(function testSmiArrayConcat() {
+ var result = [].concat([-12]);
+
+ assertEquals(1, result.length);
+ assertEquals([-12], result);
+})();
+
+(function testDoubleArrayConcat() {
+ var result = [].concat([-1073741825]);
+
+ assertEquals(1, result.length);
+ assertEquals([-1073741825], result);
+})();
+
+(function testSmiArrayNonConcatSpreadable() {
+ var array = [-10];
+ array[Symbol.isConcatSpreadable] = false;
+ var result = [].concat(array);
+
+ assertEquals(1, result.length);
+ assertEquals(1, result[0].length);
+ assertEquals([-10], result[0]);
+})();
+
+(function testDoubleArrayNonConcatSpreadable() {
+ var array = [-1073741825];
+ array[Symbol.isConcatSpreadable] = false;
+ var result = [].concat(array);
+
+ assertEquals(1, result.length);
+ assertEquals(1, result[0].length);
+ assertEquals([-1073741825], result[0]);
+})();
+
+Array.prototype[Symbol.isConcatSpreadable] = false;
+
+
+(function testSmiArray() {
+ var result = [].concat([-12]);
+
+ assertEquals(2, result.length);
+ assertEquals(0, result[0].length);
+ assertEquals(1, result[1].length);
+ assertEquals([-12], result[1]);
+})();
+
+(function testDoubleArray() {
+ var result = [].concat([-1073741825]);
+
+ assertEquals(2, result.length);
+ assertEquals(0, result[0].length);
+ assertEquals(1, result[1].length);
+ assertEquals([-1073741825], result[1]);
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-668795.js b/src/v8/test/mjsunit/regress/regress-crbug-668795.js
new file mode 100644
index 0000000..b85d222
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-668795.js
@@ -0,0 +1,21 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function g() {
+ return g.arguments;
+}
+
+function f() {
+ var result = "R:";
+ for (var i = 0; i < 3; ++i) {
+ if (i == 1) %OptimizeOsr();
+ result += g([1])[0];
+ result += g([2])[0];
+ }
+ return result;
+}
+
+assertEquals("R:121212", f());
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-669411.js b/src/v8/test/mjsunit/regress/regress-crbug-669411.js
new file mode 100644
index 0000000..469934f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-669411.js
@@ -0,0 +1,11 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function f(o) {
+ o[5000000] = 0;
+}
+var o = Object.create(null);
+f(o);
+f(o);
+f(o);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-669451.js b/src/v8/test/mjsunit/regress/regress-crbug-669451.js
new file mode 100644
index 0000000..0bbc1c1
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-669451.js
@@ -0,0 +1,15 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo() {
+ var a = [,];
+ a[0] = {}
+ a[0].toString = FAIL;
+}
+try { foo(); } catch (e) {}
+try { foo(); } catch (e) {}
+%OptimizeFunctionOnNextCall(foo);
+try { foo(); } catch (e) {}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-669540.js b/src/v8/test/mjsunit/regress/regress-crbug-669540.js
new file mode 100644
index 0000000..d029d88
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-669540.js
@@ -0,0 +1,15 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function f({
+ [
+ (function g() {
+ assertThrows(function(){
+ print(eval("p"));
+ }, ReferenceError);
+ })()
+ ]: p
+}) {};
+
+f({});
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-669850.js b/src/v8/test/mjsunit/regress/regress-crbug-669850.js
new file mode 100644
index 0000000..50f5940
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-669850.js
@@ -0,0 +1,11 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+eval('function f(a) { return [' + new Array(1 << 17) + ',a] }');
+assertEquals(23, f(23)[1 << 17]);
+assertEquals(42, f(42)[1 << 17]);
+%OptimizeFunctionOnNextCall(f);
+assertEquals(65, f(65)[1 << 17]);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-671576.js b/src/v8/test/mjsunit/regress/regress-crbug-671576.js
new file mode 100644
index 0000000..b9c7bcc
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-671576.js
@@ -0,0 +1,13 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f() {
+ for (var i of [NaN].keys());
+}
+
+f();
+%OptimizeFunctionOnNextCall(f);
+f();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-672792.js b/src/v8/test/mjsunit/regress/regress-crbug-672792.js
new file mode 100644
index 0000000..d458f7c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-672792.js
@@ -0,0 +1,18 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Generate a function {f} containing a large array literal of doubles.
+eval("function f() { return [" + String("0.1,").repeat(65535) + "] }");
+
+// Running the function once will initialize the boilerplate.
+assertEquals(65535, f().length);
+
+// Running the function again will perform cloning.
+assertEquals(65535, f().length);
+
+// Running the function as optimized code next.
+%OptimizeFunctionOnNextCall(f);
+assertEquals(65535, f().length);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-673008.js b/src/v8/test/mjsunit/regress/regress-crbug-673008.js
new file mode 100644
index 0000000..4e232fa
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-673008.js
@@ -0,0 +1,23 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var a = {
+ "33": true,
+ "-1": true
+};
+
+var strkeys = Object.keys(a).map(function(k) { return "" + k });
+var numkeys = Object.keys(a).map(function(k) { return +k });
+var keys = strkeys.concat(numkeys);
+
+keys.forEach(function(k) {
+ assertTrue(a.hasOwnProperty(k),
+ "property not found: " + k + "(" + (typeof k) + ")");
+});
+
+var b = {};
+b.__proto__ = a;
+keys.forEach(function(k) {
+ assertTrue(k in b, "property not found: " + k + "(" + (typeof k) + ")");
+});
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-677757.js b/src/v8/test/mjsunit/regress/regress-crbug-677757.js
new file mode 100644
index 0000000..044970c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-677757.js
@@ -0,0 +1,7 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+for (var i = 0; i < 50000; i++) {
+ ("Foo"[0] + "barbarbarbarbarbar")[0];
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-679202.js b/src/v8/test/mjsunit/regress/regress-crbug-679202.js
new file mode 100644
index 0000000..e435022
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-679202.js
@@ -0,0 +1,14 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var x = Object.prototype;
+
+function f() { return x <= x; }
+
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+f();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-679378.js b/src/v8/test/mjsunit/regress/regress-crbug-679378.js
new file mode 100644
index 0000000..fded13f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-679378.js
@@ -0,0 +1,19 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var x = {};
+x.__defineGetter__('0', () => 0);
+x.a = {v: 1.51};
+
+var y = {};
+y.a = {u:"OK"};
+
+function foo(o) { return o.a.u; }
+foo(y);
+foo(y);
+foo(x);
+%OptimizeFunctionOnNextCall(foo);
+%DebugPrint(foo(x));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-679841.js b/src/v8/test/mjsunit/regress/regress-crbug-679841.js
new file mode 100644
index 0000000..a21c9f2
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-679841.js
@@ -0,0 +1,5 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(-1e-301).toString(2);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-681983.js b/src/v8/test/mjsunit/regress/regress-crbug-681983.js
new file mode 100644
index 0000000..eab161c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-681983.js
@@ -0,0 +1,18 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function g(a) {
+ a = a >>> 0;
+ %_DeoptimizeNow();
+ return a;
+}
+
+function f() {
+ return g(-1);
+}
+
+%OptimizeFunctionOnNextCall(f);
+assertEquals(4294967295, f());
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-682194.js b/src/v8/test/mjsunit/regress/regress-crbug-682194.js
new file mode 100644
index 0000000..62a4347
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-682194.js
@@ -0,0 +1,35 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc
+
+var proxy = new Proxy([], {
+ defineProperty() {
+ w.length = 1; // shorten the array so the backstore pointer is relocated
+ gc(); // force gc to move the array's elements backstore
+ return Object.defineProperty.apply(this, arguments);
+ }
+});
+
+class MyArray extends Array {
+ // custom constructor which returns a proxy object
+ static get[Symbol.species](){
+ return function() {
+ return proxy;
+ }
+ };
+}
+
+var w = new MyArray(100);
+w[1] = 0.1;
+w[2] = 0.1;
+
+var result = Array.prototype.concat.call(w);
+
+assertEquals(undefined, result[0]);
+assertEquals(0.1, result[1]);
+
+for (var i = 2; i < 200; i++) {
+ assertEquals(undefined, result[i]);
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-683581.js b/src/v8/test/mjsunit/regress/regress-crbug-683581.js
new file mode 100644
index 0000000..6b6c54b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-683581.js
@@ -0,0 +1,13 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var v = 0;
+function foo() {
+ for (var i = 0; i < 70000; i++) {
+ v += i;
+ }
+ eval();
+}
+foo()
+assertEquals(2449965000, v);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-683667.js b/src/v8/test/mjsunit/regress/regress-crbug-683667.js
new file mode 100644
index 0000000..adba522
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-683667.js
@@ -0,0 +1,14 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc --verify-heap
+
+var realm = Realm.create();
+var g = Realm.global(realm);
+var obj = {x: 0, g: g};
+
+// Navigation will replace JSGlobalObject behind the JSGlobalProxy g and
+// therefore will change the g's map. The old map must be marked as non-stable.
+Realm.navigate(realm);
+gc();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-684208.js b/src/v8/test/mjsunit/regress/regress-crbug-684208.js
new file mode 100644
index 0000000..7055a7e
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-684208.js
@@ -0,0 +1,15 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo() {
+ var a = [1, 2.3, /*hole*/, 4.2];
+ %_DeoptimizeNow();
+ return a[2];
+}
+assertSame(undefined, foo());
+assertSame(undefined, foo());
+%OptimizeFunctionOnNextCall(foo)
+assertSame(undefined, foo());
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-685050.js b/src/v8/test/mjsunit/regress/regress-crbug-685050.js
new file mode 100644
index 0000000..2560e2e
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-685050.js
@@ -0,0 +1,19 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function bar(a) {
+ a[0] = 0;
+ a[1] = 0;
+}
+
+var a = new Int32Array(2);
+bar([1, 2, 3]);
+function foo() {
+ bar([1, 2, 3]);
+ bar(a);
+}
+%OptimizeFunctionOnNextCall(foo);
+foo();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-685504.js b/src/v8/test/mjsunit/regress/regress-crbug-685504.js
new file mode 100644
index 0000000..83975bf
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-685504.js
@@ -0,0 +1,18 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var v2 = 1073741823;
+var v13 = {};
+function f1(a, b) {
+ var v4 = a + b;
+ var v1 = v4.substring(20);
+ v2[v4];
+ return v1;
+}
+
+v5 = f1("abcdefghijklmnopqrstuvwxyz", "abcdefghijklmnopqrstuvwxyz");
+function f8(name, input, regexp) {
+ var v14 = input.match(regexp);
+ RegExp["$'"]}
+f8("CaptureGlobal", v5, v13, []["anama"]);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-685506.js b/src/v8/test/mjsunit/regress/regress-crbug-685506.js
new file mode 100644
index 0000000..1be9c02
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-685506.js
@@ -0,0 +1,26 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --noconcurrent-recompilation
+
+var a = {};
+
+function init() {
+ a = [];
+ for (var __v_1 = 0; __v_1 < 10016; __v_1++) {
+ a.push({});
+ }
+ a.map(function() {}) + "";
+}
+init();
+
+function foo() {
+ a.push((a + "!", 23));
+ return a;
+}
+assertEquals(23, foo()[10016]);
+assertEquals(23, foo()[10017]);
+assertEquals(23, foo()[10018]);
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(23, foo()[10019]);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-685634.js b/src/v8/test/mjsunit/regress/regress-crbug-685634.js
new file mode 100644
index 0000000..2032744
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-685634.js
@@ -0,0 +1,14 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+"use strict";
+
+function foo(f) { return f.apply(this, arguments); }
+function bar() {}
+
+foo(bar);
+%OptimizeFunctionOnNextCall(foo);
+foo(bar);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-685680.js b/src/v8/test/mjsunit/regress/regress-crbug-685680.js
new file mode 100644
index 0000000..3c23e41
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-685680.js
@@ -0,0 +1,15 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(s) {
+ s = s + '0123456789012';
+ return s.indexOf('0');
+}
+
+assertEquals(0, foo('0'));
+assertEquals(0, foo('0'));
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(0, foo('0'));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-685965.js b/src/v8/test/mjsunit/regress/regress-crbug-685965.js
new file mode 100644
index 0000000..1f2c6c8
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-685965.js
@@ -0,0 +1,13 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function __f_0(a) {
+ var __v_3 = a + undefined;
+ var __v_0 = __v_3.substring(0, 20);
+ var __v_1 = {};
+ __v_1[__v_3];
+ return __v_0;
+}
+__v_4 = __f_0( "abcdefghijklmnopqrstuvwxyz");
+assertEquals("bcdefg", __v_4.substring(7, 1));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-686102.js b/src/v8/test/mjsunit/regress/regress-crbug-686102.js
new file mode 100644
index 0000000..13f4503
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-686102.js
@@ -0,0 +1,15 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var a = [];
+Object.freeze(a);
+function foo() {
+ return a.length;
+}
+assertEquals(0, foo());
+assertEquals(0, foo());
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(0, foo());
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-686427.js b/src/v8/test/mjsunit/regress/regress-crbug-686427.js
new file mode 100644
index 0000000..b1827a4
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-686427.js
@@ -0,0 +1,15 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f(a, base) {
+ a[base + 4] = 23;
+ return a;
+}
+var i = 1073741824;
+assertEquals(23, f({}, 1)[1 + 4]);
+assertEquals(23, f([], 2)[2 + 4]);
+%OptimizeFunctionOnNextCall(f);
+assertEquals(23, f({}, i)[i + 4]);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-686737.js b/src/v8/test/mjsunit/regress/regress-crbug-686737.js
new file mode 100644
index 0000000..aab7113
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-686737.js
@@ -0,0 +1,13 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+Object.prototype.__defineGetter__(0, () => { throw Error() });
+var a = [,0.1];
+function foo(i) { a[i]; }
+foo(1);
+foo(1);
+%OptimizeFunctionOnNextCall(foo);
+assertThrows(() => foo(0), Error);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-687029.js b/src/v8/test/mjsunit/regress/regress-crbug-687029.js
new file mode 100644
index 0000000..c3ca01f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-687029.js
@@ -0,0 +1,14 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(x) {
+ x = Math.clz32(x);
+ return "a".indexOf("a", x);
+}
+foo(1);
+foo(1);
+%OptimizeFunctionOnNextCall(foo);
+foo();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-687990.js b/src/v8/test/mjsunit/regress/regress-crbug-687990.js
new file mode 100644
index 0000000..2410085
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-687990.js
@@ -0,0 +1,16 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var x = 1;
+
+var foo = (function() {
+ "use asm";
+ var o = this;
+ return function() { o.x = null; }
+})();
+
+%OptimizeFunctionOnNextCall(foo);
+foo();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-688567.js b/src/v8/test/mjsunit/regress/regress-crbug-688567.js
new file mode 100644
index 0000000..5f66bc0
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-688567.js
@@ -0,0 +1,36 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+{
+ function a(){}
+ function b(){}
+ function c(){}
+ function d(){}
+ function e(){}
+ function f(){}
+ function g(){}
+ function h(){}
+}
+
+var names = Object.getOwnPropertyNames(this);
+names = names.filter(n => Array.prototype.includes.call("abcdefgh", n));
+assertEquals("a,b,c,d,e,f,g,h", names.join());
+
+{
+ {
+ let j;
+ {
+ // This j will not be hoisted
+ function j(){}
+ }
+ }
+ function i(){}
+
+ // but this j will be.
+ function j(){}
+}
+
+var names = Object.getOwnPropertyNames(this);
+names = names.filter(n => Array.prototype.includes.call("ij", n));
+assertEquals("i,j", names.join());
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-688734.js b/src/v8/test/mjsunit/regress/regress-crbug-688734.js
new file mode 100644
index 0000000..90acd5d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-688734.js
@@ -0,0 +1,16 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function foo(a) {
+ a[0] = 3;
+}
+var v = [,6];
+v.__proto__ = [];
+foo(v);
+delete v[0];
+var count = 0;
+v.__proto__.__defineSetter__(0, function() { count++; });
+foo([1,,,2]);
+foo(v);
+assertEquals(1, count);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-691323.js b/src/v8/test/mjsunit/regress/regress-crbug-691323.js
new file mode 100644
index 0000000..d786875
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-691323.js
@@ -0,0 +1,35 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+var buffer = new ArrayBuffer(0x100);
+var array = new Uint8Array(buffer).fill(55);
+var tmp = {};
+tmp[Symbol.toPrimitive] = function () {
+ %ArrayBufferNeuter(array.buffer)
+ return 0;
+};
+
+
+assertEquals(-1, Array.prototype.indexOf.call(array, 0x00, tmp));
+
+buffer = new ArrayBuffer(0x100);
+array = new Uint8Array(buffer).fill(55);
+tmp = {};
+tmp[Symbol.toPrimitive] = function () {
+ %ArrayBufferNeuter(array.buffer)
+ return 0;
+};
+
+
+assertEquals(false, Array.prototype.includes.call(array, 0x00, tmp));
+
+buffer = new ArrayBuffer(0x100);
+array = new Uint8Array(buffer).fill(55);
+tmp = {};
+tmp[Symbol.toPrimitive] = function () {
+ %ArrayBufferNeuter(array.buffer)
+ return 0;
+};
+assertEquals(true, Array.prototype.includes.call(array, undefined, tmp));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-691687.js b/src/v8/test/mjsunit/regress/regress-crbug-691687.js
new file mode 100644
index 0000000..1d05874
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-691687.js
@@ -0,0 +1,10 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --always-opt --no-lazy --turbo-filter=whatever
+
+function g() { eval() }
+with ({}) { }
+f = ({x}) => x;
+assertEquals(42, f({x: 42}));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-694416.js b/src/v8/test/mjsunit/regress/regress-crbug-694416.js
new file mode 100644
index 0000000..14303f2
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-694416.js
@@ -0,0 +1,17 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var good = 23;
+var boom = 42;
+
+function foo(name) {
+ return this[name];
+}
+
+assertEquals(23, foo('good'));
+assertEquals(23, foo('good'));
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(42, foo('boom'));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-694709.js b/src/v8/test/mjsunit/regress/regress-crbug-694709.js
new file mode 100644
index 0000000..407b477
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-694709.js
@@ -0,0 +1,13 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f(primitive) {
+ return primitive.__proto__;
+}
+assertEquals(Symbol.prototype, f(Symbol()));
+assertEquals(Symbol.prototype, f(Symbol()));
+%OptimizeFunctionOnNextCall(f);
+assertEquals(Symbol.prototype, f(Symbol()));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-696622.js b/src/v8/test/mjsunit/regress/regress-crbug-696622.js
new file mode 100644
index 0000000..5b8d2e3
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-696622.js
@@ -0,0 +1,14 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+class C {}
+class D extends C { constructor() { super(...unresolved, 75) } }
+D.__proto__ = null;
+
+assertThrows(() => new D(), TypeError);
+assertThrows(() => new D(), TypeError);
+%OptimizeFunctionOnNextCall(D);
+assertThrows(() => new D(), TypeError);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-697017.js b/src/v8/test/mjsunit/regress/regress-crbug-697017.js
new file mode 100644
index 0000000..adfaa3b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-697017.js
@@ -0,0 +1,8 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+for (var i = 0; i < 100; i++) {
+ print(i);
+ (Int32Array)["abc" + i] = i;
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-698607.js b/src/v8/test/mjsunit/regress/regress-crbug-698607.js
new file mode 100644
index 0000000..c9df425
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-698607.js
@@ -0,0 +1,22 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function assertSame(expected, found) {
+ if (found === expected) {
+ } else if ((expected !== expected) && (found !== found)) {
+ }
+}
+
+function foo() {
+ var x = {var: 0.5};
+ assertSame(x, x.val);
+ return () => x;
+}
+
+foo(1);
+foo(1);
+%OptimizeFunctionOnNextCall(foo);
+foo(1);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-699282.js b/src/v8/test/mjsunit/regress/regress-crbug-699282.js
new file mode 100644
index 0000000..726b1f7
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-699282.js
@@ -0,0 +1,11 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var v = 1;
+function foo() { return Math.floor(-v / 125); }
+assertEquals(-1, foo());
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(-1, foo());
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-700678.js b/src/v8/test/mjsunit/regress/regress-crbug-700678.js
new file mode 100644
index 0000000..1a9623a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-700678.js
@@ -0,0 +1,20 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(function testNonConfigurableProperty() {
+ function ownKeys(x) { return ["23", "length"]; }
+ var target = [];
+ var proxy = new Proxy(target, {ownKeys:ownKeys});
+ Object.defineProperty(target, "23", {value:true});
+ assertEquals(["23", "length"], Object.getOwnPropertyNames(proxy));
+})();
+
+(function testPreventedExtension() {
+ function ownKeys(x) { return ["42", "length"]; }
+ var target = [];
+ var proxy = new Proxy(target, {ownKeys:ownKeys});
+ target[42] = true;
+ Object.preventExtensions(target);
+ assertEquals(["42", "length"], Object.getOwnPropertyNames(proxy));
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-700733.js b/src/v8/test/mjsunit/regress/regress-crbug-700733.js
new file mode 100644
index 0000000..0a130fa
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-700733.js
@@ -0,0 +1,66 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --verify-heap --expose-gc
+
+(function test_keyed_load() {
+ var smi_arr = [0];
+ smi_arr.load = 42;
+
+ var double_arr = [0.5];
+ double_arr.load = 42;
+
+ var obj_arr = [{}];
+ obj_arr.load = 42;
+
+ var arrs = [smi_arr, double_arr, obj_arr];
+
+ var tmp;
+ function do_keyed_load(arrs) {
+ for (var i = 0; i < arrs.length; i++) {
+ var arr = arrs[i];
+ tmp = arr[0];
+ }
+ }
+
+ var obj = {};
+ obj.load_boom = smi_arr;
+
+ do_keyed_load(arrs);
+ do_keyed_load(arrs);
+ %OptimizeFunctionOnNextCall(do_keyed_load);
+ do_keyed_load(arrs);
+
+ gc();
+})();
+
+(function test_keyed_store() {
+ var smi_arr = [0];
+ smi_arr.store = 42;
+
+ var double_arr = [0.5];
+ double_arr.store = 42;
+
+ var obj_arr = [{}];
+ obj_arr.store = 42;
+
+ var arrs = [smi_arr, double_arr, obj_arr];
+
+ function do_keyed_store(arrs) {
+ for (var i = 0; i < arrs.length; i++) {
+ var arr = arrs[i];
+ arr[0] = 0;
+ }
+ }
+
+ var obj = {};
+ obj.store_boom = smi_arr;
+
+ do_keyed_store(arrs);
+ do_keyed_store(arrs);
+ %OptimizeFunctionOnNextCall(do_keyed_store);
+ do_keyed_store(arrs);
+
+ gc();
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-702058-1.js b/src/v8/test/mjsunit/regress/regress-crbug-702058-1.js
new file mode 100644
index 0000000..6f01906
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-702058-1.js
@@ -0,0 +1,10 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var arr = [];
+for (var i = 0; i < 100000; i++) arr[i] = 0;
+var fromIndex = {valueOf: function() { arr.length = 0; }};
+arr.indexOf(1, fromIndex);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-702058-2.js b/src/v8/test/mjsunit/regress/regress-crbug-702058-2.js
new file mode 100644
index 0000000..a4bb18d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-702058-2.js
@@ -0,0 +1,10 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var arr = [];
+for (var i = 0; i < 100000; i++) arr[i] = 0.1;
+var fromIndex = {valueOf: function() { arr.length = 0; }};
+arr.indexOf(1.1, fromIndex);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-702058-3.js b/src/v8/test/mjsunit/regress/regress-crbug-702058-3.js
new file mode 100644
index 0000000..f78fdc0
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-702058-3.js
@@ -0,0 +1,10 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var arr = [];
+for (var i = 0; i < 100000; i++) arr[i] = [];
+var fromIndex = {valueOf: function() { arr.length = 0; }};
+arr.indexOf({}, fromIndex);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-702793.js b/src/v8/test/mjsunit/regress/regress-crbug-702793.js
new file mode 100644
index 0000000..a2982bc
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-702793.js
@@ -0,0 +1,19 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc
+
+prop = "property";
+
+function f(o) {
+ return o.prop;
+}
+
+f(this);
+f(this);
+
+delete this.prop;
+
+gc();
+assertEquals(undefined, f(this));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-702798.js b/src/v8/test/mjsunit/regress/regress-crbug-702798.js
new file mode 100644
index 0000000..861271a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-702798.js
@@ -0,0 +1,8 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Access any property that's also available on the global of the other realm.
+this.__defineGetter__("Object", ()=>0);
+__proto__ = Realm.global(Realm.create());
+Object;
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-703610.js b/src/v8/test/mjsunit/regress/regress-crbug-703610.js
new file mode 100644
index 0000000..a8901d5
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-703610.js
@@ -0,0 +1,16 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function fun() {};
+fun.prototype = 42;
+new fun();
+function f() {
+ return fun.prototype;
+}
+assertEquals(42, f());
+assertEquals(42, f());
+%OptimizeFunctionOnNextCall(f);
+assertEquals(42, f());
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-706642.js b/src/v8/test/mjsunit/regress/regress-crbug-706642.js
new file mode 100644
index 0000000..4467c68
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-706642.js
@@ -0,0 +1,37 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+class A extends Object {
+ constructor(arg) {
+ super();
+ superclass_counter++;
+ if (superclass_counter === 3) {
+ return 1;
+ }
+ }
+}
+
+class B extends A {
+ constructor() {
+ let x = super(123);
+ return x.a;
+ }
+}
+
+var superclass_counter = 0;
+var observer = new Proxy(A, {
+ get(target, property, receiver) {
+ if (property === 'prototype') {
+ %DeoptimizeFunction(B);
+ }
+ return Reflect.get(target, property, receiver);
+ }
+});
+
+Reflect.construct(B, [], observer);
+Reflect.construct(B, [], observer);
+%OptimizeFunctionOnNextCall(B);
+assertThrows(() => Reflect.construct(B, [], observer), TypeError);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-707580.js b/src/v8/test/mjsunit/regress/regress-crbug-707580.js
new file mode 100644
index 0000000..37d13d2
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-707580.js
@@ -0,0 +1,10 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var thrower = { [Symbol.toPrimitive] : function() { throw "I was called!" } };
+var heap_number = 4.2;
+var smi_number = 23;
+
+assertThrows(() => heap_number.hasOwnProperty(thrower));
+assertThrows(() => smi_number.hasOwnProperty(thrower));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-708050-1.js b/src/v8/test/mjsunit/regress/regress-crbug-708050-1.js
new file mode 100644
index 0000000..be26e10
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-708050-1.js
@@ -0,0 +1,17 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var v = {}
+
+function foo() {
+ v[0] = 5;
+ v[-0] = 27;
+ return v[0];
+}
+
+assertEquals(27, foo());
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(27, foo());
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-708050-2.js b/src/v8/test/mjsunit/regress/regress-crbug-708050-2.js
new file mode 100644
index 0000000..a7d9b29
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-708050-2.js
@@ -0,0 +1,17 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var v = [];
+
+function foo() {
+ v[0] = 5;
+ v[-0] = 27;
+ return v[0];
+}
+
+assertEquals(27, foo());
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(27, foo());
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-709537.js b/src/v8/test/mjsunit/regress/regress-crbug-709537.js
new file mode 100644
index 0000000..088c65b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-709537.js
@@ -0,0 +1,14 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo() {
+ return { 0: {}, x: {} };
+}
+var ref = foo();
+assertEquals(ref, foo());
+assertEquals(ref, foo());
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(ref, foo());
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-709753.js b/src/v8/test/mjsunit/regress/regress-crbug-709753.js
new file mode 100644
index 0000000..e4d4d4e
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-709753.js
@@ -0,0 +1,13 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(a, i) { a[i].x; }
+
+var a = [,0.1];
+foo(a, 1);
+foo(a, 1);
+%OptimizeFunctionOnNextCall(foo);
+assertThrows(() => foo(a, 0), TypeError);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-711166.js b/src/v8/test/mjsunit/regress/regress-crbug-711166.js
new file mode 100644
index 0000000..7f4acb9
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-711166.js
@@ -0,0 +1,22 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+'use strict'
+function g() {
+ var x = 1;
+ try { undefined.x } catch (e) { x = e; }
+ (function() { x });
+ return x;
+}
+function f(a) {
+ var args = arguments;
+ assertInstanceof(g(), TypeError);
+ return args.length;
+}
+assertEquals(1, f(0));
+assertEquals(1, f(0));
+%OptimizeFunctionOnNextCall(f);
+assertEquals(1, f(0));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-712802.js b/src/v8/test/mjsunit/regress/regress-crbug-712802.js
new file mode 100644
index 0000000..e23519e
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-712802.js
@@ -0,0 +1,12 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(...args) { return Array.isArray(args); }
+
+assertTrue(foo());
+assertTrue(foo());
+%OptimizeFunctionOnNextCall(foo);
+assertTrue(foo());
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-714696.js b/src/v8/test/mjsunit/regress/regress-crbug-714696.js
new file mode 100644
index 0000000..ad59254
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-714696.js
@@ -0,0 +1,10 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+if (this.Intl) {
+ new Intl.v8BreakIterator();
+ new Intl.DateTimeFormat();
+ try { console.log({ toString: function() { throw 1; }}); } catch (e) {}
+ new Intl.v8BreakIterator();
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-714872.js b/src/v8/test/mjsunit/regress/regress-crbug-714872.js
new file mode 100644
index 0000000..88dee14
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-714872.js
@@ -0,0 +1,8 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function f() {}
+f.prototype = 1;
+f.foo = 1;
+f.prototype = {};
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-714971.js b/src/v8/test/mjsunit/regress/regress-crbug-714971.js
new file mode 100644
index 0000000..d72c7a0
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-714971.js
@@ -0,0 +1,19 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function Module(stdlib, foreign, heap) {
+ "use asm";
+ var a = new stdlib.Int16Array(heap);
+ function f() {
+ return a[23 >> -1];
+ }
+ return { f:f };
+}
+var b = new ArrayBuffer(1024);
+var m = Module(this, {}, b);
+new Int16Array(b)[0] = 42;
+assertEquals(42, m.f());
+assertFalse(%IsAsmWasmCode(Module));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-714981.js b/src/v8/test/mjsunit/regress/regress-crbug-714981.js
new file mode 100644
index 0000000..e6a664d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-714981.js
@@ -0,0 +1,32 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function addProperties(o)
+{
+ o.p1 = 1;
+ o.p2 = 2;
+ o.p3 = 3;
+ o.p4 = 4;
+ o.p5 = 5;
+ o.p6 = 6;
+ o.p7 = 7;
+ o.p8 = 8;
+}
+function removeProperties(o)
+{
+ delete o.p8;
+ delete o.p7;
+ delete o.p6;
+ delete o.p5;
+}
+function makeO()
+{
+ var o = { };
+ addProperties(o);
+ removeProperties(o);
+ addProperties(o);
+}
+for (var i = 0; i < 3; ++i) {
+ o = makeO();
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-715151.js b/src/v8/test/mjsunit/regress/regress-crbug-715151.js
new file mode 100644
index 0000000..c0b2c5d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-715151.js
@@ -0,0 +1,15 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --verify-heap
+
+function foo() {
+ var a = [0];
+ Object.preventExtensions(a);
+ return a.pop();
+}
+foo();
+foo();
+%OptimizeFunctionOnNextCall(foo);
+foo();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-715404.js b/src/v8/test/mjsunit/regress/regress-crbug-715404.js
new file mode 100644
index 0000000..8ff2d00
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-715404.js
@@ -0,0 +1,11 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo() { Array(-1); }
+assertThrows(foo, RangeError);
+assertThrows(foo, RangeError);
+%OptimizeFunctionOnNextCall(foo);
+assertThrows(foo, RangeError);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-715455.js b/src/v8/test/mjsunit/regress/regress-crbug-715455.js
new file mode 100644
index 0000000..21ec165
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-715455.js
@@ -0,0 +1,25 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function MODULE() {
+ "use asm";
+ function f() {
+ bogus_function_table[0 & LIMIT]();
+ }
+ return { f:f };
+}
+
+var bogus_function_table = [ Object ];
+var test_set = [ 0x3fffffff, 0x7fffffff, 0xffffffff ];
+for (var i = 0; i < test_set.length; ++i) {
+ bogus_function_table[i] = Object;
+ var src = MODULE.toString();
+ src = src.replace(/MODULE/g, "Module" + i);
+ src = src.replace(/LIMIT/g, test_set[i]);
+ var module = eval("(" + src + ")");
+ assertDoesNotThrow(module(this).f());
+ assertFalse(%IsAsmWasmCode(module));
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-715862.js b/src/v8/test/mjsunit/regress/regress-crbug-715862.js
new file mode 100644
index 0000000..60e836d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-715862.js
@@ -0,0 +1,17 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --verify-heap
+
+function f(a) {
+ a.x = 0;
+ a[1] = 0.1;
+ a.x = {};
+}
+
+f(new Array(1));
+f(new Array());
+
+%OptimizeFunctionOnNextCall(f);
+f(new Array(1));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-716520.js b/src/v8/test/mjsunit/regress/regress-crbug-716520.js
new file mode 100644
index 0000000..5058c94
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-716520.js
@@ -0,0 +1,21 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var __v_0 = {};
+var __v_8 = this;
+var __v_11 = -1073741825;
+__v_1 = this;
+try {
+} catch(e) {; }
+ function __f_4() {}
+ __f_4.prototype = __v_0;
+ function __f_9() { return new __f_4().v; }
+ __f_9(); __f_9();
+try {
+(function() {
+})();
+} catch(e) {; }
+ Object.assign(__v_0, __v_1, __v_0);
+(function() {
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-716804.js b/src/v8/test/mjsunit/regress/regress-crbug-716804.js
new file mode 100644
index 0000000..181a3d6
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-716804.js
@@ -0,0 +1,13 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var v = [];
+v.__proto__ = function() {};
+v.prototype;
+
+var v = [];
+v.__proto__ = new Error();
+v.stack;
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-716912.js b/src/v8/test/mjsunit/regress/regress-crbug-716912.js
new file mode 100644
index 0000000..ca1663d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-716912.js
@@ -0,0 +1,23 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc --invoke-weak-callbacks
+
+function __f_6() {
+this.a4 = {};
+}
+__v_6 = new __f_6();
+__v_6.prototype = __v_6;
+__v_6 = new __f_6();
+gc();
+gc();
+
+buf = new ArrayBuffer(8);
+__v_8 = new Int32Array(buf);
+__v_9 = new Float64Array(buf);
+
+__v_8[0] = 1;
+__v_6.a4 = {a: 0};
+delete __v_6.a4;
+__v_6.boom = __v_9[0];
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-718779.js b/src/v8/test/mjsunit/regress/regress-crbug-718779.js
new file mode 100644
index 0000000..e62c107
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-718779.js
@@ -0,0 +1,21 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function __f_1()
+{
+ __v_1.p2 = 2147483648;
+ __v_1.p3 = 3;
+ __v_1.p4 = 4;
+ __v_1.p5 = 2147483648;
+ __v_1.p6 = 6;
+}
+function __f_2()
+{
+ delete __v_1.p6;
+ delete __v_1.p5;
+}
+var __v_1 = { };
+__f_1(__v_1);
+__f_2(__v_1);
+__f_1(__v_1);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-719384.js b/src/v8/test/mjsunit/regress/regress-crbug-719384.js
new file mode 100644
index 0000000..8b6a838
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-719384.js
@@ -0,0 +1,34 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function TestThrowingObserver() {
+ function Module(stdlib, foreign) {
+ "use asm";
+ var x = foreign.x | 0;
+ function f() {}
+ return { f:f };
+ }
+ var observer = { get x() { throw new Error() } };
+ assertThrows(() => Module(this, observer));
+ assertFalse(%IsAsmWasmCode(Module));
+})();
+
+(function TestMutatingObserver() {
+ function Module(stdlib, foreign) {
+ "use asm";
+ var x = +foreign.x;
+ var PI = stdlib.Math.PI;
+ function f() {
+ return +(PI + x);
+ }
+ return { f:f };
+ }
+ var stdlib = { Math : { PI : Math.PI } };
+ var observer = { get x() { stdlib.Math.PI = 23; return 42; } };
+ var m = Module(stdlib, observer);
+ assertFalse(%IsAsmWasmCode(Module));
+ assertEquals(65, m.f());
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-719479.js b/src/v8/test/mjsunit/regress/regress-crbug-719479.js
new file mode 100644
index 0000000..dac49de
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-719479.js
@@ -0,0 +1,24 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function baz(a, b) {
+ for (var i = 0; i < a.length; i++) {
+ if (a[i], b[i]) return false;
+ }
+}
+function bar(expected, found) {
+ if (!baz(found, expected)) {
+ }
+};
+bar([{}, 6, NaN], [1.8, , NaN]);
+function foo() {
+ var a = [1,2,3,4];
+ bar(a.length, a.length);
+}
+foo();
+foo();
+%OptimizeFunctionOnNextCall(foo);
+foo();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-721835.js b/src/v8/test/mjsunit/regress/regress-crbug-721835.js
new file mode 100644
index 0000000..80f99e6
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-721835.js
@@ -0,0 +1,31 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --validate-asm --allow-natives-syntax
+
+(function TestValidationFailureInForStatement() {
+ function Module() {
+ "use asm"
+ function f() {
+ var a = 0;
+ for (a = b; 0; 0) {};
+ return 0;
+ }
+ return { f:f };
+ }
+ assertThrows(() => Module().f(), ReferenceError);
+ assertFalse(%IsAsmWasmCode(Module));
+})();
+
+(function TestForStatementInVoidFunction() {
+ function Module() {
+ "use asm"
+ function f() {
+ for (1; 0; 0) {};
+ }
+ return { f:f };
+ }
+ assertDoesNotThrow(() => Module().f());
+ assertTrue(%IsAsmWasmCode(Module));
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-722348.js b/src/v8/test/mjsunit/regress/regress-crbug-722348.js
new file mode 100644
index 0000000..6c99e70
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-722348.js
@@ -0,0 +1,14 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function Module(global, env) {
+ "use asm";
+ var unused_fun = env.fun;
+ function f() {}
+ return { f:f }
+}
+assertThrows(() => Module(), TypeError);
+assertFalse(%IsAsmWasmCode(Module));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-722756.js b/src/v8/test/mjsunit/regress/regress-crbug-722756.js
new file mode 100644
index 0000000..b4d82ad
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-722756.js
@@ -0,0 +1,40 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var array = [[{}], [1.1]];
+
+function transition() {
+ for(var i = 0; i < array.length; i++){
+ var arr = array[i];
+ arr[0] = {};
+ }
+}
+
+var double_arr2 = [1.1,2.2];
+
+var flag = 0;
+function swap() {
+ try {} catch(e) {} // Prevent Crankshaft from inlining this.
+ if (flag == 1) {
+ array[1] = double_arr2;
+ }
+}
+
+var expected = 6.176516726456e-312;
+function f(){
+ swap();
+ double_arr2[0] = 1;
+ transition();
+ double_arr2[1] = expected;
+}
+
+for(var i = 0; i < 3; i++) {
+ f();
+}
+%OptimizeFunctionOnNextCall(f);
+flag = 1;
+f();
+assertEquals(expected, double_arr2[1]);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-722783.js b/src/v8/test/mjsunit/regress/regress-crbug-722783.js
new file mode 100644
index 0000000..32ffd4e
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-722783.js
@@ -0,0 +1,21 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function set_x(v) {
+ x = v;
+}
+
+var o = {};
+set_x(o);
+set_x(o);
+assertEquals(o, x);
+Object.defineProperty(this, "x", { value:5, writable:false, configurable:true });
+assertEquals(5, x);
+set_x(o);
+set_x(o);
+assertEquals(5, x);
+Object.defineProperty(this, "x", { value:42, writable:true, configurable:true });
+assertEquals(42, x);
+set_x(o);
+assertEquals(o, x);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-722871.js b/src/v8/test/mjsunit/regress/regress-crbug-722871.js
new file mode 100644
index 0000000..c5b7958
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-722871.js
@@ -0,0 +1,113 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+let sab = new SharedArrayBuffer(10 * 4);
+let memory = new Int32Array(sab);
+let workers = [];
+let runningWorkers = 0;
+
+function startWorker(script) {
+ let worker = new Worker(script);
+ worker.done = false;
+ worker.idx = workers.length;
+ workers.push(worker);
+ worker.postMessage(memory);
+ ++runningWorkers;
+};
+
+let shared = `
+ function wait(memory, index, waitCondition, wakeCondition) {
+ while (memory[index] == waitCondition) {
+ var result = Atomics.wait(memory, index, waitCondition);
+ switch (result) {
+ case 'not-equal':
+ case 'ok':
+ break;
+ default:
+ postMessage('Error: bad result from wait: ' + result);
+ break;
+ }
+ var value = memory[index];
+ if (value != wakeCondition) {
+ postMessage(
+ 'Error: wait returned not-equal but the memory has a bad value: ' +
+ value);
+ }
+ }
+ var value = memory[index];
+ if (value != wakeCondition) {
+ postMessage(
+ 'Error: done waiting but the memory has a bad value: ' + value);
+ }
+ }
+
+ function wake(memory, index) {
+ var result = Atomics.wake(memory, index, 1);
+ if (result != 0 && result != 1) {
+ postMessage('Error: bad result from wake: ' + result);
+ }
+ }
+`;
+
+let worker1 = startWorker(shared + `
+ onmessage = function(msg) {
+ let memory = msg;
+ const didStartIdx = 0;
+ const shouldGoIdx = 1;
+ const didEndIdx = 2;
+
+ postMessage("started");
+ postMessage("memory: " + memory);
+ wait(memory, didStartIdx, 0, 1);
+ memory[shouldGoIdx] = 1;
+ wake(memory, shouldGoIdx);
+ wait(memory, didEndIdx, 0, 1);
+ postMessage("memory: " + memory);
+ postMessage("done");
+ };
+`);
+
+let worker2 = startWorker(shared + `
+ onmessage = function(msg) {
+ let memory = msg;
+ const didStartIdx = 0;
+ const shouldGoIdx = 1;
+ const didEndIdx = 2;
+
+ postMessage("started");
+ postMessage("memory: " + memory);
+ Atomics.store(memory, didStartIdx, 1);
+ wake(memory, didStartIdx);
+ wait(memory, shouldGoIdx, 0, 1);
+ Atomics.store(memory, didEndIdx, 1);
+ wake(memory, didEndIdx, 1);
+ postMessage("memory: " + memory);
+ postMessage("done");
+ };
+`);
+
+let running = true;
+while (running) {
+ for (let worker of workers) {
+ if (worker.done) continue;
+
+ let msg = worker.getMessage();
+ if (msg) {
+ switch (msg) {
+ case "done":
+ if (worker.done === false) {
+ print("worker #" + worker.idx + " done.");
+ worker.done = true;
+ if (--runningWorkers === 0) {
+ running = false;
+ }
+ }
+ break;
+
+ default:
+ print("msg from worker #" + worker.idx + ": " + msg);
+ break;
+ }
+ }
+ }
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-723132.js b/src/v8/test/mjsunit/regress/regress-crbug-723132.js
new file mode 100644
index 0000000..99189f6
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-723132.js
@@ -0,0 +1,16 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function outer() {
+ function* generator() {
+ let arrow = () => {
+ assertSame(expectedReceiver, this);
+ assertEquals(42, arguments[0]);
+ };
+ arrow();
+ }
+ generator.call(this, 42).next();
+}
+let expectedReceiver = {};
+outer.call(expectedReceiver);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-723455.js b/src/v8/test/mjsunit/regress/regress-crbug-723455.js
new file mode 100644
index 0000000..85f5e3c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-723455.js
@@ -0,0 +1,18 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --verify-heap
+
+function f(a) {
+ a.x = 0;
+ a[0] = 0.1;
+ a.x = {};
+}
+
+f(new Array(1));
+f(new Array(1));
+f(new Array());
+
+%OptimizeFunctionOnNextCall(f);
+f(new Array(1));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-724153.js b/src/v8/test/mjsunit/regress/regress-crbug-724153.js
new file mode 100644
index 0000000..541a493
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-724153.js
@@ -0,0 +1,18 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-turbo-verify
+
+(function TestParameterLimit() {
+ var src = '(function f(a,';
+ for (var i = 0; i < 65535 - 2; i++) {
+ src += 'b' + i + ',';
+ }
+ src += 'c) { return a + c })';
+ var f = eval(src);
+ assertEquals(NaN, f(1));
+ assertEquals(NaN, f(2));
+ %OptimizeFunctionOnNextCall(f);
+ assertEquals(NaN, f(3));
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-724608.js b/src/v8/test/mjsunit/regress/regress-crbug-724608.js
new file mode 100644
index 0000000..cd91211
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-724608.js
@@ -0,0 +1,13 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(x) {
+ return {['p']: 0, x};
+}
+foo();
+var a = {['p']: ''};
+%OptimizeFunctionOnNextCall(foo);
+foo();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-725201.js b/src/v8/test/mjsunit/regress/regress-crbug-725201.js
new file mode 100644
index 0000000..c540b6d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-725201.js
@@ -0,0 +1,20 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function __f_1() {
+ function __f_2() {
+ Array.prototype.__proto__ = { 77e4 : null };
+ }
+ __f_2();
+ %OptimizeFunctionOnNextCall(__f_2);
+ __f_2();
+}
+try {
+__f_1();
+} catch(e) {; }
+for (var __v_6 in [(1.2)]) { }
+
+%HeapObjectVerify([(1.2)]);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-725537.js b/src/v8/test/mjsunit/regress/regress-crbug-725537.js
new file mode 100644
index 0000000..ed72d54
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-725537.js
@@ -0,0 +1,10 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc --verify-heap
+
+const AsyncFunction = async function(){}.constructor;
+class MyAsync extends AsyncFunction {}
+var af = new MyAsync();
+gc();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-72736.js b/src/v8/test/mjsunit/regress/regress-crbug-72736.js
new file mode 100644
index 0000000..4b4b145
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-72736.js
@@ -0,0 +1,37 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// See http://crbug.com/72736
+
+// This tests that Object.defineProperty actually allows to change the value of
+// a non-writable property if configurable is true.
+
+var obj = {};
+Object.defineProperty(obj, 'foo', { value: 10, configurable: true });
+assertEquals(obj.foo, 10);
+Object.defineProperty(obj, 'foo', { value: 20, configurable: true });
+assertEquals(obj.foo, 20);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-728813.js b/src/v8/test/mjsunit/regress/regress-crbug-728813.js
new file mode 100644
index 0000000..b5a8a99
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-728813.js
@@ -0,0 +1,9 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var p = new Proxy({}, {
+ has: function () { throw "nope"; }
+});
+p.length = 2;
+assertThrows(() => Array.prototype.indexOf.call(p));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-729573-1.js b/src/v8/test/mjsunit/regress/regress-crbug-729573-1.js
new file mode 100644
index 0000000..1b596ab
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-729573-1.js
@@ -0,0 +1,67 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function() {
+ function foo() {
+ var a = foo.bind(this);
+ %DeoptimizeNow();
+ if (!a) return a;
+ return 0;
+ }
+
+ assertEquals(0, foo());
+ assertEquals(0, foo());
+ %OptimizeFunctionOnNextCall(foo);
+ assertEquals(0, foo());
+})();
+
+(function() {
+ "use strict";
+
+ function foo() {
+ var a = foo.bind(this);
+ %DeoptimizeNow();
+ if (!a) return a;
+ return 0;
+ }
+
+ assertEquals(0, foo());
+ assertEquals(0, foo());
+ %OptimizeFunctionOnNextCall(foo);
+ assertEquals(0, foo());
+})();
+
+(function() {
+ function foo() {
+ var a = foo.bind(this);
+ %DeoptimizeNow();
+ if (!a) return a;
+ return 0;
+ }
+ foo.prototype = {custom: "prototype"};
+
+ assertEquals(0, foo());
+ assertEquals(0, foo());
+ %OptimizeFunctionOnNextCall(foo);
+ assertEquals(0, foo());
+})();
+
+(function() {
+ "use strict";
+
+ function foo() {
+ var a = foo.bind(this);
+ %DeoptimizeNow();
+ if (!a) return a;
+ return 0;
+ }
+ foo.prototype = {custom: "prototype"};
+
+ assertEquals(0, foo());
+ assertEquals(0, foo());
+ %OptimizeFunctionOnNextCall(foo);
+ assertEquals(0, foo());
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-729573-2.js b/src/v8/test/mjsunit/regress/regress-crbug-729573-2.js
new file mode 100644
index 0000000..45486ec
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-729573-2.js
@@ -0,0 +1,23 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function bar(x) {
+ "use strict";
+ return this + x;
+}
+
+function foo(f) {
+ var a = bar.bind(42, 1);
+ return f() ? 0 : a;
+}
+
+function t() { return true; }
+
+assertEquals(0, foo(t));
+assertEquals(0, foo(t));
+%OptimizeFunctionOnNextCall(foo);
+var a = foo(_ => false);
+assertEquals(43, a());
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-729597.js b/src/v8/test/mjsunit/regress/regress-crbug-729597.js
new file mode 100644
index 0000000..b4c54e8
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-729597.js
@@ -0,0 +1,18 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --verify-heap
+
+function __f_3(f) {
+ arguments.__defineGetter__('length', f);
+ return arguments;
+}
+function __f_4() { return "boom"; }
+
+__v_4 = [];
+__v_13 = "";
+
+for (var i = 0; i < 12800; ++i) {
+ __v_13 += __v_4.__proto__ = __f_3(__f_4);
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-731193.js b/src/v8/test/mjsunit/regress/regress-crbug-731193.js
new file mode 100644
index 0000000..6c1c088
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-731193.js
@@ -0,0 +1,27 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function f() {
+}
+
+// Make prototype of f go dictionary-mode.
+for (var i = 0; i < 10000; i++) {
+ f.prototype["b" + i] = 1;
+}
+
+var o = new f();
+
+function access(o, k) {
+ return o[k];
+}
+
+// Create a thin string.
+var p = "b";
+p += 10001;
+
+assertEquals(undefined, access(o, p));
+assertEquals(undefined, access(o, p));
+assertEquals(undefined, access(o, p));
+f.prototype[p] = 100;
+assertEquals(100, access(o, p));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-732169.js b/src/v8/test/mjsunit/regress/regress-crbug-732169.js
new file mode 100644
index 0000000..41dc9d2
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-732169.js
@@ -0,0 +1,29 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function TestGeneratorMaterialization() {
+ function* f([x]) { yield x }
+ // No warm-up of {f} to trigger soft deopt.
+ %OptimizeFunctionOnNextCall(f);
+ var gen = f([23]);
+ assertEquals("[object Generator]", gen.toString());
+ assertEquals({ done:false, value:23 }, gen.next());
+ assertEquals({ done:true, value:undefined }, gen.next());
+})();
+
+(function TestGeneratorMaterializationWithProperties() {
+ function* f(x = (%_DeoptimizeNow(), 23)) { yield x }
+ function g() {
+ var gen = f();
+ gen.p = 42;
+ return gen;
+ }
+ function h() { f() }
+ // Enough warm-up to make {p} an in-object property.
+ for (var i = 0; i < 100; ++i) { g(); h(); }
+ %OptimizeFunctionOnNextCall(h);
+ h(); // In {h} the generator does not escape.
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-734051.js b/src/v8/test/mjsunit/regress/regress-crbug-734051.js
new file mode 100644
index 0000000..2655db0
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-734051.js
@@ -0,0 +1,15 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function TestMutableHeapNumberLiteral() {
+ var data = { a: 0, b: 0 };
+ data.a += 0.1;
+ assertEquals(0.1, data.a);
+ assertEquals(0, data.b);
+};
+TestMutableHeapNumberLiteral();
+TestMutableHeapNumberLiteral();
+TestMutableHeapNumberLiteral();
+TestMutableHeapNumberLiteral();
+TestMutableHeapNumberLiteral();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-734162.js b/src/v8/test/mjsunit/regress/regress-crbug-734162.js
new file mode 100644
index 0000000..24ea1f0
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-734162.js
@@ -0,0 +1,48 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+
+(function TestSmi() {
+ var v_0 = {};
+ function f_0(constructor, closure) {
+ var v_2 = { value: 0 };
+ v_4 = closure(constructor, 1073741823, v_0, v_2);
+ assertEquals(1, v_2.value);
+ }
+ function f_1(constructor, val, deopt, v_2) {
+ if (!new constructor(val, deopt, v_2)) {
+ }
+ }
+ function f_10(constructor) {
+ f_0(constructor, f_1);
+ f_0(constructor, f_1);
+ f_0(constructor, f_1);
+ }
+ function f_12(val, deopt, v_2) {
+ v_2.value++;
+ }
+ f_10(f_12);
+})();
+
+(function TestHeapNumber() {
+ var v_0 = {};
+ function f_0(constructor, closure) {
+ var v_2 = { value: 1.5 };
+ v_4 = closure(constructor, 1073741823, v_0, v_2);
+ assertEquals(2.5, v_2.value);
+ }
+ function f_1(constructor, val, deopt, v_2) {
+ if (!new constructor(val, deopt, v_2)) {
+ }
+ }
+ function f_10(constructor) {
+ f_0(constructor, f_1);
+ f_0(constructor, f_1);
+ f_0(constructor, f_1);
+ }
+ function f_12(val, deopt, v_2) {
+ v_2.value++;
+ }
+ f_10(f_12);
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-736451.js b/src/v8/test/mjsunit/regress/regress-crbug-736451.js
new file mode 100644
index 0000000..3f70fe2
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-736451.js
@@ -0,0 +1,13 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-externalize-string --no-stress-opt
+
+!function() {
+ const s0 = "external string turned into two byte";
+ const s1 = s0.substring(1);
+ externalizeString(s0, true);
+
+ s1.toLowerCase();
+}();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-736575.js b/src/v8/test/mjsunit/regress/regress-crbug-736575.js
new file mode 100644
index 0000000..3622b09
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-736575.js
@@ -0,0 +1,14 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f() {
+ return [...[/*hole*/, 2.3]];
+}
+
+assertEquals(undefined, f()[0]);
+assertEquals(undefined, f()[0]);
+%OptimizeFunctionOnNextCall(f);
+assertEquals(undefined, f()[0]);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-736633.js b/src/v8/test/mjsunit/regress/regress-crbug-736633.js
new file mode 100644
index 0000000..4c9f0cc
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-736633.js
@@ -0,0 +1,21 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f(x) {
+ switch (x | 0) {
+ case 0:
+ case 1:
+ case 2:
+ case -2147483644:
+ case 2147483647:
+ return x + 1;
+ }
+ return 0;
+}
+assertEquals(1, f(0));
+assertEquals(2, f(1));
+%OptimizeFunctionOnNextCall(f);
+assertEquals(3, f(2));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-737645.js b/src/v8/test/mjsunit/regress/regress-crbug-737645.js
new file mode 100644
index 0000000..13d3087
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-737645.js
@@ -0,0 +1,23 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+for (let i = 0; i < 100; i++) {
+ // - length > 2 to trigger sorting.
+ // - key > kRequiresSlowElementsLimit required to set the according bit on the
+ // dictionary elements store.
+ let key = 1073741800 + i;
+ var a = { length: 12, 1: 0xFA, [key]: 0xFB };
+ %HeapObjectVerify(a);
+ assertEquals(["1", ""+key, "length"], Object.keys(a));
+ // Sort, everything > length is ignored.
+ Array.prototype.sort.call(a);
+ %HeapObjectVerify(a);
+ assertEquals(["0", ""+key, "length"], Object.keys(a));
+ // Sorting again to trigger bug caused by not setting requires_slow_elements
+ Array.prototype.sort.call(a);
+ %HeapObjectVerify(a);
+ assertEquals(["0", ""+key, "length"], Object.keys(a));
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-738763.js b/src/v8/test/mjsunit/regress/regress-crbug-738763.js
new file mode 100644
index 0000000..71cb67b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-738763.js
@@ -0,0 +1,25 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --verify-heap --allow-natives-syntax --expose-gc
+
+let constant = { a: 1 };
+
+function update_array(array) {
+ array.x = constant;
+ %HeapObjectVerify(array);
+ array[0] = undefined;
+ %HeapObjectVerify(array);
+ return array;
+}
+
+let ar1 = [1];
+let ar2 = [2];
+let ar3 = [3];
+gc();
+gc();
+
+update_array(ar1);
+constant = update_array(ar2);
+update_array(ar3);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-740116.js b/src/v8/test/mjsunit/regress/regress-crbug-740116.js
new file mode 100644
index 0000000..dc6fb64
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-740116.js
@@ -0,0 +1,29 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function TestReflectGetPrototypeOfOnPrimitive() {
+ function f() { return Reflect.getPrototypeOf(""); }
+ assertThrows(f, TypeError);
+ assertThrows(f, TypeError);
+ %OptimizeFunctionOnNextCall(f);
+ assertThrows(f, TypeError);
+})();
+
+(function TestObjectGetPrototypeOfOnPrimitive() {
+ function f() { return Object.getPrototypeOf(""); }
+ assertSame(String.prototype, f());
+ assertSame(String.prototype, f());
+ %OptimizeFunctionOnNextCall(f);
+ assertSame(String.prototype, f());
+})();
+
+(function TestDunderProtoOnPrimitive() {
+ function f() { return "".__proto__; }
+ assertSame(String.prototype, f());
+ assertSame(String.prototype, f());
+ %OptimizeFunctionOnNextCall(f);
+ assertSame(String.prototype, f());
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-740398.js b/src/v8/test/mjsunit/regress/regress-crbug-740398.js
new file mode 100644
index 0000000..3624107
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-740398.js
@@ -0,0 +1,13 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var longString = (function() {
+ return "a".repeat(%StringMaxLength());
+})();
+
+assertThrows(() => { return { get[longString]() { } } }, RangeError);
+assertThrows(() => { return { set[longString](v) { } } }, RangeError);
+assertThrows(() => { return { [Symbol(longString)]: () => {} } }, RangeError);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-740591.js b/src/v8/test/mjsunit/regress/regress-crbug-740591.js
new file mode 100644
index 0000000..c3f5161
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-740591.js
@@ -0,0 +1,69 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(function regressionCaseOne() {
+ var c;
+ for (let [a, b = c = function() { return a + b }] of [[0]]) {
+ function f() { return a };
+ }
+ c();
+})();
+
+(function testForInFunction() {
+ for (const {length: a, b = function() { return a, b }} in {foo: 42}) {
+ assertSame(b, (function() { return b() })());
+ }
+})();
+
+(function testForOfFunction() {
+ for (const [a, b = function() { return a, b }] of [[42]]) {
+ assertSame(b, (function() { return b() })());
+ }
+})();
+
+(function testForInVariableProxy() {
+ for (const {length: a, b = a} in {foo: 42}) {
+ assertEquals(3, a);
+ assertEquals(a, b);
+ }
+})();
+
+(function testForOfVariableProxy() {
+ for (const [a, b = a] of [[42]]) {
+ assertEquals(42, a);
+ assertEquals(a, b);
+ }
+})();
+
+(function testClassLiteral() {
+ for (let { a, b = class c { static f() { return a, b } } } of [{}]) {
+ assertSame(b, (function() { return b.f() })());
+ }
+})();
+
+// Methods in class literals remain inside the
+// class scope after scope reparenting.
+(function testClassLiteralMethod() {
+ for (let { a, b = class c { m() { return c } } } of [{}]) {
+ assertSame(b, (function() { return (new b).m() })());
+ }
+})();
+
+// Function literals in computed class names remain inside the
+// class scope after scope reparenting.
+(function testClassLiteralComputedName() {
+ let d;
+ for (let { a, b = class c { [d = function() { return c }]() { } } } of [{}]) {
+ assertSame(b, (function() { return b, d() })());
+ }
+})();
+
+// Function literals in class extends expressions names remain inside the
+// class scope after scope reparenting.
+(function testClassLiteralComputedName() {
+ let d;
+ for (let { a, b = class c extends (d = function() { return c }, Object) { } } of [{}]) {
+ assertSame(b, (function() { return b, d() })());
+ }
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-740803.js b/src/v8/test/mjsunit/regress/regress-crbug-740803.js
new file mode 100644
index 0000000..b470eca
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-740803.js
@@ -0,0 +1,19 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+({
+ m() {
+ x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x;
+ x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x;
+ x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x;
+ x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x;
+ x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x;
+ x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x;
+ x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x;
+ x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x;
+ x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x;
+ x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x; x;
+ x;
+ }
+})
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-741078.js b/src/v8/test/mjsunit/regress/regress-crbug-741078.js
new file mode 100644
index 0000000..8dfea72
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-741078.js
@@ -0,0 +1,19 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --expose-gc
+
+function* gen() {}
+
+(function warmup() {
+ for (var i = 0; i < 100; ++i) {
+ var g = gen();
+ g.p = 42;
+ }
+})();
+
+gc(); // Ensure no instance alive.
+gen(); // Still has unused fields.
+%OptimizeFunctionOnNextCall(gen);
+gen(); // Was shrunk, boom!
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-743154.js b/src/v8/test/mjsunit/regress/regress-crbug-743154.js
new file mode 100644
index 0000000..a5bb2aa
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-743154.js
@@ -0,0 +1,22 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+
+
+Object.prototype[1] = 1.5;
+
+var v = { length: 12, [1073741824]: 0 };
+
+assertEquals(['1073741824', 'length'], Object.keys(v));
+assertEquals(undefined, v[0]);
+assertEquals(1.5, v[1]);
+assertEquals(0, v[1073741824]);
+
+// Properly handle out of range HeapNumber keys on 32bit platforms.
+Array.prototype.sort.call(v);
+
+assertEquals(['0', '1073741824', 'length'], Object.keys(v));
+assertEquals(1.5, v[0]);
+assertEquals(1.5, v[1]);
+assertEquals(0, v[1073741824]);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-746835.js b/src/v8/test/mjsunit/regress/regress-crbug-746835.js
new file mode 100644
index 0000000..ab5e354
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-746835.js
@@ -0,0 +1,112 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// This example crashes if the AllocationSites have not been properly added to
+// the allocation_sites_list.
+
+// Flags: --expose-gc
+
+function __getProperties() {
+ return [];
+ let properties = [];
+ for (let name of Object.getOwnPropertyNames()) {;
+ }
+ return properties;
+}
+
+function __getRandomProperty() {
+ let properties = __getProperties();
+ if (!properties.length)
+ return undefined;
+ return properties[seed % properties.length];
+}
+var kWasmH0 = 0;
+var kWasmH1 = 0x61;
+var kWasmH2 = 0x73;
+var kWasmH3 = 0x6d;
+var kWasmV0 = 0x1;
+var kWasmV1 = 0;
+var kWasmV2 = 0;
+var kWasmV3 = 0;
+class Binary extends Array {
+ emit_header() {
+ this.push(kWasmH0, kWasmH1, kWasmH2, kWasmH3,
+ kWasmV0, kWasmV1, kWasmV2, kWasmV3);
+ }
+}
+class WasmModuleBuilder {
+ constructor() {
+ this.exports = [];
+ }
+ addImportedMemory() {}
+ setFunctionTableLength() {}
+ toArray() {
+ let binary = new Binary;
+ let wasm = this;
+ binary.emit_header();
+ "emitting imports @ " + binary.length;
+ section => {};
+ var mem_export = (wasm.memory !== undefined && wasm.memory.exp);
+ var exports_count = wasm.exports.length + (mem_export ? 1 : 0);
+ return binary;
+ }
+ toBuffer() {
+ let bytes = this.toArray();
+ let buffer = new ArrayBuffer(bytes.length);
+ let view = new Uint8Array(buffer);
+ for (let i = 0; i < bytes.length; i++) {
+ let val = bytes[i];
+ view[i] = val | 0;
+ }
+ return buffer;
+ }
+ instantiate(ffi) {
+ let module = new WebAssembly.Module(this.toBuffer());
+ let instance = new WebAssembly.Instance(module);
+ }
+}
+
+var v_40 = 0;
+var v_43 = NaN;
+
+try {
+ v_23 = new WasmModuleBuilder();
+} catch (e) {
+ print("Caught: " + e);
+}
+
+try {
+ v_31 = [0xff];
+ v_29 = [v_31];
+} catch (e) {
+ print("Caught: " + e);
+}
+
+try {
+ v_25 = ["main"];
+ gc();
+} catch (e) {
+ print("Caught: " + e);
+}
+for (var v_28 of [[2]]) {
+ try {
+ gc();
+ } catch (e) {
+ print("Caught: " + e);
+ }
+}
+try {
+ module = v_23.instantiate();
+} catch (e) {
+ print("Caught: " + e);
+}
+try {
+ v_41 = [];
+} catch (e) {;
+}
+for (var v_43 = 0; v_43 < 100000; v_43++) try {
+ v_41[v_43] = [];
+} catch (e) {
+ "Caught: " + e;
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-747062.js b/src/v8/test/mjsunit/regress/regress-crbug-747062.js
new file mode 100644
index 0000000..4fe99d3
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-747062.js
@@ -0,0 +1,37 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function TestNonCallableForEach() {
+ function foo() { [].forEach(undefined) }
+ assertThrows(foo, TypeError);
+ assertThrows(foo, TypeError);
+ %OptimizeFunctionOnNextCall(foo);
+ assertThrows(foo, TypeError);
+})();
+
+(function TestNonCallableForEachCaught() {
+ function foo() { try { [].forEach(undefined) } catch(e) { return e } }
+ assertInstanceof(foo(), TypeError);
+ assertInstanceof(foo(), TypeError);
+ %OptimizeFunctionOnNextCall(foo);
+ assertInstanceof(foo(), TypeError);
+})();
+
+(function TestNonCallableMap() {
+ function foo() { [].map(undefined); }
+ assertThrows(foo, TypeError);
+ assertThrows(foo, TypeError);
+ %OptimizeFunctionOnNextCall(foo);
+ assertThrows(foo, TypeError);
+})();
+
+(function TestNonCallableMapCaught() {
+ function foo() { try { [].map(undefined) } catch(e) { return e } }
+ assertInstanceof(foo(), TypeError);
+ assertInstanceof(foo(), TypeError);
+ %OptimizeFunctionOnNextCall(foo);
+ assertInstanceof(foo(), TypeError);
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-747979.js b/src/v8/test/mjsunit/regress/regress-crbug-747979.js
new file mode 100644
index 0000000..bbdea1d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-747979.js
@@ -0,0 +1,32 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f(a) {
+ %HeapObjectVerify(a);
+ a[1] = 0;
+ %HeapObjectVerify(a);
+}
+
+function foo() {}
+
+var arr1 = [0];
+var arr2 = [0];
+var arr3 = [0];
+
+arr1.f = foo;
+arr1[0] = 4.2;
+
+arr2.f = foo;
+
+arr3.f = foo;
+arr3[0] = 4.2;
+arr3.f = f;
+
+f(arr1);
+f(arr2);
+f(arr3);
+%OptimizeFunctionOnNextCall(f);
+f(arr3);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-748539.js b/src/v8/test/mjsunit/regress/regress-crbug-748539.js
new file mode 100644
index 0000000..bae5987
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-748539.js
@@ -0,0 +1,22 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f1() {}
+function f2() {}
+
+var o1 = [];
+o1.a = 0;
+o1.f = f1;
+%HeapObjectVerify(o1);
+
+var o2 = [];
+o2.a = 4.2;
+o2.f = f2;
+%HeapObjectVerify(o2);
+
+o1.a;
+%HeapObjectVerify(o1);
+%HeapObjectVerify(o2);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-751109.js b/src/v8/test/mjsunit/regress/regress-crbug-751109.js
new file mode 100644
index 0000000..035e646
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-751109.js
@@ -0,0 +1,7 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --verify-heap
+
+(new constructor)[0] = null;
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-751715.js b/src/v8/test/mjsunit/regress/regress-crbug-751715.js
new file mode 100644
index 0000000..68241eb
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-751715.js
@@ -0,0 +1,16 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+class Base {}
+class Derived extends Base {
+ constructor() { super(); }
+}
+var proxy = new Proxy(Base, { get() {} });
+assertDoesNotThrow(() => Reflect.construct(Derived, []));
+assertThrows(() => Reflect.construct(Derived, [], proxy), TypeError);
+assertThrows(() => Reflect.construct(Derived, [], proxy), TypeError);
+%OptimizeFunctionOnNextCall(Derived);
+assertThrows(() => Reflect.construct(Derived, [], proxy), TypeError);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-752481.js b/src/v8/test/mjsunit/regress/regress-crbug-752481.js
new file mode 100644
index 0000000..d0cc6a3
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-752481.js
@@ -0,0 +1,32 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+const A = class A {}
+
+function test(foo) {
+ assertThrows(foo);
+ assertThrows(foo);
+ %OptimizeFunctionOnNextCall(foo);
+ assertThrows(foo);
+}
+
+// Test combinations of rest parameters and primitive new.targets
+test((...args) => Reflect.construct(A, args, 0));
+test((...args) => Reflect.construct(A, args, true));
+test((...args) => Reflect.construct(A, args, false));
+test((...args) => Reflect.construct(A, args, ""));
+test((...args) => Reflect.construct(A, args, null));
+test((...args) => Reflect.construct(A, args, undefined));
+test((...args) => Reflect.construct(A, args, Symbol.species));
+
+// Test combinations of arguments object and primitive new.targets.
+test(function() { Reflect.construct(A, arguments, 0); });
+test(function() { Reflect.construct(A, arguments, true); });
+test(function() { Reflect.construct(A, arguments, false); });
+test(function() { Reflect.construct(A, arguments, ""); });
+test(function() { Reflect.construct(A, arguments, null); });
+test(function() { Reflect.construct(A, arguments, undefined); });
+test(function() { Reflect.construct(A, arguments, Symbol.species); });
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-752712.js b/src/v8/test/mjsunit/regress/regress-crbug-752712.js
new file mode 100644
index 0000000..12d833c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-752712.js
@@ -0,0 +1,24 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Proxy get trap doesn't fail when the value returned by it
+// is a number.
+
+var number = 1;
+
+(function testFailingInvariant() {
+ var obj = {};
+ var handler = {
+ get: function() {}
+ };
+ var proxy = new Proxy(obj, handler);
+ Object.defineProperty(handler, 'get', {
+ get: function() {
+ return number;
+ }
+ });
+ assertThrows(function(){ proxy.property; }, TypeError);
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-752826.js b/src/v8/test/mjsunit/regress/regress-crbug-752826.js
new file mode 100644
index 0000000..d0e124e
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-752826.js
@@ -0,0 +1,22 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function h(a) {
+ return a[1];
+}
+assertEquals(0, h(new Int8Array(10)));
+assertEquals(0, h(new Int8Array(10)));
+
+function g() {
+ return h(arguments);
+}
+function f() {
+ return g(23, 42);
+}
+assertEquals(42, f());
+assertEquals(42, f());
+%OptimizeFunctionOnNextCall(f);
+assertEquals(42, f());
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-752846.js b/src/v8/test/mjsunit/regress/regress-crbug-752846.js
new file mode 100644
index 0000000..c2095dc
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-752846.js
@@ -0,0 +1,21 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Check that the receiver of Runtime_GetPropertyWithReceiver can be
+// a plain JS value.
+
+var values = [
+ 10,
+ false,
+ "test"
+];
+
+for (let val of values) {
+ var proto = Object.getPrototypeOf(val);
+
+ var proxy = new Proxy({}, {});
+ Object.setPrototypeOf(proto, proxy);
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-754175.js b/src/v8/test/mjsunit/regress/regress-crbug-754175.js
new file mode 100644
index 0000000..5490ba3
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-754175.js
@@ -0,0 +1,19 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --mock-arraybuffer-allocator
+
+function Module(stdlib, foreign, buffer) {
+ "use asm";
+ var heap = new stdlib.Int8Array(buffer);
+ function foo() { return heap[23] | 0 }
+ return { foo:foo };
+}
+function instantiate() {
+ // On 32-bit architectures buffer allocation will throw.
+ var buffer = new ArrayBuffer(0x100000000);
+ // On 64-bit architectures instantiation will throw.
+ var module = Module(this, {}, buffer);
+}
+assertThrows(instantiate, RangeError);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-754177.js b/src/v8/test/mjsunit/regress/regress-crbug-754177.js
new file mode 100644
index 0000000..1c105a3
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-754177.js
@@ -0,0 +1,12 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Do not crash on non-JSFunction input.
+%NeverOptimizeFunction(undefined);
+%NeverOptimizeFunction(true);
+%NeverOptimizeFunction(1);
+%NeverOptimizeFunction({});
+assertThrows("%NeverOptimizeFunction()", SyntaxError);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-755044.js b/src/v8/test/mjsunit/regress/regress-crbug-755044.js
new file mode 100644
index 0000000..45f0e84
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-755044.js
@@ -0,0 +1,15 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(f){
+ f.caller;
+}
+function bar(f) {
+ new foo(f);
+}
+bar(function() {});
+%OptimizeFunctionOnNextCall(bar);
+bar(function() {});
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-756332.js b/src/v8/test/mjsunit/regress/regress-crbug-756332.js
new file mode 100644
index 0000000..10bccbc
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-756332.js
@@ -0,0 +1,13 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+{
+ let z = ({x: {y} = {y: 42}} = {}) => y;
+ assertEquals(42, z());
+}
+
+{
+ let z = ({x: [y] = [42]} = {}) => y;
+ assertEquals(42, z());
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-757199.js b/src/v8/test/mjsunit/regress/regress-crbug-757199.js
new file mode 100644
index 0000000..d2e9502
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-757199.js
@@ -0,0 +1,31 @@
+/// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var obj1 = {};
+var obj2 = {};
+
+function h() {}
+
+h.prototype = obj2;
+
+function g(v) {
+ v.constructor;
+}
+function f() {
+ g(obj1);
+}
+
+obj1.x = 0;
+f();
+
+obj1.__defineGetter__("x", function() {});
+
+g(obj2);
+
+obj2.y = 0;
+
+%OptimizeFunctionOnNextCall(f);
+f();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-758773.js b/src/v8/test/mjsunit/regress/regress-crbug-758773.js
new file mode 100644
index 0000000..1dbcdd1
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-758773.js
@@ -0,0 +1,6 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(0).__defineGetter__(0, function() { });
+Number.prototype[0] = "string";
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-759327.js b/src/v8/test/mjsunit/regress/regress-crbug-759327.js
new file mode 100644
index 0000000..9b42217
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-759327.js
@@ -0,0 +1,23 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --expose-gc
+
+function Module(stdlib, env, heap) {
+ "use asm";
+ var MEM = new stdlib.Int32Array(heap);
+ function f() {
+ MEM[0] = 0;
+ }
+ return { f: f };
+}
+function instantiate() {
+ var buffer = new ArrayBuffer(0);
+ Module(this, {}, buffer).f();
+ try {} finally {}
+ gc();
+ Module(this, {}, buffer).f();
+}
+instantiate();
+assertTrue(%IsAsmWasmCode(Module));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-762472.js b/src/v8/test/mjsunit/regress/regress-crbug-762472.js
new file mode 100644
index 0000000..e8d2842
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-762472.js
@@ -0,0 +1,26 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --stack-size=100
+
+function Module() {
+ "use asm";
+ function f() {}
+ return { f:f }
+}
+
+function InstantiateNearStackLimit() {
+ try {
+ var fuse = InstantiateNearStackLimit();
+ if (fuse == 0) Module();
+ return fuse - 1;
+ } catch(e) {
+ return init_fuse;
+ }
+}
+
+var init_fuse = 0;
+for (init_fuse = 0; init_fuse < 10; init_fuse++) {
+ InstantiateNearStackLimit();
+}
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-762874-1.js b/src/v8/test/mjsunit/regress/regress-crbug-762874-1.js
new file mode 100644
index 0000000..ab1b7c1
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-762874-1.js
@@ -0,0 +1,18 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+const maxLength = %StringMaxLength();
+const s = 'A'.repeat(maxLength);
+
+function foo(s) {
+ let x = s.indexOf("", maxLength);
+ return x === maxLength;
+}
+
+assertTrue(foo(s));
+assertTrue(foo(s));
+%OptimizeFunctionOnNextCall(foo);
+assertTrue(foo(s));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-762874-2.js b/src/v8/test/mjsunit/regress/regress-crbug-762874-2.js
new file mode 100644
index 0000000..6d301b5
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-762874-2.js
@@ -0,0 +1,18 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+const maxLength = %StringMaxLength();
+const s = 'A'.repeat(maxLength);
+
+function foo(s) {
+ let x = s.lastIndexOf("", maxLength);
+ return x === maxLength;
+}
+
+assertTrue(foo(s));
+assertTrue(foo(s));
+%OptimizeFunctionOnNextCall(foo);
+assertTrue(foo(s));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-763683.js b/src/v8/test/mjsunit/regress/regress-crbug-763683.js
new file mode 100644
index 0000000..92ba46c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-763683.js
@@ -0,0 +1,22 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertThrows(function test() {
+ var proxy = new Proxy({}, {});
+ var key_or_proxy = 0;
+
+ function failing_get() {
+ return proxy[key_or_proxy];
+ }
+
+ failing_get();
+
+ key_or_proxy = new Proxy({
+ toString() {
+ throw new TypeError('error');
+ }
+ }, {});
+
+ failing_get();
+}, TypeError);
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-768367.js b/src/v8/test/mjsunit/regress/regress-crbug-768367.js
new file mode 100644
index 0000000..d1041f3
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-768367.js
@@ -0,0 +1,14 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+const o = {};
+
+function foo() { return o[4294967295]; }
+
+assertEquals(undefined, foo());
+assertEquals(undefined, foo());
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(undefined, foo());
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-769852.js b/src/v8/test/mjsunit/regress/regress-crbug-769852.js
new file mode 100644
index 0000000..120ea01
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-769852.js
@@ -0,0 +1,14 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f(o) {
+ function g() {}
+ Object.keys(o).forEach(suite => g());
+}
+assertDoesNotThrow(() => f({}));
+assertDoesNotThrow(() => f({ x:0 }));
+%OptimizeFunctionOnNextCall(f);
+assertDoesNotThrow(() => f({ x:0 }));
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-770543.js b/src/v8/test/mjsunit/regress/regress-crbug-770543.js
new file mode 100644
index 0000000..5397a49
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-770543.js
@@ -0,0 +1,31 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function FunctionCallerFromInlinedBuiltin() {
+ function f() {
+ function g() {
+ Object.getOwnPropertyDescriptor(g, "caller");
+ };
+ [0].forEach(g);
+ }
+ f();
+ f();
+ %OptimizeFunctionOnNextCall(f);
+ f();
+})();
+
+(function FunctionArgumentsFromInlinedBuiltin() {
+ function g() {
+ g.arguments;
+ }
+ function f() {
+ [0].forEach(g);
+ }
+ f();
+ f();
+ %OptimizeFunctionOnNextCall(f);
+ f();
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-crbug-87478.js b/src/v8/test/mjsunit/regress/regress-crbug-87478.js
new file mode 100644
index 0000000..115b3fd
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-crbug-87478.js
@@ -0,0 +1,36 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Check that arguments access ICs correctly handle non-JSObject
+// receivers.
+function f(array) { return array[0]; }
+function args(a) { return arguments; }
+// Put the keyed load in f into the keyed-load-arguments state.
+for (var i = 0; i < 10; i++) {
+ f(args(1));
+}
+f('123');
diff --git a/src/v8/test/mjsunit/regress/regress-create-exception.js b/src/v8/test/mjsunit/regress/regress-create-exception.js
new file mode 100644
index 0000000..440449c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-create-exception.js
@@ -0,0 +1,59 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --max-semi-space-size=1
+"use strict";
+
+// Check for GC bug constructing exceptions.
+var v = [1, 2, 3, 4]
+
+Object.preventExtensions(v);
+
+function foo() {
+ var re = /2147483647/; // Equal to 0x7fffffff.
+ for (var i = 0; i < 10000; i++) {
+ var ok = false;
+ try {
+ var j = 1;
+ // Allocate some heap numbers in order to randomize the behaviour of the
+ // garbage collector. 93 is chosen to be a prime number to avoid the
+ // allocation settling into a too neat pattern.
+ for (var j = 0; j < i % 93; j++) {
+ j *= 1.123567; // An arbitrary floating point number.
+ }
+ v[0x7fffffff] = 0; // Trigger exception.
+ assertTrue(false);
+ return j; // Make sure that future optimizations don't eliminate j.
+ } catch(e) {
+ ok = true;
+ assertTrue(re.test(e), 'e: ' + e);
+ }
+ assertTrue(ok);
+ }
+}
+
+foo();
diff --git a/src/v8/test/mjsunit/regress/regress-deep-proto.js b/src/v8/test/mjsunit/regress/regress-deep-proto.js
new file mode 100644
index 0000000..5d2758c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-deep-proto.js
@@ -0,0 +1,45 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function poly(x) {
+ return x.foo;
+}
+
+var one = {foo: 0};
+var two = {foo: 0, bar: 1};
+var three = {bar: 0};
+three.__proto__ = {};
+three.__proto__.__proto__ = {};
+three.__proto__.__proto__.__proto__ = {};
+three.__proto__.__proto__.__proto__.__proto__ = {};
+three.__proto__.__proto__.__proto__.__proto__.__proto__ = {};
+
+for (var i = 0; i < 1e6; i++) {
+ poly(one);
+ poly(two);
+ poly(three);
+}
diff --git a/src/v8/test/mjsunit/regress/regress-delete-empty-double.js b/src/v8/test/mjsunit/regress/regress-delete-empty-double.js
new file mode 100644
index 0000000..c27cb55
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-delete-empty-double.js
@@ -0,0 +1,40 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+a = [1.1,2.2,3.3];
+a.length = 1;
+delete a[1];
+
+assertTrue(%HasDoubleElements(a));
+assertFalse(%HasHoleyElements(a));
+
+delete a[0];
+
+assertTrue(%HasDoubleElements(a));
+assertTrue(%HasHoleyElements(a));
diff --git a/src/v8/test/mjsunit/regress/regress-deopt-gc.js b/src/v8/test/mjsunit/regress/regress-deopt-gc.js
new file mode 100644
index 0000000..a74e2c5
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-deopt-gc.js
@@ -0,0 +1,49 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax --expose-gc
+
+// This tests that we can correctly handle a GC immediately after a function
+// has been deoptimized, even when we have an activation of this function on
+// the stack.
+
+// Ensure that there is code objects before the code for the opt_me function.
+(function() { var a = 10; a++; })();
+
+function opt_me() {
+ deopt();
+}
+
+function deopt() {
+ // Make sure we don't inline this function
+ try { var a = 42; } catch(o) {};
+ %DeoptimizeFunction(opt_me);
+ gc();
+}
+
+
+opt_me();
diff --git a/src/v8/test/mjsunit/regress/regress-deopt-gcb.js b/src/v8/test/mjsunit/regress/regress-deopt-gcb.js
new file mode 100644
index 0000000..fed92b4
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-deopt-gcb.js
@@ -0,0 +1,49 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax --expose-gc
+
+// This tests that we can correctly handle a GC immediately after a function
+// has been deoptimized, even when we have an activation of this function on
+// the stack.
+
+// Ensure that there is code objects before the code for the opt_me function.
+(function() { var a = 10; a++; })();
+
+function opt_me() {
+ deopt();
+}
+
+// Make sure we don't inline this function
+%NeverOptimizeFunction(deopt);
+function deopt() {
+ %DeoptimizeFunction(opt_me);
+ gc();
+}
+
+
+opt_me();
diff --git a/src/v8/test/mjsunit/regress/regress-deopt-in-array-literal-spread.js b/src/v8/test/mjsunit/regress/regress-deopt-in-array-literal-spread.js
new file mode 100644
index 0000000..8bebbe2
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-deopt-in-array-literal-spread.js
@@ -0,0 +1,12 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f(a,b,c,d) { return [a, ...(%DeoptimizeNow(), [b,c]), d]; }
+
+assertEquals([1,2,3,4], f(1,2,3,4));
+assertEquals([1,2,3,4], f(1,2,3,4));
+%OptimizeFunctionOnNextCall(f);
+assertEquals([1,2,3,4], f(1,2,3,4));
diff --git a/src/v8/test/mjsunit/regress/regress-deopt-store-effect.js b/src/v8/test/mjsunit/regress/regress-deopt-store-effect.js
new file mode 100644
index 0000000..59094d3
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-deopt-store-effect.js
@@ -0,0 +1,82 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// Test deopt after generic store with effect context.
+var pro = { x : 1 }
+var a = {}
+a.__proto__ = pro
+delete pro.x
+
+function g(o) {
+ return 7 + (o.z = 1, 20);
+}
+
+g(a);
+g(a);
+%OptimizeFunctionOnNextCall(g);
+Object.defineProperty(pro, "z", {
+ set: function(v) { %DeoptimizeFunction(g); },
+ get: function() { return 20; }
+});
+
+assertEquals(27, g(a));
+
+// Test deopt after polymorphic as monomorphic store with effect context.
+
+var i = { z : 2, r : 1 }
+var j = { z : 2 }
+var p = { a : 10 }
+var pp = { a : 20, b : 1 }
+
+function bar(o, p) {
+ return 7 + (o.z = 1, p.a);
+}
+
+bar(i, p);
+bar(i, p);
+bar(j, p);
+%OptimizeFunctionOnNextCall(bar);
+assertEquals(27, bar(i, pp));
+
+// Test deopt after polymorphic store with effect context.
+
+var i = { r : 1, z : 2 }
+var j = { z : 2 }
+var p = { a : 10 }
+var pp = { a : 20, b : 1 }
+
+function bar1(o, p) {
+ return 7 + (o.z = 1, p.a);
+}
+
+bar1(i, p);
+bar1(i, p);
+bar1(j, p);
+%OptimizeFunctionOnNextCall(bar1);
+assertEquals(27, bar1(i, pp));
diff --git a/src/v8/test/mjsunit/regress/regress-deoptimize-constant-keyed-load.js b/src/v8/test/mjsunit/regress/regress-deoptimize-constant-keyed-load.js
new file mode 100644
index 0000000..ed63133
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-deoptimize-constant-keyed-load.js
@@ -0,0 +1,22 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var o = { };
+o.__defineGetter__("progressChanged", function() { %DeoptimizeFunction(f); return 10; })
+
+function g(a, b, c) {
+ return a + b + c;
+}
+
+function f() {
+ var t="progressChanged";
+ return g(1, o[t], 100);
+}
+
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+assertEquals(111, f());
diff --git a/src/v8/test/mjsunit/regress/regress-dictionary-to-fast-arguments.js b/src/v8/test/mjsunit/regress/regress-dictionary-to-fast-arguments.js
new file mode 100644
index 0000000..f12679a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-dictionary-to-fast-arguments.js
@@ -0,0 +1,11 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function f(a, b) {
+ for (var i = 10000; i > 0; i--) {
+ arguments[i] = 0;
+ }
+}
+
+f(1.5, 2.5);
diff --git a/src/v8/test/mjsunit/regress/regress-double-canonicalization.js b/src/v8/test/mjsunit/regress/regress-double-canonicalization.js
new file mode 100644
index 0000000..2b345d2
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-double-canonicalization.js
@@ -0,0 +1,24 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var ab = new ArrayBuffer(8);
+var i_view = new Int32Array(ab);
+i_view[0] = %GetHoleNaNUpper()
+i_view[1] = %GetHoleNaNLower();
+var hole_nan = (new Float64Array(ab))[0];
+
+var array = [];
+
+function write() {
+ array[0] = hole_nan;
+}
+
+write();
+%OptimizeFunctionOnNextCall(write);
+write();
+array[1] = undefined;
+assertTrue(isNaN(array[0]));
+assertEquals("number", typeof array[0]);
diff --git a/src/v8/test/mjsunit/regress/regress-double-property.js b/src/v8/test/mjsunit/regress/regress-double-property.js
new file mode 100644
index 0000000..2ddb45b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-double-property.js
@@ -0,0 +1,9 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function f(a) {
+ return {0.1: a};
+}
+
+f();
diff --git a/src/v8/test/mjsunit/regress/regress-embedded-cons-string.js b/src/v8/test/mjsunit/regress/regress-embedded-cons-string.js
new file mode 100644
index 0000000..b95b619
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-embedded-cons-string.js
@@ -0,0 +1,70 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-gc --allow-natives-syntax
+// Flags: --concurrent-recompilation --block-concurrent-recompilation
+// Flags: --opt --no-always-opt
+
+if (!%IsConcurrentRecompilationSupported()) {
+ print("Concurrent recompilation is disabled. Skipping this test.");
+ quit();
+}
+
+function test(fun) {
+ fun();
+ fun();
+ // Mark for concurrent optimization.
+ %OptimizeFunctionOnNextCall(fun, "concurrent");
+ // Kick off recompilation.
+ fun();
+ // Tenure cons string after compile graph has been created.
+ gc();
+ // In the mean time, concurrent recompiling is still blocked.
+ assertUnoptimized(fun, "no sync");
+ // Let concurrent recompilation proceed.
+ %UnblockConcurrentRecompilation();
+ // Concurrent recompilation eventually finishes, embeds tenured cons string.
+ assertOptimized(fun, "sync");
+ // Visit embedded cons string during mark compact.
+ gc();
+}
+
+function f() {
+ return "abcdefghijklmn" + "123456789";
+}
+
+function g() {
+ return "abcdefghijklmn\u2603" + "123456789";
+}
+
+function h() {
+ return "abcdefghijklmn\u2603" + "123456789\u2604";
+}
+
+test(f);
+test(g);
+test(h);
diff --git a/src/v8/test/mjsunit/regress/regress-empty-fixed-double-array.js b/src/v8/test/mjsunit/regress/regress-empty-fixed-double-array.js
new file mode 100644
index 0000000..1db9e2b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-empty-fixed-double-array.js
@@ -0,0 +1,15 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --enable-slow-asserts
+
+function f(a, x) {
+ a.shift();
+ a[0] = x;
+}
+
+f([1], 1.1);
+f([1], 1.1);
+%OptimizeFunctionOnNextCall(f);
+f([1], 1.1);
diff --git a/src/v8/test/mjsunit/regress/regress-ensure-initial-map.js b/src/v8/test/mjsunit/regress/regress-ensure-initial-map.js
new file mode 100644
index 0000000..dbd4762
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-ensure-initial-map.js
@@ -0,0 +1,22 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var x = Object.getOwnPropertyDescriptor({get x() {}}, "x").get;
+function f(o, b) {
+ if (b) {
+ return o instanceof x;
+ }
+}
+
+%OptimizeFunctionOnNextCall(f);
+f();
+
+function g() {
+ return new x();
+}
+
+%OptimizeFunctionOnNextCall(g);
+assertThrows(()=>g());
diff --git a/src/v8/test/mjsunit/regress/regress-enum-prop-keys-cache-size.js b/src/v8/test/mjsunit/regress/regress-enum-prop-keys-cache-size.js
new file mode 100644
index 0000000..1227500
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-enum-prop-keys-cache-size.js
@@ -0,0 +1,19 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --stress-compaction
+
+%SetAllocationTimeout(100000, 100000);
+
+var x = {};
+x.a = 1;
+x.b = 2;
+x = {};
+
+var y = {};
+y.a = 1;
+
+%SetAllocationTimeout(100000, 0);
+
+for (var z in y) { }
diff --git a/src/v8/test/mjsunit/regress/regress-escape-preserve-smi-representation.js b/src/v8/test/mjsunit/regress/regress-escape-preserve-smi-representation.js
new file mode 100644
index 0000000..fd899d6
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-escape-preserve-smi-representation.js
@@ -0,0 +1,34 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function deepEquals(a, b) {
+ if (a === b) { if (a === 0) return (1 / a) === (1 / b); return true; }
+ if (typeof a != typeof b) return false;
+ if (typeof a == "number") return isNaN(a) && isNaN(b);
+ if (typeof a !== "object" && typeof a !== "function") return false;
+ if (objectClass === "RegExp") { return (a.toString() === b.toString()); }
+ if (objectClass === "Function") return false;
+ if (objectClass === "Array") {
+ var elementsCount = 0;
+ if (a.length != b.length) { return false; }
+ for (var i = 0; i < a.length; i++) {
+ if (!deepEquals(a[i], b[i])) return false;
+ }
+ return true;
+ }
+}
+
+
+function __f_1(){
+ var __v_0 = [];
+ for(var i=0; i<2; i++){
+ __v_0.push([])
+ deepEquals(2, __v_0.length);
+ }
+}
+__f_1();
+%OptimizeFunctionOnNextCall(__f_1);
+__f_1();
diff --git a/src/v8/test/mjsunit/regress/regress-et-clobbers-doubles.js b/src/v8/test/mjsunit/regress/regress-et-clobbers-doubles.js
new file mode 100644
index 0000000..47fa479
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-et-clobbers-doubles.js
@@ -0,0 +1,39 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+function t_smi(a) {
+ a[0] = 1.5;
+}
+
+t_smi([1,,3]);
+t_smi([1,,3]);
+t_smi([1,,3]);
+%OptimizeFunctionOnNextCall(t_smi);
+var ta = [1,,3];
+t_smi(ta);
+assertEquals([1.5,,3], ta);
diff --git a/src/v8/test/mjsunit/regress/regress-eval-cache.js b/src/v8/test/mjsunit/regress/regress-eval-cache.js
new file mode 100644
index 0000000..8f8dc18
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-eval-cache.js
@@ -0,0 +1,19 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(function f() {
+ try {
+ throw 1;
+ } catch (e) {
+ var a = 0;
+ var b = 0;
+ var c = 0;
+ var x = 1;
+ var result = eval('eval("x")').toString();
+ assertEquals("1", result);
+ }
+ var x = 2;
+ var result = eval('eval("x")').toString();
+ assertEquals("2", result);
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-eval-context.js b/src/v8/test/mjsunit/regress/regress-eval-context.js
new file mode 100644
index 0000000..e376282
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-eval-context.js
@@ -0,0 +1,20 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(function() {
+ 'use strict';
+ var x = 0;
+
+ {
+ let x = 1;
+ assertEquals(1, eval("x"));
+ }
+
+ {
+ let y = 2;
+ assertEquals(0, eval("x"));
+ }
+
+ assertEquals(0, eval("x"));
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-existing-shared-function-info.js b/src/v8/test/mjsunit/regress/regress-existing-shared-function-info.js
new file mode 100644
index 0000000..a53014c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-existing-shared-function-info.js
@@ -0,0 +1,18 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc
+
+function f() {
+ return function g() {
+ return function h() {}
+ }
+}
+
+var h = f()();
+
+// Make sure code has been flushed.
+for (var i of Array(10)) gc();
+
+f()();
diff --git a/src/v8/test/mjsunit/regress/regress-fast-empty-string.js b/src/v8/test/mjsunit/regress/regress-fast-empty-string.js
new file mode 100644
index 0000000..9b9fea9
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-fast-empty-string.js
@@ -0,0 +1,13 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var o = {};
+o[""] = 1;
+var x = {__proto__:o};
+for (i = 0; i < 3; i++) {
+ o[""];
+}
+for (i = 0; i < 3; i++) {
+ assertEquals(undefined, o.x);
+}
diff --git a/src/v8/test/mjsunit/regress/regress-fast-literal-transition.js b/src/v8/test/mjsunit/regress/regress-fast-literal-transition.js
new file mode 100644
index 0000000..2dc6a97
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-fast-literal-transition.js
@@ -0,0 +1,62 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax --always-opt --expose-gc
+
+// Test that the elements kind of the boilerplate object is sufficiently
+// checked in LFastLiteral, so that unoptimized code can transition the
+// boilerplate. The --always-opt flag makes sure that optimized code is
+// not thrown away at deoptimization.
+
+// The switch statement in f() makes sure that f() is not inlined. If we
+// start inlining switch statements, we will still catch the bug on the
+// final --stress-opt run.
+
+function f(x) {
+ switch(x) {
+ case 1: return 1.4;
+ case 2: return 1.5;
+ case 3: return {};
+ default: gc();
+ }
+}
+
+function g(x) {
+ return [1.1, 1.2, 1.3, f(x)];
+}
+
+// Step 1: Optimize g() to contain a PACKED_DOUBLE_ELEMENTS boilerplate.
+assertEquals([1.1, 1.2, 1.3, 1.4], g(1));
+assertEquals([1.1, 1.2, 1.3, 1.5], g(2));
+%OptimizeFunctionOnNextCall(g);
+
+// Step 2: Deoptimize g() and transition to PACKED_ELEMENTS boilerplate.
+assertEquals([1.1, 1.2, 1.3, {}], g(3));
+
+// Step 3: Cause a GC while broken clone of boilerplate is on the heap,
+// hence causing heap verification to catch it.
+assertEquals([1.1, 1.2, 1.3, undefined], g(4));
diff --git a/src/v8/test/mjsunit/regress/regress-filter-contexts.js b/src/v8/test/mjsunit/regress/regress-filter-contexts.js
new file mode 100644
index 0000000..d2abe00
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-filter-contexts.js
@@ -0,0 +1,14 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f() { return f.x; }
+f.__proto__ = null;
+f.prototype = "";
+
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+f();
diff --git a/src/v8/test/mjsunit/regress/regress-force-constant-representation.js b/src/v8/test/mjsunit/regress/regress-force-constant-representation.js
new file mode 100644
index 0000000..4ec2a6a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-force-constant-representation.js
@@ -0,0 +1,18 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Test push double as tagged.
+var a = [{}];
+function f(a) {
+ a.push(Infinity);
+}
+
+f(a);
+f(a);
+f(a);
+%OptimizeFunctionOnNextCall(f);
+f(a);
+assertEquals([{}, Infinity, Infinity, Infinity, Infinity], a);
diff --git a/src/v8/test/mjsunit/regress/regress-force-representation.js b/src/v8/test/mjsunit/regress/regress-force-representation.js
new file mode 100644
index 0000000..8f6746b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-force-representation.js
@@ -0,0 +1,22 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function optimize(crankshaft_test) {
+ crankshaft_test();
+ crankshaft_test();
+ %OptimizeFunctionOnNextCall(crankshaft_test);
+ crankshaft_test();
+}
+
+function f() {
+ var v1 = 0;
+ var v2 = -0;
+ var t = v2++;
+ v2++;
+ return Math.max(v2++, v1++);
+}
+
+optimize(f);
diff --git a/src/v8/test/mjsunit/regress/regress-freeze-setter.js b/src/v8/test/mjsunit/regress/regress-freeze-setter.js
new file mode 100644
index 0000000..c5ac986
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-freeze-setter.js
@@ -0,0 +1,7 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+Object.defineProperty(this, 'x', {set: function() { }});
+Object.freeze(this);
+eval('"use strict"; x = 20;');
diff --git a/src/v8/test/mjsunit/regress/regress-freeze.js b/src/v8/test/mjsunit/regress/regress-freeze.js
new file mode 100644
index 0000000..6f3de2a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-freeze.js
@@ -0,0 +1,46 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// CountOperation
+function f(o) { o.x++ };
+var o = {x: 5};
+Object.freeze(o);
+f(o);
+f(o);
+%OptimizeFunctionOnNextCall(f);
+f(o);
+assertEquals(5, o.x);
+
+// Compound Assignment
+function f2(o) { o.x+=3 };
+f2(o);
+f2(o);
+%OptimizeFunctionOnNextCall(f2);
+f2(o);
+assertEquals(5, o.x);
diff --git a/src/v8/test/mjsunit/regress/regress-function-length-strict.js b/src/v8/test/mjsunit/regress/regress-function-length-strict.js
new file mode 100644
index 0000000..77cca24
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-function-length-strict.js
@@ -0,0 +1,41 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test that the length property of a function is read-only in strict mode.
+
+"use strict";
+
+function foo(a, b, c) {
+ return b;
+}
+
+var desc = Object.getOwnPropertyDescriptor(foo, 'length');
+assertEquals(3, desc.value);
+assertFalse(desc.writable);
+assertFalse(desc.enumerable);
+assertTrue(desc.configurable);
+assertThrows(function() { foo.length = 2; }, TypeError);
diff --git a/src/v8/test/mjsunit/regress/regress-fundecl.js b/src/v8/test/mjsunit/regress/regress-fundecl.js
new file mode 100644
index 0000000..fddb589
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-fundecl.js
@@ -0,0 +1,44 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// Test hoisting of function declarations in the optimizing
+// compiler in case of deoptimization.
+
+function h(a, b) {
+ var r = a + b;
+ function X() { return 42; }
+ return r + X();
+}
+
+for (var i = 0; i < 5; i++) h(1,2);
+
+%OptimizeFunctionOnNextCall(h);
+
+assertEquals(45, h(1,2));
+assertEquals("foo742", h("foo", 7));
diff --git a/src/v8/test/mjsunit/regress/regress-grow-deopt.js b/src/v8/test/mjsunit/regress/regress-grow-deopt.js
new file mode 100644
index 0000000..df3a83f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-grow-deopt.js
@@ -0,0 +1,16 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f(a, v) {
+ a[a.length] = v;
+}
+
+var a = [1.4];
+f(a, 1);
+f(a, 2);
+%OptimizeFunctionOnNextCall(f);
+f(a, {});
+assertEquals(4, a.length);
diff --git a/src/v8/test/mjsunit/regress/regress-grow-store-smi-check.js b/src/v8/test/mjsunit/regress/regress-grow-store-smi-check.js
new file mode 100644
index 0000000..381141d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-grow-store-smi-check.js
@@ -0,0 +1,53 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// The below test function was generated from part of a WebKit layout
+// test library setup routine: fast/canvas/webgl/resources/pnglib.js
+
+function test(crc32) {
+ for (var i = 0; i < 256; i++) {
+ var c = i;
+ for (var j = 0; j < 8; j++) {
+ if (c & 1) {
+ c = -306674912 ^ ((c >> 1) & 0x7fffffff);
+ } else {
+ c = (c >> 1) & 0x7fffffff;
+ }
+ }
+ crc32[i] = c;
+ }
+}
+
+var a = [0.5];
+for (var i = 0; i < 256; ++i) a[i] = i;
+
+test([0.5]);
+test(a);
+%OptimizeFunctionOnNextCall(test);
+test(a);
diff --git a/src/v8/test/mjsunit/regress/regress-gvn-ftt.js b/src/v8/test/mjsunit/regress/regress-gvn-ftt.js
new file mode 100644
index 0000000..dee5765
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-gvn-ftt.js
@@ -0,0 +1,27 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --track-field-types
+
+function A(id) {
+ this.id = id;
+}
+
+var a1 = new A(1);
+var a2 = new A(2);
+
+
+var g;
+function f(o, value) {
+ g = o.o;
+ o.o = value;
+ return o.o;
+}
+
+var obj = {o: a1};
+
+f(obj, a1);
+f(obj, a1);
+%OptimizeFunctionOnNextCall(f);
+assertEquals(a2.id, f(obj, a2).id);
diff --git a/src/v8/test/mjsunit/regress/regress-hoist-load-named-field.js b/src/v8/test/mjsunit/regress/regress-hoist-load-named-field.js
new file mode 100644
index 0000000..7df07a0
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-hoist-load-named-field.js
@@ -0,0 +1,66 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// Load fields should not be hoisted beyond their check maps when the check maps
+// cannot be hoisted due to changes in elements kinds.
+function f(o, a) {
+ var v;
+ var i = 1;
+ while (i < 2) {
+ v = o.y;
+ a[0] = 1.5;
+ i++;
+ }
+ return v;
+}
+
+f({y:1.4}, [1]);
+f({y:1.6}, [1]);
+%OptimizeFunctionOnNextCall(f);
+f({x:1}, [1]);
+
+// Polymorphic loads should not be hoisted beyond their compare maps.
+function f2(o) {
+ var i = 0;
+ var v;
+ while (i < 1) {
+ v = o.x;
+ i++;
+ }
+ return v;
+}
+
+var o1 = { x: 1.5 };
+var o2 = { y: 1, x: 1 };
+
+f2(o1);
+f2(o1);
+f2(o2);
+%OptimizeFunctionOnNextCall(f2);
+f2(o2);
diff --git a/src/v8/test/mjsunit/regress/regress-indirect-push-unchecked.js b/src/v8/test/mjsunit/regress/regress-indirect-push-unchecked.js
new file mode 100644
index 0000000..dca7e96
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-indirect-push-unchecked.js
@@ -0,0 +1,20 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var a = [1.5];
+
+function p() {
+ Array.prototype.push.call(a, 1.7);
+}
+
+p();
+p();
+p();
+%OptimizeFunctionOnNextCall(p);
+p();
+a.push({});
+p();
+assertEquals(1.7, a[a.length - 1]);
diff --git a/src/v8/test/mjsunit/regress/regress-inline-arrow-as-construct.js b/src/v8/test/mjsunit/regress/regress-inline-arrow-as-construct.js
new file mode 100644
index 0000000..bd8fa31
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-inline-arrow-as-construct.js
@@ -0,0 +1,19 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// This tests that inlining a constructor call to a function which cannot be
+// used as a constructor (e.g. arrow function) still throws correctly.
+
+var g = () => {}
+
+function f() {
+ return new g();
+}
+
+assertThrows(f);
+assertThrows(f);
+%OptimizeFunctionOnNextCall(f);
+assertThrows(f);
diff --git a/src/v8/test/mjsunit/regress/regress-inline-class-constructor.js b/src/v8/test/mjsunit/regress/regress-inline-class-constructor.js
new file mode 100644
index 0000000..1d77176
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-inline-class-constructor.js
@@ -0,0 +1,28 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+"use strict";
+
+var B = class extends Int32Array { }
+
+function f(b) {
+ if (b) {
+ null instanceof B;
+ }
+}
+
+f();
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+f();
+
+function f2() {
+ return new B();
+}
+
+%OptimizeFunctionOnNextCall(f2);
+f2();
diff --git a/src/v8/test/mjsunit/regress/regress-inline-constant-load.js b/src/v8/test/mjsunit/regress/regress-inline-constant-load.js
new file mode 100644
index 0000000..303639c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-inline-constant-load.js
@@ -0,0 +1,27 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var o1 = {};
+var o2 = {};
+
+function foo(x) {
+ return x.bar;
+}
+
+Object.defineProperty(o1, "bar", {value:200});
+foo(o1);
+foo(o1);
+
+function f(b) {
+ var o = o2;
+ if (b) { return foo(o) }
+}
+
+f(false);
+%OptimizeFunctionOnNextCall(f);
+assertEquals(undefined, f(false));
+Object.defineProperty(o2, "bar", {value: 100});
+assertEquals(100, f(true));
diff --git a/src/v8/test/mjsunit/regress/regress-inline-getter-near-stack-limit.js b/src/v8/test/mjsunit/regress/regress-inline-getter-near-stack-limit.js
new file mode 100644
index 0000000..d459a7a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-inline-getter-near-stack-limit.js
@@ -0,0 +1,24 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax
+
+function runNearStackLimit(f) {
+ function t() {
+ try { t(); } catch(e) { f(); }
+ };
+ try { t(); } catch(e) {}
+}
+
+function g(x) { return x.bar; }
+function f1() { }
+function f2() { }
+
+var x = Object.defineProperty({}, "bar", { get: f1 });
+g(x);
+g(x);
+var y = Object.defineProperty({}, "bar", { get: f2 });
+g(y);
+%OptimizeFunctionOnNextCall(g);
+runNearStackLimit(function() { g(y); });
diff --git a/src/v8/test/mjsunit/regress/regress-inlining-function-literal-context.js b/src/v8/test/mjsunit/regress/regress-inlining-function-literal-context.js
new file mode 100644
index 0000000..9b7f7ac
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-inlining-function-literal-context.js
@@ -0,0 +1,53 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax --expose-gc
+
+function mkbaz(x) {
+ function baz() {
+ return function () {
+ return [x];
+ }
+ }
+ return baz;
+}
+
+var baz = mkbaz(1);
+
+function foo() {
+ var f = baz();
+ return f();
+}
+
+// Tenure.
+gc();
+gc();
+
+assertArrayEquals([1], foo());
+assertArrayEquals([1], foo());
+%OptimizeFunctionOnNextCall(foo);
+assertArrayEquals([1], foo());
diff --git a/src/v8/test/mjsunit/regress/regress-int32-truncation.js b/src/v8/test/mjsunit/regress/regress-int32-truncation.js
new file mode 100644
index 0000000..dec4ac1
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-int32-truncation.js
@@ -0,0 +1,61 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function f(i, b) {
+ var a = 0;
+ if (b) {
+ var c = 1 << i;
+ a = c + c;
+ }
+ var x = a >> 3;
+ return a;
+}
+
+f(1, false);
+f(1, true);
+%OptimizeFunctionOnNextCall(f);
+assertEquals((1 << 30) * 2, f(30, true));
+
+
+var global = 1;
+
+function f2(b) {
+ var a = 0;
+ if (b) {
+ a = global;
+ }
+ var x = a >> 3;
+ return a;
+}
+
+f2(false);
+f2(true);
+%OptimizeFunctionOnNextCall(f2);
+global = 2.5;
+assertEquals(global, f2(true));
diff --git a/src/v8/test/mjsunit/regress/regress-integer-indexed-element.js b/src/v8/test/mjsunit/regress/regress-integer-indexed-element.js
new file mode 100644
index 0000000..1bae2d0
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-integer-indexed-element.js
@@ -0,0 +1,12 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var o = {__proto__:new Int32Array(100)};
+Object.prototype[1.3] = 10;
+assertEquals(undefined, o[1.3]);
+
+var o = new Int32Array(100);
+var o2 = new Int32Array(200);
+o.__proto__ = o2;
+assertEquals(undefined, Reflect.get(o, 1.3, o2));
diff --git a/src/v8/test/mjsunit/regress/regress-is-contextual.js b/src/v8/test/mjsunit/regress/regress-is-contextual.js
new file mode 100644
index 0000000..844f4a2
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-is-contextual.js
@@ -0,0 +1,41 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// CallIC accumulates feedback that string index is out of bounds, then
+// misses
+function foo(index) {
+ return text.charAt(index);
+}
+
+var text = "hi there";
+foo(0);
+foo(0);
+foo(100); // Accumulate feedback that index is out of bounds.
+text = false;
+
+// This line ASSERTS in debug without fix.
+assertThrows(function () { foo(); }, TypeError);
diff --git a/src/v8/test/mjsunit/regress/regress-is-smi-repr.js b/src/v8/test/mjsunit/regress/regress-is-smi-repr.js
new file mode 100644
index 0000000..e9f2b51
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-is-smi-repr.js
@@ -0,0 +1,18 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+"use strict";
+
+var global;
+
+function g() { global = this; }
+Object.defineProperty(Number.prototype, "prop", { get: g });
+function f(s) { s.prop; }
+
+f(1);
+f(1);
+%OptimizeFunctionOnNextCall(f);
+f(1);
diff --git a/src/v8/test/mjsunit/regress/regress-iteration-order.js b/src/v8/test/mjsunit/regress/regress-iteration-order.js
new file mode 100644
index 0000000..76f5c3f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-iteration-order.js
@@ -0,0 +1,42 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var x = {a: 1, b: 2, c: 3};
+
+x.__proto__ = {};
+
+delete x.b;
+
+x.d = 4;
+
+s = "";
+
+for (key in x) {
+ s += x[key];
+}
+
+assertEquals("134", s);
diff --git a/src/v8/test/mjsunit/regress/regress-json-parse-index.js b/src/v8/test/mjsunit/regress/regress-json-parse-index.js
new file mode 100644
index 0000000..d1a785a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-json-parse-index.js
@@ -0,0 +1,6 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var o = JSON.parse('{"\\u0030":100}');
+assertEquals(100, o[0]);
diff --git a/src/v8/test/mjsunit/regress/regress-json-stringify-gc.js b/src/v8/test/mjsunit/regress/regress-json-stringify-gc.js
new file mode 100644
index 0000000..905ab40
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-json-stringify-gc.js
@@ -0,0 +1,51 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var a = [];
+var new_space_string = "a";
+for (var i = 0; i < 8; i++) {
+ new_space_string += new_space_string;
+}
+for (var i = 0; i < 10000; i++) a.push(new_space_string);
+
+// At some point during the first stringify, allocation causes a GC and
+// new_space_string is moved to old space. Make sure that this does not
+// screw up reading from the correct location.
+json1 = JSON.stringify(a);
+json2 = JSON.stringify(a);
+assertTrue(json1 == json2, "GC caused JSON.stringify to fail.");
+
+// Check that the slow path of JSON.stringify works correctly wrt GC.
+for (var i = 0; i < 10000; i++) {
+ var s = i.toString();
+ assertEquals('"' + s + '"', JSON.stringify(s, null, 0));
+}
+
+for (var i = 0; i < 10000; i++) {
+ var s = i.toString() + "\u2603";
+ assertEquals('"' + s + '"', JSON.stringify(s, null, 0));
+}
diff --git a/src/v8/test/mjsunit/regress/regress-keyed-access-string-length.js b/src/v8/test/mjsunit/regress/regress-keyed-access-string-length.js
new file mode 100644
index 0000000..f2ead68
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-keyed-access-string-length.js
@@ -0,0 +1,37 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function f(i) {
+ return "abc"[i];
+}
+
+f("length");
+f("length");
+%OptimizeFunctionOnNextCall(f);
+f("length");
diff --git a/src/v8/test/mjsunit/regress/regress-keyed-store-global.js b/src/v8/test/mjsunit/regress/regress-keyed-store-global.js
new file mode 100644
index 0000000..1b12777
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-keyed-store-global.js
@@ -0,0 +1,12 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --verify-heap
+function f(a) {
+ for (var i = 0; i < 256; i++) a[i] = i;
+}
+
+f([]);
+f([]);
+f(this);
diff --git a/src/v8/test/mjsunit/regress/regress-keyed-store-non-strict-arguments.js b/src/v8/test/mjsunit/regress/regress-keyed-store-non-strict-arguments.js
new file mode 100644
index 0000000..865d600
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-keyed-store-non-strict-arguments.js
@@ -0,0 +1,16 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function args(arg) { return arguments; }
+var a = args(false);
+
+(function () {
+ "use strict";
+ a["const" + 0] = 0;
+})();
+
+(function () {
+ "use strict";
+ a[0] = 0;
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-latin-1.js b/src/v8/test/mjsunit/regress/regress-latin-1.js
new file mode 100644
index 0000000..e7f3136
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-latin-1.js
@@ -0,0 +1,91 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+assertEquals(String.fromCharCode(97, 220, 256), 'a' + '\u00DC' + '\u0100');
+assertEquals(String.fromCharCode(97, 220, 256), 'a\u00DC\u0100');
+
+assertEquals(0x80, JSON.stringify("\x80").charCodeAt(1));
+assertEquals(0x80, JSON.stringify("\x80", 0, null).charCodeAt(1));
+
+assertEquals(['a', 'b', '\xdc'], ['b', '\xdc', 'a'].sort());
+
+assertEquals(['\xfc\xdc', '\xfc'], new RegExp('(\xdc)\\1', 'i').exec('\xfc\xdc'));
+// Same test but for all values in Latin-1 range.
+var total_lo = 0;
+for (var i = 0; i < 0xff; i++) {
+ var base = String.fromCharCode(i);
+ var escaped = base;
+ if (base == '(' || base == ')' || base == '*' || base == '+' ||
+ base == '?' || base == '[' || base == ']' || base == '\\' ||
+ base == '$' || base == '^' || base == '|') {
+ escaped = '\\' + base;
+ }
+ var lo = String.fromCharCode(i + 0x20);
+ base_result = new RegExp('(' + escaped + ')\\1', 'i').exec(base + base);
+ assertEquals( base_result, [base + base, base]);
+ lo_result = new RegExp('(' + escaped + ')\\1', 'i').exec(base + lo);
+ if (base.toLowerCase() == lo) {
+ assertEquals([base + lo, base], lo_result);
+ total_lo++;
+ } else {
+ assertEquals(null, lo_result);
+ }
+}
+// Should have hit the branch for the following char codes:
+// [A-Z], [192-222] but not 215
+assertEquals((90-65+1)+(222-192-1+1), total_lo);
+
+// Latin-1 whitespace character
+assertEquals( 1, +(String.fromCharCode(0xA0) + '1') );
+
+// Latin-1 \W characters
+assertEquals(["+\u00a3", "=="], "+\u00a3==".match(/\W\W/g));
+
+// Latin-1 character that uppercases out of Latin-1.
+assertTrue(/\u0178/i.test('\u00ff'));
+
+// Unicode equivalence
+assertTrue(/\u039c/i.test('\u00b5'));
+assertTrue(/\u039c/i.test('\u03bc'));
+assertTrue(/\u00b5/i.test('\u03bc'));
+// Unicode equivalence ranges
+assertTrue(/[\u039b-\u039d]/i.test('\u00b5'));
+assertFalse(/[^\u039b-\u039d]/i.test('\u00b5'));
+assertFalse(/[\u039b-\u039d]/.test('\u00b5'));
+assertTrue(/[^\u039b-\u039d]/.test('\u00b5'));
+
+// Check a regression in QuoteJsonSlow and WriteQuoteJsonString
+for (var testNumber = 0; testNumber < 2; testNumber++) {
+ var testString = "\xdc";
+ var loopLength = testNumber == 0 ? 0 : 20;
+ for (var i = 0; i < loopLength; i++ ) {
+ testString += testString;
+ }
+ var stringified = JSON.stringify({"test" : testString}, null, 0);
+ var stringifiedExpected = '{"test":"' + testString + '"}';
+ assertEquals(stringifiedExpected, stringified);
+}
diff --git a/src/v8/test/mjsunit/regress/regress-lazy-deopt-inlining.js b/src/v8/test/mjsunit/regress/regress-lazy-deopt-inlining.js
new file mode 100644
index 0000000..6cda168
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-lazy-deopt-inlining.js
@@ -0,0 +1,24 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+"use strict";
+function f1(d) {
+ return 1 + f2(f3(d));
+}
+
+function f2(v) { return v; }
+
+function f3(d) {
+ if (d) %DeoptimizeFunction(f1);
+ return 2;
+}
+
+%NeverOptimizeFunction(f3);
+
+f1(false);
+f1(false);
+%OptimizeFunctionOnNextCall(f1);
+assertEquals(3, f1(true));
diff --git a/src/v8/test/mjsunit/regress/regress-lazy-deopt-inlining2.js b/src/v8/test/mjsunit/regress/regress-lazy-deopt-inlining2.js
new file mode 100644
index 0000000..7b73b14
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-lazy-deopt-inlining2.js
@@ -0,0 +1,24 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+"use strict";
+function f1(d) {
+ return 1 + f2(1, f3(d), d);
+}
+
+function f2(v0, v1, v2) { return v1; }
+
+function f3(d) {
+ if (d) %DeoptimizeFunction(f1);
+ return 2;
+}
+
+%NeverOptimizeFunction(f3);
+
+f1(false);
+f1(false);
+%OptimizeFunctionOnNextCall(f1);
+assertEquals(3, f1(true));
diff --git a/src/v8/test/mjsunit/regress/regress-lazy-deopt-reloc.js b/src/v8/test/mjsunit/regress/regress-lazy-deopt-reloc.js
new file mode 100644
index 0000000..f1fe6d5
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-lazy-deopt-reloc.js
@@ -0,0 +1,52 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Do not generate debug code since that will space things differently
+// in the generated code.
+// Flags: --allow-natives-syntax --expose-gc --nodebug-code
+
+// Regression test for issue where we did not pad the relocation
+// information enough to have room for lazy deoptimization.
+
+function kaboom() {
+ var a = function () {},
+ b = function () {},
+ c, d = function () { var d = []; },
+ e = function () { var e = {}; };
+ c = function () { d(); b(); };
+ return function (x, y) {
+ c();
+ a();
+ return function f() { }({});
+ };
+}
+
+kaboom();
+
+%DeoptimizeFunction(kaboom);
+
+gc();
diff --git a/src/v8/test/mjsunit/regress/regress-lea-matching.js b/src/v8/test/mjsunit/regress/regress-lea-matching.js
new file mode 100644
index 0000000..988368a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-lea-matching.js
@@ -0,0 +1,14 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function f(a, b, c) {
+ a = a|0;
+ b = b|0;
+ c = c|0;
+ var r = 0;
+ r = a + ((b << 1) + c) | 0;
+ return r|0;
+}
+
+assertEquals(8, f(1, 2, 3));
diff --git a/src/v8/test/mjsunit/regress/regress-load-elements.js b/src/v8/test/mjsunit/regress/regress-load-elements.js
new file mode 100644
index 0000000..68cdc8e
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-load-elements.js
@@ -0,0 +1,49 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function bad_func(o,a) {
+ for (var i = 0; i < 1; ++i) {
+ o.prop = 0;
+ var x = a[0];
+ }
+}
+
+o = new Object();
+a = {};
+a[0] = 1;
+bad_func(o, a);
+
+o = new Object();
+bad_func(o, a);
+
+// Optimize. Before the fix, the elements-load and subsequent fixed-array-length
+// were hoisted above the map check. This is invalid since not all types
+// necessarily have elements.
+%OptimizeFunctionOnNextCall(bad_func);
+bad_func(o, "");
diff --git a/src/v8/test/mjsunit/regress/regress-load-field-by-index.js b/src/v8/test/mjsunit/regress/regress-load-field-by-index.js
new file mode 100644
index 0000000..c572c1e
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-load-field-by-index.js
@@ -0,0 +1,22 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var o = {a:1.5, b:{}};
+
+function f(o) {
+ var result = [];
+ for (var k in o) {
+ result[result.length] = o[k];
+ }
+ return result;
+}
+
+f(o);
+f(o);
+%OptimizeFunctionOnNextCall(f);
+var array = f(o);
+o.a = 1.7;
+assertEquals(1.5, array[0]);
diff --git a/src/v8/test/mjsunit/regress/regress-map-invalidation-1.js b/src/v8/test/mjsunit/regress/regress-map-invalidation-1.js
new file mode 100644
index 0000000..430972b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-map-invalidation-1.js
@@ -0,0 +1,47 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var c = { x: 2, y: 1 };
+
+function h() {
+ %TryMigrateInstance(c);
+ return 2;
+}
+%NeverOptimizeFunction(h);
+
+function f() {
+ for (var i = 0; i < 100000; i++) {
+ var n = c.x + h();
+ assertEquals(4, n);
+ }
+ var o2 = [{ x: 2.5, y:1 }];
+ return o2;
+}
+
+f();
diff --git a/src/v8/test/mjsunit/regress/regress-map-invalidation-2.js b/src/v8/test/mjsunit/regress/regress-map-invalidation-2.js
new file mode 100644
index 0000000..ece96b3
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-map-invalidation-2.js
@@ -0,0 +1,54 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax --opt
+
+var c = { x: 2, y: 1 };
+
+function g() {
+ var outer = { foo: 1 };
+ function f(b, c) {
+ var n = outer.foo;
+ for (var i = 0; i < 10; i++) {
+ n += c.x + outer.foo;
+ }
+ if (b) return [{ x: 1.5, y: 1 }];
+ else return c;
+ }
+ // Clear type feedback from previous stress runs.
+ %ClearFunctionFeedback(f);
+ return f;
+}
+
+var fun = g();
+fun(false, c);
+fun(false, c);
+fun(false, c);
+%OptimizeFunctionOnNextCall(fun);
+fun(false, c);
+fun(true, c);
+assertOptimized(fun);
diff --git a/src/v8/test/mjsunit/regress/regress-mask-array-length.js b/src/v8/test/mjsunit/regress/regress-mask-array-length.js
new file mode 100644
index 0000000..bd87e7c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-mask-array-length.js
@@ -0,0 +1,10 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var a = [];
+var o = {
+ __proto__: a
+};
+Object.preventExtensions(o);
+o.length = 'abc';
diff --git a/src/v8/test/mjsunit/regress/regress-merge-descriptors.js b/src/v8/test/mjsunit/regress/regress-merge-descriptors.js
new file mode 100644
index 0000000..98e2f26
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-merge-descriptors.js
@@ -0,0 +1,92 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var extend = function (d, b) {
+ function __() { this.constructor = d; }
+ __.prototype = b.prototype;
+ d.prototype = new __();
+};
+
+var Car = (function (Super) {
+ var Car = function () {
+ var self = this;
+
+ Super.call(self);
+
+ Object.defineProperties(self, {
+ "make": {
+ enumerable: true,
+ configurable: true,
+ get: function () {
+ return "Ford";
+ }
+ }
+ });
+
+ self.copy = function () {
+ throw new Error("Meant to be overriden");
+ };
+
+ return self;
+ };
+
+ extend(Car, Super);
+
+ return Car;
+}(Object));
+
+
+var SuperCar = ((function (Super) {
+ var SuperCar = function (make) {
+ var self = this;
+
+ Super.call(self);
+
+
+ Object.defineProperties(self, {
+ "make": {
+ enumerable: true,
+ configurable: true,
+ get: function () {
+ return make;
+ }
+ }
+ });
+
+ // Convert self.copy from DATA_CONSTANT to DATA.
+ self.copy = function () { };
+
+ return self;
+ };
+ extend(SuperCar, Super);
+ return SuperCar;
+})(Car));
+
+assertEquals("Ford", new Car().make);
+assertEquals("Bugatti", new SuperCar("Bugatti").make);
+assertEquals("Lambo", new SuperCar("Lambo").make);
+assertEquals("Shelby", new SuperCar("Shelby").make);
diff --git a/src/v8/test/mjsunit/regress/regress-migrate-callbacks.js b/src/v8/test/mjsunit/regress/regress-migrate-callbacks.js
new file mode 100644
index 0000000..b1979ea
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-migrate-callbacks.js
@@ -0,0 +1,11 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var o1 = {};
+o1.x = 1
+o1.y = 1.5
+var o2 = {}
+o2.x = 1.5;
+o2.__defineSetter__('y', function(v) { });
+o1.y;
diff --git a/src/v8/test/mjsunit/regress/regress-mul-canoverflow.js b/src/v8/test/mjsunit/regress/regress-mul-canoverflow.js
new file mode 100644
index 0000000..e3e21ca
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-mul-canoverflow.js
@@ -0,0 +1,45 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function boom(a) {
+ return ((a | 0) * (a | 0)) | 0;
+}
+function boom_unoptimized(a) {
+ try {} catch(_) {}
+ return ((a | 0) * (a | 0)) | 0;
+}
+
+boom(1, 1);
+boom(2, 2);
+
+%OptimizeFunctionOnNextCall(boom);
+var big_int = 0x5F00000F;
+var expected = boom_unoptimized(big_int);
+var actual = boom(big_int)
+assertEquals(expected, actual);
diff --git a/src/v8/test/mjsunit/regress/regress-mul-canoverflowb.js b/src/v8/test/mjsunit/regress/regress-mul-canoverflowb.js
new file mode 100644
index 0000000..4203ac4
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-mul-canoverflowb.js
@@ -0,0 +1,45 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function boom(a) {
+ return ((a | 0) * (a | 0)) | 0;
+}
+%NeverOptimizeFunction(boom_unoptimized);
+function boom_unoptimized(a) {
+ return ((a | 0) * (a | 0)) | 0;
+}
+
+boom(1, 1);
+boom(2, 2);
+
+%OptimizeFunctionOnNextCall(boom);
+var big_int = 0x5F00000F;
+var expected = boom_unoptimized(big_int);
+var actual = boom(big_int)
+assertEquals(expected, actual);
diff --git a/src/v8/test/mjsunit/regress/regress-no-dummy-use-for-arguments-object.js b/src/v8/test/mjsunit/regress/regress-no-dummy-use-for-arguments-object.js
new file mode 100644
index 0000000..658d776
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-no-dummy-use-for-arguments-object.js
@@ -0,0 +1,21 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function g() {
+ arguments.length;
+}
+
+var global = "";
+
+function f() {
+ global.dummy = this;
+ g({});
+}
+
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+f();
diff --git a/src/v8/test/mjsunit/regress/regress-ntl.js b/src/v8/test/mjsunit/regress/regress-ntl.js
new file mode 100644
index 0000000..993599e
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-ntl.js
@@ -0,0 +1,41 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function mod1() {
+ var v_1 = 1;
+ var v_2 = 1;
+ v_1++;
+ v_2 = {valueOf: function() { throw "gagh"; }};
+
+ function bug1() {
+ for (var i = 0; i < 1; v_2++) {
+ if (v_1 == 1) ;
+ }
+ }
+
+ return bug1;
+}
+
+var f = mod1();
+assertThrows(f);
+%OptimizeFunctionOnNextCall(f);
+assertThrows(f);
+
+
+var v_3 = 1;
+var v_4 = 1;
+v_3++;
+v_4 = {valueOf: function() { throw "gagh"; }};
+
+function bug2() {
+ for (var i = 0; i < 1; v_4++) {
+ if (v_3 == 1) ;
+ }
+}
+
+assertThrows(bug2);
+%OptimizeFunctionOnNextCall(bug2);
+assertThrows(bug2);
diff --git a/src/v8/test/mjsunit/regress/regress-object-assign-deprecated-2.js b/src/v8/test/mjsunit/regress/regress-object-assign-deprecated-2.js
new file mode 100644
index 0000000..89693de
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-object-assign-deprecated-2.js
@@ -0,0 +1,8 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var x = {a:1, b:2};
+Object.defineProperty(x, "c", {set(v) {}})
+var y = {get c() { return {a:1, b:2.5} }};
+Object.assign(x, y, x);
diff --git a/src/v8/test/mjsunit/regress/regress-object-assign-deprecated.js b/src/v8/test/mjsunit/regress/regress-object-assign-deprecated.js
new file mode 100644
index 0000000..d2e60f9
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-object-assign-deprecated.js
@@ -0,0 +1,7 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var x = {a:1, b:2};
+var y = {a:1, b:2.5};
+Object.assign(x, x);
diff --git a/src/v8/test/mjsunit/regress/regress-omit-checks.js b/src/v8/test/mjsunit/regress/regress-omit-checks.js
new file mode 100644
index 0000000..e5d5074
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-omit-checks.js
@@ -0,0 +1,55 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var a = {x:1};
+var a_deprecate = {x:1};
+a_deprecate.x = 1.5;
+function create() {
+ return {__proto__:a, y:1};
+}
+var b1 = create();
+var b2 = create();
+var b3 = create();
+var b4 = create();
+
+function set(b) {
+ b.x = 5;
+ b.z = 10;
+}
+
+set(b1);
+set(b2);
+%OptimizeFunctionOnNextCall(set);
+set(b3);
+var called = false;
+a.x = 1.5;
+Object.defineProperty(a, "z", {set:function(v) { called = true; }});
+set(b4);
+assertTrue(called);
+assertEquals(undefined, b4.z);
diff --git a/src/v8/test/mjsunit/regress/regress-opt-typeof-null.js b/src/v8/test/mjsunit/regress/regress-opt-typeof-null.js
new file mode 100644
index 0000000..e4721a1
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-opt-typeof-null.js
@@ -0,0 +1,12 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f() {
+ return typeof null === "object";
+};
+
+%OptimizeFunctionOnNextCall(f);
+assertTrue(f());
diff --git a/src/v8/test/mjsunit/regress/regress-osr-context.js b/src/v8/test/mjsunit/regress/regress-osr-context.js
new file mode 100644
index 0000000..a739541
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-osr-context.js
@@ -0,0 +1,20 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --function-context-specialization
+// Flags: --turbo-filter=f
+
+(function() {
+ "use strict";
+ var a = 23;
+ function f() {
+ for (let i = 0; i < 5; ++i) {
+ a--; // Make sure {a} is non-immutable, hence context allocated.
+ function g() { return i } // Make sure block has a context.
+ if (i == 2) %OptimizeOsr();
+ }
+ return a;
+ }
+ assertEquals(18, f());
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-osr-in-case-label.js b/src/v8/test/mjsunit/regress/regress-osr-in-case-label.js
new file mode 100644
index 0000000..3ad9e33
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-osr-in-case-label.js
@@ -0,0 +1,18 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --harmony-do-expressions
+
+function f(x) {
+ switch (x) {
+ case 1: return "one";
+ case 2: return "two";
+ case do { for (var i = 0; i < 10; i++) { if (i == 5) %OptimizeOsr(); } }:
+ case 3: return "WAT";
+ }
+}
+
+assertEquals("one", f(1));
+assertEquals("two", f(2));
+assertEquals("WAT", f(3));
diff --git a/src/v8/test/mjsunit/regress/regress-osr-in-literal.js b/src/v8/test/mjsunit/regress/regress-osr-in-literal.js
new file mode 100644
index 0000000..7553b9c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-osr-in-literal.js
@@ -0,0 +1,30 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --harmony-do-expressions
+
+"use strict";
+
+var p = {};
+var testCases = [
+ { s:"[1, do { _OSR_ 2 }, 3]", r:[1, 2, 3] },
+ { s:"[1, ...[2], do { _OSR_ 3 }, 4]", r:[1, 2, 3, 4] },
+ { s:"[1, ...do { _OSR_ [2,3] }, 4]", r:[1, 2, 3, 4] },
+ { s:"{ a:do { _OSR_ 1 } }", r:{ a:1 } },
+ { s:"{ a:do { _OSR_ 2 }, __proto__:p }", r:{ a:2, __proto__:p } },
+ { s:"{ a:do { _OSR_ 3 }, get b() { return 4; } }", r:{ a:3, b:4 } },
+ { s:"{ [do { _OSR_ 'b' }]: 3 }", r:{ b:3 } },
+ { s:"{ [do { _OSR_ 'b' }]: 3, c: 4 }", r:{ b:3, c:4 } },
+ { s:"{ [do { _OSR_ 'b' }]: 3, __proto__:p }", r:{ b:3, __proto__:p } },
+ { s:"{ get [do { _OSR_ 'c' }]() { return 4; } }", r:{ c:4 } },
+ { s:"class { [do { _OSR_ 'f' }]() {} }" },
+ { s:"class { [do { _OSR_ 'f' }]() {}; g() {} }" },
+];
+
+for (var i = 0; i < testCases.length; ++i) {
+ var source = "(function f" + i + "(x) { return " + testCases[i].s + "})";
+ var osr = "for (var i = 0; i < 10; i++) { if (i == 5) %OptimizeOsr(); }";
+ var result = eval(source.replace("_OSR_", osr))();
+ if (testCases[i].r) assertEquals(testCases[i].r, result);
+}
diff --git a/src/v8/test/mjsunit/regress/regress-param-local-type.js b/src/v8/test/mjsunit/regress/regress-param-local-type.js
new file mode 100644
index 0000000..0eaca50
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-param-local-type.js
@@ -0,0 +1,58 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax --opt
+
+// Test that we do not confuse the first local and the first parameter
+// when gathering type information.
+
+function f(a) { // First parameter is tagged.
+ var s = ''; // First local has string type.
+ var n = 0;
+ var i = 1;
+ n = i + a;
+}
+
+f(1);
+f(1);
+%OptimizeFunctionOnNextCall(f);
+f(1);
+assertOptimized(f);
+
+
+function g() { // 0th parameter (receiver) is tagged.
+ var s = ''; // First local has string type.
+ var n = 0;
+ var i = 1;
+ n = i + this;
+}
+
+g.call(1);
+g.call(1);
+%OptimizeFunctionOnNextCall(g);
+g.call(1);
+assertOptimized(g);
diff --git a/src/v8/test/mjsunit/regress/regress-parse-use-strict.js b/src/v8/test/mjsunit/regress/regress-parse-use-strict.js
new file mode 100644
index 0000000..9dd0f4c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-parse-use-strict.js
@@ -0,0 +1,42 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Filler long enough to trigger lazy parsing.
+var filler = "/*" + new Array(1024).join('x') + "*/";
+
+// Snippet trying to switch to strict mode.
+var strict = '"use strict"; with({}) {}';
+
+// Test switching to strict mode after string literal.
+assertThrows('function f() { "use sanity";' + strict + '}');
+assertThrows('function f() { "use sanity";' + strict + filler + '}');
+
+// Test switching to strict mode after function declaration.
+// We must use eval instead of assertDoesNotThrow here to make sure that
+// lazy parsing is triggered. Otherwise the bug won't reproduce.
+eval('function f() { function g() {}' + strict + '}');
+eval('function f() { function g() {}' + strict + filler + '}');
diff --git a/src/v8/test/mjsunit/regress/regress-parseint.js b/src/v8/test/mjsunit/regress/regress-parseint.js
new file mode 100644
index 0000000..05501f3
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-parseint.js
@@ -0,0 +1,18 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f(string, radix) {
+ // Use a phi to force radix into heap number representation.
+ radix = (radix == 0) ? radix : (radix >> 0);
+ if (radix != 2) return NaN;
+ return %StringParseInt(string, radix);
+}
+
+assertEquals(2, (-4294967294) >> 0);
+assertEquals(3, f("11", -4294967294));
+assertEquals(NaN, f("11", -2147483650));
+%OptimizeFunctionOnNextCall(f);
+assertEquals(3, f("11", -4294967294));
diff --git a/src/v8/test/mjsunit/regress/regress-phi-truncation.js b/src/v8/test/mjsunit/regress/regress-phi-truncation.js
new file mode 100644
index 0000000..940efe3
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-phi-truncation.js
@@ -0,0 +1,89 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function test(fun, expectation) {
+ assertEquals(1, fun(1));
+ %OptimizeFunctionOnNextCall(fun);
+ assertEquals(expectation, fun(0));
+}
+
+test(function(x) {
+ var a = x ? true : false;
+ return a | 0;
+}, 0);
+
+test(function(x) {
+ var a = x ? true : true;
+ return a | 0;
+}, 1);
+
+test(function(x) {
+ var a = x ? true : "0";
+ return a | 0;
+}, 0);
+
+test(function(x) {
+ var a = x ? true : "1";
+ return a | 0;
+}, 1);
+
+test(function(x) {
+ var a = x ? true : "-1";
+ return a | 0;
+}, -1);
+
+test(function(x) {
+ var a = x ? true : "-0";
+ return a | 0;
+}, 0);
+
+test(function(x) {
+ var a = x ? true : "0x1234";
+ return a | 0;
+}, 0x1234);
+
+test(function(x) {
+ var a = x ? true : { valueOf: function() { return 2; } };
+ return a | 0;
+}, 2);
+
+test(function(x) {
+ var a = x ? true : undefined;
+ return a | 0;
+}, 0);
+
+test(function(x) {
+ var a = x ? true : null;
+ return a | 0;
+}, 0);
+
+test(function(x) {
+ var a = x ? true : "";
+ return a | 0;
+}, 0);
diff --git a/src/v8/test/mjsunit/regress/regress-polymorphic-load.js b/src/v8/test/mjsunit/regress/regress-polymorphic-load.js
new file mode 100644
index 0000000..2545e85
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-polymorphic-load.js
@@ -0,0 +1,43 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function f(o) {
+ return o.x;
+}
+
+var o1 = {x:1};
+var o2 = {__proto__: {x:2}};
+
+f(o2);
+f(o2);
+f(o2);
+f(o1);
+%OptimizeFunctionOnNextCall(f);
+assertEquals(1, f(o1));
+assertEquals(2, f(o2));
diff --git a/src/v8/test/mjsunit/regress/regress-polymorphic-store.js b/src/v8/test/mjsunit/regress/regress-polymorphic-store.js
new file mode 100644
index 0000000..4723a7f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-polymorphic-store.js
@@ -0,0 +1,48 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var o1 = {};
+o1.f1 = function() { return 10; };
+o1.x = 5;
+o1.y = 2;
+var o2 = {};
+o2.x = 5;
+o2.y = 5;
+
+function store(o, v) {
+ o.y = v;
+}
+
+store(o2, 0);
+store(o1, 0);
+store(o2, 0);
+%OptimizeFunctionOnNextCall(store);
+store(o1, 10);
+assertEquals(5, o1.x);
+assertEquals(10, o1.y);
diff --git a/src/v8/test/mjsunit/regress/regress-private-enumerable.js b/src/v8/test/mjsunit/regress/regress-private-enumerable.js
new file mode 100644
index 0000000..6627c53
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-private-enumerable.js
@@ -0,0 +1,31 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+class A {}
+class B {}
+Object.assign(B, A);
+assertEquals("class B {}", B.toString());
+
+(function() {
+ function f(a, i, v) {
+ a[i] = v;
+ }
+
+ f("make it generic", 0, 0);
+
+ var o = {foo: "foo"};
+ %OptimizeObjectForAddingMultipleProperties(o, 10);
+
+ var s = %CreatePrivateSymbol("priv");
+ f(o, s, "private");
+ %ToFastProperties(o);
+
+ var desc = Object.getOwnPropertyDescriptor(o, s);
+ assertEquals("private", desc.value);
+ assertTrue(desc.writable);
+ assertFalse(desc.enumerable);
+ assertTrue(desc.configurable);
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-push-args-twice.js b/src/v8/test/mjsunit/regress/regress-push-args-twice.js
new file mode 100644
index 0000000..faa6007
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-push-args-twice.js
@@ -0,0 +1,37 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Check that the ADD binary op stub correctly handles non-number arguments
+// passed on registers.
+
+try {
+ for (var key = 0; key != 10; key++) {
+ var x = 1 + undefined;
+ }
+} catch(e) {
+ fail("no exception", e);
+}
diff --git a/src/v8/test/mjsunit/regress/regress-put-prototype-transition.js b/src/v8/test/mjsunit/regress/regress-put-prototype-transition.js
new file mode 100644
index 0000000..bc63d21
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-put-prototype-transition.js
@@ -0,0 +1,49 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --expose-gc --stress-compaction --gc-interval=255
+
+function deepEquals(a, b) { if (a === b) { if (a === 0) return (1 / a) === (1 / b); return true; } if (typeof a != typeof b) return false; if (typeof a == "number") return isNaN(a) && isNaN(b); if (typeof a !== "object" && typeof a !== "function") return false; var objectClass = classOf(a); if (objectClass !== classOf(b)) return false; if (objectClass === "RegExp") { return (a.toString() === b.toString()); } if (objectClass === "Function") return false; if (objectClass === "Array") { var elementCount = 0; if (a.length != b.length) { return false; } for (var i = 0; i < a.length; i++) { if (!deepEquals(a[i], b[i])) return false; } return true; } if (objectClass == "String" || objectClass == "Number" || objectClass == "Boolean" || objectClass == "Date") { if (a.valueOf() !== b.valueOf()) return false; } return deepObjectEquals(a, b); }
+assertSame = function assertSame(expected, found, name_opt) { if (found === expected) { if (expected !== 0 || (1 / expected) == (1 / found)) return; } else if ((expected !== expected) && (found !== found)) { return; } fail(PrettyPrint(expected), found, name_opt); }; assertEquals = function assertEquals(expected, found, name_opt) { if (!deepEquals(found, expected)) { fail(PrettyPrint(expected), found, name_opt); } };
+assertEqualsDelta = function assertEqualsDelta(expected, found, delta, name_opt) { assertTrue(Math.abs(expected - found) <= delta, name_opt); }; assertArrayEquals = function assertArrayEquals(expected, found, name_opt) { var start = ""; if (name_opt) { start = name_opt + " - "; } assertEquals(expected.length, found.length, start + "array length"); if (expected.length == found.length) { for (var i = 0; i < expected.length; ++i) { assertEquals(expected[i], found[i], start + "array element at index " + i); } } };
+assertTrue = function assertTrue(value, name_opt) { assertEquals(true, value, name_opt); };
+assertFalse = function assertFalse(value, name_opt) { assertEquals(false, value, name_opt); };
+// End stripped down and modified version of mjsunit.js.
+
+var __v_0 = {};
+var __v_1 = {};
+function __f_3() { }
+function __f_4(obj) {
+ for (var __v_2 = 0; __v_2 < 26; __v_2++) {
+ obj["__v_5" + __v_2] = 0;
+ }
+}
+function __f_0(__v_1, __v_6) {
+ (new __f_3()).__proto__ = __v_1;
+}
+%DebugPrint(undefined);
+function __f_1(__v_4, add_first, __v_6, same_map_as) {
+ var __v_1 = __v_4 ? new __f_3() : {};
+ assertTrue(__v_4 || %HasFastProperties(__v_1));
+ if (add_first) {
+ __f_4(__v_1);
+ assertFalse(%HasFastProperties(__v_1));
+ __f_0(__v_1, __v_6);
+ assertFalse(%HasFastProperties(__v_1));
+ } else {
+ __f_0(__v_1, __v_6);
+ assertTrue(__v_4 || !%HasFastProperties(__v_1));
+ __f_4(__v_1);
+ assertTrue(__v_4 || !%HasFastProperties(__v_1));
+ }
+}
+gc();
+for (var __v_2 = 0; __v_2 < 4; __v_2++) {
+ var __v_6 = ((__v_2 & 2) != 7);
+ var __v_4 = ((__v_2 & 2) != 0);
+ __f_1(__v_4, true, __v_6);
+ var __v_0 = __f_1(__v_4, false, __v_6);
+ __f_1(__v_4, false, __v_6, __v_0);
+}
+__v_5 = {a: 1, b: 2, c: 3};
diff --git a/src/v8/test/mjsunit/regress/regress-r3391.js b/src/v8/test/mjsunit/regress/regress-r3391.js
new file mode 100644
index 0000000..d557284
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-r3391.js
@@ -0,0 +1,77 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Check what we do if toLocaleString doesn't return a string when we are
+// calling Array.prototype.toLocaleString. The standard is somewhat
+// vague on this point. This test is now passed by both V8 and JSC.
+
+var evil_called = 0;
+var evil_locale_called = 0;
+var exception_thrown = 0;
+
+function evil_to_string() {
+ evil_called++;
+ return this;
+}
+
+function evil_to_locale_string() {
+ evil_locale_called++;
+ return this;
+}
+
+var o = {toString: evil_to_string, toLocaleString: evil_to_locale_string};
+
+try {
+ [o].toLocaleString();
+} catch(e) {
+ exception_thrown++;
+}
+
+assertEquals(1, evil_called, "evil1");
+assertEquals(1, evil_locale_called, "local1");
+assertEquals(1, exception_thrown, "exception1");
+
+try {
+ [o].toString();
+} catch(e) {
+ exception_thrown++;
+}
+
+assertEquals(2, evil_called, "evil2");
+assertEquals(1, evil_locale_called, "local2");
+assertEquals(2, exception_thrown, "exception2");
+
+try {
+ [o].join(o);
+} catch(e) {
+ exception_thrown++;
+}
+
+assertEquals(3, evil_called, "evil3");
+assertEquals(1, evil_locale_called, "local3");
+assertEquals(3, exception_thrown, "exception3");
+print("ok");
diff --git a/src/v8/test/mjsunit/regress/regress-r4998.js b/src/v8/test/mjsunit/regress/regress-r4998.js
new file mode 100644
index 0000000..a82c266
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-r4998.js
@@ -0,0 +1,92 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test for a broken fast-smi-loop that does not save the incremented value
+// of the loop index. If this test fails, it loops forever, and times out.
+
+// Calling foo() spills the virtual frame.
+function foo() {
+ return;
+}
+
+function bar() {
+ var x1 = 3;
+ var x2 = 3;
+ var x3 = 3;
+ var x4 = 3;
+ var x5 = 3;
+ var x6 = 3;
+ var x7 = 3;
+ var x8 = 3;
+ var x9 = 3;
+ var x10 = 3;
+ var x11 = 3;
+ var x12 = 3;
+ var x13 = 3;
+
+ foo();
+
+ x1 = 257;
+ x2 = 258;
+ x3 = 259;
+ x4 = 260;
+ x5 = 261;
+ x6 = 262;
+ x7 = 263;
+ x8 = 264;
+ x9 = 265;
+ x10 = 266;
+ x11 = 267;
+ x12 = 268;
+ x13 = 269;
+
+ // The loop variable x7 is initialized to 3,
+ // and then MakeMergeable is called on the virtual frame.
+ // MakeMergeable has forced the loop variable x7 to be spilled,
+ // so it is marked as synced
+ // The back edge then merges its virtual frame, which incorrectly
+ // claims that x7 is synced, and does not save the modified
+ // value.
+ for (x7 = 3; x7 < 10; ++x7) {
+ foo();
+ }
+}
+
+bar();
+
+function aliasing() {
+ var x = 3;
+ var j;
+ for (j = 7; j < 11; ++j) {
+ x = j;
+ }
+
+ assertEquals(10, x);
+ assertEquals(11, j);
+}
+
+aliasing();
diff --git a/src/v8/test/mjsunit/regress/regress-recurse-patch-binary-op.js b/src/v8/test/mjsunit/regress/regress-recurse-patch-binary-op.js
new file mode 100644
index 0000000..842cc79
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-recurse-patch-binary-op.js
@@ -0,0 +1,10 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var i = 0
+function valueOf() {
+ while (true) return i++ < 4 ? 1 + this : 2
+}
+
+1 + ({valueOf})
diff --git a/src/v8/test/mjsunit/regress/regress-refreeze-same-map.js b/src/v8/test/mjsunit/regress/regress-refreeze-same-map.js
new file mode 100644
index 0000000..19cdb50
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-refreeze-same-map.js
@@ -0,0 +1,40 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// precondition
+assertTrue(%HaveSameMap(Object.freeze({}), Object.freeze({})));
+assertTrue(%HaveSameMap(Object.freeze({a: 1}), Object.freeze({a: 1})));
+assertTrue(%HaveSameMap(Object.freeze([]), Object.freeze([])));
+assertTrue(%HaveSameMap(Object.freeze([1,2]), Object.freeze([1,2])));
+
+assertTrue(%HaveSameMap(Object.seal({}), Object.seal({})));
+assertTrue(%HaveSameMap(Object.seal({a: 1}), Object.seal({a: 1})));
+assertTrue(%HaveSameMap(Object.seal([]), Object.seal([])));
+assertTrue(%HaveSameMap(Object.seal([1,2]), Object.seal([1,2])));
+
+// refreezing an already frozen obj does not keep adding transitions
+assertTrue(%HaveSameMap(Object.freeze({}), Object.freeze( Object.freeze({}) )));
+assertTrue(%HaveSameMap(Object.freeze({a: 1}), Object.freeze( Object.freeze({a: 1}) )));
+assertTrue(%HaveSameMap(Object.freeze([]), Object.freeze( Object.freeze([]) )));
+assertTrue(%HaveSameMap(Object.freeze([1,2]), Object.freeze( Object.freeze([1,2]) )));
+
+// resealing a sealed object is idempotent
+assertTrue(%HaveSameMap(Object.seal({}), Object.seal( Object.seal({}) )));
+assertTrue(%HaveSameMap(Object.seal({a: 1}), Object.seal( Object.seal({a: 1}) )));
+assertTrue(%HaveSameMap(Object.seal([]), Object.seal( Object.seal([]) )));
+assertTrue(%HaveSameMap(Object.seal([1,2]), Object.seal( Object.seal([1,2]) )));
+
+// sealing a frozen object is idempotent
+assertTrue(%HaveSameMap(Object.freeze({}), Object.seal( Object.freeze({}) )));
+assertTrue(%HaveSameMap(Object.freeze({a: 1}), Object.seal( Object.freeze({a: 1}) )));
+assertTrue(%HaveSameMap(Object.freeze([]), Object.seal( Object.freeze([]) )));
+assertTrue(%HaveSameMap(Object.freeze([1,2]), Object.seal( Object.freeze([1,2]) )));
+
+// freezing a sealed empty is idempotent
+assertTrue(%HaveSameMap(Object.freeze(Object.seal({})), Object.seal({})));
+
+// sealing a unextensible empty object is idempotent
+assertTrue(%HaveSameMap(Object.seal(Object.preventExtensions({})), Object.preventExtensions({})));
diff --git a/src/v8/test/mjsunit/regress/regress-regexp-codeflush.js b/src/v8/test/mjsunit/regress/regress-regexp-codeflush.js
new file mode 100644
index 0000000..03fe321
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-regexp-codeflush.js
@@ -0,0 +1,55 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --gc-global
+
+// Regression test for regexp that has multiple matches and which
+// internally calls RegExpImpl::IrregexpExecOnce more than once without
+// ensuring that the regexp is compiled.
+// This can create a crash if the code was exchanged with the sweep
+// generation (for code flushing support) in GC during the matching.
+
+var re = new RegExp('(s)', "g");
+
+function foo() {
+ return "42";
+}
+
+// Run enough times to get a number of GC's (all mark sweep because of the
+// --gc_global) flag.
+for ( var i = 0; i < 10; i++) {
+ // Make a long string with plenty of matches for re.
+ var x = "s foo s bar s foo s bar s";
+ x = x + x;
+ x = x + x;
+ x = x + x;
+ x = x + x;
+ x = x + x;
+ x = x + x;
+ x = x + x;
+ x.replace(re, foo);
+}
diff --git a/src/v8/test/mjsunit/regress/regress-regexp-construct-result.js b/src/v8/test/mjsunit/regress/regress-regexp-construct-result.js
new file mode 100644
index 0000000..84bdd20
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-regexp-construct-result.js
@@ -0,0 +1,45 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Create a huge regexp with many alternative capture groups, most of
+// which do not capture anything, but the corresponding capture slot
+// in the result object has to exist, even though filled with undefined.
+// Having a large result array helps stressing GC.
+
+var num_captures = 1000;
+var regexp_string = "(a)";
+for (var i = 0; i < num_captures - 1; i++) {
+ regexp_string += "|(b)";
+}
+var regexp = new RegExp(regexp_string);
+
+for (var i = 0; i < 10; i++) {
+ var matches = regexp.exec("a");
+ var count = 0;
+ matches.forEach(function() { count++; });
+ assertEquals(num_captures + 1, count);
+}
diff --git a/src/v8/test/mjsunit/regress/regress-regexp-nocase.js b/src/v8/test/mjsunit/regress/regress-regexp-nocase.js
new file mode 100644
index 0000000..27637da
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-regexp-nocase.js
@@ -0,0 +1,30 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var s = "('')x\nx\uF670";
+
+assertEquals(s.match(/\((').*\1\)/i), ["('')", "'"]);
diff --git a/src/v8/test/mjsunit/regress/regress-reset-dictionary-elements.js b/src/v8/test/mjsunit/regress/regress-reset-dictionary-elements.js
new file mode 100644
index 0000000..d3d093e
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-reset-dictionary-elements.js
@@ -0,0 +1,14 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var a = [];
+a[10000] = 1;
+a.length = 0;
+a[1] = 1;
+a.length = 0;
+assertEquals(undefined, a[1]);
+
+var o = {};
+Object.freeze(o);
+assertEquals(undefined, o[1]);
diff --git a/src/v8/test/mjsunit/regress/regress-set-flags-stress-compact.js b/src/v8/test/mjsunit/regress/regress-set-flags-stress-compact.js
new file mode 100644
index 0000000..5bc59a7
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-set-flags-stress-compact.js
@@ -0,0 +1,10 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+%SetFlags("--gc-interval=164 --stress-compaction");
+
+var a = [];
+for (var i = 0; i < 10000; i++) { a[i * 100] = 0; }
diff --git a/src/v8/test/mjsunit/regress/regress-shift-enumerable.js b/src/v8/test/mjsunit/regress/regress-shift-enumerable.js
new file mode 100644
index 0000000..f3ee258
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-shift-enumerable.js
@@ -0,0 +1,16 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var arr = [1, 2];
+Object.defineProperty(arr, 0xfffe, {
+ value: 3,
+ configurable: true,
+ writable: true,
+ enumerable: false
+});
+arr[0xffff] = 4;
+arr.shift();
+var desc = Object.getOwnPropertyDescriptor(arr, 0xfffe);
+assertEquals(4, desc.value);
+assertFalse(desc.enumerable);
diff --git a/src/v8/test/mjsunit/regress/regress-sliced-external-cons-regexp.js b/src/v8/test/mjsunit/regress/regress-sliced-external-cons-regexp.js
new file mode 100644
index 0000000..145c831
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-sliced-external-cons-regexp.js
@@ -0,0 +1,21 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-externalize-string --expose-gc
+
+var re = /(B)/;
+var cons1 = "0123456789" + "ABCDEFGHIJ";
+var cons2 = "0123456789\u1234" + "ABCDEFGHIJ";
+gc();
+gc(); // Promote cons.
+
+try { externalizeString(cons1, false); } catch (e) { }
+try { externalizeString(cons2, true); } catch (e) { }
+
+var slice1 = cons1.slice(1,-1);
+var slice2 = cons2.slice(1,-1);
+for (var i = 0; i < 10; i++) {
+ assertEquals(["B", "B"], re.exec(slice1));
+ assertEquals(["B", "B"], re.exec(slice2));
+}
diff --git a/src/v8/test/mjsunit/regress/regress-smi-math-floor-round.js b/src/v8/test/mjsunit/regress/regress-smi-math-floor-round.js
new file mode 100644
index 0000000..7c033a3
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-smi-math-floor-round.js
@@ -0,0 +1,67 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+
+function f(o) {
+ return Math.floor(o.x_smi) + 1;
+}
+
+assertEquals(2, f({x_smi:1}));
+assertEquals(2, f({x_smi:1}));
+%OptimizeFunctionOnNextCall(f);
+assertEquals(2, f({x_smi:1}));
+
+function f2(o) {
+ return Math.floor(o.x_tagged) + 1;
+}
+
+var o = {x_tagged:{}};
+o.x_tagged = 1.4;
+assertEquals(2, f2(o));
+assertEquals(2, f2(o));
+%OptimizeFunctionOnNextCall(f2);
+assertEquals(2, f2(o));
+
+function f3(o) {
+ return Math.round(o.x_smi) + 1;
+}
+
+assertEquals(2, f3({x_smi:1}));
+assertEquals(2, f3({x_smi:1}));
+%OptimizeFunctionOnNextCall(f3);
+assertEquals(2, f3({x_smi:1}));
+
+function f4(o) {
+ return Math.round(o.x_tagged) + 1;
+}
+
+assertEquals(2, f4(o));
+assertEquals(2, f4(o));
+%OptimizeFunctionOnNextCall(f4);
+assertEquals(2, f4(o));
diff --git a/src/v8/test/mjsunit/regress/regress-smi-only-concat.js b/src/v8/test/mjsunit/regress/regress-smi-only-concat.js
new file mode 100644
index 0000000..503f306
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-smi-only-concat.js
@@ -0,0 +1,37 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// This tests that concatenating a fast smi-only array and a fast object array
+// results in a fast object array.
+
+var fast_array = ['a', 'b'];
+var array = fast_array.concat(fast_array);
+
+assertTrue(%HasObjectElements(fast_array));
+assertTrue(%HasObjectElements(array));
diff --git a/src/v8/test/mjsunit/regress/regress-smi-scanning.js b/src/v8/test/mjsunit/regress/regress-smi-scanning.js
new file mode 100644
index 0000000..56cf9f9
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-smi-scanning.js
@@ -0,0 +1,7 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+x = 2
+3;
+assertEquals(2, x);
diff --git a/src/v8/test/mjsunit/regress/regress-sort-arguments.js b/src/v8/test/mjsunit/regress/regress-sort-arguments.js
new file mode 100644
index 0000000..54ebeb1
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-sort-arguments.js
@@ -0,0 +1,10 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function f(a) { return arguments; }
+var a = f(1,2,3);
+delete a[1];
+Array.prototype.sort.apply(a);
+a[10000000] = 4;
+Array.prototype.sort.apply(a);
diff --git a/src/v8/test/mjsunit/regress/regress-splice-large-index.js b/src/v8/test/mjsunit/regress/regress-splice-large-index.js
new file mode 100644
index 0000000..1f4eb9c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-splice-large-index.js
@@ -0,0 +1,41 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var a = [];
+a[0xfffffffe] = 10;
+assertThrows("a.unshift(1);", RangeError);
+assertEquals(0xffffffff, a.length);
+assertEquals(10, a[0xffffffff]);
+assertEquals(0xffffffff, a.length);
+assertEquals(undefined, a[0xfffffffe]);
+
+a = [1,2,3];
+a[0xfffffffe] = 10;
+assertThrows("a.splice(1,1,7,7,7,7,7);", RangeError);
+assertEquals([1,7,7,7,7,7,3], a.slice(0, 7));
+assertEquals(0xffffffff, a.length);
+assertEquals(10, a[0xfffffffe + 5 - 1]);
diff --git a/src/v8/test/mjsunit/regress/regress-sqrt.js b/src/v8/test/mjsunit/regress/regress-sqrt.js
new file mode 100644
index 0000000..f2a7e55
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-sqrt.js
@@ -0,0 +1,47 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// Check that Math.sqrt returns the same value regardless of being
+// optimized or not.
+
+function f(x) {
+ return Math.sqrt(x);
+}
+
+var x = 7.0506280066499245e-233;
+
+var a = f(x);
+
+f(0.1);
+f(0.2);
+%OptimizeFunctionOnNextCall(f);
+
+var b = f(x);
+
+assertEquals(a, b);
diff --git a/src/v8/test/mjsunit/regress/regress-store-global-proxy.js b/src/v8/test/mjsunit/regress/regress-store-global-proxy.js
new file mode 100644
index 0000000..c85531c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-store-global-proxy.js
@@ -0,0 +1,12 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+delete Object.prototype.__proto__;
+
+function f() {
+ this.toString = 1;
+}
+
+f.apply({});
+f();
diff --git a/src/v8/test/mjsunit/regress/regress-store-heapobject.js b/src/v8/test/mjsunit/regress/regress-store-heapobject.js
new file mode 100644
index 0000000..9f2a1b8
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-store-heapobject.js
@@ -0,0 +1,27 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var o = {a: undefined};
+
+function store(o, v) {
+ o.a = v;
+}
+
+store(o, undefined);
+store(o, undefined);
+
+function f(bool) {
+ var o = {a: undefined};
+ if (bool) {
+ store(o, 1);
+ }
+ return o;
+}
+
+f(false);
+f(false);
+%OptimizeFunctionOnNextCall(f);
+f(true);
diff --git a/src/v8/test/mjsunit/regress/regress-store-uncacheable.js b/src/v8/test/mjsunit/regress/regress-store-uncacheable.js
new file mode 100644
index 0000000..4baedba
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-store-uncacheable.js
@@ -0,0 +1,40 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax --opt
+
+function f() {
+ var o = {};
+ o["<abc>"] = 123;
+}
+
+f();
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+f();
+assertOptimized(f);
diff --git a/src/v8/test/mjsunit/regress/regress-string-from-char-code-tonumber.js b/src/v8/test/mjsunit/regress/regress-string-from-char-code-tonumber.js
new file mode 100644
index 0000000..a02a277
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-string-from-char-code-tonumber.js
@@ -0,0 +1,26 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var thrower = { [Symbol.toPrimitive]: function() { FAIL } };
+
+function testTrace(func) {
+ try {
+ func(thrower);
+ assertUnreachable();
+ } catch (e) {
+ assertTrue(e.stack.indexOf("fromCharCode") >= 0);
+ }
+}
+
+testTrace(String.fromCharCode);
+
+function foo(x) { return String.fromCharCode(x); }
+
+foo(1);
+foo(2);
+testTrace(foo);
+%OptimizeFunctionOnNextCall(foo);
+testTrace(foo);
diff --git a/src/v8/test/mjsunit/regress/regress-swapelements.js b/src/v8/test/mjsunit/regress/regress-swapelements.js
new file mode 100644
index 0000000..7c7a683
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-swapelements.js
@@ -0,0 +1,55 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Check that modifying an array while sorting it does not segfault. See
+// http://code.google.com/p/chromium/issues/detail?id=66099.
+
+function Item(val) {
+ this.value = val;
+}
+
+
+var size = 23;
+var array1 = new Array(size);
+
+
+function myToString() {
+ array1.splice(0, 1);
+ return this.value.toString();
+}
+
+
+function test() {
+ for (var i = 0; i < size; i++) {
+ array1[i] = new Item(i);
+ array1[i].toString = myToString;
+ }
+ array1.sort();
+}
+
+
+test();
diff --git a/src/v8/test/mjsunit/regress/regress-sync-optimized-lists.js b/src/v8/test/mjsunit/regress/regress-sync-optimized-lists.js
new file mode 100644
index 0000000..9297c2d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-sync-optimized-lists.js
@@ -0,0 +1,40 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --block-concurrent-recompilation
+
+function Ctor() {
+ this.a = 1;
+}
+
+function get_closure() {
+ return function add_field(obj, osr) {
+ obj.c = 3;
+ var x = 0;
+ if (osr) %OptimizeOsr();
+ for (var i = 0; i < 10; i++) {
+ x = i + 1;
+ }
+ return x;
+ }
+}
+
+var f1 = get_closure();
+f1(new Ctor(), false);
+f1(new Ctor(), false);
+
+%OptimizeFunctionOnNextCall(f1, "concurrent");
+
+// Kick off concurrent recompilation and OSR.
+var o = new Ctor();
+f1(o, true);
+
+// Flush the optimizing compiler's queue.
+%NotifyContextDisposed();
+
+// Trigger deopt.
+o.c = 2.2;
+
+var f2 = get_closure();
+f2(new Ctor(), true);
diff --git a/src/v8/test/mjsunit/regress/regress-transcendental.js b/src/v8/test/mjsunit/regress/regress-transcendental.js
new file mode 100644
index 0000000..4065f50
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-transcendental.js
@@ -0,0 +1,48 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-gc
+
+// Test whether the runtime implementation and generated code of
+// sine and tangens return the same results.
+
+function test(f, x, name) {
+ // Reset transcendental cache.
+ gc();
+ // Initializing cache leads to a runtime call.
+ var runtime_result = f(x);
+ // Flush transcendental cache entries and optimize f.
+ for (var i = 0; i < 100000; i++) f(i);
+ // Calculate using generated code.
+ var gencode_result = f(x);
+ print(name + " runtime function: " + runtime_result);
+ print(name + " generated code : " + gencode_result);
+ assertEquals(gencode_result, runtime_result);
+}
+
+test(Math.tan, -1.57079632679489660000, "Math.tan");
+test(Math.sin, 6.283185307179586, "Math.sin");
diff --git a/src/v8/test/mjsunit/regress/regress-trap-allocation-memento.js b/src/v8/test/mjsunit/regress/regress-trap-allocation-memento.js
new file mode 100644
index 0000000..e31fb88
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-trap-allocation-memento.js
@@ -0,0 +1,50 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --noalways-opt
+
+var elements_kind = {
+ fast_smi_only : 'fast smi only elements',
+ fast : 'fast elements',
+ fast_double : 'fast double elements',
+ dictionary : 'dictionary elements',
+}
+
+function getKind(obj) {
+ if (%HasSmiElements(obj)) return elements_kind.fast_smi_only;
+ if (%HasObjectElements(obj)) return elements_kind.fast;
+ if (%HasDoubleElements(obj)) return elements_kind.fast_double;
+ if (%HasDictionaryElements(obj)) return elements_kind.dictionary;
+}
+
+function assertKind(expected, obj, name_opt) {
+ assertEquals(expected, getKind(obj), name_opt);
+}
+
+(function() {
+ function make1() { return new Array(); }
+ function make2() { return new Array(); }
+ function make3() { return new Array(); }
+ function foo(a, i) { a[0] = i; }
+
+ function run_test(maker_function) {
+ var one = maker_function();
+ assertKind(elements_kind.fast_smi_only, one);
+ // Use memento to pre-transition allocation site to DOUBLE elements.
+ foo(one, 1.5);
+ // Newly created arrays should now have DOUBLE elements right away.
+ var two = maker_function();
+ assertKind(elements_kind.fast_double, two);
+ }
+
+ // Initialize the KeyedStoreIC in foo; the actual operation will be done
+ // in the runtime.
+ run_test(make1);
+ // Run again; the IC optimistically assumed to only see the transitioned
+ // (double-elements) map again, so this will make it polymorphic.
+ // The actual operation will again be done in the runtime.
+ run_test(make2);
+ // Finally, check if the initialized IC honors the allocation memento.
+ run_test(make3);
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-typedarray-length.js b/src/v8/test/mjsunit/regress/regress-typedarray-length.js
new file mode 100644
index 0000000..0dde61f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-typedarray-length.js
@@ -0,0 +1,149 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var a = new Int32Array(100);
+a.__proto__ = null;
+
+function get(a) {
+ return a.length;
+}
+
+assertEquals(undefined, get(a));
+assertEquals(undefined, get(a));
+assertEquals(undefined, get(a));
+%OptimizeFunctionOnNextCall(get);
+assertEquals(undefined, get(a));
+
+get = function(a) {
+ return a.byteLength;
+}
+
+assertEquals(undefined, get(a));
+assertEquals(undefined, get(a));
+assertEquals(undefined, get(a));
+%OptimizeFunctionOnNextCall(get);
+assertEquals(undefined, get(a));
+
+get = function(a) {
+ return a.byteOffset;
+}
+
+assertEquals(undefined, get(a));
+assertEquals(undefined, get(a));
+assertEquals(undefined, get(a));
+%OptimizeFunctionOnNextCall(get);
+assertEquals(undefined, get(a));
+
+(function() {
+ "use strict";
+
+ class MyTypedArray extends Int32Array {
+ get length() {
+ return "length";
+ }
+ }
+
+ a = new MyTypedArray();
+
+ get = function(a) {
+ return a.length;
+ }
+
+ assertEquals("length", get(a));
+ assertEquals("length", get(a));
+ assertEquals("length", get(a));
+ %OptimizeFunctionOnNextCall(get);
+ assertEquals("length", get(a));
+
+ a.__proto__ = null;
+
+ get = function(a) {
+ return a.length;
+ }
+
+ assertEquals(undefined, get(a));
+ assertEquals(undefined, get(a));
+ assertEquals(undefined, get(a));
+ %OptimizeFunctionOnNextCall(get);
+ assertEquals(undefined, get(a));
+})();
+
+(function() {
+ "use strict";
+
+ class MyTypedArray extends Int32Array {
+ constructor(length) {
+ super(length);
+ }
+ }
+
+ a = new MyTypedArray(1024);
+
+ get = function(a) {
+ return a.length;
+ }
+
+ assertEquals(1024, get(a));
+ assertEquals(1024, get(a));
+ assertEquals(1024, get(a));
+ %OptimizeFunctionOnNextCall(get);
+ assertEquals(1024, get(a));
+})();
+
+(function() {
+ "use strict";
+ var a = new Uint8Array(4);
+ Object.defineProperty(a, "length", {get: function() { return "blah"; }});
+ get = function(a) {
+ return a.length;
+ }
+
+ assertEquals("blah", get(a));
+ assertEquals("blah", get(a));
+ assertEquals("blah", get(a));
+ %OptimizeFunctionOnNextCall(get);
+ assertEquals("blah", get(a));
+})();
+
+// Ensure we can delete length, byteOffset, byteLength.
+assertTrue(Int32Array.prototype.__proto__.hasOwnProperty("length"));
+assertTrue(Int32Array.prototype.__proto__.hasOwnProperty("byteOffset"));
+assertTrue(Int32Array.prototype.__proto__.hasOwnProperty("byteLength"));
+assertTrue(delete Int32Array.prototype.__proto__.length);
+assertTrue(delete Int32Array.prototype.__proto__.byteOffset);
+assertTrue(delete Int32Array.prototype.__proto__.byteLength);
+
+a = new Int32Array(100);
+
+get = function(a) {
+ return a.length;
+}
+
+assertEquals(undefined, get(a));
+assertEquals(undefined, get(a));
+assertEquals(undefined, get(a));
+%OptimizeFunctionOnNextCall(get);
+assertEquals(undefined, get(a));
+
+get = function(a) {
+ return a.byteLength;
+}
+
+assertEquals(undefined, get(a));
+assertEquals(undefined, get(a));
+assertEquals(undefined, get(a));
+%OptimizeFunctionOnNextCall(get);
+assertEquals(undefined, get(a));
+
+get = function(a) {
+ return a.byteOffset;
+}
+
+assertEquals(undefined, get(a));
+assertEquals(undefined, get(a));
+assertEquals(undefined, get(a));
+%OptimizeFunctionOnNextCall(get);
+assertEquals(undefined, get(a));
diff --git a/src/v8/test/mjsunit/regress/regress-undefined-nan.js b/src/v8/test/mjsunit/regress/regress-undefined-nan.js
new file mode 100644
index 0000000..0e9b3d3
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-undefined-nan.js
@@ -0,0 +1,35 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function loader(dst, src, i) {
+ dst[i] = src[i];
+}
+
+var ab = new ArrayBuffer(8);
+var i_view = new Int32Array(ab);
+i_view[0] = %GetHoleNaNUpper()
+i_view[1] = %GetHoleNaNLower();
+var f_view = new Float64Array(ab);
+
+var fixed_double_elements = new Float64Array(1);
+
+function opt_store() { fixed_double_elements[0] = f_view[0]; }
+
+opt_store();
+opt_store();
+%OptimizeFunctionOnNextCall(opt_store);
+opt_store();
+
+var i32 = new Int32Array(fixed_double_elements.buffer);
+assertEquals(i_view[0], i32[0]);
+assertEquals(i_view[1], i32[1]);
+
+var doubles = [0.5];
+loader(doubles, fixed_double_elements, 0);
+loader(doubles, fixed_double_elements, 0);
+%OptimizeFunctionOnNextCall(loader);
+loader(doubles, fixed_double_elements, 0);
+assertTrue(doubles[0] !== undefined);
diff --git a/src/v8/test/mjsunit/regress/regress-undefined-nan2.js b/src/v8/test/mjsunit/regress/regress-undefined-nan2.js
new file mode 100644
index 0000000..9b0a05f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-undefined-nan2.js
@@ -0,0 +1,12 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function foo(a, i) {
+ var o = [0.5,,1];
+ a[i] = o[i];
+}
+var a1 = [0.1,0.1];
+foo(a1, 0);
+foo(a1, 1);
+assertEquals(undefined, a1[1]);
diff --git a/src/v8/test/mjsunit/regress/regress-undefined-nan3.js b/src/v8/test/mjsunit/regress/regress-undefined-nan3.js
new file mode 100644
index 0000000..5a0bc38
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-undefined-nan3.js
@@ -0,0 +1,32 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var ab = new ArrayBuffer(8);
+var i_view = new Int32Array(ab);
+i_view[0] = %GetHoleNaNUpper()
+i_view[1] = %GetHoleNaNLower();
+var f_view = new Float64Array(ab);
+
+var fixed_double_elements = new Float64Array(1);
+fixed_double_elements[0] = f_view[0];
+
+function A(src) { this.x = src[0]; }
+
+new A(fixed_double_elements);
+new A(fixed_double_elements);
+
+%OptimizeFunctionOnNextCall(A);
+
+var obj = new A(fixed_double_elements);
+
+function move_x(dst, obj) { dst[0] = obj.x; }
+
+var doubles = [0.5];
+move_x(doubles, obj);
+move_x(doubles, obj);
+%OptimizeFunctionOnNextCall(move_x);
+move_x(doubles, obj);
+assertTrue(doubles[0] !== undefined);
diff --git a/src/v8/test/mjsunit/regress/regress-undefined-store-keyed-fast-element.js b/src/v8/test/mjsunit/regress/regress-undefined-store-keyed-fast-element.js
new file mode 100644
index 0000000..9e6ec9d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-undefined-store-keyed-fast-element.js
@@ -0,0 +1,37 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function f(v) {
+ return [0.0, 0.1, 0.2, v];
+}
+
+assertEquals([0.0, 0.1, 0.2, NaN], f(NaN));
+assertEquals([0.0, 0.1, 0.2, NaN], f(NaN));
+%OptimizeFunctionOnNextCall(f);
+assertEquals([0.0, 0.1, 0.2, undefined], f(undefined));
diff --git a/src/v8/test/mjsunit/regress/regress-unlink-closures-on-deopt.js b/src/v8/test/mjsunit/regress/regress-unlink-closures-on-deopt.js
new file mode 100644
index 0000000..b7fa2b1
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-unlink-closures-on-deopt.js
@@ -0,0 +1,37 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --noalways-opt
+
+function foo() {
+ function g(o) {
+ return o.f;
+ }
+ return g;
+}
+
+let g1 = foo();
+let g2 = foo();
+
+g1({ f : 1});
+g1({ f : 2});
+g2({ f : 2});
+g2({ f : 2});
+
+%OptimizeFunctionOnNextCall(g1);
+%OptimizeFunctionOnNextCall(g2);
+
+g1({ f : 1});
+g2({ f : 2});
+g1({});
+
+assertUnoptimized(g1);
+
+// Deoptimization of g1 should also deoptimize g2 because they should share
+// the optimized code object. (Unfortunately, this test bakes in various
+// other assumptions about dealing with optimized code, and thus might break
+// in future.)
+assertUnoptimized(g2);
+
+g2({});
diff --git a/src/v8/test/mjsunit/regress/regress-unsigned-mul-add.js b/src/v8/test/mjsunit/regress/regress-unsigned-mul-add.js
new file mode 100644
index 0000000..0a2fc65
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-unsigned-mul-add.js
@@ -0,0 +1,10 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function f(a) {
+ var x = a >>> 0;
+ return (x * 1.0 + x * 1.0) << 0;
+}
+
+assertEquals(-2, f(-1));
diff --git a/src/v8/test/mjsunit/regress/regress-update-field-type-attributes.js b/src/v8/test/mjsunit/regress/regress-update-field-type-attributes.js
new file mode 100644
index 0000000..c23d062
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-update-field-type-attributes.js
@@ -0,0 +1,12 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function test(){
+ function InnerClass(){}
+ var container = {field: new InnerClass()};
+ return Object.freeze(container);
+};
+
+assertTrue(Object.isFrozen(test()));
+assertTrue(Object.isFrozen(test()));
diff --git a/src/v8/test/mjsunit/regress/regress-v8-4839.js b/src/v8/test/mjsunit/regress/regress-v8-4839.js
new file mode 100644
index 0000000..120685b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-v8-4839.js
@@ -0,0 +1,62 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function dummy() { }
+
+(function InlinedFunctionTestContext() {
+ var f = function() { }
+
+ function g() {
+ var s = "hey";
+ dummy(); // Force a deopt point.
+ if (f()) return s;
+ }
+
+ g();
+ g();
+ g();
+ %OptimizeFunctionOnNextCall(g);
+ f = function() { return true; }
+ assertEquals("hey", g());
+})();
+
+(function InlinedConstructorReturnTestContext() {
+ function c() { return 1; }
+
+ var f = function() { return !(new c()); }
+
+ function g() {
+ var s = "hey";
+ dummy(); // Force a deopt point.
+ if (f()) return s;
+ }
+
+ g();
+ g();
+ g();
+ %OptimizeFunctionOnNextCall(g);
+ f = function() { return true; }
+ assertEquals("hey", g());
+})();
+
+(function InlinedConstructorNoReturnTestContext() {
+ function c() { }
+
+ var f = function() { return !(new c()); }
+
+ function g() {
+ var s = "hey";
+ dummy(); // Force a deopt point.
+ if (f()) return s;
+ }
+
+ g();
+ g();
+ g();
+ %OptimizeFunctionOnNextCall(g);
+ f = function() { return true; }
+ assertEquals("hey", g());
+})();
diff --git a/src/v8/test/mjsunit/regress/regress-v8-4972.js b/src/v8/test/mjsunit/regress/regress-v8-4972.js
new file mode 100644
index 0000000..689ae03
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-v8-4972.js
@@ -0,0 +1,5 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+new class extends new Proxy(class {},{}) {}
diff --git a/src/v8/test/mjsunit/regress/regress-v8-5009.js b/src/v8/test/mjsunit/regress/regress-v8-5009.js
new file mode 100644
index 0000000..f499548
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-v8-5009.js
@@ -0,0 +1,61 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function fn1() {
+}
+
+function fn2() {
+}
+
+function fn3() {
+}
+
+function create(id) {
+ // Just some `FunctionTemplate` to hang on
+ var o = new version();
+
+ o.id = id;
+ o[0] = null;
+
+ return o;
+}
+
+function setM1(o) {
+ o.m1 = fn1;
+}
+
+function setM2(o) {
+ o.m2 = fn2;
+}
+
+function setAltM2(o) {
+ // Failing StoreIC happens here
+ o.m2 = fn3;
+}
+
+function setAltM1(o) {
+ o.m1 = null;
+}
+
+function test(o) {
+ o.m2();
+ o.m1();
+}
+
+var p0 = create(0);
+var p1 = create(1);
+var p2 = create(2);
+
+setM1(p0);
+setM1(p1);
+setM1(p2);
+
+setM2(p0);
+setAltM2(p0);
+setAltM1(p0);
+
+setAltM2(p1);
+
+setAltM2(p2);
+test(p2);
diff --git a/src/v8/test/mjsunit/regress/regress-v8-5254-1.js b/src/v8/test/mjsunit/regress/regress-v8-5254-1.js
new file mode 100644
index 0000000..624c85f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-v8-5254-1.js
@@ -0,0 +1,27 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var foo = (function() {
+ "use asm";
+ var a = new Uint16Array(2);
+ a[0] = 32815;
+ a[1] = 32114;
+
+ function foo() {
+ var x = a[0]|0;
+ var y = a[1]|0;
+ if (x < 0) x = 4294967296 + x|0;
+ if (y < 0) y = 4294967296 + y|0;
+ return x >= y;
+ }
+
+ return foo;
+})();
+
+assertTrue(foo());
+assertTrue(foo());
+%OptimizeFunctionOnNextCall(foo);
+assertTrue(foo());
diff --git a/src/v8/test/mjsunit/regress/regress-v8-5254-2.js b/src/v8/test/mjsunit/regress/regress-v8-5254-2.js
new file mode 100644
index 0000000..f486fa8
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-v8-5254-2.js
@@ -0,0 +1,27 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var foo = (function() {
+ "use asm";
+ var a = new Uint8Array(2);
+ a[0] = 128;
+ a[1] = 127;
+
+ function foo() {
+ var x = a[0]|0;
+ var y = a[1]|0;
+ if (x < 0) x = 4294967296 + x|0;
+ if (y < 0) y = 4294967296 + y|0;
+ return x >= y;
+ }
+
+ return foo;
+})();
+
+assertTrue(foo());
+assertTrue(foo());
+%OptimizeFunctionOnNextCall(foo);
+assertTrue(foo());
diff --git a/src/v8/test/mjsunit/regress/regress-v8-5255-1.js b/src/v8/test/mjsunit/regress/regress-v8-5255-1.js
new file mode 100644
index 0000000..cd14d63
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-v8-5255-1.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(x) {
+ return (x ? true : "7") >> 0;
+}
+
+assertEquals(1, foo(1));
+assertEquals(1, foo(1));
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(7, foo(0));
diff --git a/src/v8/test/mjsunit/regress/regress-v8-5255-2.js b/src/v8/test/mjsunit/regress/regress-v8-5255-2.js
new file mode 100644
index 0000000..5ae57ce
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-v8-5255-2.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(x) {
+ return (x ? true : "7") << 0;
+}
+
+assertEquals(1, foo(1));
+assertEquals(1, foo(1));
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(7, foo(0));
diff --git a/src/v8/test/mjsunit/regress/regress-v8-5255-3.js b/src/v8/test/mjsunit/regress/regress-v8-5255-3.js
new file mode 100644
index 0000000..004d687
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-v8-5255-3.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(x) {
+ return (x ? true : "7") >>> 0;
+}
+
+assertEquals(1, foo(1));
+assertEquals(1, foo(1));
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(7, foo(0));
diff --git a/src/v8/test/mjsunit/regress/regress-v8-5697.js b/src/v8/test/mjsunit/regress/regress-v8-5697.js
new file mode 100644
index 0000000..d7c1679
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-v8-5697.js
@@ -0,0 +1,28 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+function load(o) { return o.x; }
+
+for (var x = 0; x < 1000; ++x) {
+ load({x});
+ load({x});
+ %OptimizeFunctionOnNextCall(load);
+ try { load(); } catch (e) { }
+}
+
+assertOptimized(load);
+
+
+function store(o) { o.x = -1; }
+
+for (var x = 0; x < 1000; ++x) {
+ store({x});
+ store({x});
+ %OptimizeFunctionOnNextCall(store);
+ try { store(); } catch (e) { }
+}
+
+assertOptimized(store);
diff --git a/src/v8/test/mjsunit/regress/regress-v8-5958.js b/src/v8/test/mjsunit/regress/regress-v8-5958.js
new file mode 100644
index 0000000..dc5b95d
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-v8-5958.js
@@ -0,0 +1,16 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+class A {}
+class B {}
+
+A.__proto__ = new Proxy(A.__proto__, {
+ get: function (target, property, receiver) {
+ if (property === Symbol.hasInstance) throw new B;
+ }
+});
+
+assertThrows(() => (new A) instanceof A, B);
diff --git a/src/v8/test/mjsunit/regress/regress-v8-6706.js b/src/v8/test/mjsunit/regress/regress-v8-6706.js
new file mode 100644
index 0000000..36ce229
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-v8-6706.js
@@ -0,0 +1,37 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+const str = "a-b-c";
+
+function test(re) {
+ assertArrayEquals(["a", "b", "c"], re[Symbol.split](str));
+}
+
+!function() {
+ const re = /-/y;
+ re.lastIndex = 1;
+ test(re);
+}();
+
+!function() {
+ const re = /-/y;
+ re.lastIndex = 3;
+ test(re);
+}();
+
+!function() {
+ const re = /-/y;
+ re.lastIndex = -1;
+ test(re);
+}();
+
+!function() {
+ const re = /-/y;
+ test(re);
+}();
+
+!function() {
+ const re = /-/g;
+ test(re);
+}();
diff --git a/src/v8/test/mjsunit/regress/regress-v8-6712.js b/src/v8/test/mjsunit/regress/regress-v8-6712.js
new file mode 100644
index 0000000..0c5d544
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-v8-6712.js
@@ -0,0 +1,16 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var log = [];
+
+function f() {}
+Object.defineProperty(Function.prototype, "name", {
+ get() { log.push("getter"); return "ok"; }
+});
+delete f.name;
+var b = f.bind();
+assertEquals("bound ok", b.name);
+assertEquals("bound ok", b.name);
+assertEquals("bound ok", b.name);
+assertEquals(["getter"], log);
diff --git a/src/v8/test/mjsunit/regress/regress-v8-6716.js b/src/v8/test/mjsunit/regress/regress-v8-6716.js
new file mode 100644
index 0000000..3033fa7
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-v8-6716.js
@@ -0,0 +1,7 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function f() {}
+var a = Array(2 ** 16); // Elements in large-object-space.
+f.bind(...a);
diff --git a/src/v8/test/mjsunit/regress/regress-wasm-crbug-599413.js b/src/v8/test/mjsunit/regress/regress-wasm-crbug-599413.js
new file mode 100644
index 0000000..113fc89
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-wasm-crbug-599413.js
@@ -0,0 +1,18 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --validate-asm --allow-natives-syntax
+
+function __f_100() {
+ "use asm";
+ function __f_76() {
+ var __v_39 = 0;
+ outer: while (1) {
+ while (__v_39 == 4294967295) {
+ }
+ }
+ }
+ return {__f_76: __f_76};
+}
+assertFalse(%IsAsmWasmCode(__f_100));
diff --git a/src/v8/test/mjsunit/regress/regress-wasm-crbug-618602.js b/src/v8/test/mjsunit/regress/regress-wasm-crbug-618602.js
new file mode 100644
index 0000000..aa5bca9
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-wasm-crbug-618602.js
@@ -0,0 +1,15 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --validate-asm --allow-natives-syntax
+
+function __f_1() {
+ 'use asm';
+ function __f_3() {
+ var __v_11 = 1, __v_10 = 0, __v_12 = 0;
+ __v_12 = (__v_10 | 12) % 4294967295 | -1073741824;
+ }
+ return { __f_3: __f_3 };
+}
+assertFalse(%IsAsmWasmCode(__f_1));
diff --git a/src/v8/test/mjsunit/regress/regress-weakening-multiplication.js b/src/v8/test/mjsunit/regress/regress-weakening-multiplication.js
new file mode 100644
index 0000000..dcf0011
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-weakening-multiplication.js
@@ -0,0 +1,12 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function f() {
+ for (var j = 1; j < 1; j *= -8) {
+ }
+ for (var i = 1; i < 1; j += 2) {
+ j * -1;
+ }
+}
+f();
diff --git a/src/v8/test/mjsunit/regress/regress-x87.js b/src/v8/test/mjsunit/regress/regress-x87.js
new file mode 100644
index 0000000..c5edb70
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/regress-x87.js
@@ -0,0 +1,48 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// Regression for register allocation.
+var x;
+var a = new Float32Array([1,2, 4, 6, 8, 11, NaN, 1/0, -3])
+var val = 2.1*a[1]*a[0]*a[1*2*3*0]*a[1*1]*1.0;
+assertEquals(8.4, val);
+
+// Regression for double-phis
+var a;
+var t = true;
+var res = [2.5, 2];
+for (var i = 0; i < 2; i++) {
+ if (t) {
+ a = 1.5;
+ } else {
+ a = true;
+ }
+ assertEquals(res[i], a+1);
+ t = false;
+}
diff --git a/src/v8/test/mjsunit/regress/setter.js b/src/v8/test/mjsunit/regress/setter.js
new file mode 100644
index 0000000..e3a8000
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/setter.js
@@ -0,0 +1,66 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function s(v) {
+ v.x = 1;
+}
+
+function c(p) {
+ return {__proto__: p};
+}
+
+var p = {};
+
+var o1 = c(p);
+var o2 = c(p);
+var o3 = c(p);
+var o4 = c(p);
+var o5 = c(p);
+
+// Initialize the store IC.
+s(o1);
+s(o2);
+
+// Install a setter on p.x
+var count = 0;
+Object.defineProperty(p, "x", {
+ set: function(x) {
+ count += 1;
+ }
+});
+
+// Verify that the setter was called directly.
+o3.x = 20;
+assertEquals(1, count);
+
+// Verify that monomorphic prototype failure is triggered in the IC.
+s(o4);
+assertEquals(2, count);
+
+// Verify that the newly installed IC is correct.
+s(o5);
+assertEquals(3, count);
diff --git a/src/v8/test/mjsunit/regress/short-circuit.js b/src/v8/test/mjsunit/regress/short-circuit.js
new file mode 100644
index 0000000..25363d6
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/short-circuit.js
@@ -0,0 +1,32 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var arr = [];
+
+for (var i = 0; i < 28000; i++) {
+ arr.push(new RegExp("prefix" + i.toString() + i.toString() + i.toString()));
+}
diff --git a/src/v8/test/mjsunit/regress/splice-missing-wb.js b/src/v8/test/mjsunit/regress/splice-missing-wb.js
new file mode 100644
index 0000000..5ff0d81
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/splice-missing-wb.js
@@ -0,0 +1,56 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-gc
+
+// Create array large enough to span several page regions.
+var a = new Array(500);
+
+// Fill it with values.
+for (var i = 0; i < a.length; i++) a[i] = {idx:i};
+
+// Force it into oldspace.
+gc();
+gc();
+
+// Array should be in old space now. Store young object into array.
+// Region will be marked.
+a[0] = {idx:0};
+
+// Delete elements a[2] .. a[201]. Internally we will use
+// trimming of backing store. a[0] a[1] will be moved to
+// memory location previously occupied by a[200] a[201].
+a.splice(2, 200);
+
+// Force gc and heap verification.
+gc();
+
+// Try accessing a[0].idx. It will segfault if write-barrier was accidentally
+// omitted.
+assertEquals(0, a[0].idx);
+assertEquals(1, a[1].idx);
+assertEquals(202, a[2].idx);
diff --git a/src/v8/test/mjsunit/regress/string-compare-memcmp.js b/src/v8/test/mjsunit/regress/string-compare-memcmp.js
new file mode 100644
index 0000000..45f4734
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/string-compare-memcmp.js
@@ -0,0 +1,7 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+assertEquals(-1, %StringCompare("abc\u0102", "abc\u0201"));
diff --git a/src/v8/test/mjsunit/regress/string-fromcharcode-sideeffect.js b/src/v8/test/mjsunit/regress/string-fromcharcode-sideeffect.js
new file mode 100644
index 0000000..432ba2c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/string-fromcharcode-sideeffect.js
@@ -0,0 +1,8 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var counter = 0;
+var a = { valueOf: function() { counter++; return 0x100; } };
+assertEquals("A\u0100\u0100\u0100", String.fromCharCode(65, a, a, a));
+assertEquals(3, counter);
diff --git a/src/v8/test/mjsunit/regress/string-split-monkey-patching.js b/src/v8/test/mjsunit/regress/string-split-monkey-patching.js
new file mode 100644
index 0000000..ea5c867
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/string-split-monkey-patching.js
@@ -0,0 +1,40 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test that String.prototype.split with an regexp does not call the
+// monkey-patchable Array.prototype.push or PutValue.
+
+Array.prototype.push = assertUnreachable;
+
+Object.defineProperty(Array.prototype, "0", {
+ get: assertUnreachable,
+ set: assertUnreachable });
+
+"-".split(/-/);
+"I-must-not-use-push!".split(/-/);
+"Oh-no!".split(/(-)/);
+"a".split(/(a)|(b)/);
diff --git a/src/v8/test/mjsunit/regress/typed-array-lifetime.js b/src/v8/test/mjsunit/regress/typed-array-lifetime.js
new file mode 100644
index 0000000..db9a216
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/typed-array-lifetime.js
@@ -0,0 +1,26 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax --typed-array-max-size-in-heap=1
+
+var foo = (function () {
+ var y = 0;
+ return function foo(x) {
+ // Needs to be an external array.
+ var a = new Float64Array(32);
+ a[0] = 42;
+ y = x + 0.1; // This has to allocate.
+ return a[0];
+ }
+})();
+
+foo(1);
+foo(1);
+%OptimizeFunctionOnNextCall(foo);
+foo(1);
+// Try to force a GC during allocation in above marked line.
+for (var i = 0; i < 20; ++i) {
+ %SetAllocationTimeout(i, i, false);
+ assertEquals(42, foo(2));
+}
diff --git a/src/v8/test/mjsunit/regress/wasm/loop-stack-check.js b/src/v8/test/mjsunit/regress/wasm/loop-stack-check.js
new file mode 100644
index 0000000..a76ad01
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/loop-stack-check.js
@@ -0,0 +1,19 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm
+
+load("test/mjsunit/wasm/wasm-constants.js");
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+(function() {
+ var builder = new WasmModuleBuilder();
+ builder.addFunction("foo", kSig_i_ii)
+ .addBody([
+ kExprLoop, 00,
+ kExprBrTable, 0xfb, 0xff, 0xff, 0xff,
+ ])
+ .exportFunc();
+ assertThrows(function() { builder.instantiate(); });
+})();
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-5860.js b/src/v8/test/mjsunit/regress/wasm/regress-5860.js
new file mode 100644
index 0000000..b193323
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-5860.js
@@ -0,0 +1,30 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --expose-wasm
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+let module1 = (() => {
+ let builder = new WasmModuleBuilder();
+ builder.addMemory(1, 1);
+ builder.addFunction('load', kSig_i_i)
+ .addBody([kExprI32Const, 0, kExprI32LoadMem, 0, 0])
+ .exportAs('load');
+ return new WebAssembly.Module(builder.toBuffer());
+})();
+
+let module2 = (() => {
+ let builder = new WasmModuleBuilder();
+ builder.addMemory(1, 1);
+ builder.addImport('A', 'load', kSig_i_i);
+ builder.addExportOfKind('load', kExternalFunction, 0);
+ return new WebAssembly.Module(builder.toBuffer());
+})();
+
+let instance1 = new WebAssembly.Instance(module1);
+let instance2 = new WebAssembly.Instance(module2, {A: instance1.exports});
+
+assertEquals(0, instance2.exports.load());
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-709684.js b/src/v8/test/mjsunit/regress/wasm/regress-709684.js
new file mode 100644
index 0000000..1ca0cb6
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-709684.js
@@ -0,0 +1,78 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm --allow-natives-syntax
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+let importingModuleBinary1 = (() => {
+ var builder = new WasmModuleBuilder();
+ builder.addImport('', 'f', kSig_i_v);
+ return new Int8Array(builder.toBuffer());
+})();
+
+let importingModuleBinary2 = (() => {
+ var builder = new WasmModuleBuilder();
+ builder.addImport('', 'f', kSig_i_v);
+ builder.addFunction('g', kSig_v_v)
+ .addBody([kExprNop]);
+ return new Int8Array(builder.toBuffer());
+})();
+
+let importingModuleBinary3 = (() => {
+ var builder = new WasmModuleBuilder();
+ builder.addImport('', 'f', kSig_i_v);
+ builder.addImport('', 'f2', kSig_i_v);
+ builder.addFunction('g', kSig_v_v)
+ .addBody([kExprNop]);
+ return new Int8Array(builder.toBuffer());
+})();
+
+let importingModuleBinary4 = (() => {
+ var builder = new WasmModuleBuilder();
+ builder.addFunction('g', kSig_v_v)
+ .addBody([kExprNop]);
+ return new Int8Array(builder.toBuffer());
+})();
+
+const complexImportingModuleBinary1 = (() => {
+ let builder = new WasmModuleBuilder();
+
+ builder.addImport('a', 'b', kSig_v_v);
+ builder.addImportedMemory('c', 'd', 1);
+ builder.addImportedTable('e', 'f', 1);
+ builder.addImportedGlobal('g', '⚡', kWasmI32);
+ builder.addFunction('g', kSig_v_v)
+ .addBody([kExprNop]);
+ return builder.toBuffer();
+})();
+
+const complexImportingModuleBinary2 = (() => {
+ let builder = new WasmModuleBuilder();
+
+ builder.addImport('a', 'b', kSig_v_v);
+ builder.addImportedMemory('c', 'd', 1);
+ builder.addImportedTable('e', 'f', 1);
+ builder.addImportedGlobal('g', '⚡', kWasmI32);
+ builder.addFunction('g', kSig_v_v)
+ .addBody([kExprNop]);
+ return builder.toBuffer();
+})();
+
+var tests = [
+ importingModuleBinary1,
+ importingModuleBinary2,
+ importingModuleBinary3,
+ importingModuleBinary4,
+ complexImportingModuleBinary1,
+ complexImportingModuleBinary2
+];
+
+for (var index in tests) {
+ assertPromiseResult(
+ WebAssembly.compile(tests[index]),
+ m => assertTrue(m instanceof WebAssembly.Module),
+ assertUnreachable);
+}
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-712569.js b/src/v8/test/mjsunit/regress/wasm/regress-712569.js
new file mode 100644
index 0000000..ea7e406
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-712569.js
@@ -0,0 +1,20 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+
+var v11 = {};
+Object.defineProperty(v11.__proto__, 0, {
+ get: function() {
+ },
+ set: function() {
+ try {
+ WebAssembly.instantiate();
+ v11[0] = 0;
+ } catch (e) {
+ assertTrue(e instanceof RangeError);
+ }
+ }
+});
+v66 = new Array();
+cv = v66; cv[0] = 0.1; cv[2] = 0.2;
diff --git a/src/v8/test/mjsunit/regress/wasm/regress-752423.js b/src/v8/test/mjsunit/regress/wasm/regress-752423.js
new file mode 100644
index 0000000..15ee9a6
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regress-752423.js
@@ -0,0 +1,33 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm
+
+'use strict';
+
+load("test/mjsunit/wasm/wasm-constants.js");
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+var builder = new WasmModuleBuilder();
+builder.addImportedTable("x", "table", 1, 10000000);
+builder.addFunction("main", kSig_i_i)
+ .addBody([
+ kExprI32Const, 0,
+ kExprGetLocal, 0,
+ kExprCallIndirect, 0, kTableZero])
+ .exportAs("main");
+let module = new WebAssembly.Module(builder.toBuffer());
+let table = new WebAssembly.Table({element: "anyfunc",
+ initial: 1, maximum:1000000});
+let instance = new WebAssembly.Instance(module, {x: {table:table}});
+
+table.grow(0x40001);
+
+let instance2 = new WebAssembly.Instance(module, {x: {table:table}});
+
+try {
+ instance2.exports.main(402982); // should be OOB
+} catch (e) {
+ print("Correctly caught: ", e);
+}
diff --git a/src/v8/test/mjsunit/regress/wasm/regression-02256.js b/src/v8/test/mjsunit/regress/wasm/regression-02256.js
new file mode 100644
index 0000000..3b9b76b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regression-02256.js
@@ -0,0 +1,968 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --random-seed=891196975 --expose-gc --allow-natives-syntax
+// Flags: --gc-interval=207 --stress-compaction --validate-asm
+// Flags: --opt --no-always-opt
+//
+// /v8/test/mjsunit/wasm/grow-memory.js
+// /v8/test/mjsunit/regress/regress-540.js
+// /v8/test/mjsunit/regress/wasm/regression-02862.js
+// /v8/test/mjsunit/regress/regress-2813.js
+// /v8/test/mjsunit/regress/regress-323845.js
+// Begin stripped down and modified version of mjsunit.js for easy minimization in CF.
+
+function MjsUnitAssertionError(message) {}
+MjsUnitAssertionError.prototype.toString = function() {
+ return this.message;
+};
+var assertSame;
+var assertEquals;
+var assertEqualsDelta;
+var assertArrayEquals;
+var assertPropertiesEqual;
+var assertToStringEquals;
+var assertTrue;
+var assertFalse;
+var triggerAssertFalse;
+var assertNull;
+var assertNotNull;
+var assertThrows;
+var assertDoesNotThrow;
+var assertInstanceof;
+var assertUnreachable;
+var assertOptimized;
+var assertUnoptimized;
+
+function classOf(object) {
+ var string = Object.prototype.toString.call(object);
+ return string.substring(8, string.length - 1);
+}
+
+function PrettyPrint(value) {
+ return "";
+}
+
+function PrettyPrintArrayElement(value, index, array) {
+ return "";
+}
+
+function fail(expectedText, found, name_opt) {}
+
+function deepObjectEquals(a, b) {
+ var aProps = Object.keys(a);
+ aProps.sort();
+ var bProps = Object.keys(b);
+ bProps.sort();
+ if (!deepEquals(aProps, bProps)) {
+ return false;
+ }
+ for (var i = 0; i < aProps.length; i++) {
+ if (!deepEquals(a[aProps[i]], b[aProps[i]])) {
+ return false;
+ }
+ }
+ return true;
+}
+
+function deepEquals(a, b) {
+ if (a === b) {
+ if (a === 0) return (1 / a) === (1 / b);
+ return true;
+ }
+ if (typeof a != typeof b) return false;
+ if (typeof a == "number") return isNaN(a) && isNaN(b);
+ if (typeof a !== "object" && typeof a !== "function") return false;
+ var objectClass = classOf(a);
+ if (objectClass !== classOf(b)) return false;
+ if (objectClass === "RegExp") {
+ return (a.toString() === b.toString());
+ }
+ if (objectClass === "Function") return false;
+ if (objectClass === "Array") {
+ var elementCount = 0;
+ if (a.length != b.length) {
+ return false;
+ }
+ for (var i = 0; i < a.length; i++) {
+ if (!deepEquals(a[i], b[i])) return false;
+ }
+ return true;
+ }
+ if (objectClass == "String" || objectClass == "Number" || objectClass == "Boolean" || objectClass == "Date") {
+ if (a.valueOf() !== b.valueOf()) return false;
+ }
+ return deepObjectEquals(a, b);
+}
+assertSame = function assertSame(expected, found, name_opt) {
+ if (found === expected) {
+ if (expected !== 0 || (1 / expected) == (1 / found)) return;
+ } else if ((expected !== expected) && (found !== found)) {
+ return;
+ }
+ fail(PrettyPrint(expected), found, name_opt);
+};
+assertEquals = function assertEquals(expected, found, name_opt) {
+ if (!deepEquals(found, expected)) {
+ fail(PrettyPrint(expected), found, name_opt);
+ }
+};
+assertEqualsDelta = function assertEqualsDelta(expected, found, delta, name_opt) {
+ assertTrue(Math.abs(expected - found) <= delta, name_opt);
+};
+assertArrayEquals = function assertArrayEquals(expected, found, name_opt) {
+ var start = "";
+ if (name_opt) {
+ start = name_opt + " - ";
+ }
+ assertEquals(expected.length, found.length, start + "array length");
+ if (expected.length == found.length) {
+ for (var i = 0; i < expected.length; ++i) {
+ assertEquals(expected[i], found[i], start + "array element at index " + i);
+ }
+ }
+};
+assertPropertiesEqual = function assertPropertiesEqual(expected, found, name_opt) {
+ if (!deepObjectEquals(expected, found)) {
+ fail(expected, found, name_opt);
+ }
+};
+assertToStringEquals = function assertToStringEquals(expected, found, name_opt) {
+ if (expected != String(found)) {
+ fail(expected, found, name_opt);
+ }
+};
+assertTrue = function assertTrue(value, name_opt) {
+ assertEquals(true, value, name_opt);
+};
+assertFalse = function assertFalse(value, name_opt) {
+ assertEquals(false, value, name_opt);
+};
+assertNull = function assertNull(value, name_opt) {
+ if (value !== null) {
+ fail("null", value, name_opt);
+ }
+};
+assertNotNull = function assertNotNull(value, name_opt) {
+ if (value === null) {
+ fail("not null", value, name_opt);
+ }
+};
+assertThrows = function assertThrows(code, type_opt, cause_opt) {
+ var threwException = true;
+ try {
+ if (typeof code == 'function') {
+ code();
+ } else {
+ eval(code);
+ }
+ threwException = false;
+ } catch (e) {
+ if (typeof type_opt == 'function') {
+ assertInstanceof(e, type_opt);
+ }
+ if (arguments.length >= 3) {
+ assertEquals(e.type, cause_opt);
+ }
+ return;
+ }
+};
+assertInstanceof = function assertInstanceof(obj, type) {
+ if (!(obj instanceof type)) {
+ var actualTypeName = null;
+ var actualConstructor = Object.getPrototypeOf(obj).constructor;
+ if (typeof actualConstructor == "function") {
+ actualTypeName = actualConstructor.name || String(actualConstructor);
+ }
+ fail("Object <" + PrettyPrint(obj) + "> is not an instance of <" + (type.name || type) + ">" + (actualTypeName ? " but of < " + actualTypeName + ">" : ""));
+ }
+};
+assertDoesNotThrow = function assertDoesNotThrow(code, name_opt) {
+ try {
+ if (typeof code == 'function') {
+ code();
+ } else {
+ eval(code);
+ }
+ } catch (e) {
+ fail("threw an exception: ", e.message || e, name_opt);
+ }
+};
+assertUnreachable = function assertUnreachable(name_opt) {
+ var message = "Fail" + "ure: unreachable";
+ if (name_opt) {
+ message += " - " + name_opt;
+ }
+};
+var OptimizationStatus = function() {}
+assertUnoptimized = function assertUnoptimized(fun, sync_opt, name_opt) {
+ if (sync_opt === undefined) sync_opt = "";
+ assertTrue(OptimizationStatus(fun, sync_opt) != 1, name_opt);
+}
+assertOptimized = function assertOptimized(fun, sync_opt, name_opt) {
+ if (sync_opt === undefined) sync_opt = "";
+ assertTrue(OptimizationStatus(fun, sync_opt) != 2, name_opt);
+}
+triggerAssertFalse = function() {}
+try {
+ console.log;
+ print = console.log;
+ alert = console.log;
+} catch (e) {}
+
+function runNearStackLimit(f) {
+ function t() {
+ try {
+ t();
+ } catch (e) {
+ f();
+ }
+ };
+ try {
+ t();
+ } catch (e) {}
+}
+
+function quit() {}
+
+function nop() {}
+try {
+ gc;
+} catch (e) {
+ gc = nop;
+}
+
+function getRandomProperty(v, rand) {
+ var properties = Object.getOwnPropertyNames(v);
+ var proto = Object.getPrototypeOf(v);
+ if (proto) {
+ properties = properties.concat(Object.getOwnPropertyNames(proto));
+ }
+ if (properties.includes("constructor") && v.constructor.hasOwnProperty("__proto__")) {
+ properties = properties.concat(Object.getOwnPropertyNames(v.constructor.__proto__));
+ }
+ if (properties.length == 0) {
+ return "0";
+ }
+ return properties[rand % properties.length];
+}
+// End stripped down and modified version of mjsunit.js.
+
+var __v_0 = {};
+var __v_1 = {};
+var __v_2 = {};
+var __v_3 = {};
+var __v_4 = -1073741824;
+var __v_5 = {};
+var __v_6 = 1;
+var __v_7 = 1073741823;
+var __v_8 = {};
+var __v_9 = {};
+var __v_10 = 4294967295;
+var __v_11 = this;
+var __v_12 = {};
+var __v_13 = {};
+try {
+ load("test/mjsunit/wasm/wasm-constants.js");
+ load("test/mjsunit/wasm/wasm-module-__v_1.js");
+ __v_2 = 0x10000;
+} catch (e) {
+ print("Caught: " + e);
+}
+
+function __f_16() {
+ var __v_1 = new WasmModuleBuilder();
+ __v_1.addFunction("grow_memory", kSig_i_i)
+ .addBody([kExprGetLocal, 0, kExprGrowMemory])
+ .exportFunc();
+ __v_1.addFunction("load", kSig_i_i)
+ .addBody([kExprGetLocal, 0, kExprI32LoadMem, 0, 0])
+ .exportFunc();
+ __v_1.addFunction("store", kSig_i_ii)
+ .addBody([kExprGetLocal, 0, kExprGetLocal, 1, kExprI32StoreMem, 0, 0, kExprGetLocal, 1])
+ .exportFunc();
+ __v_1.addFunction("load16", kSig_i_i)
+ .addBody([kExprGetLocal, 0, kExprI32LoadMem16U, 0, 0])
+ .exportFunc();
+ __v_1.addFunction("store16", kSig_i_ii)
+ .addBody([kExprGetLocal, 0, kExprGetLocal, 1, kExprI32StoreMem16, 0, 0, kExprGetLocal, 1])
+ .exportFunc();
+ __v_1.__p_1551105852 = __v_1[getRandomProperty(__v_1, 1551105852)];
+ __v_1.__defineGetter__(getRandomProperty(__v_1, 348910887), function() {
+ gc();
+ __v_9[getRandomProperty(__v_9, 1894652048)] = __v_13[getRandomProperty(__v_13, 1352929371)];
+ return __v_1.__p_1551105852;
+ });
+ __v_1.addFunction("load8", kSig_i_i)
+ .addBody([kExprGetLocal, 0, kExprI32LoadMem8U, 0, 0])
+ .exportFunc();
+ __v_1.addFunction("store8", kSig_i_ii)
+ .addBody([kExprGetLocal, 0, kExprGetLocal, 1, kExprI32StoreMem8, 0, 0, kExprGetLocal, 1])
+ .exportFunc();
+ return __v_1;
+}
+
+function __f_14() {
+ var __v_4 = __f_16();
+ __v_1.addMemory(1, 1, false);
+ var module = __v_1.instantiate();
+ var __v_3;
+
+ function __f_1() {
+ return module.exports.load(__v_3);
+ }
+
+ function __f_2(value) {
+ return module.exports.store(__v_3, value);
+ }
+
+ function __f_8(pages) {
+ return module.exports.grow_memory(pages);
+ }
+ for (__v_3 = 0; __v_3 <= (__v_2 - 4); __v_3 += 4) {
+ __f_2(20);
+ assertEquals(20, __f_1());
+ }
+ for (__v_3 = __v_2 - 3; __v_3 < __v_2 + 4; __v_3++) {
+ assertTraps(kTrapMemOutOfBounds, __f_2);
+ assertTraps(kTrapMemOutOfBounds, __f_1);
+ }
+ assertEquals(1, __f_8(3));
+ for (__v_3 = __v_2; __v_3 <= 4 * __v_2 - 4; __v_3 += 4) {
+ __f_2(20);
+ assertEquals(20, __f_1());
+ }
+ for (__v_3 = 4 * __v_2 - 3; __v_3 < 4 * __v_2 + 4; __v_3++) {
+ assertTraps(kTrapMemOutOfBounds, __f_2);
+ assertTraps(kTrapMemOutOfBounds, __f_1);
+ }
+ assertEquals(4, __f_8(15));
+ for (__v_3 = 4 * __v_2 - 3; __v_3 <= 4 * __v_2 + 4; __v_3 += 4) {
+ __f_2(20);
+ assertEquals(20, __f_1());
+ }
+ for (__v_3 = 19 * __v_2 - 10; __v_3 <= 19 * __v_2 - 4; __v_3 += 4) {
+ __f_2(20);
+ gc();
+ assertEquals(12, __f_1());
+ }
+ for (__v_3 = 19 * __v_2 - 3; __v_3 < 19 * __v_2 + 5; __v_3++) {
+ assertTraps(kTrapMemOutOfBounds, __f_2);
+ assertTraps(kTrapMemOutOfBounds, __f_1);
+ }
+}
+try {
+ __f_14();
+} catch (e) {
+ print("Caught: " + e);
+}
+
+function __f_13() {
+ var __v_1 = __f_16();
+ __v_1.__defineGetter__(getRandomProperty(__v_1, 1322348896), function() {
+ gc();
+ return __f_28(__v_1);
+ });
+ __v_1.addMemory(1, 1, false);
+ var module = __v_1.instantiate();
+ assertEquals(0, __f_30(0));
+ var __v_3;
+
+ function __f_1() {
+ return module.exports.load16(__v_3);
+ }
+
+ function __f_2(value) {
+ return module.exports.store16(__v_3, value);
+ }
+
+ function __f_8(pages) {
+ return module.exports.grow_memory(pages);
+ }
+ for (__v_3 = 0; __v_3 <= (__v_2 - 2); __v_3 += 2) {
+ __f_2(20);
+ assertEquals(20, __f_1());
+ __f_19();
+ }
+ for (__v_3 = __v_2 - 1; __v_3 < __v_2 + 4; __v_3++) {
+ assertTraps(kTrapMemOutOfBounds, __f_2);
+ assertTraps(kTrapMemOutOfBounds, __f_1);
+ }
+ assertEquals(65535, __f_8(0));
+ for (__v_3 = __v_2; __v_3 <= 4 * __v_2 - 2; __v_3 += 2) {
+ __f_2(20);
+ assertEquals(20, __f_1());
+ }
+ for (__v_3 = 4 * __v_2 - 1; __v_3 < 4 * __v_2 + 4; __v_3++) {
+ assertTraps(kTrapMemOutOfBounds, __f_2);
+ assertTraps(kTrapMemOutOfBounds, __f_1);
+ }
+ assertEquals(4, __f_8(15));
+ for (__v_3 = 4 * __v_2 - 2; __v_3 <= 4 * __v_2 + 4; __v_3 += 2) {
+ __f_2(20);
+ assertEquals(20, __f_1());
+ }
+ for (__v_1 = 19 * __v_11 - 10; __v_13 <= 19 * __v_2 - 2; __v_9 += 2) {
+ __f_2(20);
+ assertEquals(20, __f_1());
+ }
+ for (__v_3 = 19 * __v_2 - 1; __v_3 < 19 * __v_2 + 5; __v_3++) {
+ assertTraps(kTrapMemOutOfBounds, __f_2);
+ assertTraps(kTrapMemOutOfBounds, __f_1);
+ }
+}
+try {
+ __f_13();
+} catch (e) {
+ print("Caught: " + e);
+}
+
+function __f_10() {
+ var __v_1 = __f_16();
+ __v_1.addMemory(1, 1, false);
+ var module = __v_1.instantiate();
+ var __v_3;
+
+ function __f_1() {
+ return module.exports.load8(__v_3);
+ }
+
+ function __f_2(value) {
+ return module.exports.store8(__v_3, value);
+ }
+
+ function __f_8(pages) {
+ return module.exports.grow_memory(pages);
+ }
+ for (__v_3 = 0; __v_3 <= __v_2 - 1; __v_3++) {
+ __f_2(20);
+ assertEquals(20, __f_1());
+ }
+ for (__v_3 = __v_2; __v_3 < __v_2 + 4; __v_3++) {
+ assertTraps(kTrapMemOutOfBounds, __f_2);
+ assertTraps(kTrapMemOutOfBounds, __f_1);
+ }
+ assertEquals(1, __f_8(3));
+ for (__v_3 = __v_2; __v_3 <= 4 * __v_2 - 1; __v_3++) {
+ __f_2(20);
+ assertEquals(20, __f_1());
+ }
+ for (__v_3 = 4 * __v_2; __v_3 < 4 * __v_2 + 4; __v_3++) {
+ assertTraps(kTrapMemOutOfBounds, __f_2);
+ assertTraps(kTrapMemOutOfBounds, __f_1);
+ }
+ assertEquals(4, __f_8(15));
+ for (__v_3 = 4 * __v_2; __v_3 <= 4 * __v_2 + 4; __v_3++) {
+ __f_2(20);
+ assertEquals(20, __f_1());
+ }
+ for (__v_3 = 19 * __v_2 - 10; __v_3 <= 19 * __v_2 - 1; __v_3++) {
+ __f_2(20);
+ assertEquals(20, __f_1());
+ }
+ for (__v_3 = 19 * __v_2; __v_3 < 19 * __v_2 + 5; __v_3++) {
+ assertTraps(kTrapMemOutOfBounds, __f_2);
+ assertTraps(kTrapMemOutOfBounds, __f_1);
+ }
+}
+try {
+ __f_10();
+} catch (e) {
+ print("Caught: " + e);
+}
+
+function __f_5() {
+ var __v_1 = __f_16();
+ var module = __v_1.instantiate();
+ var __v_3;
+
+ function __f_1() {
+ return module.exports.load(__v_3);
+ }
+
+ function __f_2(value) {
+ return module.exports.store(__v_3, value);
+ }
+
+ function __f_8(pages) {
+ return module.exports.grow_memory(pages);
+ }
+ assertTraps(kTrapMemOutOfBounds, __f_1);
+ assertTraps(kTrapMemOutOfBounds, __f_2);
+ assertEquals(0, __f_8(1));
+ for (__v_3 = 0; __v_3 <= __v_2 - 4; __v_3++) {
+ __f_2(20);
+ assertEquals(20, __f_1());
+ }
+ for (__v_3 = __v_2; __v_3 <= __v_2 + 5; __v_3++) {
+ assertTraps(kTrapMemOutOfBounds, __f_1);
+ }
+}
+try {
+ __f_5();
+} catch (e) {
+ print("Caught: " + e);
+}
+
+function __f_9() {
+ var __v_1 = __f_16();
+ var module = __v_1.instantiate();
+ var __v_4 = 16385;
+
+ function __f_8(pages) {
+ return module.exports.grow_memory(pages);
+ }
+ assertEquals(-1, __f_8(__v_13));
+}
+try {
+ __f_9();
+} catch (e) {
+ print("Caught: " + e);
+}
+
+function __f_12() {
+ var __v_1 = __f_16();
+ __v_1.addMemory(1, 1, false);
+ var module = __v_9.instantiate();
+ __v_4.__p_1905062277 = __v_4[getRandomProperty(__v_4, 1905062277)];
+ __v_4.__defineGetter__(getRandomProperty(__v_4, 1764398743), function() {
+ gc();
+ __v_0[getRandomProperty(__v_0, 1011363961)] = __v_8[getRandomProperty(__v_8, 1946768258)];
+ return __v_4.__p_1905062277;
+ });
+ var __v_4 = 16384;
+
+ function __f_8(pages) {
+ return module.exports.grow_memory(pages);
+ }
+ assertEquals(-1, __f_8(__v_4));
+}
+try {
+ __f_12();
+} catch (e) {
+ print("Caught: " + e);
+}
+
+function __f_0() {
+ var __v_1 = __f_16();
+ var module = __v_1.instantiate();
+
+ function __f_8(pages) {
+ return module.exports.grow_memory(pages);
+ }
+ assertEquals(-1, __f_8(-1));
+};
+try {
+ __f_0();
+} catch (e) {
+ print("Caught: " + e);
+}
+
+function __f_4() {
+ var __v_1 = __f_16();
+ __v_1.addMemory(1, 1, false);
+ __v_1.addFunction("memory_size", kSig_i_v)
+ .addBody([kExprMemorySize])
+ .exportFunc();
+ var module = __v_1.instantiate();
+
+ function __f_8(pages) {
+ return module.exports.grow_memory(pages);
+ }
+
+ function __f_7() {
+ return module.exports.memory_size();
+ }
+ assertEquals(1, __f_7());
+ assertEquals(1, __f_8(1));
+ assertEquals(2, __f_7());
+}
+try {
+ __f_4();
+ gc();
+} catch (e) {
+ print("Caught: " + e);
+}
+
+function __f_6() {
+ var __v_1 = __f_16();
+ __v_1.addMemory(1, 1, false);
+ var module = __v_1.instantiate();
+ var __v_3, __v_0;
+ gc();
+
+ function __f_1() {
+ return module.exports.load(__v_3);
+ }
+
+ function __f_2(value) {
+ return module.exports.store(__v_3, value);
+ }
+
+ function __f_8(pages) {
+ return module.exports.grow_memory(pages);
+ }
+ gc();
+ for (__v_3 = 0; __v_3 <= (__v_2 - 4); __v_3 += 4) {
+ __f_2(100000 - __v_3);
+ __v_3.__defineGetter__(getRandomProperty(__v_3, 764734523), function() {
+ gc();
+ return __f_16(__v_3);
+ });
+ assertEquals(100000 - __v_3, __f_1());
+ }
+ assertEquals(1, __f_8(3));
+ for (__v_3 = 0; __v_3 <= (__v_2 - 4); __v_3 += 4) {
+ assertEquals(100000 - __v_3, __f_1());
+ }
+}
+try {
+ __f_6();
+ gc();
+} catch (e) {
+ print("Caught: " + e);
+}
+
+function __f_11() {
+ var __v_1 = __f_16();
+ __v_1.addMemory(1, 1, false);
+ var module = __v_2.instantiate();
+ var __v_3, __v_0;
+
+ function __f_1() {
+ return module.exports.load16(__v_3);
+ }
+
+ function __f_2(value) {
+ return module.exports.store16(__v_3, value);
+ }
+
+ function __f_8(pages) {
+ return module.exports.grow_memory(pages);
+ }
+ for (__v_3 = 0; __v_3 <= (__v_2 - 2); __v_3 += 2) {
+ __f_2(65535 - __v_3);
+ assertEquals(65535 - __v_3, __f_1());
+ }
+ assertEquals(1, __f_8(3));
+ for (__v_3 = 0; __v_3 <= (__v_2 - 2); __v_3 += 2) {
+ assertEquals(65535 - __v_3, __f_1());
+ }
+}
+try {
+ __f_11();
+} catch (e) {
+ print("Caught: " + e);
+}
+
+function __f_15() {
+ var __v_1 = __f_16();
+ __v_1.addMemory(1, 1, false);
+ var module = __v_1.instantiate();
+ var __v_3, __v_0 = 0;
+
+ function __f_1() {
+ return module.exports.load8(__v_10);
+ }
+
+ function __f_2(value) {
+ return module.exports.store8(__v_3, value);
+ }
+
+ function __f_8(pages) {
+ return module.exports.grow_memory(pages);
+ }
+ for (__v_3 = 0; __v_3 <= (__v_2 - 1); __v_3++, __v_0++) {
+ __f_2(__v_0);
+ assertEquals(__v_0, __f_1());
+ if (__v_0 == 255) __v_0 = 0;
+ }
+ assertEquals(1, __f_8(3));
+ __v_0 = 0;
+ for (__v_10 = 0; __v_4 <= (__v_0 - 1); __v_11++, __v_5++) {
+ assertEquals(__v_0, __f_1());
+ if (__v_10 == 255) __v_5 = 0;
+ }
+}
+try {
+ __f_15();
+} catch (e) {
+ print("Caught: " + e);
+}
+
+function __f_3() {
+ var __v_1 = __f_16();
+ __v_1.addMemory(1, 1, false);
+ var module = __v_1.instantiate();
+ var __v_3, __v_0;
+
+ function __f_1() {
+ return module.exports.load(__v_3);
+ }
+
+ function __f_2(value) {
+ return module.exports.store(__v_3, value);
+ }
+
+ function __f_8(pages) {
+ return module.exports.grow_memory(pages);
+ }
+ gc();
+ __v_3 = 3 * __v_2 + 4;
+ assertTraps(kTrapMemOutOfBounds, __f_2);
+ assertEquals(1, __f_8(1));
+ assertTraps(kTrapMemOutOfBounds, __f_2);
+ assertEquals(2, __f_8(1));
+ assertTraps(kTrapMemOutOfBounds, __f_2);
+ assertEquals(3, __f_8(1));
+ for (__v_3 = 3 * __v_2; __v_3 <= 4 * __v_2 - 4; __v_3++) {
+ __f_2(0xaced);
+ assertEquals(0xaced, __f_1());
+ }
+ for (__v_3 = 4 * __v_2 - 3; __v_3 <= 4 * __v_2 + 4; __v_3++) {
+ assertTraps(kTrapMemOutOfBounds, __f_2);
+ }
+}
+try {
+ __f_3();
+} catch (e) {
+ print("Caught: " + e);
+}
+
+function __f_18(__f_17, y) {
+ eval(__f_17);
+ return y();
+}
+try {
+ var __v_17 = __f_18("function y() { return 1; }", function() {
+ return 0;
+ })
+ assertEquals(1, __v_17);
+ gc();
+ __v_17 =
+ (function(__f_17) {
+ function __f_17() {
+ return 3;
+ }
+ return __f_17();
+ })(function() {
+ return 2;
+ });
+ assertEquals(3, __v_17);
+ __v_17 =
+ (function(__f_17) {
+ function __f_17() {
+ return 5;
+ }
+ return arguments[0]();
+ })(function() {
+ return -1073741825;
+ });
+ assertEquals(5, __v_17);
+} catch (e) {
+ print("Caught: " + e);
+}
+
+function __f_27() {}
+try {
+ var __v_24 = {};
+ var __v_21 = {};
+ var __v_22 = {};
+ var __v_20 = {};
+ __v_58 = {
+ instantiateModuleFromAsm: function(text, ffi, heap) {
+ var __v_21 = eval('(' + text + ')');
+ if (__f_27()) {
+ throw "validate failure";
+ }
+ var __v_20 = __v_21();
+ if (__f_27()) {
+ throw "bad module args";
+ }
+ }
+ };
+ __f_21 = function __f_21() {
+ if (found === expected) {
+ if (1 / expected) return;
+ } else if ((expected !== expected) && (found !== found)) {
+ return;
+ };
+ };
+ __f_28 = function __f_28() {
+ if (!__f_23()) {
+ __f_125(__f_69(), found, name_opt);
+ }
+ };
+ __f_24 = function __f_24(code, type_opt, cause_opt) {
+ var __v_24 = true;
+ try {
+ if (typeof code == 'function') {
+ code();
+ } else {
+ eval();
+ }
+ __v_24 = false;
+ } catch (e) {
+ if (typeof type_opt == 'function') {
+ __f_22();
+ }
+ if (arguments.length >= 3) {
+ __f_28();
+ }
+ return;
+ }
+ };
+ __f_22 = function __f_22() {
+ if (obj instanceof type) {
+ obj.constructor;
+ if (typeof __v_57 == "function") {;
+ };
+ }
+ };
+ try {
+ __f_28();
+ __v_82.__p_750895751 = __v_82[getRandomProperty()];
+ } catch (e) {
+ "Caught: " + e;
+ }
+ __f_19();
+ gc();
+ __f_19(19, __f_24);
+ __f_19();
+ __f_19();
+ __f_24(function() {
+ __v_58.instantiateModuleFromAsm(__f_28.toString()).__f_20();
+ });
+} catch (e) {
+ print("Caught: " + e);
+}
+
+function __f_19() {
+ "use asm";
+
+ function __f_20() {}
+ return {
+ __f_20: __f_20
+ };
+}
+try {
+ __f_19();
+ __f_19();
+ __f_19();
+} catch (e) {
+ print("Caught: " + e);
+}
+
+function __f_29() {}
+try {
+ __f_19();
+ try {
+ __f_19();
+ gc();
+ __f_25();
+ } catch (e) {
+ "Caught: " + e;
+ }
+ __f_19();
+ __f_19();
+ __f_19();
+} catch (e) {
+ print("Caught: " + e);
+}
+
+function __f_23() {
+ "use asm";
+
+ function __f_20() {}
+ return {
+ __f_20: __f_20
+ };
+}
+try {
+ __f_19();
+ __f_19();
+ __f_19();
+ __f_19();
+ gc();
+ __f_19();
+ __f_19();
+ __f_19();
+} catch (e) {
+ print("Caught: " + e);
+}
+
+function __f_26(stdlib) {
+ "use asm";
+ var __v_2 = new stdlib.Int32Array();
+ __v_22[4294967295] | 14 + 1 | 14;
+ return {
+ __f_20: __f_20
+ };
+}
+
+function __f_25() {
+ var __v_19 = new ArrayBuffer();
+ var __v_23 = new Int32Array(__v_19);
+ var module = __v_58.instantiateModuleFromAsm(__f_26.toString());
+ __f_28();
+ gc();
+}
+try {
+ (function() {})();
+ (function() {})();
+ try {
+ (function() {
+ __v_23.__defineGetter__(getRandomProperty(__v_23, 580179357), function() {
+ gc();
+ return __f_25(__v_23);
+ });
+ var __v_23 = 0x87654321;
+ __v_19.__f_89();
+ })();
+ } catch (e) {;
+ }
+} catch (e) {
+ print("Caught: " + e);
+}
+
+function __f_30(x) {
+ var __v_30 = x + 1;
+ var __v_31 = x + 2;
+ if (x != 0) {
+ if (x > 0 & x < 100) {
+ return __v_30;
+ }
+ }
+ return 0;
+}
+try {
+ assertEquals(0, __f_30(0));
+ assertEquals(0, __f_30(0));
+ %OptimizeFunctionOnNextCall(__f_30);
+ assertEquals(3, __f_30(2));
+} catch (e) {
+ print("Caught: " + e);
+}
+
+function __f_31() {
+ __f_32.arguments;
+}
+
+function __f_32(x) {
+ __f_31();
+}
+
+function __f_33() {
+ __f_32({});
+}
+try {
+ __f_33();
+ __f_33();
+ __f_33();
+ %OptimizeFunctionOnNextCall(__f_33);
+ __f_33();
+ gc();
+} catch (e) {
+ print("Caught: " + e);
+}
diff --git a/src/v8/test/mjsunit/regress/wasm/regression-02256b.js b/src/v8/test/mjsunit/regress/wasm/regression-02256b.js
new file mode 100644
index 0000000..1206438
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regression-02256b.js
@@ -0,0 +1,503 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --random-seed=891196975 --expose-gc --allow-natives-syntax
+// Flags: --gc-interval=207 --stress-compaction --validate-asm
+// Flags: --opt --no-always-opt
+//
+// /v8/test/mjsunit/wasm/grow-memory.js
+// /v8/test/mjsunit/regress/regress-540.js
+// /v8/test/mjsunit/regress/wasm/regression-02862.js
+// /v8/test/mjsunit/regress/regress-2813.js
+// /v8/test/mjsunit/regress/regress-323845.js
+// Begin stripped down and modified version of mjsunit.js for easy minimization in CF.
+
+function MjsUnitAssertionError(message) {}
+MjsUnitAssertionError.prototype.toString = function() {
+ return this.message;
+};
+var assertSame;
+var assertEquals;
+var assertEqualsDelta;
+var assertArrayEquals;
+var assertPropertiesEqual;
+var assertToStringEquals;
+var assertTrue;
+var assertFalse;
+var triggerAssertFalse;
+var assertNull;
+var assertNotNull;
+var assertThrows;
+var assertDoesNotThrow;
+var assertInstanceof;
+var assertUnreachable;
+var assertOptimized;
+var assertUnoptimized;
+
+function classOf(object) {
+ var string = Object.prototype.toString.call(object);
+ return string.substring(8, string.length - 1);
+}
+
+function PrettyPrint(value) {
+ return "";
+}
+
+function PrettyPrintArrayElement(value, index, array) {
+ return "";
+}
+
+function fail(expectedText, found, name_opt) {}
+
+function deepObjectEquals(a, b) {
+ var aProps = Object.keys(a);
+ aProps.sort();
+ var bProps = Object.keys(b);
+ bProps.sort();
+ if (!deepEquals(aProps, bProps)) {
+ return false;
+ }
+ for (var i = 0; i < aProps.length; i++) {
+ if (!deepEquals(a[aProps[i]], b[aProps[i]])) {
+ return false;
+ }
+ }
+ return true;
+}
+
+function deepEquals(a, b) {
+ if (a === b) {
+ if (a === 0) return (1 / a) === (1 / b);
+ return true;
+ }
+ if (typeof a != typeof b) return false;
+ if (typeof a == "number") return isNaN(a) && isNaN(b);
+ if (typeof a !== "object" && typeof a !== "function") return false;
+ var objectClass = classOf(a);
+ if (objectClass !== classOf(b)) return false;
+ if (objectClass === "RegExp") {
+ return (a.toString() === b.toString());
+ }
+ if (objectClass === "Function") return false;
+ if (objectClass === "Array") {
+ var elementCount = 0;
+ if (a.length != b.length) {
+ return false;
+ }
+ for (var i = 0; i < a.length; i++) {
+ if (!deepEquals(a[i], b[i])) return false;
+ }
+ return true;
+ }
+ if (objectClass == "String" || objectClass == "Number" || objectClass == "Boolean" || objectClass == "Date") {
+ if (a.valueOf() !== b.valueOf()) return false;
+ }
+ return deepObjectEquals(a, b);
+}
+assertSame = function assertSame(expected, found, name_opt) {
+ if (found === expected) {
+ if (expected !== 0 || (1 / expected) == (1 / found)) return;
+ } else if ((expected !== expected) && (found !== found)) {
+ return;
+ }
+ fail(PrettyPrint(expected), found, name_opt);
+};
+assertEquals = function assertEquals(expected, found, name_opt) {
+ if (!deepEquals(found, expected)) {
+ fail(PrettyPrint(expected), found, name_opt);
+ }
+};
+assertEqualsDelta = function assertEqualsDelta(expected, found, delta, name_opt) {
+ assertTrue(Math.abs(expected - found) <= delta, name_opt);
+};
+assertArrayEquals = function assertArrayEquals(expected, found, name_opt) {
+ var start = "";
+ if (name_opt) {
+ start = name_opt + " - ";
+ }
+ assertEquals(expected.length, found.length, start + "array length");
+ if (expected.length == found.length) {
+ for (var i = 0; i < expected.length; ++i) {
+ assertEquals(expected[i], found[i], start + "array element at index " + i);
+ }
+ }
+};
+assertPropertiesEqual = function assertPropertiesEqual(expected, found, name_opt) {
+ if (!deepObjectEquals(expected, found)) {
+ fail(expected, found, name_opt);
+ }
+};
+assertToStringEquals = function assertToStringEquals(expected, found, name_opt) {
+ if (expected != String(found)) {
+ fail(expected, found, name_opt);
+ }
+};
+assertTrue = function assertTrue(value, name_opt) {
+ assertEquals(true, value, name_opt);
+};
+assertFalse = function assertFalse(value, name_opt) {
+ assertEquals(false, value, name_opt);
+};
+assertNull = function assertNull(value, name_opt) {
+ if (value !== null) {
+ fail("null", value, name_opt);
+ }
+};
+assertNotNull = function assertNotNull(value, name_opt) {
+ if (value === null) {
+ fail("not null", value, name_opt);
+ }
+};
+assertThrows = function assertThrows(code, type_opt, cause_opt) {
+ var threwException = true;
+ try {
+ if (typeof code == 'function') {
+ code();
+ } else {
+ eval(code);
+ }
+ threwException = false;
+ } catch (e) {
+ if (typeof type_opt == 'function') {
+ assertInstanceof(e, type_opt);
+ }
+ if (arguments.length >= 3) {
+ assertEquals(e.type, cause_opt);
+ }
+ return;
+ }
+};
+assertInstanceof = function assertInstanceof(obj, type) {
+ if (!(obj instanceof type)) {
+ var actualTypeName = null;
+ var actualConstructor = Object.getPrototypeOf(obj).constructor;
+ if (typeof actualConstructor == "function") {
+ actualTypeName = actualConstructor.name || String(actualConstructor);
+ }
+ fail("Object <" + PrettyPrint(obj) + "> is not an instance of <" + (type.name || type) + ">" + (actualTypeName ? " but of < " + actualTypeName + ">" : ""));
+ }
+};
+assertDoesNotThrow = function assertDoesNotThrow(code, name_opt) {
+ try {
+ if (typeof code == 'function') {
+ code();
+ } else {
+ eval(code);
+ }
+ } catch (e) {
+ fail("threw an exception: ", e.message || e, name_opt);
+ }
+};
+assertUnreachable = function assertUnreachable(name_opt) {
+ var message = "Fail" + "ure: unreachable";
+ if (name_opt) {
+ message += " - " + name_opt;
+ }
+};
+var OptimizationStatus = function() {}
+assertUnoptimized = function assertUnoptimized(fun, sync_opt, name_opt) {
+ if (sync_opt === undefined) sync_opt = "";
+ assertTrue(OptimizationStatus(fun, sync_opt) != 1, name_opt);
+}
+assertOptimized = function assertOptimized(fun, sync_opt, name_opt) {
+ if (sync_opt === undefined) sync_opt = "";
+ assertTrue(OptimizationStatus(fun, sync_opt) != 2, name_opt);
+}
+triggerAssertFalse = function() {}
+try {
+ console.log;
+ print = console.log;
+ alert = console.log;
+} catch (e) {}
+
+function runNearStackLimit(f) {
+ function t() {
+ try {
+ t();
+ } catch (e) {
+ f();
+ }
+ };
+ try {
+ t();
+ } catch (e) {}
+}
+
+function quit() {}
+
+function nop() {}
+try {
+ gc;
+} catch (e) {
+ gc = nop;
+}
+
+function getRandomProperty(v, rand) {
+ var properties = Object.getOwnPropertyNames(v);
+ var proto = Object.getPrototypeOf(v);
+ if (proto) {
+ properties = properties.concat(Object.getOwnPropertyNames(proto));
+ }
+ if (properties.includes("constructor") && v.constructor.hasOwnProperty("__proto__")) {
+ properties = properties.concat(Object.getOwnPropertyNames(v.constructor.__proto__));
+ }
+ if (properties.length == 0) {
+ return "0";
+ }
+ return properties[rand % properties.length];
+}
+// End stripped down and modified version of mjsunit.js.
+
+var __v_0 = {};
+var __v_1 = {};
+var __v_2 = {};
+var __v_3 = {};
+var __v_4 = -1073741824;
+var __v_5 = {};
+var __v_6 = 1;
+var __v_7 = 1073741823;
+var __v_8 = {};
+var __v_9 = {};
+var __v_10 = 4294967295;
+var __v_11 = this;
+var __v_12 = {};
+var __v_13 = {};
+
+
+function __f_18(__f_17, y) {
+ eval(__f_17);
+ return y();
+}
+try {
+ var __v_17 = __f_18("function y() { return 1; }", function() {
+ return 0;
+ })
+ assertEquals(1, __v_17);
+ gc();
+ __v_17 =
+ (function(__f_17) {
+ function __f_17() {
+ return 3;
+ }
+ return __f_17();
+ })(function() {
+ return 2;
+ });
+ assertEquals(3, __v_17);
+ __v_17 =
+ (function(__f_17) {
+ function __f_17() {
+ return 5;
+ }
+ return arguments[0]();
+ })(function() {
+ return -1073741825;
+ });
+ assertEquals(5, __v_17);
+} catch (e) {
+ print("Caught: " + e);
+}
+
+function __f_27() {}
+try {
+ var __v_24 = {};
+ var __v_21 = {};
+ var __v_22 = {};
+ var __v_20 = {};
+ __v_58 = {
+ instantiateModuleFromAsm: function(text, ffi, heap) {
+ var __v_21 = eval('(' + text + ')');
+ if (__f_27()) {
+ throw "validate failure";
+ }
+ var __v_20 = __v_21();
+ if (__f_27()) {
+ throw "bad module args";
+ }
+ }
+ };
+ __f_21 = function __f_21() {
+ if (found === expected) {
+ if (1 / expected) return;
+ } else if ((expected !== expected) && (found !== found)) {
+ return;
+ };
+ };
+ __f_28 = function __f_28() {
+ if (!__f_23()) {
+ __f_125(__f_69(), found, name_opt);
+ }
+ };
+ __f_24 = function __f_24(code, type_opt, cause_opt) {
+ var __v_24 = true;
+ try {
+ if (typeof code == 'function') {
+ code();
+ } else {
+ eval();
+ }
+ __v_24 = false;
+ } catch (e) {
+ if (typeof type_opt == 'function') {
+ __f_22();
+ }
+ if (arguments.length >= 3) {
+ __f_28();
+ }
+ return;
+ }
+ };
+ __f_22 = function __f_22() {
+ if (obj instanceof type) {
+ obj.constructor;
+ if (typeof __v_57 == "function") {;
+ };
+ }
+ };
+ try {
+ __f_28();
+ __v_82.__p_750895751 = __v_82[getRandomProperty()];
+ } catch (e) {
+ "Caught: " + e;
+ }
+ __f_19();
+ gc();
+ __f_19(19, __f_24);
+ __f_19();
+ __f_19();
+ __f_24(function() {
+ __v_58.instantiateModuleFromAsm(__f_28.toString()).__f_20();
+ });
+} catch (e) {
+ print("Caught: " + e);
+}
+
+function __f_19() {
+ "use asm";
+
+ function __f_20() {}
+ return {
+ __f_20: __f_20
+ };
+}
+try {
+ __f_19();
+ __f_19();
+ __f_19();
+} catch (e) {
+ print("Caught: " + e);
+}
+
+function __f_29() {}
+try {
+ __f_19();
+ try {
+ __f_19();
+ gc();
+ __f_25();
+ } catch (e) {
+ "Caught: " + e;
+ }
+ __f_19();
+ __f_19();
+ __f_19();
+} catch (e) {
+ print("Caught: " + e);
+}
+
+function __f_23() {
+ "use asm";
+
+ function __f_20() {}
+ return {
+ __f_20: __f_20
+ };
+}
+try {
+ __f_19();
+ __f_19();
+ __f_19();
+ __f_19();
+ gc();
+ __f_19();
+ __f_19();
+ __f_19();
+} catch (e) {
+ print("Caught: " + e);
+}
+
+function __f_26(stdlib) {
+ "use asm";
+ var __v_2 = new stdlib.Int32Array();
+ __v_22[4294967295] | 14 + 1 | 14;
+ return {
+ __f_20: __f_20
+ };
+}
+
+function __f_25() {
+ var __v_19 = new ArrayBuffer();
+ var __v_23 = new Int32Array(__v_19);
+ var module = __v_58.instantiateModuleFromAsm(__f_26.toString());
+ __f_28();
+ gc();
+}
+try {
+ (function() {})();
+ (function() {})();
+ try {
+ (function() {
+ __v_23.__defineGetter__(getRandomProperty(__v_23, 580179357), function() {
+ gc();
+ return __f_25(__v_23);
+ });
+ var __v_23 = 0x87654321;
+ __v_19.__f_89();
+ })();
+ } catch (e) {;
+ }
+} catch (e) {
+ print("Caught: " + e);
+}
+
+function __f_30(x) {
+ var __v_30 = x + 1;
+ var __v_31 = x + 2;
+ if (x != 0) {
+ if (x > 0 & x < 100) {
+ return __v_30;
+ }
+ }
+ return 0;
+}
+try {
+ assertEquals(0, __f_30(0));
+ assertEquals(0, __f_30(0));
+ %OptimizeFunctionOnNextCall(__f_30);
+ assertEquals(3, __f_30(2));
+} catch (e) {
+ print("Caught: " + e);
+}
+
+function __f_31() {
+ __f_32.arguments;
+}
+
+function __f_32(x) {
+ __f_31();
+}
+
+function __f_33() {
+ __f_32({});
+}
+try {
+ __f_33();
+ __f_33();
+ __f_33();
+ %OptimizeFunctionOnNextCall(__f_33);
+ __f_33();
+ gc();
+} catch (e) {
+ print("Caught: " + e);
+}
diff --git a/src/v8/test/mjsunit/regress/wasm/regression-02862.js b/src/v8/test/mjsunit/regress/wasm/regression-02862.js
new file mode 100644
index 0000000..92ed1cd
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regression-02862.js
@@ -0,0 +1,107 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --random-seed=1557792826 --expose-gc --invoke-weak-callbacks --omit-quit --gc-interval=469 --validate-asm
+
+function nop() {}
+var __v_42 = {};
+var __v_49 = {};
+var __v_70 = {};
+var __v_79 = {};
+__v_58 = {
+ instantiateModuleFromAsm: function(text, ffi, heap) {
+ var __v_49 = eval('(' + text + ')');
+ if (nop()) {
+ throw "validate failure";
+ }
+ var __v_79 = __v_49();
+ if (nop()) {
+ throw "bad module args";
+ }
+ }};
+__f_140 = function __f_140() {
+ if (found === expected) {
+ if (1 / expected) return;
+ } else if ((expected !== expected) && (found !== found)) { return; };
+};
+__f_128 = function __f_128() { if (!__f_105()) { __f_125(__f_69(), found, name_opt); } };
+__f_136 = function __f_136(code, type_opt, cause_opt) {
+ var __v_42 = true;
+ try {
+ if (typeof code == 'function') { code(); }
+ else { eval(); }
+ __v_42 = false;
+ } catch (e) {
+ if (typeof type_opt == 'function') { __f_101(); }
+ if (arguments.length >= 3) { __f_128(); }
+ return;
+ }
+};
+__f_101 = function __f_101() { if (obj instanceof type) {obj.constructor; if (typeof __v_57 == "function") {; }; } };
+try {
+__f_128();
+__v_82.__p_750895751 = __v_82[getRandomProperty()];
+} catch(e) {"Caught: " + e; }
+__f_119();
+gc();
+__f_119(19, __f_136);
+__f_119();
+__f_119();
+__f_136(function() {
+ __v_58.instantiateModuleFromAsm(__f_128.toString()).__f_108();
+});
+function __f_119() {
+ "use asm";
+ function __f_108() {
+ }
+ return {__f_108: __f_108};
+}
+__f_119();
+__f_119();
+__f_119();
+function __f_95() {
+}
+__f_119();
+try {
+__f_119();
+__f_135();
+} catch(e) {"Caught: " + e; }
+__f_119();
+__f_119();
+__f_119();
+function __f_105() {
+ "use asm";
+ function __f_108() {
+ }
+ return {__f_108: __f_108};
+}
+__f_119();
+__f_119();
+__f_119();
+__f_119();
+__f_119();
+__f_119();
+__f_119();
+function __f_93(stdlib) {
+ "use asm";
+ var __v_70 = new stdlib.Int32Array();
+__v_70[4294967295]|14 + 1 | 14;
+ return {__f_108: __f_108};
+}
+function __f_135() {
+ var __v_66 = new ArrayBuffer();
+ var __v_54 = new Int32Array(__v_66);
+ var module = __v_58.instantiateModuleFromAsm( __f_93.toString());
+ __f_128();
+}
+(function () {
+})();
+(function () {
+})();
+try {
+(function() {
+ var __v_54 = 0x87654321;
+ __v_66.__f_89();
+})();
+} catch(e) {; }
diff --git a/src/v8/test/mjsunit/regress/wasm/regression-5531.js b/src/v8/test/mjsunit/regress/wasm/regression-5531.js
new file mode 100644
index 0000000..1363f96
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regression-5531.js
@@ -0,0 +1,22 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm
+
+load("test/mjsunit/wasm/wasm-constants.js");
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+(function() {
+ var builder = new WasmModuleBuilder();
+ builder.addMemory(1, 1, false);
+ builder.addFunction("foo", kSig_i_v)
+ .addBody([
+ kExprI32Const, 0x00,
+ kExprI32Const, 0x0b,
+ kExprI32Const, 0x0f,
+ kExprBrTable, 0xcb, 0xcb, 0xcb, 0x00, 0x00, 0xcb, 0x00 // entries=1238475
+ ])
+ .exportFunc();
+ assertThrows(function() { builder.instantiate(); });
+})();
diff --git a/src/v8/test/mjsunit/regress/wasm/regression-5800.js b/src/v8/test/mjsunit/regress/wasm/regression-5800.js
new file mode 100644
index 0000000..2e56da8
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regression-5800.js
@@ -0,0 +1,56 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load("test/mjsunit/wasm/wasm-constants.js");
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+(function AddTest() {
+ let builder = new WasmModuleBuilder();
+
+ builder.addFunction("main", kSig_i_v)
+ .addBody([
+ kExprBlock, kWasmStmt,
+ kExprI64Const, 0,
+ // 0x80 ... 0x10 is the LEB encoding of 0x100000000. This is chosen so
+ // that the 64-bit constant has a non-zero top half. In this bug, the
+ // top half was clobbering eax, leading to the function return 1 rather
+ // than 0.
+ kExprI64Const, 0x80, 0x80, 0x80, 0x80, 0x10,
+ kExprI64Add,
+ kExprI64Eqz,
+ kExprBrIf, 0,
+ kExprI32Const, 0,
+ kExprReturn,
+ kExprEnd,
+ kExprI32Const, 0
+ ])
+ .exportFunc();
+ let module = builder.instantiate();
+ assertEquals(0, module.exports.main());
+})();
+
+(function SubTest() {
+ let builder = new WasmModuleBuilder();
+
+ builder.addFunction("main", kSig_i_v)
+ .addBody([
+ kExprBlock, kWasmStmt,
+ kExprI64Const, 0,
+ // 0x80 ... 0x10 is the LEB encoding of 0x100000000. This is chosen so
+ // that the 64-bit constant has a non-zero top half. In this bug, the
+ // top half was clobbering eax, leading to the function return 1 rather
+ // than 0.
+ kExprI64Const, 0x80, 0x80, 0x80, 0x80, 0x10,
+ kExprI64Sub,
+ kExprI64Eqz,
+ kExprBrIf, 0,
+ kExprI32Const, 0,
+ kExprReturn,
+ kExprEnd,
+ kExprI32Const, 0
+ ])
+ .exportFunc();
+ let module = builder.instantiate();
+ assertEquals(0, module.exports.main());
+})();
diff --git a/src/v8/test/mjsunit/regress/wasm/regression-5884.js b/src/v8/test/mjsunit/regress/wasm/regression-5884.js
new file mode 100644
index 0000000..8677f10
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regression-5884.js
@@ -0,0 +1,20 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+(function() {
+ var builder = new WasmModuleBuilder();
+ builder.addMemory(31, 31, false);
+ builder.addFunction('test', kSig_i_iii)
+ .addBodyWithEnd([
+ // body:
+ kExprI64Const, 0x41, kExprI64Const, 0x41, kExprI64LtS, kExprI32Const,
+ 0x01, kExprI32StoreMem, 0x00, 0x41, kExprUnreachable,
+ kExprEnd, // @60
+ ])
+ .exportFunc();
+ var module = builder.instantiate();
+})();
diff --git a/src/v8/test/mjsunit/regress/wasm/regression-6054.js b/src/v8/test/mjsunit/regress/wasm/regression-6054.js
new file mode 100644
index 0000000..7b309b6
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regression-6054.js
@@ -0,0 +1,342 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+(function() {
+ var builder = new WasmModuleBuilder();
+ builder.addMemory(16, 32, false);
+ builder.addFunction('test', kSig_i_i)
+ .addBodyWithEnd([
+ kExprI32Const, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+ kExprI32LoadMem8S, 0x00, 0x00,
+kExprEnd, // @44
+ ])
+ .exportFunc();
+ var module = builder.instantiate();
+ assertEquals(0, module.exports.test(1));
+})();
diff --git a/src/v8/test/mjsunit/regress/wasm/regression-6164.js b/src/v8/test/mjsunit/regress/wasm/regression-6164.js
new file mode 100644
index 0000000..3035ea5
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regression-6164.js
@@ -0,0 +1,19 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+(function() {
+ var builder = new WasmModuleBuilder();
+ builder.addMemory(31, 31, false);
+ builder.addFunction('test', kSig_l_v)
+ .addBodyWithEnd([
+// body:
+kExprUnreachable,
+kExprEnd, // @374
+ ])
+ .exportFunc();
+ var module = builder.instantiate();
+})();
diff --git a/src/v8/test/mjsunit/regress/wasm/regression-643595.js b/src/v8/test/mjsunit/regress/wasm/regression-643595.js
new file mode 100644
index 0000000..9da074b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regression-643595.js
@@ -0,0 +1,11 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --cache=code --validate-asm
+
+(function f() {
+ "use asm";
+ function g() { }
+ return { g: g };
+})();
diff --git a/src/v8/test/mjsunit/regress/wasm/regression-644682.js b/src/v8/test/mjsunit/regress/wasm/regression-644682.js
new file mode 100644
index 0000000..b58c0d9
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regression-644682.js
@@ -0,0 +1,26 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm
+
+load("test/mjsunit/wasm/wasm-constants.js");
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+(function() {
+var builder = new WasmModuleBuilder();
+builder.addFunction("regression_644682", kSig_i_v)
+ .addBody([
+ kExprBlock, // @1
+ kExprI32Const, 0x3b,
+ kExprI32LoadMem, 0x00, 0x00,
+ kExprI32Const, 0x10,
+ kExprBrIf, 0x01, 0x00, // arity=1 depth0
+ kExprI32Const, 0x45,
+ kExprI32Const, 0x3b,
+ kExprI64LoadMem16S, 0x00, 0x3b,
+ kExprBrIf, 0x01, 0x00 // arity=1 depth0
+ ])
+ .exportFunc();
+assertThrows(function() { builder.instantiate(); });
+})();
diff --git a/src/v8/test/mjsunit/regress/wasm/regression-647649.js b/src/v8/test/mjsunit/regress/wasm/regression-647649.js
new file mode 100644
index 0000000..dc89ebd
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regression-647649.js
@@ -0,0 +1,42 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --nostress-opt --expose-gc --noalways-opt --invoke-weak-callbacks
+
+// This test was generated by the fuzzer.
+
+function getRandomProperty(v, rand) {
+ var properties = Object.getOwnPropertyNames(v);
+ var proto = Object.getPrototypeOf(v);
+ if (proto) {; }
+ if ("constructor" && v.constructor.hasOwnProperty()) {; }
+ if (properties.length == 0) { return "0"; }
+ return properties[rand % properties.length];
+}
+
+var __v_11 = {};
+
+function __f_1(stdlib, foreign, buffer) {
+ "use asm";
+ var __v_3 = new stdlib.Float64Array(buffer);
+ function __f_0() {
+ var __v_1 = 6.0;
+ __v_3[2] = __v_1 + 1.0;
+ }
+ return {__f_0: __f_0};
+}
+try {
+ var __v_0 = new ArrayBuffer(207222809);
+ var module = __f_1(this, null, __v_0);
+( {
+})();
+} catch(e) {; }
+__v_13 = '@3'
+Array.prototype.__proto__ = {3: __v_13};
+Array.prototype.__proto__.__proto__ = {7: __v_11};
+__v_9 = [0, 1, , , 4, 5, , , , 9]
+__v_12 = __v_9.splice(4, 1)
+__v_9.__defineGetter__(getRandomProperty(__v_9, 1689439720), function() { return {}; });
+ __v_9[8]
+gc();
diff --git a/src/v8/test/mjsunit/regress/wasm/regression-648079.js b/src/v8/test/mjsunit/regress/wasm/regression-648079.js
new file mode 100644
index 0000000..acc6146
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regression-648079.js
@@ -0,0 +1,328 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm
+
+load("test/mjsunit/wasm/wasm-constants.js");
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+// Non-standard opcodes.
+let kSig_s_v = makeSig([], [kWasmS128]);
+let kExprS128LoadMem = 0xc0;
+
+(function() {
+"use asm";
+var builder = new WasmModuleBuilder();
+builder.addFunction("regression_648079", kSig_s_v)
+ .addBody([
+ // locals:
+ 0x00,
+ // body:
+ kExprI64RemU,
+ kExprI64Ctz,
+ kExprI64LeU,
+ kExprUnreachable,
+ kExprUnreachable,
+ kExprUnreachable,
+ kExprUnreachable,
+ kExprI64Ctz,
+ kExprI64Ne,
+ kExprI64ShrS,
+ kExprI64GtS,
+ kExprI64RemU,
+ kExprUnreachable,
+ kExprI64RemU,
+ kExprI32Eqz,
+ kExprI64LeU,
+ kExprDrop,
+ kExprF32Add,
+ kExprI64Ior,
+ kExprF32CopySign,
+ kExprI64Ne,
+ kExprI64GeS,
+ kExprUnreachable,
+ kExprF32Trunc,
+ kExprF32Trunc,
+ kExprUnreachable,
+ kExprIf, 10, // @32
+ kExprBlock, 00, // @34
+ kExprBr, // depth=109
+ kExprI64Shl,
+ kExprI64LeU,
+ kExprI64GeS,
+ kExprI64Clz,
+ kExprF32Min,
+ kExprF32Eq,
+ kExprF32Trunc,
+ kExprF32Trunc,
+ kExprF32Trunc,
+ kExprUnreachable,
+ kExprI32Const,
+ kExprUnreachable,
+ kExprBr, // depth=101
+ kExprF32Div,
+ kExprI64GtU,
+ kExprI64GeS,
+ kExprI64Clz,
+ kExprSelect,
+ kExprI64GtS,
+ kExprI64RemU,
+ kExprI64LeU,
+ kExprI64Shl,
+ kExprI64Ctz,
+ kExprLoop, 01, // @63 i32
+ kExprElse, // @65
+ kExprI64LeU,
+ kExprI64RemU,
+ kExprI64Ne,
+ kExprI64GeS,
+ kExprI32Const,
+ kExprI64GtS,
+ kExprI64LoadMem32U,
+ kExprI64Clz,
+ kExprI64Shl,
+ kExprI64Ne,
+ kExprI64ShrS,
+ kExprI64GtS,
+ kExprI64DivU,
+ kExprI64Ne,
+ kExprI64GtS,
+ kExprI64Ne,
+ kExprI64Popcnt,
+ kExprI64DivU,
+ kExprI64DivU,
+ kExprSelect,
+ kExprI64Ctz,
+ kExprI64Popcnt,
+ kExprI64RemU,
+ kExprI64Clz,
+ kExprF64Sub,
+ kExprF32Trunc,
+ kExprF32Trunc,
+ kExprI64RemU,
+ kExprI64Ctz,
+ kExprI64LeU,
+ kExprUnreachable,
+ kExprUnreachable,
+ kExprUnreachable,
+ kExprBrIf, // depth=116
+ kExprF32Min,
+ kExprI64GtU,
+ kExprBlock, 01, // @107 i32
+ kExprTeeLocal,
+ kExprBlock, 01, // @111 i32
+ kExprBlock, 01, // @113 i32
+ kExprBlock, 01, // @115 i32
+ kExprBlock, 01, // @117 i32
+ kExprBlock, 01, // @119 i32
+ kExprBlock, 01, // @121 i32
+ kExprBlock, 01, // @123 i32
+ kExprBlock, 88, // @125
+ kExprF32Trunc,
+ kExprF32Trunc,
+ kExprF32Trunc,
+ kExprUnreachable,
+ kExprLoop, 40, // @131
+ kExprUnreachable,
+ kExprUnreachable,
+ kExprI32Add,
+ kExprBlock, 05, // @136
+ kExprUnreachable,
+ kExprIf, 02, // @139 i64
+ kExprBlock, 01, // @141 i32
+ kExprBrIf, // depth=16
+ kExprLoop, 00, // @145
+ kExprUnreachable,
+ kExprUnreachable,
+ kExprReturn,
+ kExprUnreachable,
+ kExprUnreachable,
+ kExprUnreachable,
+ kExprI64LoadMem16U,
+ kExprUnreachable,
+ kExprUnreachable,
+ kExprUnreachable,
+ kExprUnreachable,
+ kExprUnreachable,
+ kExprNop,
+ kExprBr, // depth=1
+ kExprElse, // @164
+ kExprF32Trunc,
+ kExprI32Add,
+ kExprCallIndirect, // sig #1
+ kExprUnreachable,
+ kExprUnreachable,
+ kExprUnreachable,
+ kExprBlock, 00, // @172
+ kExprI64RemU,
+ kExprI64Ctz,
+ kExprI64LeU,
+ kExprUnreachable,
+ kExprUnreachable,
+ kExprUnreachable,
+ kExprUnreachable,
+ kExprUnreachable,
+ kExprDrop,
+ kExprI64Popcnt,
+ kExprF32Min,
+ kExprUnreachable,
+ kExprF64Sub,
+ kExprI32Const,
+ kExprUnreachable,
+ kExprGetLocal,
+ kExprI64LoadMem32U,
+ kExprUnreachable,
+ kExprI64RemU,
+ kExprI32Eqz,
+ kExprI64LeU,
+ kExprDrop,
+ kExprF32Add,
+ kExprI64Ior,
+ kExprF32CopySign,
+ kExprI64Ne,
+ kExprI64GeS,
+ kExprUnreachable,
+ kExprF32Trunc,
+ kExprF32Trunc,
+ kExprUnreachable,
+ kExprIf, 10, // @216
+ kExprBlock, 00, // @218
+ kExprBr, // depth=109
+ kExprI64Shl,
+ kExprI64LeU,
+ kExprI64GeS,
+ kExprI64Clz,
+ kExprF32Min,
+ kExprF32Eq,
+ kExprF32Trunc,
+ kExprF32Trunc,
+ kExprF32Trunc,
+ kExprUnreachable,
+ kExprF64Min,
+ kExprI32Const,
+ kExprBr, // depth=101
+ kExprF32Div,
+ kExprI64GtU,
+ kExprI64GeS,
+ kExprI64Clz,
+ kExprI64Popcnt,
+ kExprF64Lt,
+ kExprF32Trunc,
+ kExprF32Trunc,
+ kExprF32Trunc,
+ kExprUnreachable,
+ kExprLoop, 01, // @247 i32
+ kExprElse, // @249
+ kExprI64LeU,
+ kExprI64RemU,
+ kExprI64Ne,
+ kExprI64GeS,
+ kExprI32Const,
+ kExprBlock, 01, // @256 i32
+ kExprBlock, 01, // @258 i32
+ kExprBlock, 01, // @260 i32
+ kExprBlock, 01, // @262 i32
+ kExprBlock, 01, // @264 i32
+ kExprF32Ge,
+ kExprF32Trunc,
+ kExprF32Trunc,
+ kExprF32Trunc,
+ kExprUnreachable,
+ kExprLoop, 40, // @271
+ kExprUnreachable,
+ kExprUnreachable,
+ kExprI32Add,
+ kExprBlock, 01, // @276 i32
+ kExprUnreachable,
+ kExprIf, 02, // @279 i64
+ kExprBlock, 00, // @281
+ kExprBrIf, // depth=16
+ kExprLoop, 00, // @285
+ kExprUnreachable,
+ kExprUnreachable,
+ kExprReturn,
+ kExprUnreachable,
+ kExprUnreachable,
+ kExprUnreachable,
+ kExprI64LoadMem16U,
+ kExprUnreachable,
+ kExprUnreachable,
+ kExprUnreachable,
+ kExprUnreachable,
+ kExprUnreachable,
+ kExprNop,
+ kExprBr, // depth=1
+ kExprElse, // @304
+ kExprF32Trunc,
+ kExprI32Add,
+ kExprCallIndirect, // sig #1
+ kExprUnreachable,
+ kExprUnreachable,
+ kExprUnreachable,
+ kExprBlock, 00, // @312
+ kExprI64RemU,
+ kExprI64Ctz,
+ kExprI64LeU,
+ kExprUnreachable,
+ kExprUnreachable,
+ kExprUnreachable,
+ kExprDrop,
+ kExprI64Popcnt,
+ kExprF32Min,
+ kExprUnreachable,
+ kExprF64Sub,
+ kExprI32Const,
+ kExprUnreachable,
+ kExprGetLocal,
+ kExprI64LoadMem32U,
+ kExprUnreachable,
+ kExprUnreachable,
+ kExprNop,
+ kExprBr, // depth=1
+ kExprElse, // @348
+ kExprF32Trunc,
+ kExprI32Add,
+ kExprCallIndirect, // sig #1
+ kExprUnreachable,
+ kExprUnreachable,
+ kExprUnreachable,
+ kExprBlock, 00, // @356
+ kExprI64RemU,
+ kExprI64Ctz,
+ kExprI64LeU,
+ kExprUnreachable,
+ kExprUnreachable,
+ kExprUnreachable,
+ kExprDrop,
+ kExprI64Popcnt,
+ kExprF32Min,
+ kExprUnreachable,
+ kExprF64Sub,
+ kExprI32Const,
+ kExprUnreachable,
+ kExprGetLocal,
+ kExprI64LoadMem32U,
+ kExprF64Min,
+ kExprF64Min,
+ kExprF64Min,
+ kExprF64Min,
+ kExprF64Min,
+ kExprF32Trunc,
+ kExprF32Trunc,
+ kExprF32Trunc,
+ kExprUnreachable,
+ kExprF64Min,
+ kExprF64Min,
+ kExprF64Min,
+ kExprF64Min,
+ kExprF64Min,
+ kExprF64Min,
+ kExprF64Min,
+ kExprF64Min,
+ kExprF64Min,
+ kExprF64Min,
+ ])
+ .exportFunc();
+assertThrows(function() { builder.instantiate(); });
+})();
diff --git a/src/v8/test/mjsunit/regress/wasm/regression-651961.js b/src/v8/test/mjsunit/regress/wasm/regression-651961.js
new file mode 100644
index 0000000..30f6565
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regression-651961.js
@@ -0,0 +1,24 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm
+
+load("test/mjsunit/wasm/wasm-constants.js");
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+(function() {
+ var builder = new WasmModuleBuilder();
+ builder.addMemory(1, 32, false);
+ builder.addFunction("foo", kSig_i_v)
+ .addBody([
+ kExprMemorySize, kMemoryZero,
+ kExprI32Const, 0x10,
+ kExprGrowMemory, kMemoryZero,
+ kExprI32Mul,
+ ])
+ .exportFunc();
+ var module = builder.instantiate();
+ var result = module.exports.foo();
+ assertEquals(1, result);
+})();
diff --git a/src/v8/test/mjsunit/regress/wasm/regression-654377.js b/src/v8/test/mjsunit/regress/wasm/regression-654377.js
new file mode 100644
index 0000000..871da72
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regression-654377.js
@@ -0,0 +1,23 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm
+
+load("test/mjsunit/wasm/wasm-constants.js");
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+(function() {
+ var builder = new WasmModuleBuilder();
+ builder.addMemory(1, 1, false);
+ builder.addFunction("foo", kSig_i_v)
+ .addBody([
+ kExprI32Const, 00,
+ kExprMemorySize,
+ kExprBrIf, 00,
+ kExprMemorySize,
+ kExprBr, 0xe7, 0xd2, 0xf2, 0xff, 0x1d
+ ])
+ .exportFunc();
+ assertThrows(function() { builder.instantiate(); });
+})();
diff --git a/src/v8/test/mjsunit/regress/wasm/regression-663994.js b/src/v8/test/mjsunit/regress/wasm/regression-663994.js
new file mode 100644
index 0000000..da3d7c7
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regression-663994.js
@@ -0,0 +1,14 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm
+
+load("test/mjsunit/wasm/wasm-constants.js");
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+(function() {
+ var builder = new WasmModuleBuilder();
+ var module = builder.instantiate();
+ assertTrue(typeof(module.exports) != "undefined");
+})();
diff --git a/src/v8/test/mjsunit/regress/wasm/regression-666741.js b/src/v8/test/mjsunit/regress/wasm/regression-666741.js
new file mode 100644
index 0000000..9531fc8
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regression-666741.js
@@ -0,0 +1,9 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --random-seed=-1101427159 --enable-slow-asserts --expose-wasm
+
+(function __f_7() {
+ assertThrows(() => new WebAssembly.Memory({initial: 59199}), RangeError);
+})();
diff --git a/src/v8/test/mjsunit/regress/wasm/regression-667745.js b/src/v8/test/mjsunit/regress/wasm/regression-667745.js
new file mode 100644
index 0000000..68c8803
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regression-667745.js
@@ -0,0 +1,389 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm
+
+load("test/mjsunit/wasm/wasm-constants.js");
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+(function() {
+ var builder = new WasmModuleBuilder();
+ builder.addMemory(0, 0, false);
+ builder.addFunction("test", kSig_i_iii)
+ .addBody([
+kExprI32Const, 0x0b,
+kExprI32Clz,
+kExprI32Clz,
+kExprI32Clz,
+kExprI32Const, 0x67,
+kExprI32Const, 0x07,
+kExprI32Clz,
+kExprI32Clz,
+kExprI32Clz,
+kExprI32Clz,
+kExprI32Clz,
+kExprI32Eq,
+kExprI32RemU,
+kExprI32Clz,
+kExprI32Const, 0x25,
+kExprI32Const, 0x82, 0x6c,
+kExprI32Add,
+kExprI32Const, 0x41,
+kExprI32Clz,
+kExprI32Clz,
+kExprI32Const, 0x41,
+kExprI32Const, 0x41,
+kExprI32Const, 0x70,
+kExprI32Clz,
+kExprI32Clz,
+kExprI32Clz,
+kExprI32Const, 0x70,
+kExprI32Clz,
+kExprI32Clz,
+kExprI32Const, 0x67,
+kExprI32Clz,
+kExprI32Clz,
+kExprI32GeS,
+kExprI32Const, 0x67,
+kExprI32Clz,
+kExprI32Clz,
+kExprI32Clz,
+kExprI32Clz,
+kExprI32Const, 0x41,
+kExprDrop,
+kExprI32Const, 0x41,
+kExprI32Const, 0x41,
+kExprI32Clz,
+kExprI32Clz,
+kExprI32Const, 0x41,
+kExprI32Clz,
+kExprI32Clz,
+kExprI32Clz,
+kExprI32Clz,
+kExprI32Clz,
+kExprI32Clz,
+kExprI32Clz,
+kExprCallFunction, 0x00, // function #0
+kExprCallFunction, 0x00, // function #0
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprI32Const, 0x41,
+kExprI32Const, 0x41,
+kExprI32Const, 0x01,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprSelect,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprI32Const, 0x41,
+kExprI32Const, 0x0e,
+kExprI32Const, 0x41,
+kExprI32Const, 0x41,
+kExprI32Clz,
+kExprI32Clz,
+kExprI32Clz,
+kExprI32Clz,
+kExprI32Clz,
+kExprI32Clz,
+kExprI32Const, 0x41,
+kExprI32Const, 0x41,
+kExprI32Clz,
+kExprI32Clz,
+kExprI32Clz,
+kExprI32Clz,
+kExprI32Clz,
+kExprI32Clz,
+kExprI32Clz,
+kExprI32Clz,
+kExprCallFunction, 0x00, // function #0
+kExprCallFunction, 0x00, // function #0
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprI32Const, 0x41,
+kExprI32Const, 0x41,
+kExprI32Const, 0x01,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprSelect,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprI32Const, 0x41,
+kExprI32Const, 0x0e,
+kExprI32Const, 0x41,
+kExprI32Const, 0x41,
+kExprI32Clz,
+kExprI32Clz,
+kExprI32Clz,
+kExprI32Clz,
+kExprI32Clz,
+kExprI32Clz,
+kExprI32Const, 0x41,
+kExprI32Const, 0x41,
+kExprI32Clz,
+kExprI32Clz,
+kExprI32Clz,
+kExprI32Clz,
+kExprI32Clz,
+kExprI32Clz,
+kExprI32Clz,
+kExprI32Clz,
+kExprCallFunction, 0x00, // function #0
+kExprCallFunction, 0x00, // function #0
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprI32Const, 0x41,
+kExprI32Const, 0x41,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprI32Const, 0x41,
+kExprI32Const, 0x41,
+kExprI32Const, 0x01,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprSelect,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprI32Const, 0x41,
+kExprI32Const, 0x0e,
+kExprI32Const, 0x41,
+kExprI32Const, 0x41,
+kExprI32Clz,
+kExprI32Clz,
+kExprI32Clz,
+kExprI32Clz,
+kExprI32Clz,
+kExprI32Clz,
+kExprI32Const, 0x41,
+kExprI32Const, 0x41,
+kExprI32Clz,
+kExprI32Clz,
+kExprI32Clz,
+kExprI32Clz,
+kExprI32Clz,
+kExprI32Clz,
+kExprI32Clz,
+kExprI32Clz,
+kExprCallFunction, 0x00, // function #0
+kExprCallFunction, 0x00, // function #0
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprI32Const, 0x41,
+kExprI32Const, 0x41,
+kExprI32Const, 0x01,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprSelect,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprI32Const, 0x41,
+kExprI32Const, 0x0e,
+kExprI32Const, 0x41,
+kExprI32Const, 0x41,
+kExprI32Clz,
+kExprI32Clz,
+kExprI32Clz,
+kExprI32Clz,
+kExprI32Clz,
+kExprI32Clz,
+kExprI32Const, 0x41,
+kExprI32Const, 0x41,
+kExprI32Clz,
+kExprI32Clz,
+kExprI32Clz,
+kExprI32Clz,
+kExprI32Clz,
+kExprI32Clz,
+kExprI32Clz,
+kExprI32Clz,
+kExprCallFunction, 0x00, // function #0
+kExprCallFunction, 0x00, // function #0
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprI32Const, 0x4a,
+kExprI32Const, 0x41,
+kExprI32LtU,
+kExprI32Const, 0x67,
+kExprI32Clz,
+kExprI32GtS,
+kExprI32Const, 0x41,
+kExprI32Const, 0x41,
+kExprI32Ne,
+kExprI32Clz,
+kExprI32Clz,
+kExprI32Clz,
+kExprI32Clz,
+kExprI32Clz,
+kExprI32Const, 0x41,
+kExprI32Const, 0x1a,
+kExprI32Const, 0x71,
+kExprI32And,
+kExprI32And,
+kExprI32And,
+kExprI32And,
+kExprI32And,
+kExprI32And,
+kExprI32And,
+kExprI32And,
+kExprI32ShrS,
+kExprI32Clz,
+kExprCallFunction, 0x00, // function #0
+kExprCallFunction, 0x00, // function #0
+kExprI32Clz,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprI32Const, 0x4a,
+kExprI32Const, 0x41,
+kExprI32LtU,
+kExprI32Const, 0x67,
+kExprI32Clz,
+kExprI32GtS,
+kExprI32Const, 0x41,
+kExprI32Const, 0x41,
+kExprI32Ne,
+kExprI32Clz,
+kExprI32Clz,
+kExprI32Clz,
+kExprI32Clz,
+kExprI32Clz,
+kExprI32Const, 0x41,
+kExprI32Const, 0x1a,
+kExprI32Const, 0x71,
+kExprI32And,
+kExprI32And,
+kExprI32And,
+kExprI32And,
+kExprI32And,
+kExprI32And,
+kExprI32And,
+kExprI32And,
+kExprI32ShrS,
+kExprI32Clz,
+kExprCallFunction, 0x00, // function #0
+kExprCallFunction, 0x00, // function #0
+kExprI32Clz,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprI32Clz,
+kExprI32Clz,
+kExprI32Clz,
+kExprI32Clz,
+kExprUnreachable,
+kExprCallFunction, 0x00, // function #0
+kExprCallFunction, 0x00, // function #0
+kExprNop,
+kExprNop,
+kExprNop,
+kExprNop,
+kExprReturn
+ ])
+ .exportFunc();
+ var module = builder.instantiate();
+ assertTrue(module != undefined);
+})();
diff --git a/src/v8/test/mjsunit/regress/wasm/regression-670683.js b/src/v8/test/mjsunit/regress/wasm/regression-670683.js
new file mode 100644
index 0000000..7306e11
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regression-670683.js
@@ -0,0 +1,20 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm --allow-natives-syntax
+
+const bytes = new Uint8Array([
+ 0x00, 0x61, 0x73, 0x6d, 0x01, 0x00, 0x00, 0x00, 0x01, 0x05, 0x01,
+ 0x60, 0x00, 0x01, 0x7f, 0x03, 0x02, 0x01, 0x00, 0x05, 0x03, 0x01,
+ 0x00, 0x01, 0x07, 0x11, 0x02, 0x04, 0x67, 0x72, 0x6f, 0x77, 0x00,
+ 0x00, 0x06, 0x6d, 0x65, 0x6d, 0x6f, 0x72, 0x79, 0x02, 0x00, 0x0a,
+ 0x08, 0x01, 0x06, 0x00, 0x41, 0x01, 0x40, 0x00, 0x0b
+]);
+
+assertPromiseResult(
+ WebAssembly.compile(bytes),
+ module => {
+ print('promise resolved: ' + module);
+ new WebAssembly.Instance(module).exports.grow();
+ });
diff --git a/src/v8/test/mjsunit/regress/wasm/regression-674447.js b/src/v8/test/mjsunit/regress/wasm/regression-674447.js
new file mode 100644
index 0000000..228b038
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regression-674447.js
@@ -0,0 +1,10 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --validate-asm --cache=code
+
+(function() {
+ "use asm";
+ return function f() {}
+})();
diff --git a/src/v8/test/mjsunit/regress/wasm/regression-680938.js b/src/v8/test/mjsunit/regress/wasm/regression-680938.js
new file mode 100644
index 0000000..75c8a45
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regression-680938.js
@@ -0,0 +1,8 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var v17 = {};
+var v32 = {};
+v39 = new WebAssembly.Memory(v32);
+v49 = v39.grow(v17);
diff --git a/src/v8/test/mjsunit/regress/wasm/regression-684858.js b/src/v8/test/mjsunit/regress/wasm/regression-684858.js
new file mode 100644
index 0000000..bfef7fc
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regression-684858.js
@@ -0,0 +1,34 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+var name = 'regression_684858';
+
+function patchNameLength(buffer) {
+ var count = 0;
+ var view = new Uint8Array(buffer);
+ for (var i = 0, e = view.length - name.length; i <= e; ++i) {
+ var subs = String.fromCharCode.apply(null, view.slice(i, i + name.length));
+ if (subs != name) continue;
+ ++count;
+ // One byte before this name, its length is encoded.
+ // Patch this to 127, making it out of bounds.
+ if (view.length >= 127) throw Error('cannot patch reliably');
+ if (view[i - 1] != name.length) throw Error('unexpected length');
+ view[i - 1] = 0x7f;
+ }
+ if (count != 1) throw Error('did not find name');
+}
+
+var builder = new WasmModuleBuilder();
+builder.addFunction(name, kSig_i_v)
+ .addBody([kExprI32Const, 2, kExprI32Const, 0, kExprI32DivU])
+ .exportAs('main');
+var buffer = builder.toBuffer();
+patchNameLength(buffer);
+var module = new WebAssembly.Module(buffer);
+var instance = new WebAssembly.Instance(module);
+assertThrows(() => instance.exports.main(), WebAssembly.RuntimeError);
diff --git a/src/v8/test/mjsunit/regress/wasm/regression-688876.js b/src/v8/test/mjsunit/regress/wasm/regression-688876.js
new file mode 100644
index 0000000..83bebbb
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regression-688876.js
@@ -0,0 +1,42 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+(function() {
+ var builder = new WasmModuleBuilder();
+ builder.addMemory(16, 32, false);
+ builder.addFunction('test', kSig_i_i)
+ .addBodyWithEnd([
+ kExprI32Const, 0x41,
+ kExprI32Const, 0x45,
+ kExprI32Const, 0x41,
+ kExprI32DivU,
+ kExprI32LoadMem8S, 0x00, 0x3a,
+ kExprI32Const, 0x75,
+ kExprI32Const, 0x75,
+ kExprI32Const, 0x6e,
+ kExprI32Eqz,
+ kExprI32LoadMem8S, 0x00, 0x3a,
+ kExprI32Add,
+ kExprI32DivU,
+ kExprI32LoadMem8S, 0x00, 0x74,
+ kExprI32And,
+ kExprI32Eqz,
+ kExprI32And,
+kExprGrowMemory, 0x00,
+ kExprI32Const, 0x55,
+ kExprI32LoadMem8S, 0x00, 0x3a,
+ kExprI32LoadMem16U, 0x00, 0x71,
+ kExprI32Const, 0x00,
+ kExprI32RemU,
+ kExprI32And,
+kExprI32Eqz,
+kExprEnd, // @44
+ ])
+ .exportFunc();
+ var module = builder.instantiate();
+ assertThrows(() => {module.exports.test(1);});
+})();
diff --git a/src/v8/test/mjsunit/regress/wasm/regression-689450.js b/src/v8/test/mjsunit/regress/wasm/regression-689450.js
new file mode 100644
index 0000000..9a4989c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regression-689450.js
@@ -0,0 +1,25 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+(function() {
+ var builder = new WasmModuleBuilder();
+ builder.addMemory(16, 32, false);
+ builder.addFunction('test', kSig_i_i)
+ .addBodyWithEnd([
+ kExprGetLocal, 0x00,
+ kExprI32Const, 0x29,
+ kExprI32Shl,
+ kExprI32Const, 0x18,
+ kExprI32ShrS,
+ kExprI32Const, 0x18,
+ kExprI32Shl,
+ kExprEnd,
+ ])
+ .exportFunc();
+ var module = builder.instantiate();
+ assertEquals(0, module.exports.test(16));
+})();
diff --git a/src/v8/test/mjsunit/regress/wasm/regression-694433.js b/src/v8/test/mjsunit/regress/wasm/regression-694433.js
new file mode 100644
index 0000000..a260e20
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regression-694433.js
@@ -0,0 +1,6 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var size = 0x40000000;
+assertThrows(() => WebAssembly.validate(new Uint16Array(size)), RangeError);
diff --git a/src/v8/test/mjsunit/regress/wasm/regression-698587.js b/src/v8/test/mjsunit/regress/wasm/regression-698587.js
new file mode 100644
index 0000000..8e0be88
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regression-698587.js
@@ -0,0 +1,10 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var heap = new ArrayBuffer();
+function asm(stdlib, ffi, heap) {
+ "use asm";
+ return {};
+}
+asm({}, {}, heap);
diff --git a/src/v8/test/mjsunit/regress/wasm/regression-699485.js b/src/v8/test/mjsunit/regress/wasm/regression-699485.js
new file mode 100644
index 0000000..7f45607
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regression-699485.js
@@ -0,0 +1,22 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm
+
+load("test/mjsunit/wasm/wasm-constants.js");
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+(function() {
+"use asm";
+var builder = new WasmModuleBuilder();
+builder.addMemory(0, 5, false);
+builder.addFunction("regression_699485", kSig_i_v)
+ .addBody([
+ kExprI32Const, 0x04,
+ kExprNop,
+ kExprGrowMemory, 0x00,
+ ]).exportFunc();
+let module = builder.instantiate();
+assertEquals(0, module.exports.regression_699485());
+})();
diff --git a/src/v8/test/mjsunit/regress/wasm/regression-702460.js b/src/v8/test/mjsunit/regress/wasm/regression-702460.js
new file mode 100644
index 0000000..73c01e1
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regression-702460.js
@@ -0,0 +1,51 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load("test/mjsunit/wasm/wasm-constants.js");
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+// Non-standard opcodes.
+let kSig_s_v = makeSig([], [kWasmS128]);
+let kExprS128LoadMem = 0xc0;
+
+(function() {
+"use asm";
+ var builder = new WasmModuleBuilder();
+ builder.addFunction("regression_702460", kSig_i_v)
+ .addBody([
+ kExprI32Const, 0x52,
+ kExprI32Const, 0x41,
+ kExprI32Const, 0x3c,
+ kExprI32Const, 0xdc, 0x01,
+ kExprGrowMemory, 0x00,
+ kExprGrowMemory, 0x00,
+ kExprGrowMemory, 0x00,
+ kExprSetLocal, 0x00,
+ kExprGrowMemory, 0x00,
+ kExprGrowMemory, 0x00,
+ kExprGrowMemory, 0x00,
+ kExprGrowMemory, 0x00,
+ kExprGrowMemory, 0x00,
+ kExprGrowMemory, 0x00,
+ kExprGrowMemory, 0x00,
+ kExprGrowMemory, 0x00,
+ kExprGrowMemory, 0x00,
+ kExprGrowMemory, 0x00,
+ kExprGrowMemory, 0x00,
+ kExprGrowMemory, 0x00,
+ kExprGrowMemory, 0x00,
+ kExprGrowMemory, 0x00,
+ kExprGrowMemory, 0x00,
+ kExprGrowMemory, 0x00,
+ kExprGrowMemory, 0x00,
+ kExprGrowMemory, 0x00,
+ kExprGrowMemory, 0x00,
+ kExprGrowMemory, 0x00,
+ kExprGrowMemory, 0x00,
+ kExprS128LoadMem, 0x00, 0x40,
+ kExprUnreachable,
+ kExprGrowMemory, 0x00
+ ]).exportFunc();
+ assertThrows(() => builder.instantiate());
+})();
diff --git a/src/v8/test/mjsunit/regress/wasm/regression-702839.js b/src/v8/test/mjsunit/regress/wasm/regression-702839.js
new file mode 100644
index 0000000..859d268
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regression-702839.js
@@ -0,0 +1,11 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function __f_0() {
+ "use asm";
+ function __f_1() { }
+ return {__f_1: __f_1};
+}
+__f_0();
+__f_0();
diff --git a/src/v8/test/mjsunit/regress/wasm/regression-703568.js b/src/v8/test/mjsunit/regress/wasm/regression-703568.js
new file mode 100644
index 0000000..c7d716b
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regression-703568.js
@@ -0,0 +1,15 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --stack-size=100
+
+function asm() {
+ 'use asm';
+ return {};
+}
+function f() {
+ asm();
+ f();
+}
+assertThrows(() => f(), RangeError);
diff --git a/src/v8/test/mjsunit/regress/wasm/regression-708714.js b/src/v8/test/mjsunit/regress/wasm/regression-708714.js
new file mode 100644
index 0000000..10cd67a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regression-708714.js
@@ -0,0 +1,23 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load("test/mjsunit/wasm/wasm-constants.js");
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+var builder = new WasmModuleBuilder();
+
+builder.addExplicitSection([kFunctionSectionCode,
+ // length
+ 7,
+ // functions count
+ 1,
+ // signature index (invalid LEB)
+ 0xff, 0xff, 0xff, 0xff, 0xff]);
+builder.addExplicitSection([kStartSectionCode,
+ // length
+ 1,
+ // index
+ 0]);
+
+assertThrows(() => builder.instantiate(), WebAssembly.CompileError);
diff --git a/src/v8/test/mjsunit/regress/wasm/regression-710844.js b/src/v8/test/mjsunit/regress/wasm/regression-710844.js
new file mode 100644
index 0000000..a45e953
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regression-710844.js
@@ -0,0 +1,23 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load("test/mjsunit/wasm/wasm-constants.js");
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+(function() {
+ "use asm";
+ var builder = new WasmModuleBuilder();
+ builder.addMemory(0, 5, true);
+ builder.addFunction("regression_710844", kSig_v_v)
+ .addBody([
+ kExprI32Const, 0x03,
+ kExprNop,
+ kExprGrowMemory, 0x00,
+ kExprI32Const, 0x13,
+ kExprNop,
+ kExprI32StoreMem8, 0x00, 0x10
+ ]).exportFunc();
+ let instance = builder.instantiate();
+ instance.exports.regression_710844();
+})();
diff --git a/src/v8/test/mjsunit/regress/wasm/regression-711203.js b/src/v8/test/mjsunit/regress/wasm/regression-711203.js
new file mode 100644
index 0000000..46f274a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regression-711203.js
@@ -0,0 +1,30 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load("test/mjsunit/wasm/wasm-constants.js");
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+(function() {
+ var builder = new WasmModuleBuilder();
+ builder.addMemory(16, 32, false);
+ builder.addFunction("test", kSig_i_iii)
+ .addBodyWithEnd([
+ // body:
+ kExprI64Const, 0,
+ kExprI64Const, 0x1,
+ kExprI64Clz,
+ kExprI64Sub,
+ kExprI64Const, 0x10,
+ kExprI64Const, 0x1b,
+ kExprI64Shl,
+ kExprI64Sub,
+ kExprI64Popcnt,
+ kExprI32ConvertI64,
+ kExprEnd, // @207
+ ])
+ .exportFunc();
+ var module = builder.instantiate();
+ const result = module.exports.test(1, 2, 3);
+ assertEquals(58, result);
+})();
diff --git a/src/v8/test/mjsunit/regress/wasm/regression-715216-a.js b/src/v8/test/mjsunit/regress/wasm/regression-715216-a.js
new file mode 100644
index 0000000..5625341
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regression-715216-a.js
@@ -0,0 +1,12 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --wasm-interpret-all --validate-asm
+
+function asm() {
+ "use asm";
+ function f() {}
+ return {};
+}
+asm();
diff --git a/src/v8/test/mjsunit/regress/wasm/regression-715216-b.js b/src/v8/test/mjsunit/regress/wasm/regression-715216-b.js
new file mode 100644
index 0000000..0954f80
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regression-715216-b.js
@@ -0,0 +1,13 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --wasm-interpret-all --wasm-lazy-compilation
+
+load("test/mjsunit/wasm/wasm-constants.js");
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+var builder = new WasmModuleBuilder();
+builder.addFunction('f', kSig_v_v).addBody([]);
+builder.addFunction('g', kSig_v_v).addBody([]);
+builder.instantiate();
diff --git a/src/v8/test/mjsunit/regress/wasm/regression-717056.js b/src/v8/test/mjsunit/regress/wasm/regression-717056.js
new file mode 100644
index 0000000..534cf74
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regression-717056.js
@@ -0,0 +1,16 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Check that stack overflow inside asm-wasm translation propagates correctly.
+
+function asm() {
+ 'use asm';
+ return {};
+}
+
+function rec() {
+ asm();
+ rec();
+}
+assertThrows(() => rec(), RangeError);
diff --git a/src/v8/test/mjsunit/regress/wasm/regression-717194.js b/src/v8/test/mjsunit/regress/wasm/regression-717194.js
new file mode 100644
index 0000000..074b2e4
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regression-717194.js
@@ -0,0 +1,30 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+PAGE_SIZE = 0x10000;
+PAGES = 10;
+
+memory = new WebAssembly.Memory({initial: PAGES});
+buffer = memory.buffer;
+
+var func = (function (stdlib, env, heap) {
+ "use asm";
+
+ var array = new stdlib.Int32Array(heap);
+
+ return function () {
+ array[0] = 0x41424344;
+ array[1] = 0x45464748;
+ }
+}({Int32Array: Int32Array}, {}, buffer));
+
+for (var i = 0; i < 1000; ++i)
+ func();
+
+memory.grow(1);
+
+func();
+
+for(var i = 0; i < 2; ++i)
+ new ArrayBuffer(PAGE_SIZE * PAGES);
diff --git a/src/v8/test/mjsunit/regress/wasm/regression-719175.js b/src/v8/test/mjsunit/regress/wasm/regression-719175.js
new file mode 100644
index 0000000..c6217b0
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regression-719175.js
@@ -0,0 +1,16 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --validate-asm --wasm-interpret-all
+
+function asm() {
+ 'use asm';
+ function f() {
+ if (1.0 % 2.5 == -0.75) {
+ }
+ return 0;
+ }
+ return {f: f};
+}
+asm().f();
diff --git a/src/v8/test/mjsunit/regress/wasm/regression-722445.js b/src/v8/test/mjsunit/regress/wasm/regression-722445.js
new file mode 100644
index 0000000..f6a96dc
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regression-722445.js
@@ -0,0 +1,16 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+var builder = new WasmModuleBuilder();
+builder.addFunction('f', kSig_v_v).addBody([
+ kExprI32Const, 0, kExprBrTable,
+ // 0x80000000 in LEB:
+ 0x80, 0x80, 0x80, 0x80, 0x08,
+ // First break target. Creation of this node triggered the bug.
+ 0
+]);
+assertThrows(() => builder.instantiate(), WebAssembly.CompileError);
diff --git a/src/v8/test/mjsunit/regress/wasm/regression-724846.js b/src/v8/test/mjsunit/regress/wasm/regression-724846.js
new file mode 100644
index 0000000..628d58f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regression-724846.js
@@ -0,0 +1,14 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+// Flags: --wasm-max-mem-pages=49152
+
+let builder = new WasmModuleBuilder();
+const num_pages = 49152;
+builder.addMemory(num_pages, num_pages);
+// num_pages * 64k (page size) > kMaxInt.
+assertThrows(() => builder.instantiate(), RangeError);
diff --git a/src/v8/test/mjsunit/regress/wasm/regression-724851.js b/src/v8/test/mjsunit/regress/wasm/regression-724851.js
new file mode 100644
index 0000000..1883479
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regression-724851.js
@@ -0,0 +1,12 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --wasm-lazy-compilation
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+let builder = new WasmModuleBuilder();
+builder.addFunction('f', kSig_i_v).addBody([kExprReturn]);
+assertThrows(() => builder.instantiate(), WebAssembly.CompileError);
diff --git a/src/v8/test/mjsunit/regress/wasm/regression-724972.js b/src/v8/test/mjsunit/regress/wasm/regression-724972.js
new file mode 100644
index 0000000..2af403c
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regression-724972.js
@@ -0,0 +1,11 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+var builder = new WasmModuleBuilder();
+builder.addMemory(0, 0, true);
+var instance = builder.instantiate();
+instance.exports.memory.buffer;
diff --git a/src/v8/test/mjsunit/regress/wasm/regression-727219.js b/src/v8/test/mjsunit/regress/wasm/regression-727219.js
new file mode 100644
index 0000000..af0d872
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regression-727219.js
@@ -0,0 +1,22 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc --validate-asm
+
+function asm() {
+ "use asm";
+ function f(a) {
+ a = a | 0;
+ tab[a & 0]() | 0;
+ }
+ function unused() {
+ return 0;
+ }
+ var tab = [ unused ];
+ return f;
+}
+
+asm();
+gc();
+asm();
diff --git a/src/v8/test/mjsunit/regress/wasm/regression-727222.js b/src/v8/test/mjsunit/regress/wasm/regression-727222.js
new file mode 100644
index 0000000..6b3f2fa
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regression-727222.js
@@ -0,0 +1,14 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+var builder = new WasmModuleBuilder();
+builder.addMemory(0, 0, false);
+builder.addFunction('f', kSig_i_v)
+ .addBody([kExprMemorySize, kMemoryZero])
+ .exportFunc();
+var instance = builder.instantiate();
+instance.exports.f();
diff --git a/src/v8/test/mjsunit/regress/wasm/regression-727560.js b/src/v8/test/mjsunit/regress/wasm/regression-727560.js
new file mode 100644
index 0000000..f92d879
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regression-727560.js
@@ -0,0 +1,18 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+{
+ let builder = new WasmModuleBuilder();
+ builder.addMemory();
+ builder.exportMemoryAs("exported_mem");
+ i1 = builder.instantiate();
+}
+{
+ let builder = new WasmModuleBuilder();
+ builder.addImportedMemory("fil", "imported_mem");
+ i2 = builder.instantiate({fil: {imported_mem: i1.exports.exported_mem}});
+}
diff --git a/src/v8/test/mjsunit/regress/wasm/regression-729991.js b/src/v8/test/mjsunit/regress/wasm/regression-729991.js
new file mode 100644
index 0000000..85a9ae7
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regression-729991.js
@@ -0,0 +1,15 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+let builder = new WasmModuleBuilder();
+builder.addCustomSection('BBBB', []);
+builder.addCustomSection('AAAA', new Array(32).fill(0));
+let buffer = builder.toBuffer();
+// Shrink the buffer by 30 bytes (content of the unknown section named 'AAAA').
+buffer = buffer.slice(0, buffer.byteLength - 30);
+// Instantiation should fail on the truncated buffer.
+assertThrows(() => new WebAssembly.Module(buffer), WebAssembly.CompileError);
diff --git a/src/v8/test/mjsunit/regress/wasm/regression-731351.js b/src/v8/test/mjsunit/regress/wasm/regression-731351.js
new file mode 100644
index 0000000..238223a
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regression-731351.js
@@ -0,0 +1,23 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --validate-asm --expose-gc --stress-opt
+
+gc();
+function asm(stdlib, foreign, buffer) {
+ "use asm";
+ var HEAP32 = new stdlib.Uint32Array(buffer);
+ function load(a) {
+ a = a | 0;
+ return +(HEAP32[a >> 2] >>> 0);
+ }
+ return {load: load};
+}
+
+function RunAsmJsTest() {
+ buffer = new ArrayBuffer(65536);
+ var asm_module = asm({Uint32Array: Uint32Array}, {}, buffer);
+ asm_module.load(buffer.byteLength);
+}
+RunAsmJsTest();
diff --git a/src/v8/test/mjsunit/regress/wasm/regression-734108.js b/src/v8/test/mjsunit/regress/wasm/regression-734108.js
new file mode 100644
index 0000000..d8774f4
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regression-734108.js
@@ -0,0 +1,16 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --wasm-async-compilation
+
+__v_0 = new Uint8Array([
+ 0x00, 0x61, 0x73, 0x6d, 0x01, 0x00, 0x00, 0x00, 0x01, 0x05, 0x01,
+ 0x60, 0x00, 0x01, 0x7f, 0x03, 0x02, 0x01, 0x00, 0x05, 0x03, 0x01,
+ 0x00, 0x01, 0x07, 0x11, 0x02, 0x04, 0x67, 0x72, 0x6f, 0x77, 0x00,
+ 0x00, 0x06, 0x6d, 0x65, 0x6d, 0x6f, 0x72, 0x79, 0x02, 0x00, 0x0a,
+ 0x08, 0x01, 0x06, 0x00, 0x41, 0x01, 0x40, 0x00, 0x0b
+]);
+assertPromiseResult(
+ WebAssembly.compile(__v_0)
+);
diff --git a/src/v8/test/mjsunit/regress/wasm/regression-734246.js b/src/v8/test/mjsunit/regress/wasm/regression-734246.js
new file mode 100644
index 0000000..57f9894
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regression-734246.js
@@ -0,0 +1,16 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+let builder = new WasmModuleBuilder();
+builder.addExplicitSection([
+ kUnknownSectionCode,
+ // section length
+ 0x0f,
+ // name length: 0xffffffff
+ 0xf9, 0xff, 0xff, 0xff, 0x0f
+]);
+assertThrows(() => builder.instantiate(), WebAssembly.CompileError);
diff --git a/src/v8/test/mjsunit/regress/wasm/regression-734345.js b/src/v8/test/mjsunit/regress/wasm/regression-734345.js
new file mode 100644
index 0000000..f55a062
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regression-734345.js
@@ -0,0 +1,28 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+builder1 = new WasmModuleBuilder();
+builder1.addFunction('exp1', kSig_v_v).addBody([kExprUnreachable]).exportFunc();
+
+builder2 = new WasmModuleBuilder();
+builder2.addImport('imp', 'imp', kSig_v_v);
+builder2.addFunction('call_imp', kSig_v_v)
+ .addBody([kExprCallFunction, 0])
+ .exportFunc();
+
+export1 = builder1.instantiate().exports.exp1;
+export2 = builder2.instantiate({imp: {imp: export1}}).exports.call_imp;
+export1 = undefined;
+
+let a = [0];
+for (i = 0; i < 10; ++i) {
+ a = a.concat(new Array(i).fill(i));
+ assertThrows(() => export2(), WebAssembly.RuntimeError);
+ gc();
+}
diff --git a/src/v8/test/mjsunit/regress/wasm/regression-736584.js b/src/v8/test/mjsunit/regress/wasm/regression-736584.js
new file mode 100644
index 0000000..39f03c1
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regression-736584.js
@@ -0,0 +1,17 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --wasm-lazy-compilation
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+let mem = new WebAssembly.Memory({});
+let builder = new WasmModuleBuilder();
+builder.addImportedMemory("mod", "imported_mem");
+builder.addFunction('mem_size', kSig_i_v)
+ .addBody([kExprMemorySize, kMemoryZero])
+ .exportFunc();
+let instance = builder.instantiate({mod: {imported_mem: mem}});
+instance.exports.mem_size();
diff --git a/src/v8/test/mjsunit/regress/wasm/regression-737069.js b/src/v8/test/mjsunit/regress/wasm/regression-737069.js
new file mode 100644
index 0000000..c68d10f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regression-737069.js
@@ -0,0 +1,35 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm
+
+load("test/mjsunit/wasm/wasm-constants.js");
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+let binary = new Binary;
+
+binary.emit_header();
+binary.emit_section(kTypeSectionCode, section => {
+ section.emit_u32v(1); // number of types
+ section.emit_u8(kWasmFunctionTypeForm);
+ section.emit_u32v(0); // number of parameters
+ section.emit_u32v(0); // number of returns
+});
+binary.emit_section(kFunctionSectionCode, section => {
+ section.emit_u32v(1); // number of functions
+ section.emit_u32v(0); // type index
+});
+
+binary.emit_u8(kCodeSectionCode);
+binary.emit_u8(0x02); // section length
+binary.emit_u8(0x01); // number of functions
+binary.emit_u8(0x40); // function body size
+// Function body is missing here.
+
+let buffer = new ArrayBuffer(binary.length);
+let view = new Uint8Array(buffer);
+for (let i = 0; i < binary.length; i++) {
+ view[i] = binary[i] | 0;
+}
+WebAssembly.validate(buffer);
diff --git a/src/v8/test/mjsunit/regress/wasm/regression-739768.js b/src/v8/test/mjsunit/regress/wasm/regression-739768.js
new file mode 100644
index 0000000..bcf3cee
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regression-739768.js
@@ -0,0 +1,33 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+// Flags: --wasm-lazy-compilation
+
+let builder0 = new WasmModuleBuilder();
+builder0.setName('module_0');
+let sig_index = builder0.addType(kSig_i_v);
+builder0.addFunction('main', kSig_i_i)
+ .addBody([
+ kExprGetLocal, 0, // --
+ kExprCallIndirect, sig_index, kTableZero
+ ]) // --
+ .exportAs('main');
+builder0.setFunctionTableBounds(3, 3);
+builder0.addExportOfKind('table', kExternalTable);
+let module0 = new WebAssembly.Module(builder0.toBuffer());
+let instance0 = new WebAssembly.Instance(module0);
+
+let builder1 = new WasmModuleBuilder();
+builder1.setName('module_1');
+builder1.addFunction('main', kSig_i_v).addBody([kExprUnreachable]);
+builder1.addImportedTable('z', 'table');
+builder1.addFunctionTableInit(0, false, [0], true);
+let module1 = new WebAssembly.Module(builder1.toBuffer());
+let instance1 =
+ new WebAssembly.Instance(module1, {z: {table: instance0.exports.table}});
+assertThrows(
+ () => instance0.exports.main(0), WebAssembly.RuntimeError, 'unreachable');
diff --git a/src/v8/test/mjsunit/regress/wasm/regression-753496.js b/src/v8/test/mjsunit/regress/wasm/regression-753496.js
new file mode 100644
index 0000000..a056a9f
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regression-753496.js
@@ -0,0 +1,17 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function Module(stdlib, foreign, heap) {
+ "use asm";
+ var MEM64 = new stdlib.Float64Array(heap);
+ function foo(i) {
+ i = i | 0;
+ MEM64[032 ] = +(i >>> 7 ) / 2.;
+ return +MEM64[0];
+ }
+ return { foo: foo };
+}
+
+var foo = Module(this, {}, new ArrayBuffer( "" ? this : this)).foo;
+assertEquals(NaN, foo(1));
diff --git a/src/v8/test/mjsunit/regress/wasm/regression-757217.js b/src/v8/test/mjsunit/regress/wasm/regression-757217.js
new file mode 100644
index 0000000..218b090
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regression-757217.js
@@ -0,0 +1,20 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+let builder = new WasmModuleBuilder();
+builder.addImport('','f', kSig_v_v);
+builder.addExport('a', 0);
+builder.addExport('b', 0);
+var bytes = builder.toBuffer();
+
+var m = new WebAssembly.Module(bytes);
+assertTrue(m instanceof WebAssembly.Module);
+
+assertPromiseResult(
+ WebAssembly.compile(bytes)
+ .then(async_result => assertTrue(async_result instanceof WebAssembly.Module),
+ assertUnreachable));
diff --git a/src/v8/test/mjsunit/regress/wasm/regression-763439.js b/src/v8/test/mjsunit/regress/wasm/regression-763439.js
new file mode 100644
index 0000000..0f9d2b2
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regression-763439.js
@@ -0,0 +1,22 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+var builder = new WasmModuleBuilder();
+builder.addMemory(0, 1234, false);
+builder.addFunction('f', kSig_i_v)
+ .addBody([
+ kExprI32Const, 0x1d, // --
+ kExprGrowMemory, 0x00, // --
+ kExprI32LoadMem, 0x00, 0xff, 0xff, 0x45, // --
+ ])
+ .exportFunc();
+
+var module = new WebAssembly.Module(builder.toBuffer());
+var instance1 = new WebAssembly.Instance(module);
+instance1.exports.f();
+var instance2 = new WebAssembly.Instance(module);
+instance2.exports.f();
diff --git a/src/v8/test/mjsunit/regress/wasm/regression-763697.js b/src/v8/test/mjsunit/regress/wasm/regression-763697.js
new file mode 100644
index 0000000..faf74e1
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regression-763697.js
@@ -0,0 +1,15 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm --no-experimental-wasm-simd
+
+load('test/mjsunit/wasm/wasm-constants.js');
+load('test/mjsunit/wasm/wasm-module-builder.js');
+
+let builder = new WasmModuleBuilder();
+ builder.addFunction("main", kSig_i_i)
+ .addBody([kExprGetLocal, 0])
+ .addLocals({s128_count: 1});
+
+ assertFalse(WebAssembly.validate(builder.toBuffer()));
diff --git a/src/v8/test/mjsunit/regress/wasm/regression-769846.js b/src/v8/test/mjsunit/regress/wasm/regression-769846.js
new file mode 100644
index 0000000..297da84
--- /dev/null
+++ b/src/v8/test/mjsunit/regress/wasm/regression-769846.js
@@ -0,0 +1,15 @@
+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function Module() {
+ "use asm";
+ function div_(__v_6) {
+ __v_6 = __v_6 | 0;
+ }
+ return { f: div_}
+};
+var __f_0 = Module().f;
+__v_8 = [0];
+__v_8.__defineGetter__(0, function() { return __f_0(__v_8); });
+__v_8[0];
