Upgrade V8 to 2.1.0

22 files changed, 928 insertions, 45 deletions

diff --git a/deps/v8/test/mjsunit/compiler/short-circuit.js b/deps/v8/test/mjsunit/compiler/short-circuit.js
new file mode 100644
index 0000000000..42100e765d
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/short-circuit.js
@@ -0,0 +1,102 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test some expression contexts involving short-circuit boolean
+// operations that did not otherwise have test coverage.
+
+
+var x = 42;
+
+// Literals in value/test context.
+assertEquals(x, function () { return 0 || x }());
+assertEquals(1, function () { return 1 || x }());
+
+// Literals in test/value context.
+assertEquals(0, function () { return 0 && x }());
+assertEquals(x, function () { return 1 && x }());
+
+// A value on top of the stack in value/test context.
+assertEquals(x, function(y) { return y++ || x }(0));
+assertEquals(1, function(y) { return y++ || x }(1));
+
+// A value on top of the stack in a test/value context.
+assertEquals(0, function(y) { return y++ && x }(0));
+assertEquals(x, function(y) { return y++ && x }(1));
+
+// An object literal in value context.
+assertEquals(0, function () { return {x: 0}}().x);
+
+// An object literal in value/test context.
+assertEquals(0, function () { return {x: 0} || this }().x);
+
+// An object literal in test/value context.
+assertEquals(x, function () { return {x: 0} && this }().x);
+
+// An array literal in value/test context.
+assertEquals(0, function () { return [0,1] || new Array(x,1) }()[0]);
+
+// An array literal in test/value context.
+assertEquals(x, function () { return [0,1] && new Array(x,1) }()[0]);
+
+// Slot assignment in value/test context.
+assertEquals(x, function (y) { return (y = 0) || x }("?"));
+assertEquals(1, function (y) { return (y = 1) || x }("?"));
+
+// Slot assignment in test/value context.
+assertEquals(0, function (y) { return (y = 0) && x }("?"));
+assertEquals(x, function (y) { return (y = 1) && x }("?"));
+
+// void in value context.
+assertEquals(void 0, function () { return void x }());
+
+// void in value/test context.
+assertEquals(x, function () { return (void x) || x }());
+
+// void in test/value context.
+assertEquals(void 0, function () { return (void x) && x }());
+
+// Unary not in value context.
+assertEquals(false, function () { return !x }());
+
+// Unary not in value/test context.
+assertEquals(true, function (y) { return !y || x }(0));
+assertEquals(x, function (y) { return !y || x }(1));
+
+// Unary not in test/value context.
+assertEquals(x, function (y) { return !y && x }(0));
+assertEquals(false, function (y) { return !y && x }(1));
+
+// Comparison in value context.
+assertEquals(false, function () { return x < x; }());
+
+// Comparison in value/test context.
+assertEquals(x, function () { return x < x || x; }());
+assertEquals(true, function () { return x <= x || x; }());
+
+// Comparison in test/value context.
+assertEquals(false, function () { return x < x && x; }());
+assertEquals(x, function () { return x <= x && x; }());
diff --git a/deps/v8/test/mjsunit/compiler/thisfunction.js b/deps/v8/test/mjsunit/compiler/thisfunction.js
index 2af846f3e0..098fc3a4e0 100644
--- a/deps/v8/test/mjsunit/compiler/thisfunction.js
+++ b/deps/v8/test/mjsunit/compiler/thisfunction.js
@@ -25,7 +25,7 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --always_fast_compiler
+// Flags: --always-full-compiler
 
 // Test reference to this-function.
 
diff --git a/deps/v8/test/mjsunit/compiler/unary-add.js b/deps/v8/test/mjsunit/compiler/unary-add.js
new file mode 100644
index 0000000000..b1fc0c2ca1
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/unary-add.js
@@ -0,0 +1,67 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test unary addition in various contexts.
+
+// Test value context.
+assertEquals(1, +'1');
+assertEquals(1, +1);
+assertEquals(1.12, +1.12);
+assertEquals(NaN, +undefined);
+assertEquals(NaN, +{});
+
+// Test effect context.
+assertEquals(1, eval("+'1'; 1"));
+assertEquals(1, eval("+1; 1"));
+assertEquals(1, eval("+1.12; 1"));
+assertEquals(1, eval("+undefined; 1"));
+assertEquals(1, eval("+{}; 1"));
+
+// Test test context.
+assertEquals(1, (+'1') ? 1 : 2);
+assertEquals(1, (+1) ? 1 : 2);
+assertEquals(1, (+'0') ? 2 : 1);
+assertEquals(1, (+0) ? 2 : 1);
+assertEquals(1, (+1.12) ? 1 : 2);
+assertEquals(1, (+undefined) ? 2 : 1);
+assertEquals(1, (+{}) ? 2 : 1);
+
+// Test value/test context.
+assertEquals(1, +'1' || 2);
+assertEquals(1, +1 || 2);
+assertEquals(1.12, +1.12 || 2);
+assertEquals(2, +undefined || 2);
+assertEquals(2, +{} || 2);
+
+// Test test/value context.
+assertEquals(2, +'1' && 2);
+assertEquals(2, +1 && 2);
+assertEquals(0, +'0' && 2);
+assertEquals(0, +0 && 2);
+assertEquals(2, +1.12 && 2);
+assertEquals(NaN, +undefined && 2);
+assertEquals(NaN, +{} && 2);
diff --git a/deps/v8/test/mjsunit/debug-compile-event-newfunction.js b/deps/v8/test/mjsunit/debug-compile-event-newfunction.js
new file mode 100644
index 0000000000..fb43a87f77
--- /dev/null
+++ b/deps/v8/test/mjsunit/debug-compile-event-newfunction.js
@@ -0,0 +1,68 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-debug-as debug
+// Get the Debug object exposed from the debug context global object.
+Debug = debug.Debug
+
+var exception = null;  // Exception in debug event listener.
+
+function listener(event, exec_state, event_data, data) {
+  try {
+    if (event == Debug.DebugEvent.AfterCompile) {
+      assertEquals(Debug.ScriptCompilationType.Eval,
+                   event_data.script().compilationType(),
+                  'Wrong compilationType');
+      var evalFromScript = event_data.script().evalFromScript();
+      assertTrue(!!evalFromScript, ' evalFromScript ');
+      assertFalse(evalFromScript.isUndefined(), 'evalFromScript.isUndefined()');
+      assertTrue(/debug-compile-event-newfunction.js$/.test(
+                     evalFromScript.name()),
+                 'Wrong eval from script name.');
+
+      var evalFromLocation = event_data.script().evalFromLocation();
+      assertTrue(!!evalFromLocation, 'evalFromLocation is undefined');
+      assertEquals(63, evalFromLocation.line);
+
+      // Check that the event can be serialized without exceptions.
+      var json = event_data.toJSONProtocol();
+    }
+  } catch (e) {
+    exception = e
+  }
+};
+
+
+// Add the debug event listener.
+Debug.setListener(listener);
+
+// Create a function from its body text. It will lead to an eval.
+new Function('arg1', 'return arg1 + 1;');
+
+assertNull(exception, "exception in listener");
+
+Debug.setListener(null);
diff --git a/deps/v8/test/mjsunit/debug-compile-event.js b/deps/v8/test/mjsunit/debug-compile-event.js
index 4804ac772d..071183bf6e 100644
--- a/deps/v8/test/mjsunit/debug-compile-event.js
+++ b/deps/v8/test/mjsunit/debug-compile-event.js
@@ -107,7 +107,7 @@ compileSource('eval("a=2")');
 source_count++;  // Using eval causes additional compilation event.
 compileSource('eval("eval(\'(function(){return a;})\')")');
 source_count += 2;  // Using eval causes additional compilation event.
-compileSource('JSON.parse("{a:1,b:2}")');
+compileSource('JSON.parse(\'{"a":1,"b":2}\')');
 source_count++;  // Using JSON.parse causes additional compilation event.
 
 // Make sure that the debug event listener was invoked.
diff --git a/deps/v8/test/mjsunit/debug-step.js b/deps/v8/test/mjsunit/debug-step.js
index 453421864b..a887514a0e 100644
--- a/deps/v8/test/mjsunit/debug-step.js
+++ b/deps/v8/test/mjsunit/debug-step.js
@@ -79,4 +79,4 @@ f();
 assertEquals(0, result);
 
 // Get rid of the debug event listener.
-Debug.setListener(null);
\ No newline at end of file
+Debug.setListener(null);
diff --git a/deps/v8/test/mjsunit/bugs/bug-223.js b/deps/v8/test/mjsunit/for.js
index 04b296b9bf..0b7158086f 100644
--- a/deps/v8/test/mjsunit/bugs/bug-223.js
+++ b/deps/v8/test/mjsunit/for.js
@@ -1,4 +1,4 @@
-// Copyright 2008 the V8 project authors. All rights reserved.
+// Copyright 2010 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
@@ -25,15 +25,8 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// When calling user-defined functions on strings, booleans or
-// numbers, we should create a wrapper object.
-
-function TypeOfThis() { return typeof this; }
-
-String.prototype.TypeOfThis = TypeOfThis;
-Boolean.prototype.TypeOfThis = TypeOfThis;
-Number.prototype.TypeOfThis = TypeOfThis;
-
-assertEquals('object', 'xxx'.TypeOfThis());
-assertEquals('object', true.TypeOfThis());
-assertEquals('object', (42).TypeOfThis());
+// Test missing condition in for loop.
+for (var i = 0; ; i++) {
+  if (i > 100) break;
+}
+assertEquals(101, i);
diff --git a/deps/v8/test/mjsunit/json.js b/deps/v8/test/mjsunit/json.js
index 35e16340ce..56562e7694 100644
--- a/deps/v8/test/mjsunit/json.js
+++ b/deps/v8/test/mjsunit/json.js
@@ -93,20 +93,46 @@ for (var p in this)
   assertFalse(p == "JSON");
 
 // Parse
-
 assertEquals({}, JSON.parse("{}"));
+assertEquals({42:37}, JSON.parse('{"42":37}'));
 assertEquals(null, JSON.parse("null"));
 assertEquals(true, JSON.parse("true"));
 assertEquals(false, JSON.parse("false"));
 assertEquals("foo", JSON.parse('"foo"'));
 assertEquals("f\no", JSON.parse('"f\\no"'));
+assertEquals("\b\f\n\r\t\"\u2028\/\\",
+             JSON.parse('"\\b\\f\\n\\r\\t\\"\\u2028\\/\\\\"'));
+assertEquals([1.1], JSON.parse("[1.1]"));
+assertEquals([1], JSON.parse("[1.0]"));
+
+assertEquals(0, JSON.parse("0"));
+assertEquals(1, JSON.parse("1"));
+assertEquals(0.1, JSON.parse("0.1"));
 assertEquals(1.1, JSON.parse("1.1"));
-assertEquals(1, JSON.parse("1.0"));
-assertEquals(0.0000000003, JSON.parse("3e-10"));
+assertEquals(1.1, JSON.parse("1.100000"));
+assertEquals(1.111111, JSON.parse("1.111111"));
+assertEquals(-0, JSON.parse("-0"));
+assertEquals(-1, JSON.parse("-1"));
+assertEquals(-0.1, JSON.parse("-0.1"));
+assertEquals(-1.1, JSON.parse("-1.1"));
+assertEquals(-1.1, JSON.parse("-1.100000"));
+assertEquals(-1.111111, JSON.parse("-1.111111"));
+assertEquals(11, JSON.parse("1.1e1"));
+assertEquals(11, JSON.parse("1.1e+1"));
+assertEquals(0.11, JSON.parse("1.1e-1"));
+assertEquals(11, JSON.parse("1.1E1"));
+assertEquals(11, JSON.parse("1.1E+1"));
+assertEquals(0.11, JSON.parse("1.1E-1"));
+
 assertEquals([], JSON.parse("[]"));
 assertEquals([1], JSON.parse("[1]"));
 assertEquals([1, "2", true, null], JSON.parse('[1, "2", true, null]'));
 
+assertEquals("", JSON.parse('""'));
+assertEquals(["", "", -0, ""], JSON.parse('[    ""  ,    ""  ,   -0,    ""]'));
+assertEquals("", JSON.parse('""'));
+
+
 function GetFilter(name) {
   function Filter(key, value) {
     return (key == name) ? undefined : value;
@@ -145,6 +171,64 @@ TestInvalid('function () { return 0; }');
 TestInvalid("[1, 2");
 TestInvalid('{"x": 3');
 
+// JavaScript number literals not valid in JSON.
+TestInvalid('[01]');
+TestInvalid('[.1]');
+TestInvalid('[1.]');
+TestInvalid('[1.e1]');
+TestInvalid('[-.1]');
+TestInvalid('[-1.]');
+
+// Plain invalid number literals.
+TestInvalid('-');
+TestInvalid('--1');
+TestInvalid('-1e');
+TestInvalid('1e--1]');
+TestInvalid('1e+-1');
+TestInvalid('1e-+1');
+TestInvalid('1e++1');
+
+// JavaScript string literals not valid in JSON.
+TestInvalid("'single quote'");  // Valid JavaScript
+TestInvalid('"\\a invalid escape"');
+TestInvalid('"\\v invalid escape"');  // Valid JavaScript
+TestInvalid('"\\\' invalid escape"');  // Valid JavaScript
+TestInvalid('"\\x42 invalid escape"');  // Valid JavaScript
+TestInvalid('"\\u202 invalid escape"');
+TestInvalid('"\\012 invalid escape"');
+TestInvalid('"Unterminated string');
+TestInvalid('"Unterminated string\\"');
+TestInvalid('"Unterminated string\\\\\\"');
+
+// Test bad JSON that would be good JavaScript (ES5).
+
+TestInvalid("{true:42}");
+TestInvalid("{false:42}");
+TestInvalid("{null:42}");
+TestInvalid("{'foo':42}");
+TestInvalid("{42:42}");
+TestInvalid("{0:42}");
+TestInvalid("{-1:42}");
+
+// Test for trailing garbage detection.
+
+TestInvalid('42 px');
+TestInvalid('42 .2');
+TestInvalid('42 2');
+TestInvalid('42 e1');
+TestInvalid('"42" ""');
+TestInvalid('"42" ""');
+TestInvalid('"" ""');
+TestInvalid('true ""');
+TestInvalid('false ""');
+TestInvalid('null ""');
+TestInvalid('null ""');
+TestInvalid('[] ""');
+TestInvalid('[true] ""');
+TestInvalid('{} ""');
+TestInvalid('{"x":true} ""');
+TestInvalid('"Garbage""After string"');
+
 // Stringify
 
 assertEquals("true", JSON.stringify(true));
@@ -196,12 +280,8 @@ assertEquals('{"y":6,"x":5}', JSON.stringify({x:5,y:6}, ['y', 'x']));
 assertEquals(undefined, JSON.stringify(undefined));
 assertEquals(undefined, JSON.stringify(function () { }));
 
-function checkIllegal(str) {
-  assertThrows(function () { JSON.parse(str); }, SyntaxError);
-}
-
-checkIllegal('1); throw "foo"; (1');
+TestInvalid('1); throw "foo"; (1');
 
 var x = 0;
 eval("(1); x++; (1)");
-checkIllegal('1); x++; (1');
+TestInvalid('1); x++; (1');
diff --git a/deps/v8/test/mjsunit/math-round.js b/deps/v8/test/mjsunit/math-round.js
new file mode 100644
index 0000000000..d80a1036fb
--- /dev/null
+++ b/deps/v8/test/mjsunit/math-round.js
@@ -0,0 +1,52 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+assertEquals(0, Math.round(0));
+assertEquals(-0, Math.round(-0));
+assertEquals(Infinity, Math.round(Infinity));
+assertEquals(-Infinity, Math.round(-Infinity));
+assertNaN(Math.round(NaN));
+
+assertEquals(1, Math.round(0.5));
+assertEquals(1, Math.round(0.7));
+assertEquals(1, Math.round(1));
+assertEquals(1, Math.round(1.1));
+assertEquals(1, Math.round(1.49999));
+assertEquals(1/-0, 1/Math.round(-0.5));  // Test for -0 result.
+assertEquals(-1, Math.round(-0.5000000000000001));
+assertEquals(-1, Math.round(-0.7));
+assertEquals(-1, Math.round(-1));
+assertEquals(-1, Math.round(-1.1));
+assertEquals(-1, Math.round(-1.49999));
+assertEquals(-1, Math.round(-1.5));
+
+assertEquals(9007199254740990, Math.round(9007199254740990));
+assertEquals(9007199254740991, Math.round(9007199254740991));
+assertEquals(-9007199254740990, Math.round(-9007199254740990));
+assertEquals(-9007199254740991, Math.round(-9007199254740991));
+assertEquals(Number.MAX_VALUE, Math.round(Number.MAX_VALUE));
+assertEquals(-Number.MAX_VALUE, Math.round(-Number.MAX_VALUE));
diff --git a/deps/v8/test/mjsunit/mirror-script.js b/deps/v8/test/mjsunit/mirror-script.js
index 3208f16c38..8631028e4e 100644
--- a/deps/v8/test/mjsunit/mirror-script.js
+++ b/deps/v8/test/mjsunit/mirror-script.js
@@ -87,8 +87,8 @@ testScriptMirror(function(){}, 'mirror-script.js', 100, 2, 0);
 testScriptMirror(Math.sin, 'native math.js', -1, 0, 0);
 testScriptMirror(eval('(function(){})'), null, 1, 2, 1, '(function(){})', 87);
 testScriptMirror(eval('(function(){\n  })'), null, 2, 2, 1, '(function(){\n  })', 88);
-testScriptMirror(%CompileString("({a:1,b:2})", true), null, 1, 2, 2, '({a:1,b:2})');
-testScriptMirror(%CompileString("({a:1,\n  b:2})", true), null, 2, 2, 2, '({a:1,\n  b:2})');
+testScriptMirror(%CompileString('{"a":1,"b":2}', true), null, 1, 2, 2, '{"a":1,"b":2}');
+testScriptMirror(%CompileString('{"a":1,\n  "b":2}', true), null, 2, 2, 2, '{"a":1,\n  "b":2}');
 
 // Test taking slices of source.
 var mirror = debug.MakeMirror(eval('(function(){\n  1;\n})')).script();
diff --git a/deps/v8/test/mjsunit/mjsunit.js b/deps/v8/test/mjsunit/mjsunit.js
index 8ced0119fe..07c4e7eff3 100644
--- a/deps/v8/test/mjsunit/mjsunit.js
+++ b/deps/v8/test/mjsunit/mjsunit.js
@@ -75,6 +75,7 @@ function deepEquals(a, b) {
   if (typeof a == "number" && typeof b == "number" && isNaN(a) && isNaN(b)) {
     return true;
   }
+  if (a == null || b == null) return false;
   if (a.constructor === RegExp || b.constructor === RegExp) {
     return (a.constructor === b.constructor) && (a.toString === b.toString);
   }
diff --git a/deps/v8/test/mjsunit/mjsunit.status b/deps/v8/test/mjsunit/mjsunit.status
index 41388a37f8..f1752b9f51 100644
--- a/deps/v8/test/mjsunit/mjsunit.status
+++ b/deps/v8/test/mjsunit/mjsunit.status
@@ -45,8 +45,8 @@ array-constructor: PASS || TIMEOUT
 # Very slow on ARM, contains no architecture dependent code.
 unicode-case-overoptimization: PASS, TIMEOUT if ($arch == arm)
 
-# Skip long running test in debug.
-regress/regress-524: PASS, SKIP if $mode == debug
+# Skip long running test in debug and allow it to timeout in release mode.
+regress/regress-524: (PASS || TIMEOUT), SKIP if $mode == debug
 
 [ $arch == arm ]
 
diff --git a/deps/v8/test/mjsunit/object-get-own-property-names.js b/deps/v8/test/mjsunit/object-get-own-property-names.js
new file mode 100644
index 0000000000..f52cee2f92
--- /dev/null
+++ b/deps/v8/test/mjsunit/object-get-own-property-names.js
@@ -0,0 +1,104 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test ES5 section 15.2.3.4 Object.getOwnPropertyNames.
+
+// Check simple cases.
+var obj = { a: 1, b: 2};
+var propertyNames = Object.getOwnPropertyNames(obj);
+propertyNames.sort();
+assertEquals(2, propertyNames.length);
+assertEquals("a", propertyNames[0]);
+assertEquals("b", propertyNames[1]);
+
+var obj = { a: function(){}, b: function(){} };
+var propertyNames = Object.getOwnPropertyNames(obj);
+propertyNames.sort();
+assertEquals(2, propertyNames.length);
+assertEquals("a", propertyNames[0]);
+assertEquals("b", propertyNames[1]);
+
+// Check slow case
+var obj = { a: 1, b: 2, c: 3 };
+delete obj.b;
+var propertyNames = Object.getOwnPropertyNames(obj)
+propertyNames.sort();
+assertEquals(2, propertyNames.length);
+assertEquals("a", propertyNames[0]);
+assertEquals("c", propertyNames[1]);
+
+// Check that non-enumerable properties are being returned.
+var propertyNames = Object.getOwnPropertyNames([1, 2]);
+propertyNames.sort();
+assertEquals(3, propertyNames.length);
+assertEquals("0", propertyNames[0]);
+assertEquals("1", propertyNames[1]);
+assertEquals("length", propertyNames[2]);
+
+// Check that no proto properties are returned.
+var obj = { foo: "foo" };
+obj.__proto__ = { bar: "bar" };
+propertyNames = Object.getOwnPropertyNames(obj);
+propertyNames.sort();
+assertEquals(1, propertyNames.length);
+assertEquals("foo", propertyNames[0]);
+
+// Check that getter properties are returned.
+var obj = {};
+obj.__defineGetter__("getter", function() {});
+propertyNames = Object.getOwnPropertyNames(obj);
+propertyNames.sort();
+assertEquals(1, propertyNames.length);
+assertEquals("getter", propertyNames[0]);
+
+try {
+  Object.getOwnPropertyNames(4);
+  assertTrue(false);
+} catch (e) {
+  assertTrue(/on non-object/.test(e));
+}
+
+try {
+  Object.getOwnPropertyNames("foo");
+  assertTrue(false);
+} catch (e) {
+  assertTrue(/on non-object/.test(e));
+}
+
+try {
+  Object.getOwnPropertyNames(undefined);
+  assertTrue(false);
+} catch (e) {
+  assertTrue(/on non-object/.test(e));
+}
+
+try {
+  Object.getOwnPropertyNames(null);
+  assertTrue(false);
+} catch (e) {
+  assertTrue(/on non-object/.test(e));
+}
diff --git a/deps/v8/test/mjsunit/regress/regress-580.js b/deps/v8/test/mjsunit/regress/regress-580.js
new file mode 100644
index 0000000000..c6b3db7ade
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-580.js
@@ -0,0 +1,55 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test constant folding of smi operations that overflow a 32-bit int
+// See http://code.google.com/p/v8/issues/detail?id=580
+
+function num_ops() {
+  var x;
+  var tmp = 0;
+  x = (tmp = 1578221999, tmp)+(tmp = 572285336, tmp);
+  assertEquals(2150507335, x);
+  x = 1578221999 + 572285336;
+  assertEquals(2150507335, x);
+
+  x = (tmp = -1500000000, tmp)+(tmp = -2000000000, tmp);
+  assertEquals(-3500000000, x);
+  x = -1500000000 + -2000000000;
+  assertEquals(-3500000000, x);
+
+  x = (tmp = 1578221999, tmp)-(tmp = -572285336, tmp);
+  assertEquals(2150507335, x);
+  x = 1578221999 - -572285336;
+  assertEquals(2150507335, x);
+
+  x = (tmp = -1500000000, tmp)-(tmp = 2000000000, tmp);
+  assertEquals(-3500000000, x);
+  x = -1500000000 - 2000000000;
+  assertEquals(-3500000000, x);
+}
+
+num_ops();
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-3184.js b/deps/v8/test/mjsunit/regress/regress-crbug-3184.js
new file mode 100644
index 0000000000..ed78183f78
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-3184.js
@@ -0,0 +1,83 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+Object.extend = function (dest, source) {
+  for (property in source) dest[property] = source[property];
+  return dest;
+};
+
+Object.extend ( Function.prototype,
+{
+  wrap : function (wrapper) {
+    var method = this;
+    var bmethod = (function(_method) {
+      return function () {
+        this.$$$parentMethodStore$$$ = this.$proceed;
+        this.$proceed = function() { return _method.apply(this, arguments); };
+      };
+    })(method);
+    var amethod = function () {
+      this.$proceed = this.$$$parentMethodStore$$$;
+      if (this.$proceed == undefined) delete this.$proceed;
+      delete this.$$$parentMethodStore$$$;
+    };
+    var value = function() { bmethod.call(this); retval = wrapper.apply(this, arguments); amethod.call(this); return retval; };
+    return value;
+  }
+});
+
+String.prototype.cap = function() {
+  return this.charAt(0).toUpperCase() + this.substring(1).toLowerCase();
+};
+
+String.prototype.cap = String.prototype.cap.wrap(
+  function(each) {
+    if (each && this.indexOf(" ") != -1) {
+      return this.split(" ").map(
+        function (value) {
+          return value.cap();
+        }
+      ).join(" ");
+    } else {
+      return this.$proceed();
+  }
+});
+
+Object.extend( Array.prototype,
+{
+  map : function(fun) {
+    if (typeof fun != "function") throw new TypeError();
+    var len = this.length;
+    var res = new Array(len);
+    var thisp = arguments[1];
+    for (var i = 0; i < len; i++) { if (i in this) res[i] = fun.call(thisp, this[i], i, this); }
+    return res;
+  }
+});
+assertEquals("Test1 test1", "test1 test1".cap());
+assertEquals("Test2 Test2", "test2 test2".cap(true));
+
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-3867.js b/deps/v8/test/mjsunit/regress/regress-crbug-3867.js
new file mode 100644
index 0000000000..03001b6c79
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-3867.js
@@ -0,0 +1,77 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function props(x) {
+  var result = [];
+  for (var p in x) result.push(p);
+  return result;
+}
+
+function A() {
+  this.a1 = 1234;
+  this.a2 = "D";
+  this.a3 = false;
+}
+
+function B() {
+  this.b3 = false;
+  this.b2 = "D";
+  this.b1 = 1234;
+}
+
+function C() {
+  this.c3 = false;
+  this.c1 = 1234;
+  this.c2 = "D";
+}
+
+assertArrayEquals(["a1", "a2", "a3"], props(new A()));
+assertArrayEquals(["b3", "b2", "b1"], props(new B()));
+assertArrayEquals(["c3", "c1", "c2"], props(new C()));
+assertArrayEquals(["s1", "s2", "s3"], props({s1: 0, s2: 0, s3: 0}));
+assertArrayEquals(["s3", "s2", "s1"], props({s3: 0, s2: 0, s1: 0}));
+assertArrayEquals(["s3", "s1", "s2"], props({s3: 0, s1: 0, s2: 0}));
+
+var a = new A()
+a.a0 = 0;
+a.a4 = 0;
+assertArrayEquals(["a1", "a2", "a3", "a0", "a4"], props(a));
+
+var b = new B()
+b.b4 = 0;
+b.b0 = 0;
+assertArrayEquals(["b3", "b2", "b1", "b4", "b0"], props(b));
+
+var o1 = {s1: 0, s2: 0, s3: 0}
+o1.s0 = 0;
+o1.s4 = 0;
+assertArrayEquals(["s1", "s2", "s3", "s0", "s4"], props(o1));
+
+var o2 = {s3: 0, s2: 0, s1: 0}
+o2.s4 = 0;
+o2.s0 = 0;
+assertArrayEquals(["s3", "s2", "s1", "s4", "s0"], props(o2));
diff --git a/deps/v8/test/mjsunit/tools/csvparser.js b/deps/v8/test/mjsunit/tools/csvparser.js
index db3a2eba30..6ac490805f 100644
--- a/deps/v8/test/mjsunit/tools/csvparser.js
+++ b/deps/v8/test/mjsunit/tools/csvparser.js
@@ -77,3 +77,7 @@ assertEquals(
 assertEquals(
     ['code-creation','RegExp','0xf6c21c00','826','NccyrJroXvg\\/([^,]*)'],
     parser.parseLine('code-creation,RegExp,0xf6c21c00,826,"NccyrJroXvg\\/([^,]*)"'));
+
+assertEquals(
+    ['code-creation','Function','0x42f0a0','163',''],
+    parser.parseLine('code-creation,Function,0x42f0a0,163,""'));
diff --git a/deps/v8/test/mjsunit/tools/logreader.js b/deps/v8/test/mjsunit/tools/logreader.js
index 8ed5ffd267..8b74789517 100644
--- a/deps/v8/test/mjsunit/tools/logreader.js
+++ b/deps/v8/test/mjsunit/tools/logreader.js
@@ -67,7 +67,7 @@
   var reader = new devtools.profiler.LogReader({});
 
   assertEquals([0x10000000, 0x10001000, 0xffff000, 0x10000000],
-               reader.processStack(0x10000000, ['overflow',
+               reader.processStack(0x10000000, 0, ['overflow',
                    '+1000', '-2000', '+1000']));
 })();
 
diff --git a/deps/v8/test/mjsunit/tools/tickprocessor-test.func-info b/deps/v8/test/mjsunit/tools/tickprocessor-test.func-info
new file mode 100644
index 0000000000..a66b90f4c5
--- /dev/null
+++ b/deps/v8/test/mjsunit/tools/tickprocessor-test.func-info
@@ -0,0 +1,29 @@
+Statistical profiling result from v8.log, (3 ticks, 0 unaccounted, 0 excluded).
+
+ [Shared libraries]:
+   ticks  total  nonlib   name
+
+ [JavaScript]:
+   ticks  total  nonlib   name
+      2   66.7%   66.7%  Stub: CompareStub_GE
+      1   33.3%   33.3%  LazyCompile: DrawLine 3d-cube.js:17
+
+ [C++]:
+   ticks  total  nonlib   name
+
+ [GC]:
+   ticks  total  nonlib   name
+      0    0.0%
+
+ [Bottom up (heavy) profile]:
+  Note: percentage shows a share of a particular caller in the total
+  amount of its parent calls.
+  Callers occupying less than 2.0% are not shown.
+
+   ticks parent  name
+      2   66.7%  Stub: CompareStub_GE
+      2  100.0%    LazyCompile: DrawLine 3d-cube.js:17
+      2  100.0%      LazyCompile: DrawQube 3d-cube.js:188
+
+      1   33.3%  LazyCompile: DrawLine 3d-cube.js:17
+      1  100.0%    LazyCompile: DrawQube 3d-cube.js:188
diff --git a/deps/v8/test/mjsunit/tools/tickprocessor-test.log b/deps/v8/test/mjsunit/tools/tickprocessor-test.log
index 75daad6b2f..80e7ec1a87 100644
--- a/deps/v8/test/mjsunit/tools/tickprocessor-test.log
+++ b/deps/v8/test/mjsunit/tools/tickprocessor-test.log
@@ -6,19 +6,20 @@ code-creation,Stub,0xf540a100,474,"CEntryStub"
 code-creation,Script,0xf541cd80,736,"exp.js"
 code-creation,Stub,0xf541d0e0,47,"RuntimeStub_Math_exp"
 code-creation,LazyCompile,0xf541d120,145,"exp native math.js:41"
+function-creation,0xf441d280,0xf541d120
 code-creation,LoadIC,0xf541d280,117,"j"
 code-creation,LoadIC,0xf541d360,63,"i"
-tick,0x80f82d1,0xffdfe880,0,0xf541ce5c
-tick,0x80f89a1,0xffdfecf0,0,0xf541ce5c
-tick,0x8123b5c,0xffdff1a0,0,0xf541d1a1,0xf541ceea
-tick,0x8123b65,0xffdff1a0,0,0xf541d1a1,0xf541ceea
-tick,0xf541d2be,0xffdff1e4,0
-tick,0xf541d320,0xffdff1dc,0
-tick,0xf541d384,0xffdff1d8,0
-tick,0xf7db94da,0xffdff0ec,0,0xf541d1a1,0xf541ceea
-tick,0xf7db951c,0xffdff0f0,0,0xf541d1a1,0xf541ceea
-tick,0xf7dbc508,0xffdff14c,0,0xf541d1a1,0xf541ceea
-tick,0xf7dbff21,0xffdff198,0,0xf541d1a1,0xf541ceea
-tick,0xf7edec90,0xffdff0ec,0,0xf541d1a1,0xf541ceea
-tick,0xffffe402,0xffdff488,0
+tick,0x80f82d1,0xffdfe880,0,0,0xf541ce5c
+tick,0x80f89a1,0xffdfecf0,0,0,0xf541ce5c
+tick,0x8123b5c,0xffdff1a0,0,0,0xf541d1a1,0xf541ceea
+tick,0x8123b65,0xffdff1a0,0,0,0xf541d1a1,0xf541ceea
+tick,0xf541d2be,0xffdff1e4,0,0
+tick,0xf541d320,0xffdff1dc,0,0
+tick,0xf541d384,0xffdff1d8,0,0
+tick,0xf7db94da,0xffdff0ec,0,0,0xf541d1a1,0xf541ceea
+tick,0xf7db951c,0xffdff0f0,0,0,0xf541d1a1,0xf541ceea
+tick,0xf7dbc508,0xffdff14c,0,0,0xf541d1a1,0xf541ceea
+tick,0xf7dbff21,0xffdff198,0,0,0xf541d1a1,0xf541ceea
+tick,0xf7edec90,0xffdff0ec,0,0,0xf541d1a1,0xf541ceea
+tick,0xffffe402,0xffdff488,0,0
 profiler,"end"
diff --git a/deps/v8/test/mjsunit/tools/tickprocessor.js b/deps/v8/test/mjsunit/tools/tickprocessor.js
index 83bdac8ab8..abcde897ec 100644
--- a/deps/v8/test/mjsunit/tools/tickprocessor.js
+++ b/deps/v8/test/mjsunit/tools/tickprocessor.js
@@ -334,7 +334,7 @@ function PrintMonitor(outputOrFileName) {
   print = function(str) {
     var strSplit = str.split('\n');
     for (var i = 0; i < strSplit.length; ++i) {
-      s = strSplit[i];
+      var s = strSplit[i];
       realOut.push(s);
       if (outputPos < expectedOut.length) {
         if (expectedOut[outputPos] != s) {
@@ -400,7 +400,10 @@ function driveTickProcessorTest(
       'tickprocessor-test.log', 'tickprocessor-test.ignore-unknown'],
     'GcState': [
       false, false, TickProcessor.VmStates.GC,
-      'tickprocessor-test.log', 'tickprocessor-test.gc-state']
+      'tickprocessor-test.log', 'tickprocessor-test.gc-state'],
+    'FunctionInfo': [
+      false, false, null,
+      'tickprocessor-test-func-info.log', 'tickprocessor-test.func-info']
   };
   for (var testName in testData) {
     print('=== testProcessing-' + testName + ' ===');
diff --git a/deps/v8/test/mjsunit/value-wrapper.js b/deps/v8/test/mjsunit/value-wrapper.js
new file mode 100644
index 0000000000..88330b4497
--- /dev/null
+++ b/deps/v8/test/mjsunit/value-wrapper.js
@@ -0,0 +1,164 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// When calling user-defined functions on strings, booleans or
+// numbers, we should create a wrapper object.
+
+// When running the tests use loops to ensure that the call site moves through
+// the different IC states and that both the runtime system and the generated
+// IC code is tested.
+function RunTests() {
+  for (var i = 0; i < 10; i++) {
+    assertEquals('object', 'xxx'.TypeOfThis());
+    assertEquals('object', true.TypeOfThis(2,3));
+    assertEquals('object', false.TypeOfThis());
+    assertEquals('object', (42).TypeOfThis());
+    assertEquals('object', (3.14).TypeOfThis());
+  }
+  
+  for (var i = 0; i < 10; i++) {
+    assertEquals('object', 'xxx'['TypeOfThis']());
+    assertEquals('object', true['TypeOfThis']());
+    assertEquals('object', false['TypeOfThis']());
+    assertEquals('object', (42)['TypeOfThis']());
+    assertEquals('object', (3.14)['TypeOfThis']());
+  }
+  
+  function CallTypeOfThis(obj) {
+    assertEquals('object', obj.TypeOfThis());
+  }
+  
+  for (var i = 0; i < 10; i++) {
+    CallTypeOfThis('xxx');
+    CallTypeOfThis(true);
+    CallTypeOfThis(false);
+    CallTypeOfThis(42);
+    CallTypeOfThis(3.14);
+  }
+  
+  function TestWithWith(obj) {
+    with (obj) {
+      for (var i = 0; i < 10; i++) {
+        assertEquals('object', TypeOfThis());
+      }
+    }
+  }
+  
+  TestWithWith('xxx');
+  TestWithWith(true);
+  TestWithWith(false);
+  TestWithWith(42);
+  TestWithWith(3.14);
+  
+  for (var i = 0; i < 10; i++) {
+    assertEquals('object', true[7]());
+    assertEquals('object', false[7]());
+    assertEquals('object', (42)[7]());
+    assertEquals('object', (3.14)[7]());
+  }
+
+  for (var i = 0; i < 10; i++) {
+    assertEquals('object', typeof 'xxx'.ObjectValueOf());
+    assertEquals('object', typeof true.ObjectValueOf());
+    assertEquals('object', typeof false.ObjectValueOf());
+    assertEquals('object', typeof (42).ObjectValueOf());
+    assertEquals('object', typeof (3.14).ObjectValueOf());
+  }
+
+  for (var i = 0; i < 10; i++) {
+    assertEquals('[object String]', 'xxx'.ObjectToString());
+    assertEquals('[object Boolean]', true.ObjectToString());
+    assertEquals('[object Boolean]', false.ObjectToString());
+    assertEquals('[object Number]', (42).ObjectToString());
+    assertEquals('[object Number]', (3.14).ObjectToString());
+  }
+}
+
+function TypeOfThis() { return typeof this; }
+
+// Test with normal setup of prototype. 
+String.prototype.TypeOfThis = TypeOfThis;
+Boolean.prototype.TypeOfThis = TypeOfThis;
+Number.prototype.TypeOfThis = TypeOfThis;
+Boolean.prototype[7] = TypeOfThis;
+Number.prototype[7] = TypeOfThis;
+
+String.prototype.ObjectValueOf = Object.prototype.valueOf;
+Boolean.prototype.ObjectValueOf = Object.prototype.valueOf;
+Number.prototype.ObjectValueOf = Object.prototype.valueOf;
+
+String.prototype.ObjectToString = Object.prototype.toString;
+Boolean.prototype.ObjectToString = Object.prototype.toString;
+Number.prototype.ObjectToString = Object.prototype.toString;
+
+RunTests();
+
+// Run test after properties have been set to a different value.
+String.prototype.TypeOfThis = 'x';
+Boolean.prototype.TypeOfThis = 'x';
+Number.prototype.TypeOfThis = 'x';
+Boolean.prototype[7] = 'x';
+Number.prototype[7] = 'x';
+
+String.prototype.TypeOfThis = TypeOfThis;
+Boolean.prototype.TypeOfThis = TypeOfThis;
+Number.prototype.TypeOfThis = TypeOfThis;
+Boolean.prototype[7] = TypeOfThis;
+Number.prototype[7] = TypeOfThis;
+
+RunTests();
+
+// Force the prototype into slow case and run the test again.
+delete String.prototype.TypeOfThis;
+delete Boolean.prototype.TypeOfThis;
+delete Number.prototype.TypeOfThis;
+Boolean.prototype[7];
+Number.prototype[7];
+
+String.prototype.TypeOfThis = TypeOfThis;
+Boolean.prototype.TypeOfThis = TypeOfThis;
+Number.prototype.TypeOfThis = TypeOfThis;
+Boolean.prototype[7] = TypeOfThis;
+Number.prototype[7] = TypeOfThis;
+
+RunTests();
+
+// According to ES3 15.3.4.3 the this value passed to Function.prototyle.apply
+// should wrapped. According to ES5 it should not.
+assertEquals('object', TypeOfThis.apply('xxx', []));
+assertEquals('object', TypeOfThis.apply(true, []));
+assertEquals('object', TypeOfThis.apply(false, []));
+assertEquals('object', TypeOfThis.apply(42, []));
+assertEquals('object', TypeOfThis.apply(3.14, []));
+
+// According to ES3 15.3.4.3 the this value passed to Function.prototyle.call
+// should wrapped. According to ES5 it should not.
+assertEquals('object', TypeOfThis.call('xxx'));
+assertEquals('object', TypeOfThis.call(true));
+assertEquals('object', TypeOfThis.call(false));
+assertEquals('object', TypeOfThis.call(42));
+assertEquals('object', TypeOfThis.call(3.14));