deps: update v8 to 3.29.93.1

45 files changed, 856 insertions, 14 deletions

diff --git a/deps/v8/test/mjsunit/regress/poly_count_operation.js b/deps/v8/test/mjsunit/regress/poly_count_operation.js
index a8a1ed2ebc..99f041b6f1 100644
--- a/deps/v8/test/mjsunit/regress/poly_count_operation.js
+++ b/deps/v8/test/mjsunit/regress/poly_count_operation.js
@@ -25,7 +25,7 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --allow-natives-syntax
+// Flags: --allow-natives-syntax --turbo-deoptimization
 
 var o1 = {x:1};
 var o2 = {};
diff --git a/deps/v8/test/mjsunit/regress/regress-1170187.js b/deps/v8/test/mjsunit/regress/regress-1170187.js
index 5e82f8a83b..3621bc44a8 100644
--- a/deps/v8/test/mjsunit/regress/regress-1170187.js
+++ b/deps/v8/test/mjsunit/regress/regress-1170187.js
@@ -26,6 +26,8 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 // Flags: --expose-debug-as debug
+// Flags: --turbo-deoptimization
+
 // Make sure that the retreival of local variables are performed correctly even
 // when an adapter frame is present.
 
diff --git a/deps/v8/test/mjsunit/regress/regress-119609.js b/deps/v8/test/mjsunit/regress/regress-119609.js
index 99041adaf4..0c85063ac7 100644
--- a/deps/v8/test/mjsunit/regress/regress-119609.js
+++ b/deps/v8/test/mjsunit/regress/regress-119609.js
@@ -26,6 +26,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 // Flags: --expose-debug-as debug
+// Flags: --turbo-deoptimization
 
 Debug = debug.Debug;
 
diff --git a/deps/v8/test/mjsunit/regress/regress-131994.js b/deps/v8/test/mjsunit/regress/regress-131994.js
index 7f600959da..3de3813eac 100644
--- a/deps/v8/test/mjsunit/regress/regress-131994.js
+++ b/deps/v8/test/mjsunit/regress/regress-131994.js
@@ -26,6 +26,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 // Flags: --expose-debug-as debug
+// Flags: --turbo-deoptimization
 
 // Test that a variable in the local scope that shadows a context-allocated
 // variable is correctly resolved when being evaluated in the debugger.
diff --git a/deps/v8/test/mjsunit/regress/regress-325676.js b/deps/v8/test/mjsunit/regress/regress-325676.js
index 427bbc38dc..7450a6d12c 100644
--- a/deps/v8/test/mjsunit/regress/regress-325676.js
+++ b/deps/v8/test/mjsunit/regress/regress-325676.js
@@ -26,6 +26,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 // Flags: --expose-debug-as debug
+// Flags: --turbo-deoptimization
 
 // If a function parameter is forced to be context allocated,
 // debug evaluate need to resolve it to a context slot instead of
diff --git a/deps/v8/test/mjsunit/regress/regress-3564.js b/deps/v8/test/mjsunit/regress/regress-3564.js
new file mode 100644
index 0000000000..a0b9eb2994
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-3564.js
@@ -0,0 +1,24 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function MyWrapper(v) {
+  return { valueOf: function() { return v } };
+}
+
+function f() {
+  assertTrue("a" < "x");
+  assertTrue("a" < new String("y"));
+  assertTrue("a" < new MyWrapper("z"));
+
+  assertFalse("a" > "x");
+  assertFalse("a" > new String("y"));
+  assertFalse("a" > new MyWrapper("z"));
+}
+
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+f();
diff --git a/deps/v8/test/mjsunit/regress/regress-403292.js b/deps/v8/test/mjsunit/regress/regress-403292.js
new file mode 100644
index 0000000000..4e7ba283f7
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-403292.js
@@ -0,0 +1,53 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --expose-natives-as=builtins --expose-gc
+
+var __v_7 = [];
+var __v_8 = {};
+var __v_10 = {};
+var __v_11 = this;
+var __v_12 = {};
+var __v_13 = {};
+var __v_14 = "";
+var __v_15 = {};
+try {
+__v_1 = {x:0};
+%OptimizeFunctionOnNextCall(__f_1);
+assertEquals("good", __f_1());
+delete __v_1.x;
+assertEquals("good", __f_1());
+} catch(e) { print("Caught: " + e); }
+try {
+__v_3 = new Set();
+__v_5 = new builtins.SetIterator(__v_3, -12);
+__v_4 = new Map();
+__v_6 = new builtins.MapIterator(__v_4, 2);
+__f_3(Array);
+} catch(e) { print("Caught: " + e); }
+function __f_4(__v_8, filter) {
+  function __f_6(v) {
+    for (var __v_4 in v) {
+      for (var __v_4 in v) {}
+    }
+    %OptimizeFunctionOnNextCall(filter);
+    return filter(v);
+  }
+  var __v_7 = eval(__v_8);
+  gc();
+  return __f_6(__v_7);
+}
+function __f_5(__v_6) {
+  var __v_5 = new Array(__v_6);
+  for (var __v_4 = 0; __v_4 < __v_6; __v_4++) __v_5.push('{}');
+  return __v_5;
+}
+try {
+try {
+  __v_8.test("\x80");
+  assertUnreachable();
+} catch (e) {
+}
+gc();
+} catch(e) { print("Caught: " + e); }
diff --git a/deps/v8/test/mjsunit/regress/regress-404981.js b/deps/v8/test/mjsunit/regress/regress-404981.js
new file mode 100644
index 0000000000..5508d6fea7
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-404981.js
@@ -0,0 +1,6 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var large_object = new Array(5000001);
+large_object.length = 23;
diff --git a/deps/v8/test/mjsunit/regress/regress-408036.js b/deps/v8/test/mjsunit/regress/regress-408036.js
new file mode 100644
index 0000000000..a4dfade25d
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-408036.js
@@ -0,0 +1,5 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-natives-as 1
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-387627.js b/deps/v8/test/mjsunit/regress/regress-409533.js
index 5c6389b5f1..e51065e4bf 100644
--- a/deps/v8/test/mjsunit/regress/regress-crbug-387627.js
+++ b/deps/v8/test/mjsunit/regress/regress-409533.js
@@ -4,9 +4,9 @@
 
 // Flags: --allow-natives-syntax
 
-function f() {}
-%FunctionBindArguments(f, {}, undefined, 1);
-
+function f() {
+  %_RegExpConstructResult(0, {}, {});
+}
 f();
 f();
 %OptimizeFunctionOnNextCall(f);
diff --git a/deps/v8/test/mjsunit/regress/regress-410912.js b/deps/v8/test/mjsunit/regress/regress-410912.js
new file mode 100644
index 0000000000..98367bdf20
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-410912.js
@@ -0,0 +1,206 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --expose-gc
+
+var assertDoesNotThrow;
+var assertInstanceof;
+var assertUnreachable;
+var assertOptimized;
+var assertUnoptimized;
+function classOf(object) { var string = Object.prototype.toString.call(object); return string.substring(8, string.length - 1); }
+function PrettyPrint(value) { return ""; }
+function PrettyPrintArrayElement(value, index, array) { return ""; }
+function fail(expectedText, found, name_opt) { }
+function deepObjectEquals(a, b) { var aProps = Object.keys(a); aProps.sort(); var bProps = Object.keys(b); bProps.sort(); if (!deepEquals(aProps, bProps)) { return false; } for (var i = 0; i < aProps.length; i++) { if (!deepEquals(a[aProps[i]], b[aProps[i]])) { return false; } } return true; }
+function deepEquals(a, b) { if (a === b) { if (a === 0) return (1 / a) === (1 / b); return true; } if (typeof a != typeof b) return false; if (typeof a == "number") return isNaN(a) && isNaN(b); if (typeof a !== "object" && typeof a !== "function") return false; var objectClass = classOf(a); if (objectClass !== classOf(b)) return false; if (objectClass === "RegExp") { return (a.toString() === b.toString()); } if (objectClass === "Function") return false; if (objectClass === "Array") { var elementCount = 0; if (a.length != b.length) { return false; } for (var i = 0; i < a.length; i++) { if (!deepEquals(a[i], b[i])) return false; } return true; } if (objectClass == "String" || objectClass == "Number" || objectClass == "Boolean" || objectClass == "Date") { if (a.valueOf() !== b.valueOf()) return false; } return deepObjectEquals(a, b); }
+assertSame = function assertSame(expected, found, name_opt) { if (found === expected) { if (expected !== 0 || (1 / expected) == (1 / found)) return; } else if ((expected !== expected) && (found !== found)) { return; } fail(PrettyPrint(expected), found, name_opt); }; assertEquals = function assertEquals(expected, found, name_opt) { if (!deepEquals(found, expected)) { fail(PrettyPrint(expected), found, name_opt); } };
+assertEqualsDelta = function assertEqualsDelta(expected, found, delta, name_opt) { assertTrue(Math.abs(expected - found) <= delta, name_opt); };
+assertArrayEquals = function assertArrayEquals(expected, found, name_opt) { var start = ""; if (name_opt) { start = name_opt + " - "; } assertEquals(expected.length, found.length, start + "array length"); if (expected.length == found.length) { for (var i = 0; i < expected.length; ++i) { assertEquals(expected[i], found[i], start + "array element at index " + i); } } };
+assertPropertiesEqual = function assertPropertiesEqual(expected, found, name_opt) { if (!deepObjectEquals(expected, found)) { fail(expected, found, name_opt); } };
+assertToStringEquals = function assertToStringEquals(expected, found, name_opt) { if (expected != String(found)) { fail(expected, found, name_opt); } };
+assertTrue = function assertTrue(value, name_opt) { assertEquals(true, value, name_opt); };
+assertFalse = function assertFalse(value, name_opt) { assertEquals(false, value, name_opt); };
+assertNull = function assertNull(value, name_opt) { if (value !== null) { fail("null", value, name_opt); } };
+assertNotNull = function assertNotNull(value, name_opt) { if (value === null) { fail("not null", value, name_opt); } };
+var __v_39 = {};
+var __v_40 = {};
+var __v_41 = {};
+var __v_42 = {};
+var __v_43 = {};
+var __v_44 = {};
+try {
+__v_0 = [1.5,,1.7];
+__v_1 = {__v_0:1.8};
+} catch(e) { print("Caught: " + e); }
+function __f_0(__v_1,__v_0,i) {
+  __v_1.a = __v_0[i];
+  gc();
+}
+try {
+__f_0(__v_1,__v_0,0);
+__f_0(__v_1,__v_0,0);
+%OptimizeFunctionOnNextCall(__f_0);
+__f_0(__v_1,__v_0,1);
+assertEquals(undefined, __v_1.a);
+__v_0 = [1,,3];
+__v_1 = {ab:5};
+} catch(e) { print("Caught: " + e); }
+function __f_1(__v_1,__v_0,i) {
+  __v_1.ab = __v_0[i];
+}
+try {
+__f_1(__v_1,__v_0,1);
+} catch(e) { print("Caught: " + e); }
+function __f_5(x) {
+  return ~x;
+}
+try {
+__f_5(42);
+assertEquals(~12, __f_5(12.45));
+assertEquals(~46, __f_5(42.87));
+__v_2 = 1, __v_4 = 2, __v_3 = 4, __v_6 = 8;
+} catch(e) { print("Caught: " + e); }
+function __f_4() {
+  return __v_2 | (__v_4 | (__v_3 | __v_6));
+}
+try {
+__f_4();
+__v_3 = "16";
+assertEquals(17 | -13 | 0 | -5, __f_4());
+} catch(e) { print("Caught: " + e); }
+function __f_6() {
+  return __f_4();
+}
+try {
+assertEquals(1 | 2 | 16 | 8, __f_6());
+__f_4 = function() { return 42; };
+assertEquals(42, __f_6());
+__v_5 = {};
+__v_5.__f_4 = __f_4;
+} catch(e) { print("Caught: " + e); }
+function __f_7(o) {
+  return o.__f_4();
+}
+try {
+for (var __v_7 = 0; __v_7 < 5; __v_7++) __f_7(__v_5);
+%OptimizeFunctionOnNextCall(__f_7);
+__f_7(__v_5);
+assertEquals(42, __f_7(__v_5));
+assertEquals(87, __f_7({__f_4: function() { return 87; }}));
+} catch(e) { print("Caught: " + e); }
+function __f_8(x,y) {
+  x = 42;
+  y = 1;
+  y = y << "0";
+  return x | y;
+}
+try {
+assertEquals(43, __f_8(0,0));
+} catch(e) { print("Caught: " + e); }
+function __f_2(x) {
+  return 'lit[' + (x + ']');
+}
+try {
+assertEquals('lit[-87]', __f_2(-87));
+assertEquals('lit[0]', __f_2(0));
+assertEquals('lit[42]', __f_2(42));
+__v_9 = "abc";
+gc();
+var __v_8;
+} catch(e) { print("Caught: " + e); }
+function __f_9(n) { return __v_9.charAt(n); }
+try {
+for (var __v_7 = 0; __v_7 < 5; __v_7++) {
+  __v_8 = __f_9(0);
+}
+%OptimizeFunctionOnNextCall(__f_9);
+__v_8 = __f_9(0);
+} catch(e) { print("Caught: " + e); }
+function __f_3(__v_2,__v_4,__v_3,__v_6) {
+  return __v_2+__v_4+__v_3+__v_6;
+}
+try {
+assertEquals(0x40000003, __f_3(1,1,2,0x3fffffff));
+} catch(e) { print("Caught: " + e); }
+try {
+__v_19 = {
+  fast_smi_only             :  'fast smi only elements',
+  fast                      :  'fast elements',
+  fast_double               :  'fast double elements',
+  dictionary                :  'dictionary elements',
+  external_int32            :  'external int8 elements',
+  external_uint8            :  'external uint8 elements',
+  external_int16            :  'external int16 elements',
+  external_uint16           :  'external uint16 elements',
+  external_int32            :  'external int32 elements',
+  external_uint32           :  'external uint32 elements',
+  external_float32          :  'external float32 elements',
+  external_float64          :  'external float64 elements',
+  external_uint8_clamped    :  'external uint8_clamped elements',
+  fixed_int32               :  'fixed int8 elements',
+  fixed_uint8               :  'fixed uint8 elements',
+  fixed_int16               :  'fixed int16 elements',
+  fixed_uint16              :  'fixed uint16 elements',
+  fixed_int32               :  'fixed int32 elements',
+  fixed_uint32              :  'fixed uint32 elements',
+  fixed_float32             :  'fixed float32 elements',
+  fixed_float64             :  'fixed float64 elements',
+  fixed_uint8_clamped       :  'fixed uint8_clamped elements'
+}
+} catch(e) { print("Caught: " + e); }
+function __f_12() {
+}
+__v_10 = {};
+__v_10.dance = 0xD15C0;
+__v_10.drink = 0xC0C0A;
+__f_12(__v_19.fast, __v_10);
+__v_24 = [1,2,3];
+__f_12(__v_19.fast_smi_only, __v_24);
+__v_24.dance = 0xD15C0;
+__v_24.drink = 0xC0C0A;
+__f_12(__v_19.fast_smi_only, __v_24);
+function __f_18() {
+  var __v_27 = new Array();
+  __f_12(__v_19.fast_smi_only, __v_27);
+  for (var __v_18 = 0; __v_18 < 1337; __v_18++) {
+    var __v_16 = __v_18;
+    if (__v_18 == 1336) {
+      __f_12(__v_19.fast_smi_only, __v_27);
+      __v_16 = new Object();
+    }
+    __v_27[__v_18] = __v_16;
+  }
+  __f_12(__v_19.fast, __v_27);
+  var __v_15 = [];
+  __v_15[912570] = 7;
+  __f_12(__v_19.dictionary, __v_15);
+  var __v_26 = new Array(912561);
+  %SetAllocationTimeout(100000000, 10000000);
+  for (var __v_18 = 0; __v_18 < 0x20000; __v_18++) {
+    __v_26[0] = __v_18 / 2;
+  }
+  __f_12(__v_19.fixed_int8,    new Int8Array(007));
+  __f_12(__v_19.fixed_uint8,   new Uint8Array(007));
+  __f_12(__v_19.fixed_int16,   new Int16Array(666));
+  __f_12(__v_19.fixed_uint16,  new Uint16Array(42));
+  __f_12(__v_19.fixed_int32,   new Int32Array(0xF));
+  __f_12(__v_19.fixed_uint32,  new Uint32Array(23));
+  __f_12(__v_19.fixed_float32, new Float32Array(7));
+  __f_12(__v_19.fixed_float64, new Float64Array(0));
+  __f_12(__v_19.fixed_uint8_clamped, new Uint8ClampedArray(512));
+  var __v_13 = new ArrayBuffer(128);
+  __f_12(__v_19.external_int8,    new Int8Array(__v_13));
+  __f_12(__v_37.external_uint8,   new Uint8Array(__v_13));
+  __f_12(__v_19.external_int16,   new Int16Array(__v_13));
+  __f_12(__v_19.external_uint16,  new Uint16Array(__v_13));
+  __f_12(__v_19.external_int32,   new Int32Array(__v_13));
+  __f_12(__v_19.external_uint32,  new Uint32Array(__v_13));
+  __f_12(__v_19.external_float32, new Float32Array(__v_13));
+  __f_12(__v_19.external_float64, new Float64Array(__v_13));
+  __f_12(__v_19.external_uint8_clamped, new Uint8ClampedArray(__v_13));
+}
+try {
+__f_18();
+} catch(e) { }
diff --git a/deps/v8/test/mjsunit/regress/regress-411210.js b/deps/v8/test/mjsunit/regress/regress-411210.js
new file mode 100644
index 0000000000..2dbc5ff70c
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-411210.js
@@ -0,0 +1,22 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --gc-interval=439 --random-seed=-423594851
+
+var __v_3;
+function __f_2() {
+  var __v_1 = new Array(3);
+  __v_1[0] = 10;
+  __v_1[1] = 15.5;
+  __v_3 = __f_2();
+  __v_1[2] = 20;
+  return __v_1;
+}
+
+try {
+  for (var __v_2 = 0; __v_2 < 3; ++__v_2) {
+    __v_3 = __f_2();
+  }
+}
+catch (e) { }
diff --git a/deps/v8/test/mjsunit/regress/regress-411237.js b/deps/v8/test/mjsunit/regress/regress-411237.js
new file mode 100644
index 0000000000..8b75ba3015
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-411237.js
@@ -0,0 +1,15 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --harmony
+
+try {
+  %OptimizeFunctionOnNextCall(print);
+} catch(e) { }
+
+try {
+  function* f() {
+  }
+  %OptimizeFunctionOnNextCall(f);
+} catch(e) { }
diff --git a/deps/v8/test/mjsunit/regress/regress-412162.js b/deps/v8/test/mjsunit/regress/regress-412162.js
new file mode 100644
index 0000000000..6a7ad0c57f
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-412162.js
@@ -0,0 +1,14 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function test() {
+  Math.abs(-NaN).toString();
+}
+
+test();
+test();
+%OptimizeFunctionOnNextCall(test);
+test();
diff --git a/deps/v8/test/mjsunit/regress/regress-416416.js b/deps/v8/test/mjsunit/regress/regress-416416.js
new file mode 100644
index 0000000000..66e882e0fc
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-416416.js
@@ -0,0 +1,14 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function foo() {
+  try {
+    String.prototype.length.x();
+  } catch (e) {
+  }
+}
+
+foo();
+foo();
+foo();
diff --git a/deps/v8/test/mjsunit/regress/regress-416730.js b/deps/v8/test/mjsunit/regress/regress-416730.js
new file mode 100644
index 0000000000..8d7f207fd9
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-416730.js
@@ -0,0 +1,24 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var d = {x: undefined, y: undefined};
+
+function Crash(left, right) {
+  var c = {
+    x: right.x - left.x,
+    y: right.y - left.y
+  };
+  return c.x * c.y;
+}
+
+var a = {x: 0.5, y: 0};
+var b = {x: 1, y: 0};
+
+for (var i = 0; i < 3; i++) Crash(a, b);
+%OptimizeFunctionOnNextCall(Crash);
+Crash(a, b);
+
+Crash({x: 0, y: 0.5}, b);
diff --git a/deps/v8/test/mjsunit/regress/regress-conditional-position.js b/deps/v8/test/mjsunit/regress/regress-conditional-position.js
index cd8f7bd745..ae5a3acb58 100644
--- a/deps/v8/test/mjsunit/regress/regress-conditional-position.js
+++ b/deps/v8/test/mjsunit/regress/regress-conditional-position.js
@@ -25,7 +25,7 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --always-full-compiler
+// Flags: --nocrankshaft
 
 var functionToCatch;
 var lineNumber;
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-107996.js b/deps/v8/test/mjsunit/regress/regress-crbug-107996.js
index dfe07e59de..b4907f3bb8 100644
--- a/deps/v8/test/mjsunit/regress/regress-crbug-107996.js
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-107996.js
@@ -26,6 +26,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 // Flags: --expose-debug-as debug
+// Flags: --turbo-deoptimization
 
 Debug = debug.Debug;
 
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-171715.js b/deps/v8/test/mjsunit/regress/regress-crbug-171715.js
index 040c381e39..309f50a01b 100644
--- a/deps/v8/test/mjsunit/regress/regress-crbug-171715.js
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-171715.js
@@ -26,6 +26,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 // Flags: --expose-debug-as debug
+// Flags: --turbo-deoptimization
 
 Debug = debug.Debug
 
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-222893.js b/deps/v8/test/mjsunit/regress/regress-crbug-222893.js
index 39363bc912..75e17289fd 100644
--- a/deps/v8/test/mjsunit/regress/regress-crbug-222893.js
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-222893.js
@@ -26,6 +26,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 // Flags: --expose-debug-as debug
+// Flags: --turbo-deoptimization
 
 Debug = debug.Debug
 
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-320922.js b/deps/v8/test/mjsunit/regress/regress-crbug-320922.js
index 4a5b5813e0..9ba759a43e 100644
--- a/deps/v8/test/mjsunit/regress/regress-crbug-320922.js
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-320922.js
@@ -30,7 +30,7 @@
 var string = "hello world";
 var expected = "Hello " + "world";
 function Capitalize() {
-  %_OneByteSeqStringSetChar(string, 0, 0x48);
+  %_OneByteSeqStringSetChar(0, 0x48, string);
 }
 Capitalize();
 assertEquals(expected, string);
@@ -40,7 +40,7 @@ assertEquals(expected, string);
 var twobyte = "\u20ACello world";
 
 function TwoByteCapitalize() {
-  %_TwoByteSeqStringSetChar(twobyte, 0, 0x48);
+  %_TwoByteSeqStringSetChar(0, 0x48, twobyte);
 }
 TwoByteCapitalize();
 assertEquals(expected, twobyte);
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-323936.js b/deps/v8/test/mjsunit/regress/regress-crbug-323936.js
new file mode 100644
index 0000000000..d896eadcc4
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-323936.js
@@ -0,0 +1,46 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-debug-as debug
+
+Debug = debug.Debug;
+
+var step = 0;
+var exception = null;
+
+function listener(event, exec_state, event_data, data) {
+  if (event != Debug.DebugEvent.Break) return;
+  try {
+    if (step == 0) {
+      assertEquals("error", exec_state.frame(0).evaluate("e").value());
+      exec_state.frame(0).evaluate("e = 'foo'");
+      exec_state.frame(0).evaluate("x = 'modified'");
+    } else {
+      assertEquals("argument", exec_state.frame(0).evaluate("e").value());
+      exec_state.frame(0).evaluate("e = 'bar'");
+    }
+    step++;
+  } catch (e) {
+    print(e + e.stack);
+    exception = e;
+  }
+}
+
+Debug.setListener(listener);
+
+function f(e, x) {
+  try {
+    throw "error";
+  } catch(e) {
+    debugger;
+    assertEquals("foo", e);
+  }
+  debugger;
+  assertEquals("bar", e);
+  assertEquals("modified", x);
+}
+
+f("argument")
+assertNull(exception);
+assertEquals(2, step);
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-357052.js b/deps/v8/test/mjsunit/regress/regress-crbug-357052.js
index 9cde1b66c2..7a58396407 100644
--- a/deps/v8/test/mjsunit/regress/regress-crbug-357052.js
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-357052.js
@@ -7,5 +7,6 @@ function f() {
   for (var i = 0; i < 30; i++) {
     str += "abcdefgh12345678" + str;
   }
+  return str;
 }
 assertThrows(f);
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-403409.js b/deps/v8/test/mjsunit/regress/regress-crbug-403409.js
new file mode 100644
index 0000000000..ffd100b468
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-403409.js
@@ -0,0 +1,18 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+Array.prototype[0] = 777;
+var kElements = 10;
+
+var input_array = [];
+for (var i = 1; i < kElements; i++) {
+  input_array[i] = 0.5;
+}
+var output_array = input_array.concat(0.5);
+
+assertEquals(kElements + 1, output_array.length);
+assertEquals(777, output_array[0]);
+for (var j = 1; j < kElements; j++) {
+  assertEquals(0.5, output_array[j]);
+}
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-405491.js b/deps/v8/test/mjsunit/regress/regress-crbug-405491.js
new file mode 100644
index 0000000000..b63378113f
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-405491.js
@@ -0,0 +1,5 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-debug-as 1
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-405517.js b/deps/v8/test/mjsunit/regress/regress-crbug-405517.js
new file mode 100644
index 0000000000..36c3f4f7f7
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-405517.js
@@ -0,0 +1,16 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --gc-interval=203
+
+function f() {
+ var e = [0];
+ %PreventExtensions(e);
+ for (var i = 0; i < 4; i++) e.shift();
+}
+
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+f();
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-405922.js b/deps/v8/test/mjsunit/regress/regress-crbug-405922.js
new file mode 100644
index 0000000000..9f76a862db
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-405922.js
@@ -0,0 +1,27 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --expose-debug-as debug
+
+Debug = debug.Debug
+
+function listener(event, exec_state, event_data, data) {
+  try {
+    if (event == Debug.DebugEvent.Break) {
+      exec_state.prepareStep(Debug.StepAction.StepIn, 3);
+    }
+  } catch (e) {
+  }
+}
+
+Debug.setListener(listener);
+
+function f(x) {
+  if (x > 0) %_CallFunction(null, x-1, f);
+}
+
+debugger;
+f(2);
+
+Debug.setListener(null);
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-407946.js b/deps/v8/test/mjsunit/regress/regress-crbug-407946.js
new file mode 100644
index 0000000000..d5687cca34
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-407946.js
@@ -0,0 +1,12 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f(n) { return [0].indexOf((n - n) + 0); }
+
+assertEquals(0, f(.1));
+assertEquals(0, f(.1));
+%OptimizeFunctionOnNextCall(f);
+assertEquals(0, f(.1));
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-412203.js b/deps/v8/test/mjsunit/regress/regress-crbug-412203.js
new file mode 100644
index 0000000000..f15085954f
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-412203.js
@@ -0,0 +1,36 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var b = [];
+b[10000] = 1;
+// Required to reproduce the bug.
+assertTrue(%HasDictionaryElements(b));
+
+var a1 = [1.5];
+b.__proto__ = a1;
+assertEquals(1.5, ([].concat(b))[0]);
+
+var a2 = new Int32Array(2);
+a2[0] = 3;
+b.__proto__ = a2
+assertEquals(3, ([].concat(b))[0]);
+
+function foo(x, y) {
+  var a = [];
+  a[10000] = 1;
+  assertTrue(%HasDictionaryElements(a));
+
+  a.__proto__ = arguments;
+  var c = [].concat(a);
+  for (var i = 0; i < arguments.length; i++) {
+    assertEquals(i + 2, c[i]);
+  }
+  assertEquals(undefined, c[arguments.length]);
+  assertEquals(undefined, c[arguments.length + 1]);
+}
+foo(2);
+foo(2, 3);
+foo(2, 3, 4);
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-412208.js b/deps/v8/test/mjsunit/regress/regress-crbug-412208.js
new file mode 100644
index 0000000000..a194f855b4
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-412208.js
@@ -0,0 +1,16 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var non_const_true = true;
+
+function f() {
+  return non_const_true || (f() = this);
+}
+
+assertTrue(f());
+assertTrue(f());
+%OptimizeFunctionOnNextCall(f);
+assertTrue(f());
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-412210.js b/deps/v8/test/mjsunit/regress/regress-crbug-412210.js
new file mode 100644
index 0000000000..6ec7d62379
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-412210.js
@@ -0,0 +1,12 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f(x) {
+  return (x ? "" >> 0 : "") + /a/;
+};
+
+%OptimizeFunctionOnNextCall(f);
+f();
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-412215.js b/deps/v8/test/mjsunit/regress/regress-crbug-412215.js
new file mode 100644
index 0000000000..ad926fc4a2
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-412215.js
@@ -0,0 +1,33 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var dummy = {foo: "true"};
+
+var a = {y:0.5};
+a.y = 357;
+var b = a.y;
+
+var d;
+function f(  )  {
+  d = 357;
+  return {foo: b};
+}
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+var x = f();
+
+// With the bug, x is now an invalid object; the code below
+// triggers a crash.
+
+function g(obj) {
+  return obj.foo.length;
+}
+
+g(dummy);
+g(dummy);
+%OptimizeFunctionOnNextCall(g);
+g(x);
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-412319.js b/deps/v8/test/mjsunit/regress/regress-crbug-412319.js
new file mode 100644
index 0000000000..21386e3bd6
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-412319.js
@@ -0,0 +1,19 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function __f_6() {
+ var __v_7 = [0];
+ %PreventExtensions(__v_7);
+ for (var __v_6 = -2; __v_6 < 19; __v_6++) __v_7.shift();
+ __f_7(__v_7);
+}
+__f_6();
+__f_6();
+%OptimizeFunctionOnNextCall(__f_6);
+__f_6();
+function __f_7(__v_7) {
+  __v_7.push(Infinity);
+}
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-416558.js b/deps/v8/test/mjsunit/regress/regress-crbug-416558.js
new file mode 100644
index 0000000000..375ad406ea
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-416558.js
@@ -0,0 +1,115 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(function() {
+  function store(x) { x[0] = 0; }
+  store([]);
+  var c = /x/;
+  store(c);
+  function get_hole() {
+    var b = /x/;
+    store(b);
+    return b[1];
+  }
+  assertEquals(undefined, get_hole());
+  assertEquals(undefined, get_hole());
+})();
+
+(function() {
+  function store(x) { x[0] = 0; }
+  store([]);
+  var c = new Date();
+  store(c);
+  function get_hole() {
+    var b = new Date();
+    store(b);
+    return b[1];
+  }
+  assertEquals(undefined, get_hole());
+  assertEquals(undefined, get_hole());
+})();
+
+(function() {
+  function store(x) { x[0] = 0; }
+  store([]);
+  var c = new Number(1);
+  store(c);
+  function get_hole() {
+    var b = new Number(1);
+    store(b);
+    return b[1];
+  }
+  assertEquals(undefined, get_hole());
+  assertEquals(undefined, get_hole());
+})();
+
+(function() {
+  function store(x) { x[0] = 0; }
+  store([]);
+  var c = new Boolean();
+  store(c);
+  function get_hole() {
+    var b = new Boolean();
+    store(b);
+    return b[1];
+  }
+  assertEquals(undefined, get_hole());
+  assertEquals(undefined, get_hole());
+})();
+
+(function() {
+  function store(x) { x[0] = 0; }
+  store([]);
+  var c = new Map();
+  store(c);
+  function get_hole() {
+    var b = new Map();
+    store(b);
+    return b[1];
+  }
+  assertEquals(undefined, get_hole());
+  assertEquals(undefined, get_hole());
+})();
+
+(function() {
+  function store(x) { x[0] = 0; }
+  store([]);
+  var c = new Set();
+  store(c);
+  function get_hole() {
+    var b = new Set();
+    store(b);
+    return b[1];
+  }
+  assertEquals(undefined, get_hole());
+  assertEquals(undefined, get_hole());
+})();
+
+(function() {
+  function store(x) { x[0] = 0; }
+  store([]);
+  var c = new WeakMap();
+  store(c);
+  function get_hole() {
+    var b = new WeakMap();
+    store(b);
+    return b[1];
+  }
+  assertEquals(undefined, get_hole());
+  assertEquals(undefined, get_hole());
+})();
+
+(function() {
+  function store(x) { x[0] = 0; }
+  store([]);
+  var c = new WeakSet();
+  store(c);
+  function get_hole() {
+    var b = new WeakSet();
+    store(b);
+    return b[1];
+  }
+  assertEquals(undefined, get_hole());
+  assertEquals(undefined, get_hole());
+})();
diff --git a/deps/v8/test/mjsunit/regress/regress-debug-deopt-while-recompile.js b/deps/v8/test/mjsunit/regress/regress-debug-deopt-while-recompile.js
index 52c32e9cc3..ce5220a2b8 100644
--- a/deps/v8/test/mjsunit/regress/regress-debug-deopt-while-recompile.js
+++ b/deps/v8/test/mjsunit/regress/regress-debug-deopt-while-recompile.js
@@ -26,6 +26,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 // Flags: --expose-debug-as debug --allow-natives-syntax
+// Flags: --turbo-deoptimization
 
 Debug = debug.Debug;
 
diff --git a/deps/v8/test/mjsunit/regress/regress-force-constant-representation.js b/deps/v8/test/mjsunit/regress/regress-force-constant-representation.js
new file mode 100644
index 0000000000..4ec2a6a799
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-force-constant-representation.js
@@ -0,0 +1,18 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Test push double as tagged.
+var a = [{}];
+function f(a) {
+  a.push(Infinity);
+}
+
+f(a);
+f(a);
+f(a);
+%OptimizeFunctionOnNextCall(f);
+f(a);
+assertEquals([{}, Infinity, Infinity, Infinity, Infinity], a);
diff --git a/deps/v8/test/mjsunit/regress/regress-inline-constant-load.js b/deps/v8/test/mjsunit/regress/regress-inline-constant-load.js
new file mode 100644
index 0000000000..303639c74f
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-inline-constant-load.js
@@ -0,0 +1,27 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var o1 = {};
+var o2 = {};
+
+function foo(x) {
+  return x.bar;
+}
+
+Object.defineProperty(o1, "bar", {value:200});
+foo(o1);
+foo(o1);
+
+function f(b) {
+  var o = o2;
+  if (b) { return foo(o) }
+}
+
+f(false);
+%OptimizeFunctionOnNextCall(f);
+assertEquals(undefined, f(false));
+Object.defineProperty(o2, "bar", {value: 100});
+assertEquals(100, f(true));
diff --git a/deps/v8/test/mjsunit/regress/regress-json-parse-index.js b/deps/v8/test/mjsunit/regress/regress-json-parse-index.js
new file mode 100644
index 0000000000..d1a785aaf1
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-json-parse-index.js
@@ -0,0 +1,6 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var o = JSON.parse('{"\\u0030":100}');
+assertEquals(100, o[0]);
diff --git a/deps/v8/test/mjsunit/regress/regress-opt-after-debug-deopt.js b/deps/v8/test/mjsunit/regress/regress-opt-after-debug-deopt.js
index c637be5497..5cbaabca55 100644
--- a/deps/v8/test/mjsunit/regress/regress-opt-after-debug-deopt.js
+++ b/deps/v8/test/mjsunit/regress/regress-opt-after-debug-deopt.js
@@ -27,6 +27,7 @@
 
 // Flags: --expose-debug-as debug --allow-natives-syntax
 // Flags: --concurrent-recompilation --block-concurrent-recompilation
+// Flags: --turbo-deoptimization
 
 if (!%IsConcurrentRecompilationSupported()) {
   print("Concurrent recompilation is disabled. Skipping this test.");
diff --git a/deps/v8/test/mjsunit/regress/regress-reset-dictionary-elements.js b/deps/v8/test/mjsunit/regress/regress-reset-dictionary-elements.js
new file mode 100644
index 0000000000..d3d093ec09
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-reset-dictionary-elements.js
@@ -0,0 +1,14 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var a = [];
+a[10000] = 1;
+a.length = 0;
+a[1] = 1;
+a.length = 0;
+assertEquals(undefined, a[1]);
+
+var o = {};
+Object.freeze(o);
+assertEquals(undefined, o[1]);
diff --git a/deps/v8/test/mjsunit/regress/regress-seqstrsetchar-ex1.js b/deps/v8/test/mjsunit/regress/regress-seqstrsetchar-ex1.js
index c85cf56e0c..1fd8d810b3 100644
--- a/deps/v8/test/mjsunit/regress/regress-seqstrsetchar-ex1.js
+++ b/deps/v8/test/mjsunit/regress/regress-seqstrsetchar-ex1.js
@@ -47,7 +47,7 @@ function StringFromCharCode(code) {
   var two_byte = %NewString(n - i, false);
   for (var j = 0; i < n; i++, j++) {
     var code = %_Arguments(i);
-    %_TwoByteSeqStringSetChar(two_byte, j, code);
+    %_TwoByteSeqStringSetChar(j, code, two_byte);
   }
   return one_byte + two_byte;
 }
diff --git a/deps/v8/test/mjsunit/regress/regress-seqstrsetchar-ex3.js b/deps/v8/test/mjsunit/regress/regress-seqstrsetchar-ex3.js
index 43d2b08352..0a6b211648 100644
--- a/deps/v8/test/mjsunit/regress/regress-seqstrsetchar-ex3.js
+++ b/deps/v8/test/mjsunit/regress/regress-seqstrsetchar-ex3.js
@@ -30,8 +30,8 @@
 function test() {
   var string = %NewString(10, true);
   for (var i = 0; i < 10; i++) {
-    %_OneByteSeqStringSetChar(string, i, 65);
-    %_OneByteSeqStringSetChar(string, i, 66);
+    %_OneByteSeqStringSetChar(i, 65, string);
+    %_OneByteSeqStringSetChar(i, 66, string);
   }
   for (var i = 0; i < 10; i++) {
     assertEquals("B", string[i]);
diff --git a/deps/v8/test/mjsunit/regress/regress-sliced-external-cons-regexp.js b/deps/v8/test/mjsunit/regress/regress-sliced-external-cons-regexp.js
new file mode 100644
index 0000000000..145c831896
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-sliced-external-cons-regexp.js
@@ -0,0 +1,21 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-externalize-string --expose-gc
+
+var re = /(B)/;
+var cons1 = "0123456789" + "ABCDEFGHIJ";
+var cons2 = "0123456789\u1234" + "ABCDEFGHIJ";
+gc();
+gc();  // Promote cons.
+
+try { externalizeString(cons1, false); } catch (e) { }
+try { externalizeString(cons2, true); } catch (e) { }
+
+var slice1 = cons1.slice(1,-1);
+var slice2 = cons2.slice(1,-1);
+for (var i = 0; i < 10; i++) {
+  assertEquals(["B", "B"], re.exec(slice1));
+  assertEquals(["B", "B"], re.exec(slice2));
+}
diff --git a/deps/v8/test/mjsunit/regress/string-compare-memcmp.js b/deps/v8/test/mjsunit/regress/string-compare-memcmp.js
new file mode 100644
index 0000000000..45f47343ee
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/string-compare-memcmp.js
@@ -0,0 +1,7 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+assertEquals(-1, %StringCompare("abc\u0102", "abc\u0201"));
diff --git a/deps/v8/test/mjsunit/regress/string-set-char-deopt.js b/deps/v8/test/mjsunit/regress/string-set-char-deopt.js
index 9f6d434538..c8e8538e16 100644
--- a/deps/v8/test/mjsunit/regress/string-set-char-deopt.js
+++ b/deps/v8/test/mjsunit/regress/string-set-char-deopt.js
@@ -25,7 +25,7 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --allow-natives-syntax
+// Flags: --allow-natives-syntax --turbo-deoptimization
 
 (function OneByteSeqStringSetCharDeoptOsr() {
   function deopt() {
@@ -34,7 +34,7 @@
 
   function f(string, osr) {
     var world = " world";
-    %_OneByteSeqStringSetChar(string, 0, (deopt(), 0x48));
+    %_OneByteSeqStringSetChar(0, (deopt(), 0x48), string);
 
     if (osr) while (%GetOptimizationStatus(f) == 2) {}
 
@@ -56,7 +56,7 @@
   }
 
   function f(string) {
-    g(%_OneByteSeqStringSetChar(string, 0, (deopt(), 0x48)));
+    g(%_OneByteSeqStringSetChar(0, (deopt(), 0x48), string));
     return string;
   }
 
@@ -75,7 +75,7 @@
   }
 
   function f(string) {
-    g(%_TwoByteSeqStringSetChar(string, 0, (deopt(), 0x48)));
+    g(%_TwoByteSeqStringSetChar(0, (deopt(), 0x48), string));
     return string;
   }