v8: upgrade to 3.17.16

28 files changed, 1014 insertions, 6 deletions

diff --git a/deps/v8/test/mjsunit/regress/external-and-normal-array-polymorphism.js b/deps/v8/test/mjsunit/regress/external-and-normal-array-polymorphism.js
new file mode 100644
index 0000000000..0ac1545ca9
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/external-and-normal-array-polymorphism.js
@@ -0,0 +1,48 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function store_generator(compare) {
+  return function(a,i,v) {
+    a[i] = v;
+    assertEquals(compare, a[i]);
+    assertEquals(compare, a[i]);
+  }
+}
+
+f = store_generator(5);
+a = [0,0,0];
+f(a,0,5);
+a = [0,0,0];
+f(a,1,5);
+a = [0,0,0];
+f(a,2,5);
+
+f = store_generator(5.5);
+a = new Float32Array(5);
+f(a,0,5.5);
+f(a,1,5.5);
+f(a,2,5.5);
diff --git a/deps/v8/test/mjsunit/regress/negative_lookup.js b/deps/v8/test/mjsunit/regress/negative_lookup.js
new file mode 100644
index 0000000000..e23e365fc7
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/negative_lookup.js
@@ -0,0 +1,65 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function s(v) {
+  v.x = 1;
+}
+
+function c(p) {
+  return {__proto__: p};
+}
+
+var p = {};
+
+// Make p the last prototype in the chain.
+p.__proto__ = null;
+
+var o1 = c(p);
+var o2 = c(p);
+var o3 = c(p);
+var o4 = c(p);
+
+// Make y go to slow mode.
+// Do this after using p as prototype, since using an object as prototype kicks
+// it back into fast mode.
+p.y = 1;
+delete p.y;
+
+// Initialize the store IC.
+s(o1);
+s(o2);
+
+// Do something with x in slow-mode p.
+Object.defineProperty(p, "x", { writable: false, value: 5 });
+
+// Verify that directly setting x fails.
+o3.x = 10;
+assertEquals(5, o3.x);
+
+// Verify that setting x through the IC fails.
+s(o4);
+assertEquals(5, o4.x);
diff --git a/deps/v8/test/mjsunit/regress/readonly1.js b/deps/v8/test/mjsunit/regress/readonly1.js
new file mode 100644
index 0000000000..366f432fbc
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/readonly1.js
@@ -0,0 +1,71 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function s(v) {
+  v.x = 1;
+}
+
+function s_strict(v) {
+  "use strict";
+  v.x = 1;
+}
+
+function c(p) {
+  return {__proto__: p};
+}
+
+var p = {};
+
+var o1 = c(p);
+var o2 = c(p);
+var o3 = c(p);
+var o4 = c(p);
+
+// Make p go slow.
+// Do this after using p as prototype, since using an object as prototype kicks
+// it back into fast mode.
+p.y = 1;
+delete p.y;
+p.x = 5;
+
+// Initialize the store IC.
+s(o1);
+s(o2);
+s_strict(o1);
+s_strict(o2);
+
+// Make x non-writable.
+Object.defineProperty(p, "x", { writable: false });
+
+// Verify that direct setting fails.
+o3.x = 20;
+assertEquals(5, o3.x);
+
+// Verify that setting through the IC fails.
+s(o4);
+assertEquals(5, o4.x);
+assertThrows("s_strict(o4);", TypeError);
diff --git a/deps/v8/test/mjsunit/regress/readonly2.js b/deps/v8/test/mjsunit/regress/readonly2.js
new file mode 100644
index 0000000000..4e539250d5
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/readonly2.js
@@ -0,0 +1,62 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+Object.defineProperty(this, "x", { writable:true });
+
+function s(v) {
+  v.x = 1;
+}
+
+function s_strict(v) {
+  "use strict";
+  v.x = 1;
+}
+
+function c(p) {
+  return {__proto__: p};
+}
+
+var o1 = c(this);
+var o2 = c(this);
+
+// Initialize the store IC.
+s(c(this));
+s(c(this));
+s_strict(c(this));
+s_strict(c(this));
+
+// Make x non-writable.
+Object.defineProperty(this, "x", { writable:false, value:5 });
+
+// Verify that direct setting fails.
+o1.x = 20;
+assertEquals(5, o1.x);
+
+// Verify that setting through the IC fails.
+s(o2);
+assertEquals(5, o2.x);
+assertThrows("s_strict(o2);", TypeError);
diff --git a/deps/v8/test/mjsunit/regress/readonly3.js b/deps/v8/test/mjsunit/regress/readonly3.js
new file mode 100644
index 0000000000..f81979d272
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/readonly3.js
@@ -0,0 +1,65 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+this.x = 0;
+
+var p = {};
+Object.defineProperty(p, "x", {writable:false, value:5});
+this.__proto__ = p;
+
+function s(v) {
+  v.x = 1;
+}
+
+function s_strict(v) {
+  "use strict";
+  v.x = 1;
+}
+
+function c(p) {
+  return {__proto__: p};
+}
+
+var o1 = c(this);
+var o2 = c(this);
+
+// Initialize the store IC.
+s(c(this));
+s(c(this));
+s_strict(c(this));
+s_strict(c(this));
+
+delete this.x;
+
+// Verify that direct setting fails.
+o1.x = 20;
+assertEquals(5, o1.x);
+
+// Verify that setting through the IC fails.
+s(o2);
+assertEquals(5, o2.x);
+assertThrows("s_strict(o2);", TypeError);
diff --git a/deps/v8/test/mjsunit/regress/readonly4.js b/deps/v8/test/mjsunit/regress/readonly4.js
new file mode 100644
index 0000000000..b2fde2953b
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/readonly4.js
@@ -0,0 +1,74 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var slow = {};
+var p = {};
+
+slow.__proto__ = p;
+slow.x = 10;
+slow.y = 10;
+Object.defineProperty(p, "x", {writable:false, value:5});
+
+function c(p) {
+  return {__proto__: p};
+}
+
+function s(v) {
+  return v.x = 1;
+}
+
+function s_strict(v) {
+  "use strict";
+  v.x = 1;
+}
+
+var o1 = c(slow);
+var o2 = c(slow);
+var o1_strict = c(slow);
+var o2_strict = c(slow);
+var o3 = c(slow);
+var o4 = c(slow);
+
+// Make s slow.
+// Do this after using slow as prototype, since using an object as prototype
+// kicks it back into fast mode.
+delete slow.y;
+
+s(o1);
+s(o2);
+s_strict(o1_strict);
+s_strict(o2_strict);
+
+delete slow.x;
+// Directly setting x should fail.
+o3.x = 20
+assertEquals(5, o3.x);
+
+// Setting x through IC should fail.
+s(o4);
+assertEquals(5, o4.x);
+assertThrows("s_strict(o4);", TypeError);
diff --git a/deps/v8/test/mjsunit/regress/regress-105.js b/deps/v8/test/mjsunit/regress/regress-105.js
new file mode 100644
index 0000000000..9a4d5c4744
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-105.js
@@ -0,0 +1,44 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var custom_valueOf = function() {
+  assertEquals(Number, custom_valueOf.caller);
+  return 2;
+}
+
+var custom_toString = function() {
+  assertEquals(String, custom_toString.caller);
+  return "I used to be an adventurer like you";
+}
+
+var object = {};
+object.valueOf = custom_valueOf;
+object.toString = custom_toString;
+
+assertEquals(2, Number(object));
+assertEquals('I', String(object)[0]);
+
diff --git a/deps/v8/test/mjsunit/regress/regress-166379.js b/deps/v8/test/mjsunit/regress/regress-166379.js
index 2cda61182b..b19afbdde6 100644
--- a/deps/v8/test/mjsunit/regress/regress-166379.js
+++ b/deps/v8/test/mjsunit/regress/regress-166379.js
@@ -36,3 +36,4 @@ assertEquals(1, mod(3, 2));
 
 // Surprise mod with overflow.
 assertEquals(-Infinity, 1/mod(-2147483648, -1));
+
diff --git a/deps/v8/test/mjsunit/regress/regress-201590.js b/deps/v8/test/mjsunit/regress/regress-201590.js
new file mode 100644
index 0000000000..0e7ba57233
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-201590.js
@@ -0,0 +1,66 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var gdpRatio = 16/9;
+
+function Foo(initialX, initialY, initialScale, initialMapHeight) {
+  this.ORIGIN = { x: initialX, y: initialY };
+  this.scale = initialScale;
+  this.mapHeight = initialMapHeight;
+}
+
+Foo.prototype.bar = function (x, y, xOffset, yOffset) {
+  var tileHeight =  64 * 0.25 * this.scale,
+  tileWidth  = 128 * 0.25 * this.scale,
+  xOffset    = xOffset * 0.5 || 0,
+  yOffset    = yOffset * 0.5 || 0;
+  var xPos = ((xOffset) * gdpRatio) + this.ORIGIN.x * this.scale -
+      ((y * tileWidth ) * gdpRatio) + ((x * tileWidth ) * gdpRatio);
+  var yPos = ((yOffset) * gdpRatio) + this.ORIGIN.y * this.scale +
+      ((y * tileHeight) * gdpRatio) + ((x * tileHeight) * gdpRatio);
+  xPos = xPos - Math.round(((tileWidth) * gdpRatio)) +
+      this.mapHeight * Math.round(((tileWidth) * gdpRatio));
+  return {
+      x: Math.floor(xPos),
+      y: Math.floor(yPos)
+  };
+}
+
+var f = new Foo(10, 20, 2.5, 400);
+
+function baz() {
+  var b = f.bar(1.1, 2.2, 3.3, 4.4);
+  assertEquals(56529, b.x);
+  assertEquals(288, b.y);
+}
+
+baz();
+baz();
+%OptimizeFunctionOnNextCall(Foo.prototype.bar);
+baz();
diff --git a/deps/v8/test/mjsunit/regress/regress-2374.js b/deps/v8/test/mjsunit/regress/regress-2374.js
index b12e5f28c2..b333720ac0 100644
--- a/deps/v8/test/mjsunit/regress/regress-2374.js
+++ b/deps/v8/test/mjsunit/regress/regress-2374.js
@@ -31,3 +31,4 @@ var obj = JSON.parse(msg);
 var obj2 = JSON.parse(msg);
 
 assertEquals(JSON.stringify(obj), JSON.stringify(obj2));
+assertEquals(JSON.stringify(obj, null, 0), JSON.stringify(obj2));
\ No newline at end of file
diff --git a/deps/v8/test/mjsunit/regress/regress-2419.js b/deps/v8/test/mjsunit/regress/regress-2419.js
index 4ffafbe6eb..9cd453a58e 100644
--- a/deps/v8/test/mjsunit/regress/regress-2419.js
+++ b/deps/v8/test/mjsunit/regress/regress-2419.js
@@ -34,3 +34,4 @@ var b = {0: 5, 1: 4, 2: 3, 3: 2, 4: 1, 5: 0, length: 6};
 Object.freeze(b);
 Array.prototype.sort.call(b);
 assertPropertiesEqual({0: 5, 1: 4, 2: 3, 3: 2, 4: 1, 5: 0, length: 6}, b);
+
diff --git a/deps/v8/test/mjsunit/regress/regress-2438.js b/deps/v8/test/mjsunit/regress/regress-2438.js
index 7be7e71687..3f4fd7df57 100644
--- a/deps/v8/test/mjsunit/regress/regress-2438.js
+++ b/deps/v8/test/mjsunit/regress/regress-2438.js
@@ -49,3 +49,4 @@ testSideEffects("zzzz", /a/);
 testSideEffects("zzzz", /a/g);
 testSideEffects("xaxa", /a/);
 testSideEffects("xaxa", /a/g);
+
diff --git a/deps/v8/test/mjsunit/regress/regress-2444.js b/deps/v8/test/mjsunit/regress/regress-2444.js
index 41b6a95e7a..8fb8d8b52e 100644
--- a/deps/v8/test/mjsunit/regress/regress-2444.js
+++ b/deps/v8/test/mjsunit/regress/regress-2444.js
@@ -116,3 +116,5 @@ assertEquals(0,
                       object_factory(1,   0, [1, 0, 0]),
                       object_factory(2,   1, [1, 1, 0])));
 assertFlags([1, 1, 1]);
+
+
diff --git a/deps/v8/test/mjsunit/regress/regress-2451.js b/deps/v8/test/mjsunit/regress/regress-2451.js
index cc087e75e9..465e4e68c2 100644
--- a/deps/v8/test/mjsunit/regress/regress-2451.js
+++ b/deps/v8/test/mjsunit/regress/regress-2451.js
@@ -38,3 +38,4 @@ f();
 %OptimizeFunctionOnNextCall(f);
 f();
 assertTrue(%GetOptimizationStatus(f) != 2);
+
diff --git a/deps/v8/test/mjsunit/regress/regress-2564.js b/deps/v8/test/mjsunit/regress/regress-2564.js
new file mode 100644
index 0000000000..1d7cdaeaea
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-2564.js
@@ -0,0 +1,122 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var o = [ function f0() { throw new Error(); },
+          function f1() { o[0](); },
+          function f2() { o[1](); },
+          function f3() { o[2](); } ];
+
+Error.prepareStackTrace = function(error, frames) {
+  Error.prepareStackTrace = undefined;  // Prevent recursion.
+  try {
+    assertEquals(5, frames.length);
+    // Don't check the last frame since that's the top-level code.
+    for (var i = 0; i < frames.length - 1; i++) {
+      assertEquals(o[i], frames[i].getFunction());
+      assertEquals(o, frames[i].getThis());
+      // Private fields are no longer accessible.
+      assertEquals(undefined, frames[i].receiver);
+      assertEquals(undefined, frames[i].fun);
+      assertEquals(undefined, frames[i].pos);
+    }
+    return "success";
+  } catch (e) {
+    return "fail";
+  }
+}
+
+try {
+  o[3]();
+} catch (e) {
+  assertEquals("success", e.stack);
+};
+
+
+var o = [ function f0() { throw new Error(); },
+          function f1() { o[0](); },
+          function f2() { "use strict"; o[1](); },
+          function f3() { o[2](); } ];
+
+Error.prepareStackTrace = function(error, frames) {
+  Error.prepareStackTrace = undefined;  // Prevent recursion.
+  try {
+    assertEquals(5, frames.length);
+    for (var i = 0; i < 2; i++) {
+      // The first two frames are still classic mode.
+      assertEquals(o[i], frames[i].getFunction());
+      assertEquals(o, frames[i].getThis());
+    }
+    for (var i = 2; i < frames.length; i++) {
+      // The rest are poisoned by the first strict mode function.
+      assertEquals(undefined, frames[i].getFunction());
+      assertEquals(undefined, frames[i].getThis());
+    }
+    for (var i = 0; i < frames.length - 1; i++) {
+      // Function name remains accessible.
+      assertEquals("f"+i, frames[i].getFunctionName());
+    }
+    return "success";
+  } catch (e) {
+    return e;
+  }
+}
+
+try {
+  o[3]();
+} catch (e) {
+  assertEquals("success", e.stack);
+};
+
+
+var o = [ function f0() { "use strict"; throw new Error(); },
+          function f1() { o[0](); },
+          function f2() { o[1](); },
+          function f3() { o[2](); } ];
+
+Error.prepareStackTrace = function(error, frames) {
+  Error.prepareStackTrace = undefined;  // Prevent recursion.
+  try {
+    assertEquals(5, frames.length);
+    for (var i = 0; i < frames.length; i++) {
+      // The rest are poisoned by the first strict mode function.
+      assertEquals(undefined, frames[i].getFunction());
+      assertEquals(undefined, frames[i].getThis());
+      if (i < frames.length - 1) {  // Function name remains accessible.
+        assertEquals("f"+i, frames[i].getFunctionName());
+      }
+    }
+    return "success";
+  } catch (e) {
+    return e;
+  }
+}
+
+try {
+  o[3]();
+} catch (e) {
+  assertEquals("success", e.stack);
+};
diff --git a/deps/v8/test/mjsunit/regress/regress-2570.js b/deps/v8/test/mjsunit/regress/regress-2570.js
index f9060e8c07..4e32a21e4b 100644
--- a/deps/v8/test/mjsunit/regress/regress-2570.js
+++ b/deps/v8/test/mjsunit/regress/regress-2570.js
@@ -29,3 +29,4 @@ var o = ["\u56e7",   // Switch JSON stringifier to two-byte mode.
          "\u00e6"];  // Latin-1 character.
 
 assertEquals('["\u56e7","\u00e6"]', JSON.stringify(o));
+assertEquals('["\u56e7","\u00e6"]', JSON.stringify(o, null, 0));
\ No newline at end of file
diff --git a/deps/v8/test/mjsunit/regress/regress-2593.js b/deps/v8/test/mjsunit/regress/regress-2593.js
new file mode 100644
index 0000000000..b51b41c27e
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-2593.js
@@ -0,0 +1,61 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose_gc
+
+p1 =  { };
+p2 =  { };
+p3 =  { x : 1 };
+p2.__proto__ = p3
+p1.__proto__ = p2
+
+// Normalize p1.
+p1.z = 1
+delete p1.z
+
+// Make sure all objects are in old space.
+for (var i = 0; i < 10; i++) gc();
+
+function f2() {
+  p2.x;
+}
+
+function f1() {
+  return p1.x;
+}
+
+// Create load stub in p2.
+for (var i = 0; i < 10; i++) f2();
+
+// Create load stub in p2 for p1.
+for (var i = 0; i < 10; i++) f1();
+
+assertEquals(1, f1());
+
+p2.x = 2;
+
+assertEquals(2, f1());
diff --git a/deps/v8/test/mjsunit/regress/regress-2596.js b/deps/v8/test/mjsunit/regress/regress-2596.js
new file mode 100644
index 0000000000..1d327fe0f8
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-2596.js
@@ -0,0 +1,56 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var bytes = new Uint8Array([
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f]);  // kHoleNaN
+var doubles = new Float64Array(bytes.buffer);
+assertTrue(isNaN(doubles[0]));
+
+var prototype = [2.5, 2.5];
+var array = [3.5, 3.5];
+array.__proto__ = prototype;
+assertTrue(%HasFastDoubleElements(array));
+
+function boom(index) {
+  array[index] = doubles[0];
+  return array[index];
+}
+
+assertTrue(isNaN(boom(0)));
+assertTrue(isNaN(boom(0)));
+assertTrue(isNaN(boom(0)));
+
+// Test hydrogen
+%OptimizeFunctionOnNextCall(boom);
+assertTrue(isNaN(boom(0)));
+assertTrue(isNaN(boom(0)));
+assertTrue(isNaN(boom(0)));
+
+
+
diff --git a/deps/v8/test/mjsunit/regress/regress-753.js b/deps/v8/test/mjsunit/regress/regress-753.js
index 6a6d87bb0e..4621de6ba4 100644
--- a/deps/v8/test/mjsunit/regress/regress-753.js
+++ b/deps/v8/test/mjsunit/regress/regress-753.js
@@ -32,5 +32,5 @@
 // See: http://code.google.com/p/v8/issues/detail?id=753
 
 var obj = {a1: {b1: [1,2,3,4], b2: {c1: 1, c2: 2}},a2: 'a2'};
-assertEquals(JSON.stringify(obj,null, 5.99999), JSON.stringify(obj,null, 5));
+assertEquals(JSON.stringify(obj, null, 5.99999), JSON.stringify(obj, null, 5));
 
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-146910.js b/deps/v8/test/mjsunit/regress/regress-crbug-146910.js
index 1b2a60af7f..120f809731 100644
--- a/deps/v8/test/mjsunit/regress/regress-crbug-146910.js
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-146910.js
@@ -1,4 +1,4 @@
-// Copyright 2013 the V8 project authors. All rights reserved.
+// Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
@@ -25,9 +25,14 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-assertEquals(String.fromCharCode(97, 220, 256), 'a' + '\u00DC' + '\u0100');
-assertEquals(String.fromCharCode(97, 220, 256), 'a\u00DC\u0100');
+var x = [];
+assertSame(0, x.length);
+assertSame(undefined, x[0]);
 
-assertEquals(['a', 'b', '\xdc'], ['b', '\xdc', 'a'].sort());
-assertEquals(['\xfc\xdc', '\xfc'], new RegExp('(\xdc)\\1', 'i').exec('\xfc\xdc'));
+Object.defineProperty(x, '0', { value: 7, configurable: false });
+assertSame(1, x.length);
+assertSame(7, x[0]);
 
+x.length = 0;
+assertSame(1, x.length);
+assertSame(7, x[0]);
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-158185.js b/deps/v8/test/mjsunit/regress/regress-crbug-158185.js
index 5cb5900c8a..99f19c72fd 100644
--- a/deps/v8/test/mjsunit/regress/regress-crbug-158185.js
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-158185.js
@@ -36,3 +36,4 @@ assertEquals("12A",
 
 assertEquals(1, JSON.parse('{"0":1}')[0]);
 assertEquals(undefined, JSON.parse('{"00":1}')[0]);
+
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-171715.js b/deps/v8/test/mjsunit/regress/regress-crbug-171715.js
new file mode 100644
index 0000000000..040c381e39
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-171715.js
@@ -0,0 +1,87 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-debug-as debug
+
+Debug = debug.Debug
+
+var error = null;
+var test = 0;
+
+function check_v(expected, exec_state, frame_id) {
+  assertEquals(expected, exec_state.frame(frame_id).evaluate('v').value());
+}
+
+function listener(event, exec_state, event_data, data) {
+  try {
+    if (event != Debug.DebugEvent.Break) return;
+    test++;
+    if (test == 1) {
+      check_v('inner0', exec_state, 0);
+      check_v('inner0', exec_state, 1);
+      check_v('outer',  exec_state, 2);
+      assertArrayEquals(["a", "b", "c"],
+                        exec_state.frame(0).evaluate('arguments').value());
+    } else if (test == 2) {
+      check_v('inner1', exec_state, 0);
+      check_v('inner1', exec_state, 1);
+      check_v('outer',  exec_state, 2);
+      assertArrayEquals(["a", "b", "c"],
+                        exec_state.frame(0).evaluate('arguments').value());
+    } else {
+      assertEquals(3, test);
+      check_v('inner2', exec_state, 0);
+      check_v('inner1', exec_state, 1);
+      check_v('inner1', exec_state, 2);
+      check_v('outer',  exec_state, 3);
+      assertArrayEquals(["x", "y", "z"],
+                        exec_state.frame(0).evaluate('arguments').value());
+      assertArrayEquals(["a", "b", "c"],
+                        exec_state.frame(1).evaluate('arguments').value());
+    }
+  } catch (e) {
+    error = e;
+  }
+};
+
+Debug.setListener(listener);
+
+var v = 'outer';
+(function() {  // Test 1 and 2
+  var v = 'inner0';
+  eval("debugger; var v = 'inner1'; debugger;");
+  assertEquals('inner1', v);  // Overwritten by local eval.
+})("a", "b", "c");
+assertNull(error);
+
+(function() {  // Test 3
+  var v = 'inner0';  // Local eval overwrites this value.
+  eval("var v = 'inner1'; " +
+       "(function() { var v = 'inner2'; debugger; })('x', 'y', 'z');");
+  assertEquals('inner1', v);  // Overwritten by local eval.
+})("a", "b", "c");
+assertNull(error);
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-178790.js b/deps/v8/test/mjsunit/regress/regress-crbug-178790.js
index 25cc96b852..57071eaa08 100644
--- a/deps/v8/test/mjsunit/regress/regress-crbug-178790.js
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-178790.js
@@ -49,3 +49,4 @@ for (var i = 0; i < 1000; i++) {
   r3 = "(" + r3 + ")a";
 }
 "test".match(RegExp(r3));
+
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-217858.js b/deps/v8/test/mjsunit/regress/regress-crbug-217858.js
new file mode 100644
index 0000000000..8563e07eee
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-217858.js
@@ -0,0 +1,40 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var r = /r/;
+var a = "";
+function f() {
+  %OptimizeFunctionOnNextCall(f, "osr");
+  for (var i = 0; i < 1000000; i++) {
+    a += i.toString();
+    r[r] = function() {};
+  }
+}
+
+f();
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-222893.js b/deps/v8/test/mjsunit/regress/regress-crbug-222893.js
new file mode 100644
index 0000000000..d5baa7b257
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-222893.js
@@ -0,0 +1,64 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-debug-as debug
+
+Debug = debug.Debug
+
+var error = null;
+var array = ["a", "b", "c"];
+
+function listener(event, exec_state, event_data, data) {
+  try {
+    if (event == Debug.DebugEvent.Break) {
+      assertArrayEquals(array,
+                        exec_state.frame(0).evaluate('arguments').value());
+    }
+  } catch (e) {
+    error = e;
+  }
+};
+
+Debug.setListener(listener);
+
+
+function f(a, b) {
+  arguments;
+  debugger;  // Arguments object is already materialized.
+}
+
+f.apply(this, array);
+f("a", "b", "c");
+assertNull(error);
+
+function g(a, b) {
+  debugger;  // Arguments object is not yet materialized.
+}
+g.apply(this, array);
+g("a", "b", "c");
+assertNull(error);
+
diff --git a/deps/v8/test/mjsunit/regress/regress-json-stringify-gc.js b/deps/v8/test/mjsunit/regress/regress-json-stringify-gc.js
index 46c3dbf126..c0a71bf4a1 100644
--- a/deps/v8/test/mjsunit/regress/regress-json-stringify-gc.js
+++ b/deps/v8/test/mjsunit/regress/regress-json-stringify-gc.js
@@ -38,3 +38,4 @@ for (var i = 0; i < 10000; i++) a.push(new_space_string);
 json1 = JSON.stringify(a);
 json2 = JSON.stringify(a);
 assertTrue(json1 == json2, "GC caused JSON.stringify to fail.");
+
diff --git a/deps/v8/test/mjsunit/regress/regress-latin-1.js b/deps/v8/test/mjsunit/regress/regress-latin-1.js
index a988ebd36e..e7f31366c1 100644
--- a/deps/v8/test/mjsunit/regress/regress-latin-1.js
+++ b/deps/v8/test/mjsunit/regress/regress-latin-1.js
@@ -29,6 +29,7 @@ assertEquals(String.fromCharCode(97, 220, 256), 'a' + '\u00DC' + '\u0100');
 assertEquals(String.fromCharCode(97, 220, 256), 'a\u00DC\u0100');
 
 assertEquals(0x80, JSON.stringify("\x80").charCodeAt(1));
+assertEquals(0x80, JSON.stringify("\x80", 0, null).charCodeAt(1));
 
 assertEquals(['a', 'b', '\xdc'], ['b', '\xdc', 'a'].sort());
 
diff --git a/deps/v8/test/mjsunit/regress/setter.js b/deps/v8/test/mjsunit/regress/setter.js
new file mode 100644
index 0000000000..e3a8000f2b
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/setter.js
@@ -0,0 +1,66 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function s(v) {
+  v.x = 1;
+}
+
+function c(p) {
+  return {__proto__: p};
+}
+
+var p = {};
+
+var o1 = c(p);
+var o2 = c(p);
+var o3 = c(p);
+var o4 = c(p);
+var o5 = c(p);
+
+// Initialize the store IC.
+s(o1);
+s(o2);
+
+// Install a setter on p.x
+var count = 0;
+Object.defineProperty(p, "x", {
+  set: function(x) {
+    count += 1;
+  }
+});
+
+// Verify that the setter was called directly.
+o3.x = 20;
+assertEquals(1, count);
+
+// Verify that monomorphic prototype failure is triggered in the IC.
+s(o4);
+assertEquals(2, count);
+
+// Verify that the newly installed IC is correct.
+s(o5);
+assertEquals(3, count);