Upgrade V8 to 3.0.8

23 files changed, 871 insertions, 50 deletions

diff --git a/deps/v8/test/mjsunit/array-slice.js b/deps/v8/test/mjsunit/array-slice.js
index 50b5b27306..5ae31dc527 100644
--- a/deps/v8/test/mjsunit/array-slice.js
+++ b/deps/v8/test/mjsunit/array-slice.js
@@ -231,3 +231,62 @@
   func(['a', 1, undefined], 'a', 1, undefined);
   func(['a', 1, undefined, void(0)], 'a', 1, undefined, void(0));
 })();
+
+// Check slicing on arguments object when missing arguments get assigined.
+(function() {
+  function func(x, y) {
+    assertEquals(1, arguments.length);
+    assertEquals(undefined, y);
+    y = 239;
+    assertEquals(1, arguments.length);  // arguments length is the same.
+    assertEquals([x], Array.prototype.slice.call(arguments, 0));
+  }
+
+  func('a');
+})();
+
+// Check slicing on arguments object when length property has been set.
+(function() {
+  function func(x, y) {
+    assertEquals(1, arguments.length);
+    arguments.length = 7;
+    assertEquals([x,,,,,,,], Array.prototype.slice.call(arguments, 0));
+  }
+
+  func('a');
+})();
+
+// Check slicing on arguments object when length property has been set to
+// some strange value.
+(function() {
+  function func(x, y) {
+    assertEquals(1, arguments.length);
+    arguments.length = 'foobar';
+    assertEquals([], Array.prototype.slice.call(arguments, 0));
+  }
+
+  func('a');
+})();
+
+// Check slicing on arguments object when extra argument has been added
+// via indexed assignment.
+(function() {
+  function func(x, y) {
+    assertEquals(1, arguments.length);
+    arguments[3] = 239;
+    assertEquals([x], Array.prototype.slice.call(arguments, 0));
+  }
+
+  func('a');
+})();
+
+// Check slicing on arguments object when argument has been deleted by index.
+(function() {
+  function func(x, y, z) {
+    assertEquals(3, arguments.length);
+    delete arguments[1];
+    assertEquals([x,,z], Array.prototype.slice.call(arguments, 0));
+  }
+
+  func('a', 'b', 'c');
+})();
diff --git a/deps/v8/test/mjsunit/closures.js b/deps/v8/test/mjsunit/closures.js
new file mode 100644
index 0000000000..ee487a4b03
--- /dev/null
+++ b/deps/v8/test/mjsunit/closures.js
@@ -0,0 +1,45 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function runner(f, expected) {
+  for (var i = 0; i < 1000000; i++) {
+    assertEquals(expected, f.call(this));
+  }
+}
+
+function test(n) {
+  function MyFunction() {
+    var result = n * 2 + arguments.length;
+    return result;
+  }
+  runner(MyFunction, n * 2);
+}
+
+test(1);
+test(42);
+test(239);
+
diff --git a/deps/v8/test/mjsunit/compiler/regress-3249650.js b/deps/v8/test/mjsunit/compiler/regress-3249650.js
index 1f06090ec5..289e061c77 100644
--- a/deps/v8/test/mjsunit/compiler/regress-3249650.js
+++ b/deps/v8/test/mjsunit/compiler/regress-3249650.js
@@ -50,4 +50,4 @@ function test(x) {
 }
 
 var x = {a: {b: "" }};
-for (var i = 0; i < 1000000; i++) test(x);
+for (var i = 0; i < 20000; i++) test(x);
diff --git a/deps/v8/test/mjsunit/compiler/regress-closures-with-eval.js b/deps/v8/test/mjsunit/compiler/regress-closures-with-eval.js
new file mode 100644
index 0000000000..507d74f33e
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-closures-with-eval.js
@@ -0,0 +1,51 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Verifies that closures in presence of eval work fine.
+function withEval(expr, filter) {
+  function walk(v) {
+    for (var i in v) {
+      for (var i in v) {}
+    }
+    return filter(v);
+  }
+
+  var o = eval(expr);
+  return walk(o);
+}
+
+function makeTagInfoJSON(n) {
+  var a = new Array(n);
+  for (var i = 0; i < n; i++) a.push('{}');
+  return a;
+}
+
+var expr = '([' + makeTagInfoJSON(128).join(', ') + '])'
+
+for (var n = 0; n < 300; n++) {
+  withEval(expr, function(a) { return a; });
+}
diff --git a/deps/v8/test/mjsunit/debug-breakpoints.js b/deps/v8/test/mjsunit/debug-breakpoints.js
index 0bc349c4ea..13020343b0 100644
--- a/deps/v8/test/mjsunit/debug-breakpoints.js
+++ b/deps/v8/test/mjsunit/debug-breakpoints.js
@@ -118,3 +118,89 @@ Debug.clearBreakPoint(bp3);
 //   b=2;
 // }
 assertTrue(Debug.showBreakPoints(g).indexOf("[B0]") < 0);
+
+
+// Tests for setting break points by script id and position.
+function setBreakpointByPosition(f, position)
+{
+  var break_point = Debug.setBreakPointByScriptIdAndPosition(
+      Debug.findScript(f).id,
+      position + Debug.sourcePosition(f),
+      "",
+      true);
+  return break_point.number();
+}
+
+bp = setBreakpointByPosition(f, 0);
+assertEquals("() {[B0]a=1;b=2}", Debug.showBreakPoints(f));
+Debug.clearBreakPoint(bp);
+assertEquals("() {a=1;b=2}", Debug.showBreakPoints(f));
+bp1 = setBreakpointByPosition(f, 8);
+assertEquals("() {a=1;[B0]b=2}", Debug.showBreakPoints(f));
+bp2 = setBreakpointByPosition(f, 4);
+assertEquals("() {[B0]a=1;[B1]b=2}", Debug.showBreakPoints(f));
+bp3 = setBreakpointByPosition(f, 11);
+assertEquals("() {[B0]a=1;[B1]b=2[B2]}", Debug.showBreakPoints(f));
+Debug.clearBreakPoint(bp1);
+assertEquals("() {[B0]a=1;b=2[B1]}", Debug.showBreakPoints(f));
+Debug.clearBreakPoint(bp2);
+assertEquals("() {a=1;b=2[B0]}", Debug.showBreakPoints(f));
+Debug.clearBreakPoint(bp3);
+assertEquals("() {a=1;b=2}", Debug.showBreakPoints(f));
+
+bp = setBreakpointByPosition(g, 0);
+//function g() {
+//[B0]a=1;
+//b=2;
+//}
+assertTrue(Debug.showBreakPoints(g).indexOf("[B0]a=1;") > 0);
+Debug.clearBreakPoint(bp);
+//function g() {
+//a=1;
+//b=2;
+//}
+assertTrue(Debug.showBreakPoints(g).indexOf("[B0]") < 0);
+
+//Second test set and clear breakpoints on lines 1, 2 and 3 (column = 0).
+bp1 = setBreakpointByPosition(g, 12);
+//function g() {
+//a=1;
+//[B0]b=2;
+//}
+assertTrue(Debug.showBreakPoints(g).indexOf("[B0]b=2;") > 0);
+bp2 = setBreakpointByPosition(g, 5);
+//function g() {
+//[B0]a=1;
+//[B1]b=2;
+//}
+assertTrue(Debug.showBreakPoints(g).indexOf("[B0]a=1;") > 0);
+assertTrue(Debug.showBreakPoints(g).indexOf("[B1]b=2;") > 0);
+bp3 = setBreakpointByPosition(g, 19);
+//function g() {
+//[B0]a=1;
+//[B1]b=2;
+//}[B2]
+assertTrue(Debug.showBreakPoints(g).indexOf("[B0]a=1;") > 0);
+assertTrue(Debug.showBreakPoints(g).indexOf("[B1]b=2;") > 0);
+assertTrue(Debug.showBreakPoints(g).indexOf("[B2]}") > 0);
+Debug.clearBreakPoint(bp1);
+//function g() {
+//[B0]a=1;
+//b=2;
+//}[B1]
+assertTrue(Debug.showBreakPoints(g).indexOf("[B0]a=1;") > 0);
+assertTrue(Debug.showBreakPoints(g).indexOf("[B1]}") > 0);
+assertTrue(Debug.showBreakPoints(g).indexOf("[B2]") < 0);
+Debug.clearBreakPoint(bp2);
+//function g() {
+//a=1;
+//b=2;
+//}[B0]
+assertTrue(Debug.showBreakPoints(g).indexOf("[B0]}") > 0);
+assertTrue(Debug.showBreakPoints(g).indexOf("[B1]") < 0);
+Debug.clearBreakPoint(bp3);
+//function g() {
+//a=1;
+//b=2;
+//}
+assertTrue(Debug.showBreakPoints(g).indexOf("[B0]") < 0);
diff --git a/deps/v8/test/mjsunit/debug-listbreakpoints.js b/deps/v8/test/mjsunit/debug-listbreakpoints.js
new file mode 100644
index 0000000000..de0114fe09
--- /dev/null
+++ b/deps/v8/test/mjsunit/debug-listbreakpoints.js
@@ -0,0 +1,210 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-debug-as debug
+// Get the Debug object exposed from the debug context global object.
+Debug = debug.Debug
+
+// Note: the following tests only checks the debugger handling of the
+// setexceptionbreak command.  It does not test whether the debugger
+// actually breaks on exceptions or not.  That functionality is tested
+// in test-debug.cc instead.
+
+// Note: The following function g() is purposedly placed here so that
+// its line numbers will not change should we add more lines of test code
+// below.  The test checks for these line numbers.
+
+function g() { // line 40
+  var x = 5; 
+  var y = 6;
+  var z = 7;
+};
+
+var first_lineno = 40; // Must be the line number of g() above.
+                       // The first line of the file is line 0.
+
+// Simple function which stores the last debug event.
+listenerComplete = false;
+exception = false;
+
+var breakpoint1 = -1;
+var base_request = '"seq":0,"type":"request","command":"listbreakpoints"'
+
+function safeEval(code) {
+  try {
+    return eval('(' + code + ')');
+  } catch (e) {
+    assertEquals(void 0, e);
+    return undefined;
+  }
+}
+
+
+function clearBreakpoint(dcp, breakpoint_id) {
+  var base_request = '"seq":0,"type":"request","command":"clearbreakpoint"'
+  var arguments = '{"breakpoint":' + breakpoint_id + '}'
+  var request = '{' + base_request + ',"arguments":' + arguments + '}'
+  var json_response = dcp.processDebugJSONRequest(request);
+}
+
+
+function setBreakOnException(dcp, type, enabled) {
+  var base_request = '"seq":0,"type":"request","command":"setexceptionbreak"'
+  var arguments = '{"type":"' + type + '","enabled":' + enabled + '}'
+  var request = '{' + base_request + ',"arguments":' + arguments + '}'
+  var json_response = dcp.processDebugJSONRequest(request);
+}
+
+
+function testArguments(dcp, success, breakpoint_ids, breakpoint_linenos,
+                       break_on_all, break_on_uncaught) {
+  var request = '{' + base_request + '}'
+  var json_response = dcp.processDebugJSONRequest(request);
+  var response = safeEval(json_response);
+  var num_breakpoints = breakpoint_ids.length;
+
+  if (success) {
+    assertTrue(response.success, json_response);
+    assertEquals(response.body.breakpoints.length, num_breakpoints);
+    if (num_breakpoints > 0) {
+      var breakpoints = response.body.breakpoints;
+      for (var i = 0; i < breakpoints.length; i++) {
+        var id = breakpoints[i].number;
+        var found = false;
+        for (var j = 0; j < num_breakpoints; j++) {
+          if (breakpoint_ids[j] == id) {
+            assertEquals(breakpoints[i].line, breakpoint_linenos[j]);
+            found = true;
+            break;
+          }
+        }
+        assertTrue(found, "found unexpected breakpoint " + id);
+      }
+    }
+    assertEquals(response.body.breakOnExceptions, break_on_all);
+    assertEquals(response.body.breakOnUncaughtExceptions, break_on_uncaught);
+  } else {
+    assertFalse(response.success, json_response);
+  }
+}
+
+
+function listener(event, exec_state, event_data, data) {
+  try {
+  if (event == Debug.DebugEvent.Break) {
+    // Get the debug command processor.
+    var dcp = exec_state.debugCommandProcessor("unspecified_running_state");
+
+    // Test with the 1 breakpoint already set:
+    testArguments(dcp, true, [ breakpoint1 ], [ first_lineno ], false, false);
+
+    setBreakOnException(dcp, "all", true);
+    testArguments(dcp, true, [ breakpoint1 ], [ first_lineno ], true, false);
+
+    setBreakOnException(dcp, "uncaught", true);
+    testArguments(dcp, true, [ breakpoint1 ], [ first_lineno ], true, true);
+
+    setBreakOnException(dcp, "all", false);
+    testArguments(dcp, true, [ breakpoint1 ], [ first_lineno ], false, true);
+
+    setBreakOnException(dcp, "uncaught", false);
+    testArguments(dcp, true, [ breakpoint1 ], [ first_lineno ], false, false);
+
+    // Clear the one breakpoint and retest:
+    clearBreakpoint(dcp, breakpoint1);
+    testArguments(dcp, true, [], [], false, false);
+
+    setBreakOnException(dcp, "all", true);
+    testArguments(dcp, true, [], [], true, false);
+
+    setBreakOnException(dcp, "uncaught", true);
+    testArguments(dcp, true, [], [], true, true);
+
+    setBreakOnException(dcp, "all", false);
+    testArguments(dcp, true, [], [], false, true);
+
+    setBreakOnException(dcp, "uncaught", false);
+    testArguments(dcp, true, [], [], false, false);
+
+    // Set some more breakpoints, and clear them in various orders:
+    var bp2 = Debug.setBreakPoint(g, 1, 0);
+    testArguments(dcp, true, [ bp2 ],
+                  [ first_lineno + 1 ],
+                  false, false);
+
+    var bp3 = Debug.setBreakPoint(g, 2, 0);
+    testArguments(dcp, true, [ bp2, bp3 ],
+                  [ first_lineno + 1, first_lineno + 2 ],
+                  false, false);
+
+    var bp4 = Debug.setBreakPoint(g, 3, 0);
+    testArguments(dcp, true, [ bp2, bp3, bp4 ],
+                  [ first_lineno + 1, first_lineno + 2, first_lineno + 3 ],
+                  false, false);
+
+    clearBreakpoint(dcp, bp3);
+    testArguments(dcp, true, [ bp2, bp4 ],
+                  [ first_lineno + 1, first_lineno + 3 ],
+                  false, false);
+
+    clearBreakpoint(dcp, bp4);
+    testArguments(dcp, true, [ bp2 ],
+                  [ first_lineno + 1 ],
+                  false, false);
+
+    var bp5 = Debug.setBreakPoint(g, 3, 0);
+    testArguments(dcp, true, [ bp2, bp5 ],
+                  [ first_lineno + 1, first_lineno + 3 ],
+                  false, false);
+
+    clearBreakpoint(dcp, bp2);
+    testArguments(dcp, true, [ bp5 ],
+                  [ first_lineno + 3 ],
+                  false, false);
+
+    clearBreakpoint(dcp, bp5);
+    testArguments(dcp, true, [], [], false, false);
+
+    // Indicate that all was processed.
+    listenerComplete = true;
+
+  }
+  } catch (e) {
+    exception = e
+  };
+};
+
+// Add the debug event listener.
+Debug.setListener(listener);
+
+// Set a break point and call to invoke the debug event listener.
+breakpoint1 = Debug.setBreakPoint(g, 0, 0);
+g();
+
+// Make sure that the debug event listener vas invoked.
+assertFalse(exception, "exception in listener")
+assertTrue(listenerComplete, "listener did not run to completion");
diff --git a/deps/v8/test/mjsunit/debug-liveedit-diff.js b/deps/v8/test/mjsunit/debug-liveedit-diff.js
index 7edf704f7b..0d26a30b40 100644
--- a/deps/v8/test/mjsunit/debug-liveedit-diff.js
+++ b/deps/v8/test/mjsunit/debug-liveedit-diff.js
@@ -31,11 +31,15 @@
 Debug = debug.Debug
 
 function CheckCompareOneWay(s1, s2) {
-  var diff_array = Debug.LiveEdit.TestApi.CompareStringsLinewise(s1, s2);
+  var diff_array = Debug.LiveEdit.TestApi.CompareStrings(s1, s2);
 
   var pos1 = 0;
   var pos2 = 0;
   print("Compare:");
+  print("s1='" + s1 + "'");
+  print("s2='" + s2 + "'");
+  print("Diff:");
+  print("" + diff_array);
   for (var i = 0; i < diff_array.length; i += 3) {
     var similar_length = diff_array[i] - pos1;
     assertEquals(s1.substring(pos1, pos1 + similar_length),
@@ -45,12 +49,12 @@ function CheckCompareOneWay(s1, s2) {
     pos1 += similar_length;
     pos2 += similar_length;
     print("<<< " + pos1 + " " + diff_array[i + 1]);
-    print(s1.substring(pos1, pos1 + diff_array[i + 1]));
+    print(s1.substring(pos1, diff_array[i + 1]));
     print("===");
-    print(s2.substring(pos2, pos2 + diff_array[i + 2]));
+    print(s2.substring(pos2, diff_array[i + 2]));
     print(">>> " + pos2 + " " + diff_array[i + 2]);
-    pos1 += diff_array[i + 1];
-    pos2 += diff_array[i + 2];
+    pos1 = diff_array[i + 1];
+    pos2 = diff_array[i + 2];
   }
   {
     // After last change
@@ -64,9 +68,18 @@ function CheckCompareOneWay(s1, s2) {
   print("");
 }
 
-function CheckCompare(s1, s2) {
+function CheckCompareOneWayPlayWithLF(s1, s2) {
+  var s1Oneliner = s1.replace(/\n/g, ' ');
+  var s2Oneliner = s2.replace(/\n/g, ' ');
   CheckCompareOneWay(s1, s2);
-  CheckCompareOneWay(s2, s1);
+  CheckCompareOneWay(s1Oneliner, s2);
+  CheckCompareOneWay(s1, s2Oneliner);
+  CheckCompareOneWay(s1Oneliner, s2Oneliner);
+}
+
+function CheckCompare(s1, s2) {
+  CheckCompareOneWayPlayWithLF(s1, s2);
+  CheckCompareOneWayPlayWithLF(s2, s1);
 }
 
 CheckCompare("", "");
diff --git a/deps/v8/test/mjsunit/debug-liveedit-newsource.js b/deps/v8/test/mjsunit/debug-liveedit-newsource.js
index 7b8945a705..a60e69f902 100644
--- a/deps/v8/test/mjsunit/debug-liveedit-newsource.js
+++ b/deps/v8/test/mjsunit/debug-liveedit-newsource.js
@@ -64,6 +64,6 @@ print("Change log: " + JSON.stringify(change_log) + "\n");
 assertEquals("Capybara", ChooseAnimal());
 // Global variable do not get changed (without restarting script).
 assertEquals(25, something1);
-// Function is oneliner, so currently it is treated as damaged and not patched.
-assertEquals(17, ChooseNumber());
+// We should support changes in oneliners.
+assertEquals(18, ChooseNumber());
 assertEquals("Hello Peter", ChooseAnimal.Factory()("Peter"));
diff --git a/deps/v8/test/mjsunit/debug-setexceptionbreak.js b/deps/v8/test/mjsunit/debug-setexceptionbreak.js
new file mode 100644
index 0000000000..3dc27dd5c7
--- /dev/null
+++ b/deps/v8/test/mjsunit/debug-setexceptionbreak.js
@@ -0,0 +1,119 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-debug-as debug
+// Get the Debug object exposed from the debug context global object.
+Debug = debug.Debug
+
+// Note: the following tests only checks the debugger handling of the
+// setexceptionbreak command.  It does not test whether the debugger
+// actually breaks on exceptions or not.  That functionality is tested
+// in test-debug.cc instead.
+
+// Simple function which stores the last debug event.
+listenerComplete = false;
+exception = false;
+
+var breakpoint = -1;
+var base_request = '"seq":0,"type":"request","command":"setexceptionbreak"'
+
+function safeEval(code) {
+  try {
+    return eval('(' + code + ')');
+  } catch (e) {
+    assertEquals(void 0, e);
+    return undefined;
+  }
+}
+
+function testArguments(dcp, arguments, success, type, enabled) {
+  var request = '{' + base_request + ',"arguments":' + arguments + '}'
+  var json_response = dcp.processDebugJSONRequest(request);
+  var response = safeEval(json_response);
+  if (success) {
+    assertTrue(response.success, json_response);
+    assertEquals(response.body.type, type);
+    assertEquals(response.body.enabled, enabled);
+  } else {
+    assertFalse(response.success, json_response);
+  }
+}
+
+function listener(event, exec_state, event_data, data) {
+  try {
+  if (event == Debug.DebugEvent.Break) {
+    // Get the debug command processor.
+    var dcp = exec_state.debugCommandProcessor("unspecified_running_state");
+
+    // Test some illegal setexceptionbreak requests.
+    var request = '{' + base_request + '}'
+    var response = safeEval(dcp.processDebugJSONRequest(request));
+    assertFalse(response.success);
+
+    testArguments(dcp, '{}', false);
+    testArguments(dcp, '{"type":0}', false);
+
+    // Test some legal setexceptionbreak requests with default.
+    // Note: by default, break on exceptions should be disabled.  Hence,
+    // the first time, we send the command with no enabled arg, the debugger
+    // should toggle it on.  The second time, it should toggle it off.
+    testArguments(dcp, '{"type":"all"}', true, "all", true);
+    testArguments(dcp, '{"type":"all"}', true, "all", false);
+    testArguments(dcp, '{"type":"uncaught"}', true, "uncaught", true);
+    testArguments(dcp, '{"type":"uncaught"}', true, "uncaught", false);
+
+    // Test some legal setexceptionbreak requests with explicit enabled arg.
+    testArguments(dcp, '{"type":"all","enabled":true}', true, "all", true);
+    testArguments(dcp, '{"type":"all","enabled":false}', true, "all", false);
+
+    testArguments(dcp, '{"type":"uncaught","enabled":true}', true,
+                  "uncaught", true);
+    testArguments(dcp, '{"type":"uncaught","enabled":false}', true,
+                  "uncaught", false);
+
+    // Indicate that all was processed.
+    listenerComplete = true;
+
+  }
+  } catch (e) {
+    exception = e
+  };
+};
+
+// Add the debug event listener.
+Debug.setListener(listener);
+
+function g() {};
+
+
+// Set a break point and call to invoke the debug event listener.
+breakpoint = Debug.setBreakPoint(g, 0, 0);
+g();
+
+// Make sure that the debug event listener vas invoked.
+assertFalse(exception, "exception in listener")
+assertTrue(listenerComplete, "listener did not run to completion");
diff --git a/deps/v8/test/mjsunit/delay-syntax-error.js b/deps/v8/test/mjsunit/delay-syntax-error.js
index 4fcb1435c5..64cc1429bb 100644
--- a/deps/v8/test/mjsunit/delay-syntax-error.js
+++ b/deps/v8/test/mjsunit/delay-syntax-error.js
@@ -25,17 +25,18 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// To be compatible with KJS syntax errors for illegal return, break
-// and continue should be delayed to runtime.
+// To be compatible with JSC syntax errors for illegal returns should be delayed
+// to runtime.
+// Invalid continue and break statements are caught at compile time.
 
-// Do not throw syntax errors for illegal return, break and continue
-// at compile time.
+// Do not throw syntax errors for illegal return at compile time.
 assertDoesNotThrow("if (false) return;");
-assertDoesNotThrow("if (false) break;");
-assertDoesNotThrow("if (false) continue;");
 
-// Throw syntax errors for illegal return, break and continue at
-// compile time.
+// Throw syntax errors for illegal break and continue at compile time.
+assertThrows("if (false) break;");
+assertThrows("if (false) continue;");
+
+// Throw syntax errors for illegal return, break and continue at runtime.
 assertThrows("return;");
 assertThrows("break;");
 assertThrows("continue;");
diff --git a/deps/v8/test/mjsunit/error-constructors.js b/deps/v8/test/mjsunit/error-constructors.js
index ca2aa060a5..8f463fc27c 100644
--- a/deps/v8/test/mjsunit/error-constructors.js
+++ b/deps/v8/test/mjsunit/error-constructors.js
@@ -1,4 +1,4 @@
-// Copyright 2009 the V8 project authors. All rights reserved.
+// Copyright 2011 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
@@ -30,3 +30,32 @@ assertFalse(e.hasOwnProperty('message'));
 Error.prototype.toString = Object.prototype.toString;
 assertEquals("[object Error]", Error.prototype.toString());
 assertEquals(Object.prototype, Error.prototype.__proto__);
+
+// Check that error construction does not call setters for the
+// properties on error objects in prototypes.
+function fail() { assertTrue(false); };
+ReferenceError.prototype.__defineSetter__('stack', fail);
+ReferenceError.prototype.__defineSetter__('message', fail);
+ReferenceError.prototype.__defineSetter__('type', fail);
+ReferenceError.prototype.__defineSetter__('arguments', fail);
+var e0 = new ReferenceError();
+var e1 = new ReferenceError('123');
+assertTrue(e1.hasOwnProperty('message'));
+assertTrue(e0.hasOwnProperty('stack'));
+assertTrue(e1.hasOwnProperty('stack'));
+assertTrue(e0.hasOwnProperty('type'));
+assertTrue(e1.hasOwnProperty('type'));
+assertTrue(e0.hasOwnProperty('arguments'));
+assertTrue(e1.hasOwnProperty('arguments'));
+
+// Check that the name property on error prototypes is read-only and
+// dont-delete. This is not specified, but allowing overwriting the
+// name property with a getter can leaks error objects from different
+// script tags in the same context in a browser setting. We therefore
+// disallow changes to the name property on error objects.
+assertEquals("ReferenceError", ReferenceError.prototype.name);
+delete ReferenceError.prototype.name;
+assertEquals("ReferenceError", ReferenceError.prototype.name);
+ReferenceError.prototype.name = "not a reference error";
+assertEquals("ReferenceError", ReferenceError.prototype.name);
+
diff --git a/deps/v8/test/mjsunit/indexed-accessors.js b/deps/v8/test/mjsunit/indexed-accessors.js
index 395f2ab394..16348570e2 100644
--- a/deps/v8/test/mjsunit/indexed-accessors.js
+++ b/deps/v8/test/mjsunit/indexed-accessors.js
@@ -81,19 +81,6 @@ testArray();
 expected[0] = 111;
 testArray();
 
-// The functionality is not implemented for arrays due to performance issues.
-var a = [ 1 ];
-a.__defineGetter__('2', function() { return 7; });
-assertEquals(undefined, a[2]);
-assertEquals(1, a.length);
-var b = 0;
-a.__defineSetter__('5', function(y) { b = y; });
-assertEquals(1, a.length);
-a[5] = 42;
-assertEquals(0, b);
-assertEquals(42, a[5]);
-assertEquals(6, a.length);
-
 // Using a setter where only a getter is defined throws an exception.
 var q = {};
 q.__defineGetter__('0', function() { return 42; });
diff --git a/deps/v8/test/mjsunit/mjsunit.status b/deps/v8/test/mjsunit/mjsunit.status
index eeeb3dc112..057c0fa874 100644
--- a/deps/v8/test/mjsunit/mjsunit.status
+++ b/deps/v8/test/mjsunit/mjsunit.status
@@ -109,11 +109,18 @@ regress/regress-3247124: SKIP
 ##############################################################################
 [ $arch == arm && $crankshaft ]
 
-# Test that currently fail with crankshaft on ARM.
+# Test that currently fails with crankshaft on ARM.
 compiler/simple-osr: FAIL
 
 
 ##############################################################################
+[ $arch == x64 && $crankshaft ]
+
+# BUG (1026) This test is currently flaky.
+compiler/simple-osr: SKIP
+
+
+##############################################################################
 [ $arch == mips ]
 
 # Skip all tests on MIPS.
diff --git a/deps/v8/test/mjsunit/regexp.js b/deps/v8/test/mjsunit/regexp.js
index 4c1d2e315f..8d776ad5fb 100644
--- a/deps/v8/test/mjsunit/regexp.js
+++ b/deps/v8/test/mjsunit/regexp.js
@@ -84,15 +84,14 @@ assertEquals(result[4], 'D');
 assertEquals(result[5], 'E');
 assertEquals(result[6], 'F');
 
-// Some tests from the Mozilla tests, where our behavior differs from
+// Some tests from the Mozilla tests, where our behavior used to differ from
 // SpiderMonkey.
 // From ecma_3/RegExp/regress-334158.js
 assertTrue(/\ca/.test( "\x01" ));
 assertFalse(/\ca/.test( "\\ca" ));
-// Passes in KJS, fails in IrregularExpressions.
-// See http://code.google.com/p/v8/issues/detail?id=152
-//assertTrue(/\c[a/]/.test( "\x1ba/]" ));
-
+assertFalse(/\ca/.test( "ca" ));
+assertTrue(/\c[a/]/.test( "\\ca" ));
+assertTrue(/\c[a/]/.test( "\\c/" ));
 
 // Test \c in character class
 re = /^[\cM]$/;
@@ -104,11 +103,29 @@ assertFalse(re.test("\x03"));  // I.e., read as \cc
 
 re = /^[\c]]$/;
 assertTrue(re.test("c]"));
-assertFalse(re.test("\\]"));
+assertTrue(re.test("\\]"));
 assertFalse(re.test("\x1d"));  // ']' & 0x1f
-assertFalse(re.test("\\]"));
 assertFalse(re.test("\x03]"));  // I.e., read as \cc
 
+re = /^[\c1]$/;  // Digit control characters are masked in character classes.
+assertTrue(re.test("\x11"));
+assertFalse(re.test("\\"));
+assertFalse(re.test("c"));
+assertFalse(re.test("1"));
+
+re = /^[\c_]$/;  // Underscore control character is masked in character classes.
+assertTrue(re.test("\x1f"));
+assertFalse(re.test("\\"));
+assertFalse(re.test("c"));
+assertFalse(re.test("_"));
+
+re = /^[\c$]$/;  // Other characters are interpreted literally.
+assertFalse(re.test("\x04"));
+assertTrue(re.test("\\"));
+assertTrue(re.test("c"));
+assertTrue(re.test("$"));
+
+assertTrue(/^[Z-\c-e]*$/.test("Z[\\cde"));
 
 // Test that we handle \s and \S correctly inside some bizarre
 // character classes.
diff --git a/deps/v8/test/mjsunit/regress/regress-1015.js b/deps/v8/test/mjsunit/regress/regress-1015.js
new file mode 100644
index 0000000000..9e4406a9aa
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-1015.js
@@ -0,0 +1,66 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// See: http://code.google.com/p/v8/issues/detail?id=1015
+
+// Object and array literals should be created using DefineOwnProperty, and
+// therefore not hit setters in the prototype.
+
+function mkFail(message) {
+  return function () { assertUnreachable(message); }
+}
+
+Object.defineProperty(Object.prototype, "foo",
+                      {get: mkFail("oget"), set: mkFail("oset")});
+Object.defineProperty(Array.prototype, "2",
+                      {get: mkFail("aget"), set: mkFail("aset")});
+
+function inFunction() {
+  for (var i = 0; i < 10; i++) {
+    // in loop.
+    var ja = JSON.parse('[1,2,3,4]');
+    var jo = JSON.parse('{"bar": 10, "foo": 20}')
+    var jop = JSON.parse('{"bar": 10, "__proto__": { }, "foo": 20}')
+    var a = [1,2,3,4];
+    var o = { bar: 10, foo: 20 };
+    var op = { __proto__: { set bar(v) { assertUnreachable("bset"); } },
+               bar: 10 };
+  }
+}
+
+for (var i = 0; i < 10; i++) {
+  // In global scope.
+  var ja = JSON.parse('[1,2,3,4]');
+  var jo = JSON.parse('{"bar": 10, "foo": 20}')
+  var jop = JSON.parse('{"bar": 10, "__proto__": { }, "foo": 20}')
+  var a = [1,2,3,4];
+  var o = { bar: 10, foo: 20 };
+  var op = { __proto__: { set bar(v) { assertUnreachable("bset"); } },
+             bar: 10 };
+  // In function scope.
+  inFunction();
+}
diff --git a/deps/v8/test/mjsunit/regress/regress-1017.js b/deps/v8/test/mjsunit/regress/regress-1017.js
new file mode 100644
index 0000000000..3daf5428ab
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-1017.js
@@ -0,0 +1,36 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// See: http://code.google.com/p/v8/issues/detail?id=1017
+
+// 32 ASCII-characters followed by a non-ASCII character.
+// This causes an internal buffer to first expand to 64 bytes, then expand the
+// 32 ASCII characters to 64 bytes of UC16 characters, leaving no room
+// to store the 33rd character. This fails an ASSERT in debug mode.
+
+assertEquals(33, "12345678901234567890123456789012\u2028".length);
+
diff --git a/deps/v8/test/mjsunit/regress/regress-1020.js b/deps/v8/test/mjsunit/regress/regress-1020.js
new file mode 100644
index 0000000000..307a61e439
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-1020.js
@@ -0,0 +1,32 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function isObject(o) {
+  return o instanceof Object;
+}
+
+assertTrue(isObject(Object));
diff --git a/deps/v8/test/mjsunit/regress/regress-1036894.js b/deps/v8/test/mjsunit/regress/regress-1036894.js
index d89ceda11c..03ed8f9d61 100644
--- a/deps/v8/test/mjsunit/regress/regress-1036894.js
+++ b/deps/v8/test/mjsunit/regress/regress-1036894.js
@@ -25,14 +25,14 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-xeval = function(s) { eval(s); }
-xeval("$=function anonymous() { /*noex*/do {} while(({ get x(x) { break ; }, set x() { (undefined);} })); }");
+assertThrows("$=function anonymous() { /*noex*/do {} while(({ get x(x) { break ; }, set x() { (undefined);} })); }");
 
-foo = function() { eval("$=function anonymous() { /*noex*/do {} while(({ get x(x) { break ; }, set x() { (undefined);} })); }"); }
+function foo() {
+  assertThrows("$=function anonymous() { /*noex*/do {} while(({ get x(x) { break ; }, set x() { (undefined);} })); }");
+}
 foo();
 
-xeval = function(s) { eval(s); }
-eval("$=function anonymous() { /*noex*/do {} while(({ get x(x) { break ; }, set x() { (undefined);} })); }");
+assertThrows("$=function anonymous() { /*noex*/do {} while(({ get x(x) { break ; }, set x() { (undefined);} })); }");
 
 xeval = function(s) { eval(s); }
 xeval('$=function(){L: {break L;break L;}};');
diff --git a/deps/v8/test/mjsunit/regress/regress-192.js b/deps/v8/test/mjsunit/regress/regress-192.js
index 8f0978f1b6..a8e5e9da33 100644
--- a/deps/v8/test/mjsunit/regress/regress-192.js
+++ b/deps/v8/test/mjsunit/regress/regress-192.js
@@ -30,9 +30,16 @@
 
 // See http://code.google.com/p/v8/issues/detail?id=192
 
+// UPDATE: This bug report is no longer valid. In ES5, creating object
+// literals MUST NOT trigger inherited accessors, but act as if creating
+// the properties using DefineOwnProperty.
+
 Object.prototype.__defineGetter__("x", function() {});
+Object.prototype.__defineSetter__("y",
+                                  function() { assertUnreachable("setter"); });
 
-// Creating this object literal will throw an exception because we are
+// Creating this object literal will *not* throw an exception because we are
 // assigning to a property that has only a getter.
-assertThrows("({ x: 42 })");
-
+var x = ({ x: 42, y: 37 });
+assertEquals(42, x.x);
+assertEquals(37, x.y);
diff --git a/deps/v8/test/mjsunit/regress/regress-900.js b/deps/v8/test/mjsunit/regress/regress-900.js
new file mode 100644
index 0000000000..9f94348dd3
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-900.js
@@ -0,0 +1,46 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Check that we allow accessors on JSArray elements.
+
+var a = [];
+var b = {}
+Object.defineProperty(a, "1", {get: function() {return "foo";}});
+Object.defineProperty(
+    b, "1", {get: function() {return "bar";}, set: function() {this.x = 42;}});
+assertEquals(a[1], 'foo');
+assertEquals(b[1], 'bar');
+// Make sure we can't overwrite an accessor, but that the setter is
+// instead called.
+b[1] = 'foobar';
+assertEquals(b[1], 'bar');
+assertEquals(b.x, 42);
+
+var desc = Object.getOwnPropertyDescriptor(b, "1");
+assertEquals(desc['writable'], undefined);
+assertFalse(desc['enumerable']);
+assertFalse(desc['configurable']);
diff --git a/deps/v8/test/mjsunit/regress/regress-990205.js b/deps/v8/test/mjsunit/regress/regress-990205.js
index 1ab5bf88b4..b3024c23fd 100644
--- a/deps/v8/test/mjsunit/regress/regress-990205.js
+++ b/deps/v8/test/mjsunit/regress/regress-990205.js
@@ -25,11 +25,15 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
+// We throw syntax errors early for invalid break and continue statements.
+// (Notice that the example isn't valid ECMAScript due to the
+// function declaration that is not at top level.)
+
 function f() {
   // Force eager compilation of x through the use of eval. The break
   // in function x should not try to break out of the enclosing while.
   return eval("while(0) function x() { break; }; 42");
 };
 
-assertEquals(42, f());
+assertThrows("f()");
 
diff --git a/deps/v8/test/mjsunit/regress/regress-create-exception.js b/deps/v8/test/mjsunit/regress/regress-create-exception.js
index 7d53f1cd65..2119ce2b64 100644
--- a/deps/v8/test/mjsunit/regress/regress-create-exception.js
+++ b/deps/v8/test/mjsunit/regress/regress-create-exception.js
@@ -49,7 +49,7 @@ function foo() {
       return j;  // Make sure that future optimizations don't eliminate j.
     } catch(e) {
       ok = true;
-      assertTrue(re.test(e));
+      assertTrue(re.test(e), 'e: ' + e);
     }
     assertTrue(ok);
   }
diff --git a/deps/v8/test/mjsunit/testcfg.py b/deps/v8/test/mjsunit/testcfg.py
index d8fe24d37a..5cb46bc29a 100644
--- a/deps/v8/test/mjsunit/testcfg.py
+++ b/deps/v8/test/mjsunit/testcfg.py
@@ -111,6 +111,12 @@ class MjsunitTestConfiguration(test.TestConfiguration):
     third_party = [current_path + ['third_party', t] for t in self.Ls(join(self.root, 'third_party'))]
     tools = [current_path + ['tools', t] for t in self.Ls(join(self.root, 'tools'))]
     compiler = [current_path + ['compiler', t] for t in self.Ls(join(self.root, 'compiler'))]
+    mjsunit.sort()
+    regress.sort()
+    bugs.sort()
+    third_party.sort()
+    tools.sort()
+    compiler.sort()
     all_tests = mjsunit + regress + bugs + third_party + tools + compiler
     result = []
     for test in all_tests: