11 files changed, 435 insertions, 10 deletions

diff --git a/deps/v8/test/mjsunit/arguments-load-across-eval.js b/deps/v8/test/mjsunit/arguments-load-across-eval.js
new file mode 100644
index 0000000000..e97c11329e
--- /dev/null
+++ b/deps/v8/test/mjsunit/arguments-load-across-eval.js
@@ -0,0 +1,86 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Tests loading of aguments across eval calls.
+
+// Test loading across an eval call that does not shadow variables.
+function testNoShadowing(x, h) {
+  function f() {
+    eval('1');
+    assertEquals(1, x);
+    assertEquals(2, h());
+    function g() {
+      assertEquals(1, x);
+      assertEquals(2, h());
+    }
+    g();
+  }
+  f();
+}
+
+testNoShadowing(1, function() { return 2; });
+
+// Test loading across eval calls that do not shadow variables.
+function testNoShadowing2(x, h) {
+  eval('1');
+  function f() {
+    eval('1');
+    assertEquals(1, x);
+    assertEquals(2, h());
+    function g() {
+      assertEquals(1, x);
+      assertEquals(2, h());
+    }
+    g();
+  }
+  f();
+}
+
+testNoShadowing2(1, function() { return 2; });
+
+// Test loading across an eval call that shadows variables.
+function testShadowing(x, h) {
+  function f() {
+    assertEquals(1, x);
+    assertEquals(2, h());
+    eval('var x = 3; var h = function() { return 4; };');
+    assertEquals(3, x);
+    assertEquals(4, h());
+    function g() {
+      assertEquals(3, x);
+      assertEquals(4, h());
+    }
+    g();
+  }
+  f();
+  assertEquals(1, x);
+  assertEquals(2, h());
+}
+
+testShadowing(1, function() { return 2; });
+
+
diff --git a/deps/v8/test/mjsunit/array-concat.js b/deps/v8/test/mjsunit/array-concat.js
index 2346c8de67..db89f4d0b8 100644
--- a/deps/v8/test/mjsunit/array-concat.js
+++ b/deps/v8/test/mjsunit/array-concat.js
@@ -29,7 +29,82 @@
  * @fileoverview Test concat on small and large arrays
  */
 
-var poses = [140, 4000000000];
+var poses;
+
+poses = [140, 4000000000];
+while (pos = poses.shift()) {
+  var a = new Array(pos);
+  var array_proto = [];
+  a.__proto__ = array_proto;
+  assertEquals(pos, a.length);
+  a.push('foo');
+  assertEquals(pos + 1, a.length);
+  var b = ['bar'];
+  var c = a.concat(b);
+  assertEquals(pos + 2, c.length);
+  assertEquals("undefined", typeof(c[pos - 1]));
+  assertEquals("foo", c[pos]);
+  assertEquals("bar", c[pos + 1]);
+
+  // Can we fool the system by putting a number in a string?
+  var onetwofour = "124";
+  a[onetwofour] = 'doo';
+  assertEquals(a[124], 'doo');
+  c = a.concat(b);
+  assertEquals(c[124], 'doo');
+
+  // If we put a number in the prototype, then the spec says it should be
+  // copied on concat.
+  array_proto["123"] = 'baz';
+  assertEquals(a[123], 'baz');
+
+  c = a.concat(b);
+  assertEquals(pos + 2, c.length);
+  assertEquals("baz", c[123]);
+  assertEquals("undefined", typeof(c[pos - 1]));
+  assertEquals("foo", c[pos]);
+  assertEquals("bar", c[pos + 1]);
+
+  // When we take the number off the prototype it disappears from a, but
+  // the concat put it in c itself.
+  array_proto["123"] = undefined;
+  assertEquals("undefined", typeof(a[123]));
+  assertEquals("baz", c[123]);
+
+  // If the element of prototype is shadowed, the element on the instance
+  // should be copied, but not the one on the prototype.
+  array_proto[123] = 'baz';
+  a[123] = 'xyz';
+  assertEquals('xyz', a[123]);
+  c = a.concat(b);
+  assertEquals('xyz', c[123]);
+
+  // Non-numeric properties on the prototype or the array shouldn't get
+  // copied.
+  array_proto.moe = 'joe';
+  a.ben = 'jerry';
+  assertEquals(a["moe"], 'joe');
+  assertEquals(a["ben"], 'jerry');
+  c = a.concat(b);
+  // ben was not copied
+  assertEquals("undefined", typeof(c.ben));
+
+  // When we take moe off the prototype it disappears from all arrays.
+  array_proto.moe = undefined;
+  assertEquals("undefined", typeof(c.moe));
+
+  // Negative indices don't get concated.
+  a[-1] = 'minus1';
+  assertEquals("minus1", a[-1]);
+  assertEquals("undefined", typeof(a[0xffffffff]));
+  c = a.concat(b);
+  assertEquals("undefined", typeof(c[-1]));
+  assertEquals("undefined", typeof(c[0xffffffff]));
+  assertEquals(c.length, a.length + 1);
+
+}
+
+poses = [140, 4000000000];
 while (pos = poses.shift()) {
   var a = new Array(pos);
   assertEquals(pos, a.length);
@@ -91,7 +166,7 @@ while (pos = poses.shift()) {
   Array.prototype.moe = undefined;
   assertEquals("undefined", typeof(c.moe));
 
-  // Negative indeces don't get concated.
+  // Negative indices don't get concated.
   a[-1] = 'minus1';
   assertEquals("minus1", a[-1]);
   assertEquals("undefined", typeof(a[0xffffffff]));
diff --git a/deps/v8/test/mjsunit/array-pop.js b/deps/v8/test/mjsunit/array-pop.js
index a8d131e20f..f193f09c2f 100644
--- a/deps/v8/test/mjsunit/array-pop.js
+++ b/deps/v8/test/mjsunit/array-pop.js
@@ -81,6 +81,34 @@
     }
     Array.prototype.length = 0;  // Clean-up.
   }
+
+  // Check that pop works on inherited properties for
+  // arrays with array prototype.
+  for (var i = 0; i < 10 ;i++) {  // Ensure ICs are stabilized.
+    var array_proto = [];
+    array_proto[1] = 1;
+    array_proto[3] = 3;
+    array_proto[5] = 5;
+    array_proto[7] = 7;
+    array_proto[9] = 9;
+    a = [0,1,2,,4,,6,7,8,,];
+    a.__proto__ = array_proto;
+    assertEquals(10, a.length, "array_proto-inherit-initial-length");
+    for (var j = 9; j >= 0; j--) {
+      assertEquals(j + 1, a.length, "array_proto-inherit-pre-length-" + j);
+      assertTrue(j in a, "array_proto-has property " + j);
+      var own = a.hasOwnProperty(j);
+      var inherited = array_proto.hasOwnProperty(j);
+      assertEquals(j, a.pop(), "array_proto-inherit-pop");
+      assertEquals(j, a.length, "array_proto-inherit-post-length");
+      assertFalse(a.hasOwnProperty(j), "array_proto-inherit-deleted-own-" + j);
+      assertEquals(inherited, array_proto.hasOwnProperty(j),
+                   "array_proto-inherit-not-deleted-inherited" + j);
+    }
+  }
+
+  // Check that pop works on inherited properties for
+  // arrays with array prototype.
 })();
 
 // Test the case of not JSArray receiver.
diff --git a/deps/v8/test/mjsunit/array-shift.js b/deps/v8/test/mjsunit/array-shift.js
index d985b31e06..3601cbbb89 100644
--- a/deps/v8/test/mjsunit/array-shift.js
+++ b/deps/v8/test/mjsunit/array-shift.js
@@ -69,3 +69,40 @@
   assertTrue(delete Array.prototype[5]);
   assertTrue(delete Array.prototype[7]);
 })();
+
+// Now check the case with array of holes and some elements on prototype
+// which is an array itself.
+(function() {
+  var len = 9;
+  var array = new Array(len);
+  var array_proto = new Array();
+  array_proto[3] = "@3";
+  array_proto[7] = "@7";
+  array.__proto__ = array_proto;
+
+  assertEquals(len, array.length);
+  for (var i = 0; i < array.length; i++) {
+    assertEquals(array[i], array_proto[i]);
+  }
+
+  array.shift();
+
+  assertEquals(len - 1, array.length);
+  // Note that shift copies values from prototype into the array.
+  assertEquals(array[2], array_proto[3]);
+  assertTrue(array.hasOwnProperty(2));
+
+  assertEquals(array[6], array_proto[7]);
+  assertTrue(array.hasOwnProperty(6));
+
+  // ... but keeps the rest as holes:
+  array_proto[5] = "@5";
+  assertEquals(array[5], array_proto[5]);
+  assertFalse(array.hasOwnProperty(5));
+
+  assertEquals(array[3], array_proto[3]);
+  assertFalse(array.hasOwnProperty(3));
+
+  assertEquals(array[7], array_proto[7]);
+  assertFalse(array.hasOwnProperty(7));
+})();
diff --git a/deps/v8/test/mjsunit/array-slice.js b/deps/v8/test/mjsunit/array-slice.js
index 30e9f3e9ee..8f9ce53586 100644
--- a/deps/v8/test/mjsunit/array-slice.js
+++ b/deps/v8/test/mjsunit/array-slice.js
@@ -127,6 +127,53 @@
 
 
 // Now check the case with array of holes and some elements on prototype.
+// Note: that is important that this test runs before the next one
+// as the next one tampers Array.prototype.
+(function() {
+  var len = 9;
+  var array = new Array(len);
+
+  var at3 = "@3";
+  var at7 = "@7";
+
+  for (var i = 0; i < 7; i++) {
+    var array_proto = [];
+    array_proto[3] = at3;
+    array_proto[7] = at7;
+    array.__proto__ = array_proto;
+
+    assertEquals(len, array.length);
+    for (var i = 0; i < array.length; i++) {
+      assertEquals(array[i], array_proto[i]);
+    }
+
+    var sliced = array.slice();
+
+    assertEquals(len, sliced.length);
+
+    assertTrue(delete array_proto[3]);
+    assertTrue(delete array_proto[7]);
+
+    // Note that slice copies values from prototype into the array.
+    assertEquals(array[3], undefined);
+    assertFalse(array.hasOwnProperty(3));
+    assertEquals(sliced[3], at3);
+    assertTrue(sliced.hasOwnProperty(3));
+
+    assertEquals(array[7], undefined);
+    assertFalse(array.hasOwnProperty(7));
+    assertEquals(sliced[7], at7);
+    assertTrue(sliced.hasOwnProperty(7));
+
+    // ... but keeps the rest as holes:
+    array_proto[5] = "@5";
+    assertEquals(array[5], array_proto[5]);
+    assertFalse(array.hasOwnProperty(5));
+  }
+})();
+
+
+// Now check the case with array of holes and some elements on prototype.
 (function() {
   var len = 9;
   var array = new Array(len);
diff --git a/deps/v8/test/mjsunit/array-splice.js b/deps/v8/test/mjsunit/array-splice.js
index 887097db61..88c4876496 100644
--- a/deps/v8/test/mjsunit/array-splice.js
+++ b/deps/v8/test/mjsunit/array-splice.js
@@ -255,6 +255,56 @@
 
   for (var i = 0; i < 7; i++) {
     var array = new Array(len);
+    var array_proto = [];
+    array_proto[3] = at3;
+    array_proto[7] = at7;
+    array.__proto__ = array_proto;
+
+    var spliced = array.splice(2, 2, 'one', undefined, 'two');
+
+    // Second hole (at index 3) of array turns into
+    // value of Array.prototype[3] while copying.
+    assertEquals([, at3], spliced);
+    assertEquals([, , 'one', undefined, 'two', , , at7, at7, ,], array);
+
+    // ... but array[3] and array[7] is actually a hole:
+    assertTrue(delete array_proto[3]);
+    assertEquals(undefined, array[3]);
+    assertTrue(delete array_proto[7]);
+    assertEquals(undefined, array[7]);
+
+    // and now check hasOwnProperty
+    assertFalse(array.hasOwnProperty(0), "array.hasOwnProperty(0)");
+    assertFalse(array.hasOwnProperty(1), "array.hasOwnProperty(1)");
+    assertTrue(array.hasOwnProperty(2));
+    assertTrue(array.hasOwnProperty(3));
+    assertTrue(array.hasOwnProperty(4));
+    assertFalse(array.hasOwnProperty(5), "array.hasOwnProperty(5)");
+    assertFalse(array.hasOwnProperty(6), "array.hasOwnProperty(6)");
+    assertFalse(array.hasOwnProperty(7), "array.hasOwnProperty(7)");
+    assertTrue(array.hasOwnProperty(8));
+    assertFalse(array.hasOwnProperty(9), "array.hasOwnProperty(9)");
+
+    // and now check couple of indices above length.
+    assertFalse(array.hasOwnProperty(10), "array.hasOwnProperty(10)");
+    assertFalse(array.hasOwnProperty(15), "array.hasOwnProperty(15)");
+    assertFalse(array.hasOwnProperty(31), "array.hasOwnProperty(31)");
+    assertFalse(array.hasOwnProperty(63), "array.hasOwnProperty(63)");
+    assertFalse(array.hasOwnProperty(2 << 32 - 1),
+                "array.hasOwnProperty(2 << 31 - 1)");
+  }
+})();
+
+
+// Now check the case with array of holes and some elements on prototype.
+(function() {
+  var len = 9;
+
+  var at3 = "@3";
+  var at7 = "@7";
+
+  for (var i = 0; i < 7; i++) {
+    var array = new Array(len);
     Array.prototype[3] = at3;
     Array.prototype[7] = at7;
 
@@ -265,7 +315,9 @@
     assertEquals([, at3], spliced);
     assertEquals([, , 'one', undefined, 'two', , , at7, at7, ,], array);
 
-    // ... but array[7] is actually a hole:
+    // ... but array[3] and array[7] is actually a hole:
+    assertTrue(delete Array.prototype[3]);
+    assertEquals(undefined, array[3]);
     assertTrue(delete Array.prototype[7]);
     assertEquals(undefined, array[7]);
 
@@ -286,7 +338,8 @@
     assertFalse(array.hasOwnProperty(15), "array.hasOwnProperty(15)");
     assertFalse(array.hasOwnProperty(31), "array.hasOwnProperty(31)");
     assertFalse(array.hasOwnProperty(63), "array.hasOwnProperty(63)");
-    assertFalse(array.hasOwnProperty(2 << 32 - 1), "array.hasOwnProperty(2 << 31 - 1)");
+    assertFalse(array.hasOwnProperty(2 << 32 - 1),
+                "array.hasOwnProperty(2 << 31 - 1)");
   }
 })();
 
diff --git a/deps/v8/test/mjsunit/array-unshift.js b/deps/v8/test/mjsunit/array-unshift.js
index dbe245b8b4..c4cc95cbb4 100644
--- a/deps/v8/test/mjsunit/array-unshift.js
+++ b/deps/v8/test/mjsunit/array-unshift.js
@@ -37,8 +37,8 @@
 })();
 
 
-// Check that unshif with no args has a side-effect of
-// feeling the holes with elements from the prototype
+// Check that unshift with no args has a side-effect of
+// filling the holes with elements from the prototype
 // (if present, of course)
 (function() {
   var len = 3;
@@ -115,6 +115,81 @@
   assertTrue(delete Array.prototype[7]);
 })();
 
+// Check that unshift with no args has a side-effect of
+// filling the holes with elements from the prototype
+// (if present, of course)
+(function() {
+  var len = 3;
+  var array = new Array(len);
+
+  var at0 = '@0';
+  var at2 = '@2';
+
+  var array_proto = [];
+  array_proto[0] = at0;
+  array_proto[2] = at2;
+  array.__proto__ = array_proto;
+
+  // array owns nothing...
+  assertFalse(array.hasOwnProperty(0));
+  assertFalse(array.hasOwnProperty(1));
+  assertFalse(array.hasOwnProperty(2));
+
+  // ... but sees values from array_proto.
+  assertEquals(array[0], at0);
+  assertEquals(array[1], undefined);
+  assertEquals(array[2], at2);
+
+  assertEquals(len, array.unshift());
+
+  // unshift makes array own 0 and 2...
+  assertTrue(array.hasOwnProperty(0));
+  assertFalse(array.hasOwnProperty(1));
+  assertTrue(array.hasOwnProperty(2));
+
+  // ... so they are not affected be delete.
+  assertEquals(array[0], at0);
+  assertEquals(array[1], undefined);
+  assertEquals(array[2], at2);
+})();
+
+
+// Now check the case with array of holes and some elements on prototype.
+(function() {
+  var len = 9;
+  var array = new Array(len);
+  var array_proto = []
+  array_proto[3] = "@3";
+  array_proto[7] = "@7";
+  array.__proto__ = array_proto;
+
+  assertEquals(len, array.length);
+  for (var i = 0; i < array.length; i++) {
+    assertEquals(array[i], array_proto[i]);
+  }
+
+  assertEquals(len + 1, array.unshift('head'));
+
+  assertEquals(len + 1, array.length);
+  // Note that unshift copies values from prototype into the array.
+  assertEquals(array[4], array_proto[3]);
+  assertTrue(array.hasOwnProperty(4));
+
+  assertEquals(array[8], array_proto[7]);
+  assertTrue(array.hasOwnProperty(8));
+
+  // ... but keeps the rest as holes:
+  array_proto[5] = "@5";
+  assertEquals(array[5], array_proto[5]);
+  assertFalse(array.hasOwnProperty(5));
+
+  assertEquals(array[3], array_proto[3]);
+  assertFalse(array.hasOwnProperty(3));
+
+  assertEquals(array[7], array_proto[7]);
+  assertFalse(array.hasOwnProperty(7));
+})();
+
 // Check the behaviour when approaching maximal values for length.
 (function() {
   for (var i = 0; i < 7; i++) {
diff --git a/deps/v8/test/mjsunit/compiler/assignment.js b/deps/v8/test/mjsunit/compiler/assignment.js
index ee2d323781..6aded4e9c9 100644
--- a/deps/v8/test/mjsunit/compiler/assignment.js
+++ b/deps/v8/test/mjsunit/compiler/assignment.js
@@ -262,3 +262,15 @@ function bar_loop() {
 }
 
 bar_loop();
+
+
+// Test for assignment using a keyed store ic:
+function store_i_in_element_i_of_object_i() {
+  var i = new Object();
+  i[i] = i;
+}
+
+// Run three times to exercise caches.
+store_i_in_element_i_of_object_i();
+store_i_in_element_i_of_object_i();
+store_i_in_element_i_of_object_i();
diff --git a/deps/v8/test/mjsunit/mjsunit.js b/deps/v8/test/mjsunit/mjsunit.js
index 07c4e7eff3..558282f52b 100644
--- a/deps/v8/test/mjsunit/mjsunit.js
+++ b/deps/v8/test/mjsunit/mjsunit.js
@@ -27,6 +27,8 @@
 
 function MjsUnitAssertionError(message) {
   this.message = message;
+  // This allows fetching the stack trace using TryCatch::StackTrace.
+  this.stack = new Error("").stack;
 }
 
 MjsUnitAssertionError.prototype.toString = function () {
diff --git a/deps/v8/test/mjsunit/mjsunit.status b/deps/v8/test/mjsunit/mjsunit.status
index 47963fe641..514d345a46 100644
--- a/deps/v8/test/mjsunit/mjsunit.status
+++ b/deps/v8/test/mjsunit/mjsunit.status
@@ -48,10 +48,6 @@ unicode-case-overoptimization: PASS, TIMEOUT if ($arch == arm)
 # Skip long running test in debug and allow it to timeout in release mode.
 regress/regress-524: (PASS || TIMEOUT), SKIP if $mode == debug
 
-# Skip experimental liveedit drop frame on non-ia32 architectures.
-# debug-liveedit-check-stack: SKIP if $arch != ia32
-debug-liveedit-check-stack: SKIP
-
 [ $arch == arm ]
 
 # Slow tests which times out in debug mode.
@@ -68,7 +64,19 @@ array-splice: PASS || TIMEOUT
 # Skip long running test in debug mode on ARM.
 string-indexof-2: PASS, SKIP if $mode == debug
 
+# Stack manipulations in LiveEdit is implemented for ia32 only.
+debug-liveedit-check-stack: SKIP
+
 [ $arch == mips ]
 
+# Stack manipulations in LiveEdit is implemented for ia32 only.
+debug-liveedit-check-stack: SKIP
+
 # Skip all tests on MIPS.
 *: SKIP
+
+[ $arch == x64 ]
+# Stack manipulations in LiveEdit is implemented for ia32 only.
+debug-liveedit-check-stack: SKIP
+
+
diff --git a/deps/v8/test/mjsunit/property-load-across-eval.js b/deps/v8/test/mjsunit/property-load-across-eval.js
index e174b858ca..5419cc7f3b 100644
--- a/deps/v8/test/mjsunit/property-load-across-eval.js
+++ b/deps/v8/test/mjsunit/property-load-across-eval.js
@@ -41,6 +41,7 @@ function testNoShadowing() {
   function f() {
     eval('1');
     assertEquals(1, x);
+    try { typeof(asdf); } catch(e) { assertUnreachable(); }
     assertEquals(2, y);
     assertEquals('global', global_function());
     assertEquals('local', local_function());
@@ -60,6 +61,7 @@ function testNoShadowing() {
     assertEquals('const_local', local_const_initialized());
     function g() {
       assertEquals(1, x);
+      try { typeof(asdf); } catch(e) { assertUnreachable(); }
       assertEquals(2, y);
       assertEquals('global', global_function());
       assertEquals('local', local_function());