Upgrade V8 to 3.0.0

131 files changed, 6997 insertions, 262 deletions

diff --git a/deps/v8/test/cctest/SConscript b/deps/v8/test/cctest/SConscript
index ba3466dee..703813776 100644
--- a/deps/v8/test/cctest/SConscript
+++ b/deps/v8/test/cctest/SConscript
@@ -50,6 +50,7 @@ SOURCES = {
     'test-dataflow.cc',
     'test-debug.cc',
     'test-decls.cc',
+    'test-deoptimization.cc',
     'test-diy-fp.cc',
     'test-double.cc',
     'test-dtoa.cc',
@@ -69,6 +70,7 @@ SOURCES = {
     'test-parsing.cc',
     'test-profile-generator.cc',
     'test-regexp.cc',
+    'test-reloc-info.cc',
     'test-serialize.cc',
     'test-sockets.cc',
     'test-spaces.cc',
diff --git a/deps/v8/test/cctest/cctest.status b/deps/v8/test/cctest/cctest.status
index 895e24539..4f1bcdc8a 100644
--- a/deps/v8/test/cctest/cctest.status
+++ b/deps/v8/test/cctest/cctest.status
@@ -29,19 +29,43 @@ prefix cctest
 
 test-api/Bug*: FAIL
 
+
+##############################################################################
 # BUG(281): This test fails on some Linuxes.
 test-debug/DebuggerAgent: PASS, (PASS || FAIL) if $system == linux
 
 # BUG(382): Weird test. Can't guarantee that it never times out.
 test-api/ApplyInterruption: PASS || TIMEOUT
 
+# BUG(484): This test which we thought was originally corrected in r5236
+# is re-appearing. Disabled until bug in test is fixed. This only fails
+# when snapshot is on, so I am marking it PASS || FAIL
+test-heap-profiler/HeapSnapshotsDiff: PASS || FAIL
+
+# BUG(3260336): Flaky test. May be timing related.
+test-profile-generator/RecordStackTraceAtStartProfiling: PASS || FAIL
+
 # These tests always fail.  They are here to test test.py.  If
 # they don't fail then test.py has failed.
 test-serialize/TestThatAlwaysFails: FAIL
 test-serialize/DependentTestThatAlwaysFails: FAIL
 
+
+##############################################################################
+[ $arch == x64 ]
+
+# Optimization is currently not working on crankshaft x64 and ARM.
+test-heap/TestInternalWeakLists: PASS || FAIL
+test-heap/TestInternalWeakListsTraverseWithGC: PASS || FAIL
+
+
+##############################################################################
 [ $arch == arm ]
 
+# Optimization is currently not working on crankshaft x64 and ARM.
+test-heap/TestInternalWeakLists: PASS || FAIL
+test-heap/TestInternalWeakListsTraverseWithGC: PASS || FAIL
+
 # We cannot assume that we can throw OutOfMemory exceptions in all situations.
 # Apparently our ARM box is in such a state. Skip the test as it also runs for
 # a long time.
@@ -51,6 +75,12 @@ test-api/OutOfMemoryNested: SKIP
 # BUG(355): Test crashes on ARM.
 test-log/ProfLazyMode: SKIP
 
+# BUG(945): Socket connect fails on ARM
+test-debug/DebuggerAgentProtocolOverflowHeader: SKIP
+test-sockets/Socket: SKIP
+
+
+##############################################################################
 [ $arch == mips ]
 test-accessors: SKIP
 test-alloc: SKIP
diff --git a/deps/v8/test/cctest/test-alloc.cc b/deps/v8/test/cctest/test-alloc.cc
index fcf2ce4f1..d2a28d7f4 100644
--- a/deps/v8/test/cctest/test-alloc.cc
+++ b/deps/v8/test/cctest/test-alloc.cc
@@ -133,7 +133,7 @@ TEST(StressJS) {
   // Force the creation of an initial map and set the code to
   // something empty.
   Factory::NewJSObject(function);
-  function->set_code(Builtins::builtin(Builtins::EmptyFunction));
+  function->ReplaceCode(Builtins::builtin(Builtins::EmptyFunction));
   // Patch the map to have an accessor for "get".
   Handle<Map> map(function->initial_map());
   Handle<DescriptorArray> instance_descriptors(map->instance_descriptors());
diff --git a/deps/v8/test/cctest/test-api.cc b/deps/v8/test/cctest/test-api.cc
index 8ce7a79a9..b6f551150 100644
--- a/deps/v8/test/cctest/test-api.cc
+++ b/deps/v8/test/cctest/test-api.cc
@@ -5678,6 +5678,22 @@ THREADED_TEST(GlobalObjectInstanceProperties) {
   instance_template->Set(v8_str("f"),
                          v8::FunctionTemplate::New(InstanceFunctionCallback));
 
+  // The script to check how Crankshaft compiles missing global function
+  // invocations.  function g is not defined and should throw on call.
+  const char* script =
+      "function wrapper(call) {"
+      "  var x = 0, y = 1;"
+      "  for (var i = 0; i < 1000; i++) {"
+      "    x += i * 100;"
+      "    y += i * 100;"
+      "  }"
+      "  if (call) g();"
+      "}"
+      "for (var i = 0; i < 17; i++) wrapper(false);"
+      "var thrown = 0;"
+      "try { wrapper(true); } catch (e) { thrown = 1; };"
+      "thrown";
+
   {
     LocalContext env(NULL, instance_template);
     // Hold on to the global object so it can be used again in another
@@ -5688,6 +5704,8 @@ THREADED_TEST(GlobalObjectInstanceProperties) {
     CHECK_EQ(42, value->Int32Value());
     value = Script::Compile(v8_str("f()"))->Run();
     CHECK_EQ(12, value->Int32Value());
+    value = Script::Compile(v8_str(script))->Run();
+    CHECK_EQ(1, value->Int32Value());
   }
 
   {
@@ -5697,6 +5715,48 @@ THREADED_TEST(GlobalObjectInstanceProperties) {
     CHECK_EQ(42, value->Int32Value());
     value = Script::Compile(v8_str("f()"))->Run();
     CHECK_EQ(12, value->Int32Value());
+    value = Script::Compile(v8_str(script))->Run();
+    CHECK_EQ(1, value->Int32Value());
+  }
+}
+
+
+THREADED_TEST(CallKnownGlobalReceiver) {
+  v8::HandleScope handle_scope;
+
+  Local<Value> global_object;
+
+  Local<v8::FunctionTemplate> t = v8::FunctionTemplate::New();
+  Local<ObjectTemplate> instance_template = t->InstanceTemplate();
+
+  // The script to check that we leave global object not
+  // global object proxy on stack when we deoptimize from inside
+  // arguments evaluation.
+  // To provoke error we need to both force deoptimization
+  // from arguments evaluation and to force CallIC to take
+  // CallIC_Miss code path that can't cope with global proxy.
+  const char* script =
+      "function bar(x, y) { try { } finally { } }"
+      "function baz(x) { try { } finally { } }"
+      "function bom(x) { try { } finally { } }"
+      "function foo(x) { bar([x], bom(2)); }"
+      "for (var i = 0; i < 10000; i++) foo(1);"
+      "foo";
+
+  Local<Value> foo;
+  {
+    LocalContext env(NULL, instance_template);
+    // Hold on to the global object so it can be used again in another
+    // environment initialization.
+    global_object = env->Global();
+    foo = Script::Compile(v8_str(script))->Run();
+  }
+
+  {
+    // Create new environment reusing the global object.
+    LocalContext env(NULL, instance_template, global_object);
+    env->Global()->Set(v8_str("foo"), foo);
+    Local<Value> value = Script::Compile(v8_str("foo()"))->Run();
   }
 }
 
@@ -8671,6 +8731,105 @@ THREADED_TEST(TurnOnAccessCheck) {
 }
 
 
+v8::Handle<v8::String> a;
+v8::Handle<v8::String> h;
+
+static bool NamedGetAccessBlockAandH(Local<v8::Object> obj,
+                                       Local<Value> name,
+                                       v8::AccessType type,
+                                       Local<Value> data) {
+  return !(name->Equals(a) || name->Equals(h));
+}
+
+
+THREADED_TEST(TurnOnAccessCheckAndRecompile) {
+  v8::HandleScope handle_scope;
+
+  // Create an environment with access check to the global object disabled by
+  // default. When the registered access checker will block access to properties
+  // a and h
+  a = v8_str("a");
+  h = v8_str("h");
+  v8::Handle<v8::ObjectTemplate> global_template = v8::ObjectTemplate::New();
+  global_template->SetAccessCheckCallbacks(NamedGetAccessBlockAandH,
+                                           IndexedGetAccessBlocker,
+                                           v8::Handle<v8::Value>(),
+                                           false);
+  v8::Persistent<Context> context = Context::New(NULL, global_template);
+  Context::Scope context_scope(context);
+
+  // Set up a property and a number of functions.
+  context->Global()->Set(v8_str("a"), v8_num(1));
+  static const char* source = "function f1() {return a;}"
+                              "function f2() {return a;}"
+                              "function g1() {return h();}"
+                              "function g2() {return h();}"
+                              "function h() {return 1;}";
+
+  CompileRun(source);
+  Local<Function> f1;
+  Local<Function> f2;
+  Local<Function> g1;
+  Local<Function> g2;
+  Local<Function> h;
+  f1 = Local<Function>::Cast(context->Global()->Get(v8_str("f1")));
+  f2 = Local<Function>::Cast(context->Global()->Get(v8_str("f2")));
+  g1 = Local<Function>::Cast(context->Global()->Get(v8_str("g1")));
+  g2 = Local<Function>::Cast(context->Global()->Get(v8_str("g2")));
+  h =  Local<Function>::Cast(context->Global()->Get(v8_str("h")));
+
+  // Get the global object.
+  v8::Handle<v8::Object> global = context->Global();
+
+  // Call f1 one time and f2 a number of times. This will ensure that f1 still
+  // uses the runtime system to retreive property a whereas f2 uses global load
+  // inline cache.
+  CHECK(f1->Call(global, 0, NULL)->Equals(v8_num(1)));
+  for (int i = 0; i < 4; i++) {
+    CHECK(f2->Call(global, 0, NULL)->Equals(v8_num(1)));
+  }
+
+  // Same for g1 and g2.
+  CHECK(g1->Call(global, 0, NULL)->Equals(v8_num(1)));
+  for (int i = 0; i < 4; i++) {
+    CHECK(g2->Call(global, 0, NULL)->Equals(v8_num(1)));
+  }
+
+  // Detach the global and turn on access check now blocking access to property
+  // a and function h.
+  context->DetachGlobal();
+  context->Global()->TurnOnAccessCheck();
+
+  // Failing access check to property get results in undefined.
+  CHECK(f1->Call(global, 0, NULL)->IsUndefined());
+  CHECK(f2->Call(global, 0, NULL)->IsUndefined());
+
+  // Failing access check to function call results in exception.
+  CHECK(g1->Call(global, 0, NULL).IsEmpty());
+  CHECK(g2->Call(global, 0, NULL).IsEmpty());
+
+  // No failing access check when just returning a constant.
+  CHECK(h->Call(global, 0, NULL)->Equals(v8_num(1)));
+
+  // Now compile the source again. And get the newly compiled functions, except
+  // for h for which access is blocked.
+  CompileRun(source);
+  f1 = Local<Function>::Cast(context->Global()->Get(v8_str("f1")));
+  f2 = Local<Function>::Cast(context->Global()->Get(v8_str("f2")));
+  g1 = Local<Function>::Cast(context->Global()->Get(v8_str("g1")));
+  g2 = Local<Function>::Cast(context->Global()->Get(v8_str("g2")));
+  CHECK(context->Global()->Get(v8_str("h"))->IsUndefined());
+
+  // Failing access check to property get results in undefined.
+  CHECK(f1->Call(global, 0, NULL)->IsUndefined());
+  CHECK(f2->Call(global, 0, NULL)->IsUndefined());
+
+  // Failing access check to function call results in exception.
+  CHECK(g1->Call(global, 0, NULL).IsEmpty());
+  CHECK(g2->Call(global, 0, NULL).IsEmpty());
+}
+
+
 // This test verifies that pre-compilation (aka preparsing) can be called
 // without initializing the whole VM. Thus we cannot run this test in a
 // multi-threaded setup.
@@ -10522,7 +10681,9 @@ v8::Handle<Value> AnalyzeStackInNativeCode(const v8::Arguments& args) {
 
 
 // Tests the C++ StackTrace API.
-THREADED_TEST(CaptureStackTrace) {
+// TODO(3074796): Reenable this as a THREADED_TEST once it passes.
+// THREADED_TEST(CaptureStackTrace) {
+TEST(CaptureStackTrace) {
   v8::HandleScope scope;
   v8::Handle<v8::String> origin = v8::String::New("capture-stack-trace-test");
   Local<ObjectTemplate> templ = ObjectTemplate::New();
diff --git a/deps/v8/test/cctest/test-dataflow.cc b/deps/v8/test/cctest/test-dataflow.cc
index 003ac6680..5894de2a8 100644
--- a/deps/v8/test/cctest/test-dataflow.cc
+++ b/deps/v8/test/cctest/test-dataflow.cc
@@ -52,6 +52,24 @@ TEST(BitVector) {
   }
 
   {
+    BitVector v(64);
+    v.Add(27);
+    v.Add(30);
+    v.Add(31);
+    v.Add(33);
+    BitVector::Iterator iter(&v);
+    CHECK_EQ(27, iter.Current());
+    iter.Advance();
+    CHECK_EQ(30, iter.Current());
+    iter.Advance();
+    CHECK_EQ(31, iter.Current());
+    iter.Advance();
+    CHECK_EQ(33, iter.Current());
+    iter.Advance();
+    CHECK(iter.Done());
+  }
+
+  {
     BitVector v(15);
     v.Add(0);
     BitVector w(15);
diff --git a/deps/v8/test/cctest/test-debug.cc b/deps/v8/test/cctest/test-debug.cc
index 7791185c7..87f9cab97 100644
--- a/deps/v8/test/cctest/test-debug.cc
+++ b/deps/v8/test/cctest/test-debug.cc
@@ -1,4 +1,4 @@
-// Copyright 2007-2008 the V8 project authors. All rights reserved.
+// Copyright 2010 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
@@ -32,11 +32,13 @@
 #include "v8.h"
 
 #include "api.h"
+#include "cctest.h"
 #include "compilation-cache.h"
 #include "debug.h"
+#include "deoptimizer.h"
 #include "platform.h"
 #include "stub-cache.h"
-#include "cctest.h"
+#include "utils.h"
 
 
 using ::v8::internal::EmbeddedVector;
@@ -515,16 +517,52 @@ void CheckDebugBreakFunction(DebugLocalContext* env,
 // ---
 
 
-// Source for The JavaScript function which picks out the function name of the
-// top frame.
+// Source for the JavaScript function which picks out the function
+// name of a frame.
 const char* frame_function_name_source =
-    "function frame_function_name(exec_state) {"
-    "  return exec_state.frame(0).func().name();"
+    "function frame_function_name(exec_state, frame_number) {"
+    "  return exec_state.frame(frame_number).func().name();"
     "}";
 v8::Local<v8::Function> frame_function_name;
 
 
-// Source for The JavaScript function which picks out the source line for the
+// Source for the JavaScript function which pick out the name of the
+// first argument of a frame.
+const char* frame_argument_name_source =
+    "function frame_argument_name(exec_state, frame_number) {"
+    "  return exec_state.frame(frame_number).argumentName(0);"
+    "}";
+v8::Local<v8::Function> frame_argument_name;
+
+
+// Source for the JavaScript function which pick out the value of the
+// first argument of a frame.
+const char* frame_argument_value_source =
+    "function frame_argument_value(exec_state, frame_number) {"
+    "  return exec_state.frame(frame_number).argumentValue(0).value_;"
+    "}";
+v8::Local<v8::Function> frame_argument_value;
+
+
+// Source for the JavaScript function which pick out the name of the
+// first argument of a frame.
+const char* frame_local_name_source =
+    "function frame_local_name(exec_state, frame_number) {"
+    "  return exec_state.frame(frame_number).localName(0);"
+    "}";
+v8::Local<v8::Function> frame_local_name;
+
+
+// Source for the JavaScript function which pick out the value of the
+// first argument of a frame.
+const char* frame_local_value_source =
+    "function frame_local_value(exec_state, frame_number) {"
+    "  return exec_state.frame(frame_number).localValue(0).value_;"
+    "}";
+v8::Local<v8::Function> frame_local_value;
+
+
+// Source for the JavaScript function which picks out the source line for the
 // top frame.
 const char* frame_source_line_source =
     "function frame_source_line(exec_state) {"
@@ -533,7 +571,7 @@ const char* frame_source_line_source =
 v8::Local<v8::Function> frame_source_line;
 
 
-// Source for The JavaScript function which picks out the source column for the
+// Source for the JavaScript function which picks out the source column for the
 // top frame.
 const char* frame_source_column_source =
     "function frame_source_column(exec_state) {"
@@ -542,7 +580,7 @@ const char* frame_source_column_source =
 v8::Local<v8::Function> frame_source_column;
 
 
-// Source for The JavaScript function which picks out the script name for the
+// Source for the JavaScript function which picks out the script name for the
 // top frame.
 const char* frame_script_name_source =
     "function frame_script_name(exec_state) {"
@@ -551,7 +589,7 @@ const char* frame_script_name_source =
 v8::Local<v8::Function> frame_script_name;
 
 
-// Source for The JavaScript function which picks out the script data for the
+// Source for the JavaScript function which picks out the script data for the
 // top frame.
 const char* frame_script_data_source =
     "function frame_script_data(exec_state) {"
@@ -560,7 +598,7 @@ const char* frame_script_data_source =
 v8::Local<v8::Function> frame_script_data;
 
 
-// Source for The JavaScript function which picks out the script data from
+// Source for the JavaScript function which picks out the script data from
 // AfterCompile event
 const char* compiled_script_data_source =
     "function compiled_script_data(event_data) {"
@@ -569,7 +607,7 @@ const char* compiled_script_data_source =
 v8::Local<v8::Function> compiled_script_data;
 
 
-// Source for The JavaScript function which returns the number of frames.
+// Source for the JavaScript function which returns the number of frames.
 static const char* frame_count_source =
     "function frame_count(exec_state) {"
     "  return exec_state.frameCount();"
@@ -603,8 +641,8 @@ static void DebugEventBreakPointHitCount(v8::DebugEvent event,
     break_point_hit_count++;
     if (!frame_function_name.IsEmpty()) {
       // Get the name of the function.
-      const int argc = 1;
-      v8::Handle<v8::Value> argv[argc] = { exec_state };
+      const int argc = 2;
+      v8::Handle<v8::Value> argv[argc] = { exec_state, v8::Integer::New(0) };
       v8::Handle<v8::Value> result = frame_function_name->Call(exec_state,
                                                                argc, argv);
       if (result->IsUndefined()) {
@@ -834,8 +872,8 @@ static void DebugEventStepSequence(v8::DebugEvent event,
     // Check that the current function is the expected.
     CHECK(break_point_hit_count <
           StrLength(expected_step_sequence));
-    const int argc = 1;
-    v8::Handle<v8::Value> argv[argc] = { exec_state };
+    const int argc = 2;
+    v8::Handle<v8::Value> argv[argc] = { exec_state, v8::Integer::New(0) };
     v8::Handle<v8::Value> result = frame_function_name->Call(exec_state,
                                                              argc, argv);
     CHECK(result->IsString());
@@ -2586,6 +2624,10 @@ TEST(DebugStepLinear) {
   v8::Local<v8::Function> foo = CompileFunction(&env,
                                                 "function foo(){a=1;b=1;c=1;}",
                                                 "foo");
+
+  // Run foo to allow it to get optimized.
+  CompileRun("a=0; b=0; c=0; foo();");
+
   SetBreakPoint(foo, 3);
 
   // Register a debug event listener which steps and counts.
@@ -2635,7 +2677,8 @@ TEST(DebugStepKeyedLoadLoop) {
       "    y = 1;\n"
       "    x = a[i];\n"
       "  }\n"
-      "}\n",
+      "}\n"
+      "y=0\n",
       "foo");
 
   // Create array [0,1,2,3,4,5,6,7,8,9]
@@ -2681,7 +2724,8 @@ TEST(DebugStepKeyedStoreLoop) {
       "    y = 1;\n"
       "    a[i] = 42;\n"
       "  }\n"
-      "}\n",
+      "}\n"
+      "y=0\n",
       "foo");
 
   // Create array [0,1,2,3,4,5,6,7,8,9]
@@ -2753,15 +2797,12 @@ TEST(DebugStepNamedLoadLoop) {
 }
 
 
-static void DoDebugStepNamedStoreLoop(int expected, bool full_compiler = true) {
+static void DoDebugStepNamedStoreLoop(int expected) {
   v8::HandleScope scope;
   DebugLocalContext env;
 
-  // Register a debug event listener which steps and counts before compiling the
-  // function to ensure the full compiler is used.
-  if (full_compiler) {
-    v8::Debug::SetDebugEventListener(DebugEventStep);
-  }
+  // Register a debug event listener which steps and counts.
+  v8::Debug::SetDebugEventListener(DebugEventStep);
 
   // Create a function for testing stepping of named store.
   v8::Local<v8::Function> foo = CompileFunction(
@@ -2777,12 +2818,6 @@ static void DoDebugStepNamedStoreLoop(int expected, bool full_compiler = true) {
   // Call function without any break points to ensure inlining is in place.
   foo->Call(env->Global(), 0, NULL);
 
-  // Register a debug event listener which steps and counts after compiling the
-  // function to ensure the optimizing compiler is used.
-  if (!full_compiler) {
-    v8::Debug::SetDebugEventListener(DebugEventStep);
-  }
-
   // Setup break point and step through the function.
   SetBreakPoint(foo, 3);
   step_action = StepNext;
@@ -2798,20 +2833,11 @@ static void DoDebugStepNamedStoreLoop(int expected, bool full_compiler = true) {
 
 
 // Test of the stepping mechanism for named load in a loop.
-TEST(DebugStepNamedStoreLoopFull) {
-  // With the full compiler it is possible to break on the for statement.
+TEST(DebugStepNamedStoreLoop) {
   DoDebugStepNamedStoreLoop(22);
 }
 
 
-// Test of the stepping mechanism for named load in a loop.
-TEST(DebugStepNamedStoreLoopOptimizing) {
-  // With the optimizing compiler it is not possible to break on the for
-  // statement as it uses a local variable thus no IC's.
-  DoDebugStepNamedStoreLoop(11, false);
-}
-
-
 // Test the stepping mechanism with different ICs.
 TEST(DebugStepLinearMixedICs) {
   v8::HandleScope scope;
@@ -2828,6 +2854,10 @@ TEST(DebugStepLinearMixedICs) {
       "  var index='name';"
       "  var y = {};"
       "  a=1;b=2;x=a;y[index]=3;x=y[index];bar();}", "foo");
+
+  // Run functions to allow them to get optimized.
+  CompileRun("a=0; b=0; bar(); foo();");
+
   SetBreakPoint(foo, 0);
 
   step_action = StepIn;
@@ -2862,15 +2892,18 @@ TEST(DebugStepDeclarations) {
   // Register a debug event listener which steps and counts.
   v8::Debug::SetDebugEventListener(DebugEventStep);
 
-  // Create a function for testing stepping.
+  // Create a function for testing stepping. Run it to allow it to get
+  // optimized.
   const char* src = "function foo() { "
                     "  var a;"
                     "  var b = 1;"
                     "  var c = foo;"
                     "  var d = Math.floor;"
                     "  var e = b + d(1.2);"
-                    "}";
+                    "}"
+                    "foo()";
   v8::Local<v8::Function> foo = CompileFunction(&env, src, "foo");
+
   SetBreakPoint(foo, 0);
 
   // Stepping through the declarations.
@@ -2892,15 +2925,18 @@ TEST(DebugStepLocals) {
   // Register a debug event listener which steps and counts.
   v8::Debug::SetDebugEventListener(DebugEventStep);
 
-  // Create a function for testing stepping.
+  // Create a function for testing stepping. Run it to allow it to get
+  // optimized.
   const char* src = "function foo() { "
                     "  var a,b;"
                     "  a = 1;"
                     "  b = a + 2;"
                     "  b = 1 + 2 + 3;"
                     "  a = Math.floor(b);"
-                    "}";
+                    "}"
+                    "foo()";
   v8::Local<v8::Function> foo = CompileFunction(&env, src, "foo");
+
   SetBreakPoint(foo, 0);
 
   // Stepping through the declarations.
@@ -2922,7 +2958,8 @@ TEST(DebugStepIf) {
   // Register a debug event listener which steps and counts.
   v8::Debug::SetDebugEventListener(DebugEventStep);
 
-  // Create a function for testing stepping.
+  // Create a function for testing stepping. Run it to allow it to get
+  // optimized.
   const int argc = 1;
   const char* src = "function foo(x) { "
                     "  a = 1;"
@@ -2932,7 +2969,8 @@ TEST(DebugStepIf) {
                     "    c = 1;"
                     "    d = 1;"
                     "  }"
-                    "}";
+                    "}"
+                    "a=0; b=0; c=0; d=0; foo()";
   v8::Local<v8::Function> foo = CompileFunction(&env, src, "foo");
   SetBreakPoint(foo, 0);
 
@@ -2963,7 +3001,8 @@ TEST(DebugStepSwitch) {
   // Register a debug event listener which steps and counts.
   v8::Debug::SetDebugEventListener(DebugEventStep);
 
-  // Create a function for testing stepping.
+  // Create a function for testing stepping. Run it to allow it to get
+  // optimized.
   const int argc = 1;
   const char* src = "function foo(x) { "
                     "  a = 1;"
@@ -2979,7 +3018,8 @@ TEST(DebugStepSwitch) {
                     "      f = 1;"
                     "      break;"
                     "  }"
-                    "}";
+                    "}"
+                    "a=0; b=0; c=0; d=0; e=0; f=0; foo()";
   v8::Local<v8::Function> foo = CompileFunction(&env, src, "foo");
   SetBreakPoint(foo, 0);
 
@@ -3017,14 +3057,16 @@ TEST(DebugStepWhile) {
   // Register a debug event listener which steps and counts.
   v8::Debug::SetDebugEventListener(DebugEventStep);
 
-  // Create a function for testing stepping.
+  // Create a function for testing stepping. Run it to allow it to get
+  // optimized.
   const int argc = 1;
   const char* src = "function foo(x) { "
                     "  var a = 0;"
                     "  while (a < x) {"
                     "    a++;"
                     "  }"
-                    "}";
+                    "}"
+                    "foo()";
   v8::Local<v8::Function> foo = CompileFunction(&env, src, "foo");
   SetBreakPoint(foo, 8);  // "var a = 0;"
 
@@ -3033,14 +3075,14 @@ TEST(DebugStepWhile) {
   break_point_hit_count = 0;
   v8::Handle<v8::Value> argv_10[argc] = { v8::Number::New(10) };
   foo->Call(env->Global(), argc, argv_10);
-  CHECK_EQ(23, break_point_hit_count);
+  CHECK_EQ(22, break_point_hit_count);
 
   // Looping 100 times.
   step_action = StepIn;
   break_point_hit_count = 0;
   v8::Handle<v8::Value> argv_100[argc] = { v8::Number::New(100) };
   foo->Call(env->Global(), argc, argv_100);
-  CHECK_EQ(203, break_point_hit_count);
+  CHECK_EQ(202, break_point_hit_count);
 
   // Get rid of the debug event listener.
   v8::Debug::SetDebugEventListener(NULL);
@@ -3055,14 +3097,16 @@ TEST(DebugStepDoWhile) {
   // Register a debug event listener which steps and counts.
   v8::Debug::SetDebugEventListener(DebugEventStep);
 
-  // Create a function for testing stepping.
+  // Create a function for testing stepping. Run it to allow it to get
+  // optimized.
   const int argc = 1;
   const char* src = "function foo(x) { "
                     "  var a = 0;"
                     "  do {"
                     "    a++;"
                     "  } while (a < x)"
-                    "}";
+                    "}"
+                    "foo()";
   v8::Local<v8::Function> foo = CompileFunction(&env, src, "foo");
   SetBreakPoint(foo, 8);  // "var a = 0;"
 
@@ -3093,15 +3137,18 @@ TEST(DebugStepFor) {
   // Register a debug event listener which steps and counts.
   v8::Debug::SetDebugEventListener(DebugEventStep);
 
-  // Create a function for testing stepping.
+  // Create a function for testing stepping. Run it to allow it to get
+  // optimized.
   const int argc = 1;
   const char* src = "function foo(x) { "
                     "  a = 1;"
                     "  for (i = 0; i < x; i++) {"
                     "    b = 1;"
                     "  }"
-                    "}";
+                    "}"
+                    "a=0; b=0; i=0; foo()";
   v8::Local<v8::Function> foo = CompileFunction(&env, src, "foo");
+
   SetBreakPoint(foo, 8);  // "a = 1;"
 
   // Looping 10 times.
@@ -3131,7 +3178,8 @@ TEST(DebugStepForContinue) {
   // Register a debug event listener which steps and counts.
   v8::Debug::SetDebugEventListener(DebugEventStep);
 
-  // Create a function for testing stepping.
+  // Create a function for testing stepping. Run it to allow it to get
+  // optimized.
   const int argc = 1;
   const char* src = "function foo(x) { "
                     "  var a = 0;"
@@ -3144,7 +3192,8 @@ TEST(DebugStepForContinue) {
                     "    c++;"
                     "  }"
                     "  return b;"
-                    "}";
+                    "}"
+                    "foo()";
   v8::Local<v8::Function> foo = CompileFunction(&env, src, "foo");
   v8::Handle<v8::Value> result;
   SetBreakPoint(foo, 8);  // "var a = 0;"
@@ -3180,7 +3229,8 @@ TEST(DebugStepForBreak) {
   // Register a debug event listener which steps and counts.
   v8::Debug::SetDebugEventListener(DebugEventStep);
 
-  // Create a function for testing stepping.
+  // Create a function for testing stepping. Run it to allow it to get
+  // optimized.
   const int argc = 1;
   const char* src = "function foo(x) { "
                     "  var a = 0;"
@@ -3193,7 +3243,8 @@ TEST(DebugStepForBreak) {
                     "    c++;"
                     "  }"
                     "  return b;"
-                    "}";
+                    "}"
+                    "foo()";
   v8::Local<v8::Function> foo = CompileFunction(&env, src, "foo");
   v8::Handle<v8::Value> result;
   SetBreakPoint(foo, 8);  // "var a = 0;"
@@ -3230,13 +3281,16 @@ TEST(DebugStepForIn) {
   // Register a debug event listener which steps and counts.
   v8::Debug::SetDebugEventListener(DebugEventStep);
 
+  // Create a function for testing stepping. Run it to allow it to get
+  // optimized.
   v8::Local<v8::Function> foo;
   const char* src_1 = "function foo() { "
                       "  var a = [1, 2];"
                       "  for (x in a) {"
                       "    b = 0;"
                       "  }"
-                      "}";
+                      "}"
+                      "foo()";
   foo = CompileFunction(&env, src_1, "foo");
   SetBreakPoint(foo, 0);  // "var a = ..."
 
@@ -3245,12 +3299,15 @@ TEST(DebugStepForIn) {
   foo->Call(env->Global(), 0, NULL);
   CHECK_EQ(6, break_point_hit_count);
 
+  // Create a function for testing stepping. Run it to allow it to get
+  // optimized.
   const char* src_2 = "function foo() { "
                       "  var a = {a:[1, 2, 3]};"
                       "  for (x in a.a) {"
                       "    b = 0;"
                       "  }"
-                      "}";
+                      "}"
+                      "foo()";
   foo = CompileFunction(&env, src_2, "foo");
   SetBreakPoint(foo, 0);  // "var a = ..."
 
@@ -3272,12 +3329,14 @@ TEST(DebugStepWith) {
   // Register a debug event listener which steps and counts.
   v8::Debug::SetDebugEventListener(DebugEventStep);
 
-  // Create a function for testing stepping.
+  // Create a function for testing stepping. Run it to allow it to get
+  // optimized.
   const char* src = "function foo(x) { "
                     "  var a = {};"
                     "  with (a) {}"
                     "  with (b) {}"
-                    "}";
+                    "}"
+                    "foo()";
   env->Global()->Set(v8::String::New("b"), v8::Object::New());
   v8::Local<v8::Function> foo = CompileFunction(&env, src, "foo");
   v8::Handle<v8::Value> result;
@@ -3301,12 +3360,14 @@ TEST(DebugConditional) {
   // Register a debug event listener which steps and counts.
   v8::Debug::SetDebugEventListener(DebugEventStep);
 
-  // Create a function for testing stepping.
+  // Create a function for testing stepping. Run it to allow it to get
+  // optimized.
   const char* src = "function foo(x) { "
                     "  var a;"
                     "  a = x ? 1 : 2;"
                     "  return a;"
-                    "}";
+                    "}"
+                    "foo()";
   v8::Local<v8::Function> foo = CompileFunction(&env, src, "foo");
   SetBreakPoint(foo, 0);  // "var a;"
 
@@ -3340,10 +3401,12 @@ TEST(StepInOutSimple) {
   // Register a debug event listener which steps and counts.
   v8::Debug::SetDebugEventListener(DebugEventStepSequence);
 
-  // Create functions for testing stepping.
+  // Create a function for testing stepping. Run it to allow it to get
+  // optimized.
   const char* src = "function a() {b();c();}; "
                     "function b() {c();}; "
-                    "function c() {}; ";
+                    "function c() {}; "
+                    "a(); b(); c()";
   v8::Local<v8::Function> a = CompileFunction(&env, src, "a");
   SetBreakPoint(a, 0);
 
@@ -3389,11 +3452,13 @@ TEST(StepInOutTree) {
   // Register a debug event listener which steps and counts.
   v8::Debug::SetDebugEventListener(DebugEventStepSequence);
 
-  // Create functions for testing stepping.
+  // Create a function for testing stepping. Run it to allow it to get
+  // optimized.
   const char* src = "function a() {b(c(d()),d());c(d());d()}; "
                     "function b(x,y) {c();}; "
                     "function c(x) {}; "
-                    "function d() {}; ";
+                    "function d() {}; "
+                    "a(); b(); c(); d()";
   v8::Local<v8::Function> a = CompileFunction(&env, src, "a");
   SetBreakPoint(a, 0);
 
@@ -3439,10 +3504,12 @@ TEST(StepInOutBranch) {
   // Register a debug event listener which steps and counts.
   v8::Debug::SetDebugEventListener(DebugEventStepSequence);
 
-  // Create functions for testing stepping.
+  // Create a function for testing stepping. Run it to allow it to get
+  // optimized.
   const char* src = "function a() {b(false);c();}; "
                     "function b(x) {if(x){c();};}; "
-                    "function c() {}; ";
+                    "function c() {}; "
+                    "a(); b(); c()";
   v8::Local<v8::Function> a = CompileFunction(&env, src, "a");
   SetBreakPoint(a, 0);
 
@@ -6116,8 +6183,8 @@ static void DebugEventDebugBreak(
     // Get the name of the top frame function.
     if (!frame_function_name.IsEmpty()) {
       // Get the name of the function.
-      const int argc = 1;
-      v8::Handle<v8::Value> argv[argc] = { exec_state };
+      const int argc = 2;
+      v8::Handle<v8::Value> argv[argc] = { exec_state, v8::Integer::New(0) };
       v8::Handle<v8::Value> result = frame_function_name->Call(exec_state,
                                                                argc, argv);
       if (result->IsUndefined()) {
@@ -6846,6 +6913,7 @@ static void DebugEventBreakDataChecker(const v8::Debug::EventDetails& details) {
   }
 }
 
+
 // Check that event details contain context where debug event occured.
 TEST(DebugEventBreakData) {
   v8::HandleScope scope;
@@ -6898,6 +6966,156 @@ TEST(DebugEventBreakData) {
   CheckDebuggerUnloaded();
 }
 
+static bool debug_event_break_deoptimize_done = false;
+
+static void DebugEventBreakDeoptimize(v8::DebugEvent event,
+                                      v8::Handle<v8::Object> exec_state,
+                                      v8::Handle<v8::Object> event_data,
+                                      v8::Handle<v8::Value> data) {
+  if (event == v8::Break) {
+    if (!frame_function_name.IsEmpty()) {
+      // Get the name of the function.
+      const int argc = 2;
+      v8::Handle<v8::Value> argv[argc] = { exec_state, v8::Integer::New(0) };
+      v8::Handle<v8::Value> result =
+          frame_function_name->Call(exec_state, argc, argv);
+      if (!result->IsUndefined()) {
+        char fn[80];
+        CHECK(result->IsString());
+        v8::Handle<v8::String> function_name(result->ToString());
+        function_name->WriteAscii(fn);
+        if (strcmp(fn, "bar") == 0) {
+          i::Deoptimizer::DeoptimizeAll();
+          debug_event_break_deoptimize_done = true;
+        }
+      }
+    }
+
+    v8::Debug::DebugBreak();
+  }
+}
+
+
+// Test deoptimization when execution is broken using the debug break stack
+// check interrupt.
+TEST(DeoptimizeDuringDebugBreak) {
+  v8::HandleScope scope;
+  DebugLocalContext env;
+  env.ExposeDebug();
+
+  // Create a function for checking the function when hitting a break point.
+  frame_function_name = CompileFunction(&env,
+                                        frame_function_name_source,
+                                        "frame_function_name");
+
+
+  // Set a debug event listener which will keep interrupting execution until
+  // debug break. When inside function bar it will deoptimize all functions.
+  // This tests lazy deoptimization bailout for the stack check, as the first
+  // time in function bar when using debug break and no break points will be at
+  // the initial stack check.
+  v8::Debug::SetDebugEventListener(DebugEventBreakDeoptimize,
+                                   v8::Undefined());
+
+  // Compile and run function bar which will optimize it for some flag settings.
+  v8::Script::Compile(v8::String::New("function bar(){}; bar()"))->Run();
+
+  // Set debug break and call bar again.
+  v8::Debug::DebugBreak();
+  v8::Script::Compile(v8::String::New("bar()"))->Run();
+
+  CHECK(debug_event_break_deoptimize_done);
+
+  v8::Debug::SetDebugEventListener(NULL);
+}
+
+
+static void DebugEventBreakWithOptimizedStack(v8::DebugEvent event,
+                                              v8::Handle<v8::Object> exec_state,
+                                              v8::Handle<v8::Object> event_data,
+                                              v8::Handle<v8::Value> data) {
+  if (event == v8::Break) {
+    if (!frame_function_name.IsEmpty()) {
+      for (int i = 0; i < 2; i++) {
+        const int argc = 2;
+        v8::Handle<v8::Value> argv[argc] = { exec_state, v8::Integer::New(i) };
+        // Get the name of the function in frame i.
+        v8::Handle<v8::Value> result =
+            frame_function_name->Call(exec_state, argc, argv);
+        CHECK(result->IsString());
+        v8::Handle<v8::String> function_name(result->ToString());
+        CHECK(function_name->Equals(v8::String::New("loop")));
+        // Get the name of the first argument in frame i.
+        result = frame_argument_name->Call(exec_state, argc, argv);
+        CHECK(result->IsString());
+        v8::Handle<v8::String> argument_name(result->ToString());
+        CHECK(argument_name->Equals(v8::String::New("count")));
+        // Get the value of the first argument in frame i. If the
+        // funtion is optimized the value will be undefined, otherwise
+        // the value will be '1 - i'.
+        //
+        // TODO(3141533): We should be able to get the real value for
+        // optimized frames.
+        result = frame_argument_value->Call(exec_state, argc, argv);
+        CHECK(result->IsUndefined() || (result->Int32Value() == 1 - i));
+        // Get the name of the first local variable.
+        result = frame_local_name->Call(exec_state, argc, argv);
+        CHECK(result->IsString());
+        v8::Handle<v8::String> local_name(result->ToString());
+        CHECK(local_name->Equals(v8::String::New("local")));
+        // Get the value of the first local variable. If the function
+        // is optimized the value will be undefined, otherwise it will
+        // be 42.
+        //
+        // TODO(3141533): We should be able to get the real value for
+        // optimized frames.
+        result = frame_local_value->Call(exec_state, argc, argv);
+        CHECK(result->IsUndefined() || (result->Int32Value() == 42));
+      }
+    }
+  }
+}
+
+
+static v8::Handle<v8::Value> ScheduleBreak(const v8::Arguments& args) {
+  v8::Debug::SetDebugEventListener(DebugEventBreakWithOptimizedStack,
+                                   v8::Undefined());
+  v8::Debug::DebugBreak();
+  return v8::Undefined();
+}
+
+
+TEST(DebugBreakStackInspection) {
+  v8::HandleScope scope;
+  DebugLocalContext env;
+
+  frame_function_name =
+      CompileFunction(&env, frame_function_name_source, "frame_function_name");
+  frame_argument_name =
+      CompileFunction(&env, frame_argument_name_source, "frame_argument_name");
+  frame_argument_value = CompileFunction(&env,
+                                         frame_argument_value_source,
+                                         "frame_argument_value");
+  frame_local_name =
+      CompileFunction(&env, frame_local_name_source, "frame_local_name");
+  frame_local_value =
+      CompileFunction(&env, frame_local_value_source, "frame_local_value");
+
+  v8::Handle<v8::FunctionTemplate> schedule_break_template =
+      v8::FunctionTemplate::New(ScheduleBreak);
+  v8::Handle<v8::Function> schedule_break =
+      schedule_break_template->GetFunction();
+  env->Global()->Set(v8_str("scheduleBreak"), schedule_break);
+
+  const char* src =
+      "function loop(count) {"
+      "  var local = 42;"
+      "  if (count < 1) { scheduleBreak(); loop(count + 1); }"
+      "}"
+      "loop(0);";
+  v8::Script::Compile(v8::String::New(src))->Run();
+}
+
 
 // Test that setting the terminate execution flag during debug break processing.
 static void TestDebugBreakInLoop(const char* loop_head,
diff --git a/deps/v8/test/cctest/test-deoptimization.cc b/deps/v8/test/cctest/test-deoptimization.cc
new file mode 100644
index 000000000..17453552e
--- /dev/null
+++ b/deps/v8/test/cctest/test-deoptimization.cc
@@ -0,0 +1,714 @@
+// Copyright 2007-2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+#include <stdlib.h>
+
+#include "v8.h"
+
+#include "api.h"
+#include "compilation-cache.h"
+#include "debug.h"
+#include "deoptimizer.h"
+#include "platform.h"
+#include "stub-cache.h"
+#include "cctest.h"
+
+
+using ::v8::internal::Handle;
+using ::v8::internal::Object;
+using ::v8::internal::JSFunction;
+using ::v8::internal::Deoptimizer;
+using ::v8::internal::EmbeddedVector;
+using ::v8::internal::OS;
+
+// Size of temp buffer for formatting small strings.
+#define SMALL_STRING_BUFFER_SIZE 80
+
+// Utility class to set --allow-natives-syntax --always-opt and --nouse-inlining
+// when constructed and return to their default state when destroyed.
+class AlwaysOptimizeAllowNativesSyntaxNoInlining {
+ public:
+  AlwaysOptimizeAllowNativesSyntaxNoInlining()
+      : always_opt_(i::FLAG_always_opt),
+        allow_natives_syntax_(i::FLAG_allow_natives_syntax),
+        use_inlining_(i::FLAG_use_inlining) {
+    i::FLAG_always_opt = true;
+    i::FLAG_allow_natives_syntax = true;
+    i::FLAG_use_inlining = false;
+  }
+
+  ~AlwaysOptimizeAllowNativesSyntaxNoInlining() {
+    i::FLAG_allow_natives_syntax = allow_natives_syntax_;
+    i::FLAG_always_opt = always_opt_;
+    i::FLAG_use_inlining = use_inlining_;
+  }
+
+ private:
+  bool always_opt_;
+  bool allow_natives_syntax_;
+  bool use_inlining_;
+};
+
+
+// Utility class to set --allow-natives-syntax and --nouse-inlining when
+// constructed and return to their default state when destroyed.
+class AllowNativesSyntaxNoInlining {
+ public:
+  AllowNativesSyntaxNoInlining()
+      : allow_natives_syntax_(i::FLAG_allow_natives_syntax),
+        use_inlining_(i::FLAG_use_inlining) {
+    i::FLAG_allow_natives_syntax = true;
+    i::FLAG_use_inlining = false;
+  }
+
+  ~AllowNativesSyntaxNoInlining() {
+    i::FLAG_allow_natives_syntax = allow_natives_syntax_;
+    i::FLAG_use_inlining = use_inlining_;
+  }
+
+ private:
+  bool allow_natives_syntax_;
+  bool use_inlining_;
+};
+
+
+Handle<JSFunction> GetJSFunction(v8::Handle<v8::Object> obj,
+                                 const char* property_name) {
+  v8::Local<v8::Function> fun =
+      v8::Local<v8::Function>::Cast(obj->Get(v8_str(property_name)));
+  return v8::Utils::OpenHandle(*fun);
+}
+
+
+TEST(DeoptimizeSimple) {
+  v8::HandleScope scope;
+  const char* extension_list[] = { "v8/gc" };
+  v8::ExtensionConfiguration extensions(1, extension_list);
+  LocalContext env(&extensions);
+
+  // Test lazy deoptimization of a simple function.
+  {
+    AlwaysOptimizeAllowNativesSyntaxNoInlining options;
+    CompileRun(
+        "var count = 0;"
+        "function h() { %DeoptimizeFunction(f); }"
+        "function g() { count++; h(); }"
+        "function f() { g(); };"
+        "f();"
+        "gc(); gc()");
+  }
+
+  CHECK_EQ(1, env->Global()->Get(v8_str("count"))->Int32Value());
+  CHECK(!GetJSFunction(env->Global(), "f")->IsOptimized());
+  CHECK_EQ(0, Deoptimizer::GetDeoptimizedCodeCount());
+
+  // Test lazy deoptimization of a simple function. Call the function after the
+  // deoptimization while it is still activated further down the stack.
+  {
+    AlwaysOptimizeAllowNativesSyntaxNoInlining options;
+    CompileRun(
+        "var count = 0;"
+        "function g() { count++; %DeoptimizeFunction(f); f(false); }"
+        "function f(x) { if (x) { g(); } else { return } };"
+        "f(true);"
+        "gc(); gc()");
+  }
+
+  CHECK_EQ(1, env->Global()->Get(v8_str("count"))->Int32Value());
+  CHECK(!GetJSFunction(env->Global(), "f")->IsOptimized());
+  CHECK_EQ(0, Deoptimizer::GetDeoptimizedCodeCount());
+}
+
+
+TEST(DeoptimizeSimpleWithArguments) {
+  v8::HandleScope scope;
+  const char* extension_list[] = { "v8/gc" };
+  v8::ExtensionConfiguration extensions(1, extension_list);
+  LocalContext env(&extensions);
+
+  // Test lazy deoptimization of a simple function with some arguments.
+  {
+    AlwaysOptimizeAllowNativesSyntaxNoInlining options;
+    CompileRun(
+        "var count = 0;"
+        "function h(x) { %DeoptimizeFunction(f); }"
+        "function g(x, y) { count++; h(x); }"
+        "function f(x, y, z) { g(1,x); y+z; };"
+        "f(1, \"2\", false);"
+        "gc(); gc()");
+  }
+
+  CHECK_EQ(1, env->Global()->Get(v8_str("count"))->Int32Value());
+  CHECK(!GetJSFunction(env->Global(), "f")->IsOptimized());
+  CHECK_EQ(0, Deoptimizer::GetDeoptimizedCodeCount());
+
+  // Test lazy deoptimization of a simple function with some arguments. Call the
+  // function after the deoptimization while it is still activated further down
+  // the stack.
+  {
+    AlwaysOptimizeAllowNativesSyntaxNoInlining options;
+    CompileRun(
+        "var count = 0;"
+        "function g(x, y) { count++; %DeoptimizeFunction(f); f(false, 1, y); }"
+        "function f(x, y, z) { if (x) { g(x, y); } else { return y + z; } };"
+        "f(true, 1, \"2\");"
+        "gc(); gc()");
+  }
+
+  CHECK_EQ(1, env->Global()->Get(v8_str("count"))->Int32Value());
+  CHECK(!GetJSFunction(env->Global(), "f")->IsOptimized());
+  CHECK_EQ(0, Deoptimizer::GetDeoptimizedCodeCount());
+}
+
+
+TEST(DeoptimizeSimpleNested) {
+  v8::HandleScope scope;
+  const char* extension_list[] = { "v8/gc" };
+  v8::ExtensionConfiguration extensions(1, extension_list);
+  LocalContext env(&extensions);
+
+  // Test lazy deoptimization of a simple function. Have a nested function call
+  // do the deoptimization.
+  {
+    AlwaysOptimizeAllowNativesSyntaxNoInlining options;
+    CompileRun(
+        "var count = 0;"
+        "var result = 0;"
+        "function h(x, y, z) { return x + y + z; }"
+        "function g(z) { count++; %DeoptimizeFunction(f); return z;}"
+        "function f(x,y,z) { return h(x, y, g(z)); };"
+        "result = f(1, 2, 3);"
+        "gc(); gc()");
+
+    CHECK_EQ(1, env->Global()->Get(v8_str("count"))->Int32Value());
+    CHECK_EQ(6, env->Global()->Get(v8_str("result"))->Int32Value());
+    CHECK(!GetJSFunction(env->Global(), "f")->IsOptimized());
+    CHECK_EQ(0, Deoptimizer::GetDeoptimizedCodeCount());
+  }
+}
+
+
+TEST(DeoptimizeRecursive) {
+  v8::HandleScope scope;
+  const char* extension_list[] = { "v8/gc" };
+  v8::ExtensionConfiguration extensions(1, extension_list);
+  LocalContext env(&extensions);
+
+  {
+    // Test lazy deoptimization of a simple function called recursively. Call
+    // the function recursively a number of times before deoptimizing it.
+    AlwaysOptimizeAllowNativesSyntaxNoInlining options;
+    CompileRun(
+        "var count = 0;"
+        "var calls = 0;"
+        "function g() { count++; %DeoptimizeFunction(f); }"
+        "function f(x) { calls++; if (x > 0) { f(x - 1); } else { g(); } };"
+        "f(10); gc(); gc()");
+  }
+
+  CHECK_EQ(1, env->Global()->Get(v8_str("count"))->Int32Value());
+  CHECK_EQ(11, env->Global()->Get(v8_str("calls"))->Int32Value());
+  CHECK_EQ(0, Deoptimizer::GetDeoptimizedCodeCount());
+
+  v8::Local<v8::Function> fun =
+      v8::Local<v8::Function>::Cast(env->Global()->Get(v8::String::New("f")));
+  Handle<v8::internal::JSFunction> f = v8::Utils::OpenHandle(*fun);
+}
+
+
+TEST(DeoptimizeMultiple) {
+  v8::HandleScope scope;
+  const char* extension_list[] = { "v8/gc" };
+  v8::ExtensionConfiguration extensions(1, extension_list);
+  LocalContext env(&extensions);
+
+  {
+    AlwaysOptimizeAllowNativesSyntaxNoInlining options;
+    CompileRun(
+        "var count = 0;"
+        "var result = 0;"
+        "function g() { count++;"
+        "               %DeoptimizeFunction(f1);"
+        "               %DeoptimizeFunction(f2);"
+        "               %DeoptimizeFunction(f3);"
+        "               %DeoptimizeFunction(f4);}"
+        "function f4(x) { g(); };"
+        "function f3(x, y, z) { f4(); return x + y + z; };"
+        "function f2(x, y) { return x + f3(y + 1, y + 1, y + 1) + y; };"
+        "function f1(x) { return f2(x + 1, x + 1) + x; };"
+        "result = f1(1);"
+        "gc(); gc()");
+  }
+
+  CHECK_EQ(1, env->Global()->Get(v8_str("count"))->Int32Value());
+  CHECK_EQ(14, env->Global()->Get(v8_str("result"))->Int32Value());
+  CHECK_EQ(0, Deoptimizer::GetDeoptimizedCodeCount());
+}
+
+
+TEST(DeoptimizeConstructor) {
+  v8::HandleScope scope;
+  const char* extension_list[] = { "v8/gc" };
+  v8::ExtensionConfiguration extensions(1, extension_list);
+  LocalContext env(&extensions);
+
+  {
+    AlwaysOptimizeAllowNativesSyntaxNoInlining options;
+    CompileRun(
+        "var count = 0;"
+        "function g() { count++;"
+        "               %DeoptimizeFunction(f); }"
+        "function f() {  g(); };"
+        "result = new f() instanceof f;"
+        "gc(); gc()");
+  }
+
+  CHECK_EQ(1, env->Global()->Get(v8_str("count"))->Int32Value());
+  CHECK(env->Global()->Get(v8_str("result"))->IsTrue());
+  CHECK_EQ(0, Deoptimizer::GetDeoptimizedCodeCount());
+
+  {
+    AlwaysOptimizeAllowNativesSyntaxNoInlining options;
+    CompileRun(
+        "var count = 0;"
+        "var result = 0;"
+        "function g() { count++;"
+        "               %DeoptimizeFunction(f); }"
+        "function f(x, y) { this.x = x; g(); this.y = y; };"
+        "result = new f(1, 2);"
+        "result = result.x + result.y;"
+        "gc(); gc()");
+  }
+
+  CHECK_EQ(1, env->Global()->Get(v8_str("count"))->Int32Value());
+  CHECK_EQ(3, env->Global()->Get(v8_str("result"))->Int32Value());
+  CHECK_EQ(0, Deoptimizer::GetDeoptimizedCodeCount());
+}
+
+
+TEST(DeoptimizeConstructorMultiple) {
+  v8::HandleScope scope;
+  const char* extension_list[] = { "v8/gc" };
+  v8::ExtensionConfiguration extensions(1, extension_list);
+  LocalContext env(&extensions);
+
+  {
+    AlwaysOptimizeAllowNativesSyntaxNoInlining options;
+    CompileRun(
+        "var count = 0;"
+        "var result = 0;"
+        "function g() { count++;"
+        "               %DeoptimizeFunction(f1);"
+        "               %DeoptimizeFunction(f2);"
+        "               %DeoptimizeFunction(f3);"
+        "               %DeoptimizeFunction(f4);}"
+        "function f4(x) { this.result = x; g(); };"
+        "function f3(x, y, z) { this.result = new f4(x + y + z).result; };"
+        "function f2(x, y) {"
+        "    this.result = x + new f3(y + 1, y + 1, y + 1).result + y; };"
+        "function f1(x) { this.result = new f2(x + 1, x + 1).result + x; };"
+        "result = new f1(1).result;"
+        "gc(); gc()");
+  }
+
+  CHECK_EQ(1, env->Global()->Get(v8_str("count"))->Int32Value());
+  CHECK_EQ(14, env->Global()->Get(v8_str("result"))->Int32Value());
+  CHECK_EQ(0, Deoptimizer::GetDeoptimizedCodeCount());
+}
+
+
+TEST(DeoptimizeBinaryOperationADDString) {
+  v8::HandleScope scope;
+  const char* extension_list[] = { "v8/gc" };
+  v8::ExtensionConfiguration extensions(1, extension_list);
+  LocalContext env(&extensions);
+
+  const char* f_source = "function f(x, y) { return x + y; };";
+
+  {
+    AllowNativesSyntaxNoInlining options;
+    // Compile function f and collect to type feedback to insert binary op stub
+    // call in the optimized code.
+    i::FLAG_prepare_always_opt = true;
+    CompileRun("var count = 0;"
+               "var result = 0;"
+               "var deopt = false;"
+               "function X() { };"
+               "X.prototype.toString = function () {"
+               "  if (deopt) { count++; %DeoptimizeFunction(f); } return 'an X'"
+               "};");
+    CompileRun(f_source);
+    CompileRun("for (var i = 0; i < 5; i++) {"
+               "  f('a+', new X());"
+               "};");
+
+    // Compile an optimized version of f.
+    i::FLAG_always_opt = true;
+    CompileRun(f_source);
+    CompileRun("f('a+', new X());");
+    CHECK(!i::V8::UseCrankshaft() ||
+          GetJSFunction(env->Global(), "f")->IsOptimized());
+
+    // Call f and force deoptimization while processing the binary operation.
+    CompileRun("deopt = true;"
+               "var result = f('a+', new X());"
+               "gc(); gc();");
+  }
+
+  CHECK(!GetJSFunction(env->Global(), "f")->IsOptimized());
+  CHECK_EQ(1, env->Global()->Get(v8_str("count"))->Int32Value());
+  v8::Handle<v8::Value> result = env->Global()->Get(v8_str("result"));
+  CHECK(result->IsString());
+  v8::String::AsciiValue ascii(result);
+  CHECK_EQ("a+an X", *ascii);
+  CHECK_EQ(0, Deoptimizer::GetDeoptimizedCodeCount());
+}
+
+
+static void CompileConstructorWithDeoptimizingValueOf() {
+  CompileRun("var count = 0;"
+             "var result = 0;"
+             "var deopt = false;"
+             "function X() { };"
+             "X.prototype.valueOf = function () {"
+             "  if (deopt) { count++; %DeoptimizeFunction(f); } return 8"
+             "};");
+}
+
+
+static void TestDeoptimizeBinaryOpHelper(LocalContext* env,
+                                         const char* binary_op) {
+  EmbeddedVector<char, SMALL_STRING_BUFFER_SIZE> f_source_buffer;
+  OS::SNPrintF(f_source_buffer,
+               "function f(x, y) { return x %s y; };",
+               binary_op);
+  char* f_source = f_source_buffer.start();
+
+  AllowNativesSyntaxNoInlining options;
+  // Compile function f and collect to type feedback to insert binary op stub
+  // call in the optimized code.
+  i::FLAG_prepare_always_opt = true;
+  CompileConstructorWithDeoptimizingValueOf();
+  CompileRun(f_source);
+  CompileRun("for (var i = 0; i < 5; i++) {"
+             "  f(8, new X());"
+             "};");
+
+  // Compile an optimized version of f.
+  i::FLAG_always_opt = true;
+  CompileRun(f_source);
+  CompileRun("f(7, new X());");
+  CHECK(!i::V8::UseCrankshaft() ||
+        GetJSFunction((*env)->Global(), "f")->IsOptimized());
+
+  // Call f and force deoptimization while processing the binary operation.
+  CompileRun("deopt = true;"
+             "var result = f(7, new X());"
+             "gc(); gc();");
+
+  CHECK(!GetJSFunction((*env)->Global(), "f")->IsOptimized());
+}
+
+
+TEST(DeoptimizeBinaryOperationADD) {
+  v8::HandleScope scope;
+  const char* extension_list[] = { "v8/gc" };
+  v8::ExtensionConfiguration extensions(1, extension_list);
+  LocalContext env(&extensions);
+
+  TestDeoptimizeBinaryOpHelper(&env, "+");
+
+  CHECK_EQ(1, env->Global()->Get(v8_str("count"))->Int32Value());
+  CHECK_EQ(15, env->Global()->Get(v8_str("result"))->Int32Value());
+  CHECK_EQ(0, Deoptimizer::GetDeoptimizedCodeCount());
+}
+
+
+TEST(DeoptimizeBinaryOperationSUB) {
+  v8::HandleScope scope;
+  const char* extension_list[] = { "v8/gc" };
+  v8::ExtensionConfiguration extensions(1, extension_list);
+  LocalContext env(&extensions);
+
+  TestDeoptimizeBinaryOpHelper(&env, "-");
+
+  CHECK_EQ(1, env->Global()->Get(v8_str("count"))->Int32Value());
+  CHECK_EQ(-1, env->Global()->Get(v8_str("result"))->Int32Value());
+  CHECK_EQ(0, Deoptimizer::GetDeoptimizedCodeCount());
+}
+
+
+TEST(DeoptimizeBinaryOperationMUL) {
+  v8::HandleScope scope;
+  const char* extension_list[] = { "v8/gc" };
+  v8::ExtensionConfiguration extensions(1, extension_list);
+  LocalContext env(&extensions);
+
+  TestDeoptimizeBinaryOpHelper(&env, "*");
+
+  CHECK_EQ(1, env->Global()->Get(v8_str("count"))->Int32Value());
+  CHECK_EQ(56, env->Global()->Get(v8_str("result"))->Int32Value());
+  CHECK_EQ(0, Deoptimizer::GetDeoptimizedCodeCount());
+}
+
+
+TEST(DeoptimizeBinaryOperationDIV) {
+  v8::HandleScope scope;
+  const char* extension_list[] = { "v8/gc" };
+  v8::ExtensionConfiguration extensions(1, extension_list);
+  LocalContext env(&extensions);
+
+  TestDeoptimizeBinaryOpHelper(&env, "/");
+
+  CHECK_EQ(1, env->Global()->Get(v8_str("count"))->Int32Value());
+  CHECK_EQ(0, env->Global()->Get(v8_str("result"))->Int32Value());
+  CHECK_EQ(0, Deoptimizer::GetDeoptimizedCodeCount());
+}
+
+
+TEST(DeoptimizeBinaryOperationMOD) {
+  v8::HandleScope scope;
+  const char* extension_list[] = { "v8/gc" };
+  v8::ExtensionConfiguration extensions(1, extension_list);
+  LocalContext env(&extensions);
+
+  TestDeoptimizeBinaryOpHelper(&env, "%");
+
+  CHECK_EQ(1, env->Global()->Get(v8_str("count"))->Int32Value());
+  CHECK_EQ(7, env->Global()->Get(v8_str("result"))->Int32Value());
+  CHECK_EQ(0, Deoptimizer::GetDeoptimizedCodeCount());
+}
+
+
+TEST(DeoptimizeCompare) {
+  v8::HandleScope scope;
+  const char* extension_list[] = { "v8/gc" };
+  v8::ExtensionConfiguration extensions(1, extension_list);
+  LocalContext env(&extensions);
+
+  const char* f_source = "function f(x, y) { return x < y; };";
+
+  {
+    AllowNativesSyntaxNoInlining options;
+    // Compile function f and collect to type feedback to insert compare ic
+    // call in the optimized code.
+    i::FLAG_prepare_always_opt = true;
+    CompileRun("var count = 0;"
+               "var result = 0;"
+               "var deopt = false;"
+               "function X() { };"
+               "X.prototype.toString = function () {"
+               "  if (deopt) { count++; %DeoptimizeFunction(f); } return 'b'"
+               "};");
+    CompileRun(f_source);
+    CompileRun("for (var i = 0; i < 5; i++) {"
+               "  f('a', new X());"
+               "};");
+
+    // Compile an optimized version of f.
+    i::FLAG_always_opt = true;
+    CompileRun(f_source);
+    CompileRun("f('a', new X());");
+    CHECK(!i::V8::UseCrankshaft() ||
+          GetJSFunction(env->Global(), "f")->IsOptimized());
+
+    // Call f and force deoptimization while processing the comparison.
+    CompileRun("deopt = true;"
+               "var result = f('a', new X());"
+               "gc(); gc();");
+  }
+
+  CHECK(!GetJSFunction(env->Global(), "f")->IsOptimized());
+  CHECK_EQ(1, env->Global()->Get(v8_str("count"))->Int32Value());
+  CHECK_EQ(true, env->Global()->Get(v8_str("result"))->BooleanValue());
+  CHECK_EQ(0, Deoptimizer::GetDeoptimizedCodeCount());
+}
+
+
+TEST(DeoptimizeLoadICStoreIC) {
+  v8::HandleScope scope;
+  const char* extension_list[] = { "v8/gc" };
+  v8::ExtensionConfiguration extensions(1, extension_list);
+  LocalContext env(&extensions);
+
+  // Functions to generate load/store/keyed load/keyed store IC calls.
+  const char* f1_source = "function f1(x) { return x.y; };";
+  const char* g1_source = "function g1(x) { x.y = 1; };";
+  const char* f2_source = "function f2(x, y) { return x[y]; };";
+  const char* g2_source = "function g2(x, y) { x[y] = 1; };";
+
+  {
+    AllowNativesSyntaxNoInlining options;
+    // Compile functions and collect to type feedback to insert ic
+    // calls in the optimized code.
+    i::FLAG_prepare_always_opt = true;
+    CompileRun("var count = 0;"
+               "var result = 0;"
+               "var deopt = false;"
+               "function X() { };"
+               "X.prototype.__defineGetter__('y', function () {"
+               "  if (deopt) { count++; %DeoptimizeFunction(f1); };"
+               "  return 13;"
+               "});"
+               "X.prototype.__defineSetter__('y', function () {"
+               "  if (deopt) { count++; %DeoptimizeFunction(g1); };"
+               "});"
+               "X.prototype.__defineGetter__('z', function () {"
+               "  if (deopt) { count++; %DeoptimizeFunction(f2); };"
+               "  return 13;"
+               "});"
+               "X.prototype.__defineSetter__('z', function () {"
+               "  if (deopt) { count++; %DeoptimizeFunction(g2); };"
+               "});");
+    CompileRun(f1_source);
+    CompileRun(g1_source);
+    CompileRun(f2_source);
+    CompileRun(g2_source);
+    CompileRun("for (var i = 0; i < 5; i++) {"
+               "  f1(new X());"
+               "  g1(new X());"
+               "  f2(new X(), 'z');"
+               "  g2(new X(), 'z');"
+               "};");
+
+    // Compile an optimized version of the functions.
+    i::FLAG_always_opt = true;
+    CompileRun(f1_source);
+    CompileRun(g1_source);
+    CompileRun(f2_source);
+    CompileRun(g2_source);
+    CompileRun("f1(new X());");
+    CompileRun("g1(new X());");
+    CompileRun("f2(new X(), 'z');");
+    CompileRun("g2(new X(), 'z');");
+    if (i::V8::UseCrankshaft()) {
+      CHECK(GetJSFunction(env->Global(), "f1")->IsOptimized());
+      CHECK(GetJSFunction(env->Global(), "g1")->IsOptimized());
+      CHECK(GetJSFunction(env->Global(), "f2")->IsOptimized());
+      CHECK(GetJSFunction(env->Global(), "g2")->IsOptimized());
+    }
+
+    // Call functions and force deoptimization while processing the ics.
+    CompileRun("deopt = true;"
+               "var result = f1(new X());"
+               "g1(new X());"
+               "f2(new X(), 'z');"
+               "g2(new X(), 'z');"
+               "gc(); gc();");
+  }
+
+  CHECK(!GetJSFunction(env->Global(), "f1")->IsOptimized());
+  CHECK(!GetJSFunction(env->Global(), "g1")->IsOptimized());
+  CHECK(!GetJSFunction(env->Global(), "f2")->IsOptimized());
+  CHECK(!GetJSFunction(env->Global(), "g2")->IsOptimized());
+  CHECK_EQ(4, env->Global()->Get(v8_str("count"))->Int32Value());
+  CHECK_EQ(13, env->Global()->Get(v8_str("result"))->Int32Value());
+  CHECK_EQ(0, Deoptimizer::GetDeoptimizedCodeCount());
+}
+
+
+TEST(DeoptimizeLoadICStoreICNested) {
+  v8::HandleScope scope;
+  const char* extension_list[] = { "v8/gc" };
+  v8::ExtensionConfiguration extensions(1, extension_list);
+  LocalContext env(&extensions);
+
+  // Functions to generate load/store/keyed load/keyed store IC calls.
+  const char* f1_source = "function f1(x) { return x.y; };";
+  const char* g1_source = "function g1(x) { x.y = 1; };";
+  const char* f2_source = "function f2(x, y) { return x[y]; };";
+  const char* g2_source = "function g2(x, y) { x[y] = 1; };";
+
+  {
+    AllowNativesSyntaxNoInlining options;
+    // Compile functions and collect to type feedback to insert ic
+    // calls in the optimized code.
+    i::FLAG_prepare_always_opt = true;
+    CompileRun("var count = 0;"
+               "var result = 0;"
+               "var deopt = false;"
+               "function X() { };"
+               "X.prototype.__defineGetter__('y', function () {"
+               "  g1(this);"
+               "  return 13;"
+               "});"
+               "X.prototype.__defineSetter__('y', function () {"
+               "  f2(this, 'z');"
+               "});"
+               "X.prototype.__defineGetter__('z', function () {"
+               "  g2(this, 'z');"
+               "});"
+               "X.prototype.__defineSetter__('z', function () {"
+               "  if (deopt) {"
+               "    count++;"
+               "    %DeoptimizeFunction(f1);"
+               "    %DeoptimizeFunction(g1);"
+               "    %DeoptimizeFunction(f2);"
+               "    %DeoptimizeFunction(g2); };"
+               "});");
+    CompileRun(f1_source);
+    CompileRun(g1_source);
+    CompileRun(f2_source);
+    CompileRun(g2_source);
+    CompileRun("for (var i = 0; i < 5; i++) {"
+               "  f1(new X());"
+               "  g1(new X());"
+               "  f2(new X(), 'z');"
+               "  g2(new X(), 'z');"
+               "};");
+
+    // Compile an optimized version of the functions.
+    i::FLAG_always_opt = true;
+    CompileRun(f1_source);
+    CompileRun(g1_source);
+    CompileRun(f2_source);
+    CompileRun(g2_source);
+    CompileRun("f1(new X());");
+    CompileRun("g1(new X());");
+    CompileRun("f2(new X(), 'z');");
+    CompileRun("g2(new X(), 'z');");
+    if (i::V8::UseCrankshaft()) {
+      CHECK(GetJSFunction(env->Global(), "f1")->IsOptimized());
+      CHECK(GetJSFunction(env->Global(), "g1")->IsOptimized());
+      CHECK(GetJSFunction(env->Global(), "f2")->IsOptimized());
+      CHECK(GetJSFunction(env->Global(), "g2")->IsOptimized());
+    }
+
+    // Call functions and force deoptimization while processing the ics.
+    CompileRun("deopt = true;"
+               "var result = f1(new X());"
+               "gc(); gc();");
+  }
+
+  CHECK(!GetJSFunction(env->Global(), "f1")->IsOptimized());
+  CHECK(!GetJSFunction(env->Global(), "g1")->IsOptimized());
+  CHECK(!GetJSFunction(env->Global(), "f2")->IsOptimized());
+  CHECK(!GetJSFunction(env->Global(), "g2")->IsOptimized());
+  CHECK_EQ(1, env->Global()->Get(v8_str("count"))->Int32Value());
+  CHECK_EQ(13, env->Global()->Get(v8_str("result"))->Int32Value());
+  CHECK_EQ(0, Deoptimizer::GetDeoptimizedCodeCount());
+}
diff --git a/deps/v8/test/cctest/test-heap-profiler.cc b/deps/v8/test/cctest/test-heap-profiler.cc
index 95314d74a..ac4afb251 100644
--- a/deps/v8/test/cctest/test-heap-profiler.cc
+++ b/deps/v8/test/cctest/test-heap-profiler.cc
@@ -1193,4 +1193,22 @@ TEST(AggregatedHeapSnapshotJSONSerialization) {
   CHECK_EQ(1, stream.eos_signaled());
 }
 
+
+TEST(HeapSnapshotGetNodeById) {
+  v8::HandleScope scope;
+  LocalContext env;
+
+  const v8::HeapSnapshot* snapshot =
+      v8::HeapProfiler::TakeSnapshot(v8::String::New("id"));
+  const v8::HeapGraphNode* root = snapshot->GetRoot();
+  CHECK_EQ(root, snapshot->GetNodeById(root->GetId()));
+  for (int i = 0, count = root->GetChildrenCount(); i < count; ++i) {
+    const v8::HeapGraphEdge* prop = root->GetChild(i);
+    CHECK_EQ(
+        prop->GetToNode(), snapshot->GetNodeById(prop->GetToNode()->GetId()));
+  }
+  // Check a big id, which should not exist yet.
+  CHECK_EQ(NULL, snapshot->GetNodeById(0x1000000UL));
+}
+
 #endif  // ENABLE_LOGGING_AND_PROFILING
diff --git a/deps/v8/test/cctest/test-heap.cc b/deps/v8/test/cctest/test-heap.cc
index fbe66ecd7..aa5fe59bd 100644
--- a/deps/v8/test/cctest/test-heap.cc
+++ b/deps/v8/test/cctest/test-heap.cc
@@ -511,7 +511,7 @@ static void CheckSymbols(const char** strings) {
     if (!maybe_a->ToObject(&a)) continue;
     CHECK(a->IsSymbol());
     Object* b;
-    MaybeObject* maybe_b = Heap::LookupAsciiSymbol(string);
+    MaybeObject *maybe_b = Heap::LookupAsciiSymbol(string);
     if (!maybe_b->ToObject(&b)) continue;
     CHECK_EQ(b, a);
     CHECK(String::cast(b)->IsEqualTo(CStrVector(string)));
@@ -978,7 +978,9 @@ TEST(TestCodeFlushing) {
   Handle<String> foo_name = Factory::LookupAsciiSymbol("foo");
 
   // This compile will add the code to the compilation cache.
-  CompileRun(source);
+  { v8::HandleScope scope;
+    CompileRun(source);
+  }
 
   // Check function is compiled.
   Object* func_value =
@@ -1000,8 +1002,8 @@ TEST(TestCodeFlushing) {
   Heap::CollectAllGarbage(true);
 
   // foo should no longer be in the compilation cache
-  CHECK(!function->shared()->is_compiled());
-  CHECK(!function->is_compiled());
+  CHECK(!function->shared()->is_compiled() || function->IsOptimized());
+  CHECK(!function->is_compiled() || function->IsOptimized());
   // Call foo to get it recompiled.
   CompileRun("foo()");
   CHECK(function->shared()->is_compiled());
@@ -1021,6 +1023,20 @@ static int CountGlobalContexts() {
 }
 
 
+// Count the number of user functions in the weak list of optimized
+// functions attached to a global context.
+static int CountOptimizedUserFunctions(v8::Handle<v8::Context> context) {
+  int count = 0;
+  Handle<Context> icontext = v8::Utils::OpenHandle(*context);
+  Object* object = icontext->get(Context::OPTIMIZED_FUNCTIONS_LIST);
+  while (object->IsJSFunction() && !JSFunction::cast(object)->IsBuiltin()) {
+    count++;
+    object = JSFunction::cast(object)->next_function_link();
+  }
+  return count;
+}
+
+
 TEST(TestInternalWeakLists) {
   static const int kNumTestContexts = 10;
 
@@ -1032,9 +1048,63 @@ TEST(TestInternalWeakLists) {
   // Create a number of global contests which gets linked together.
   for (int i = 0; i < kNumTestContexts; i++) {
     ctx[i] = v8::Context::New();
+
+    bool opt = (FLAG_always_opt && i::V8::UseCrankshaft());
+
     CHECK_EQ(i + 1, CountGlobalContexts());
 
     ctx[i]->Enter();
+
+    // Create a handle scope so no function objects get stuch in the outer
+    // handle scope
+    v8::HandleScope scope;
+    const char* source = "function f1() { };"
+                         "function f2() { };"
+                         "function f3() { };"
+                         "function f4() { };"
+                         "function f5() { };";
+    CompileRun(source);
+    CHECK_EQ(0, CountOptimizedUserFunctions(ctx[i]));
+    CompileRun("f1()");
+    CHECK_EQ(opt ? 1 : 0, CountOptimizedUserFunctions(ctx[i]));
+    CompileRun("f2()");
+    CHECK_EQ(opt ? 2 : 0, CountOptimizedUserFunctions(ctx[i]));
+    CompileRun("f3()");
+    CHECK_EQ(opt ? 3 : 0, CountOptimizedUserFunctions(ctx[i]));
+    CompileRun("f4()");
+    CHECK_EQ(opt ? 4 : 0, CountOptimizedUserFunctions(ctx[i]));
+    CompileRun("f5()");
+    CHECK_EQ(opt ? 5 : 0, CountOptimizedUserFunctions(ctx[i]));
+
+    // Remove function f1, and
+    CompileRun("f1=null");
+
+    // Scavenge treats these references as strong.
+    for (int j = 0; j < 10; j++) {
+      Heap::PerformScavenge();
+      CHECK_EQ(opt ? 5 : 0, CountOptimizedUserFunctions(ctx[i]));
+    }
+
+    // Mark compact handles the weak references.
+    Heap::CollectAllGarbage(true);
+    CHECK_EQ(opt ? 4 : 0, CountOptimizedUserFunctions(ctx[i]));
+
+    // Get rid of f3 and f5 in the same way.
+    CompileRun("f3=null");
+    for (int j = 0; j < 10; j++) {
+      Heap::PerformScavenge();
+      CHECK_EQ(opt ? 4 : 0, CountOptimizedUserFunctions(ctx[i]));
+    }
+    Heap::CollectAllGarbage(true);
+    CHECK_EQ(opt ? 3 : 0, CountOptimizedUserFunctions(ctx[i]));
+    CompileRun("f5=null");
+    for (int j = 0; j < 10; j++) {
+      Heap::PerformScavenge();
+      CHECK_EQ(opt ? 3 : 0, CountOptimizedUserFunctions(ctx[i]));
+    }
+    Heap::CollectAllGarbage(true);
+    CHECK_EQ(opt ? 2 : 0, CountOptimizedUserFunctions(ctx[i]));
+
     ctx[i]->Exit();
   }
 
@@ -1076,6 +1146,25 @@ static int CountGlobalContextsWithGC(int n) {
 }
 
 
+// Count the number of user functions in the weak list of optimized
+// functions attached to a global context causing a GC after the
+// specified number of elements.
+static int CountOptimizedUserFunctionsWithGC(v8::Handle<v8::Context> context,
+                                             int n) {
+  int count = 0;
+  Handle<Context> icontext = v8::Utils::OpenHandle(*context);
+  Handle<Object> object(icontext->get(Context::OPTIMIZED_FUNCTIONS_LIST));
+  while (object->IsJSFunction() &&
+         !Handle<JSFunction>::cast(object)->IsBuiltin()) {
+    count++;
+    if (count == n) Heap::CollectAllGarbage(true);
+    object = Handle<Object>(
+        Object::cast(JSFunction::cast(*object)->next_function_link()));
+  }
+  return count;
+}
+
+
 TEST(TestInternalWeakListsTraverseWithGC) {
   static const int kNumTestContexts = 10;
 
@@ -1090,10 +1179,37 @@ TEST(TestInternalWeakListsTraverseWithGC) {
     ctx[i] = v8::Context::New();
     CHECK_EQ(i + 1, CountGlobalContexts());
     CHECK_EQ(i + 1, CountGlobalContextsWithGC(i / 2 + 1));
-
-    ctx[i]->Enter();
-    ctx[i]->Exit();
   }
+
+  bool opt = (FLAG_always_opt && i::V8::UseCrankshaft());
+
+  // Compile a number of functions the length of the weak list of optimized
+  // functions both with and without GCs while iterating the list.
+  ctx[0]->Enter();
+  const char* source = "function f1() { };"
+                       "function f2() { };"
+                       "function f3() { };"
+                       "function f4() { };"
+                       "function f5() { };";
+  CompileRun(source);
+  CHECK_EQ(0, CountOptimizedUserFunctions(ctx[0]));
+  CompileRun("f1()");
+  CHECK_EQ(opt ? 1 : 0, CountOptimizedUserFunctions(ctx[0]));
+  CHECK_EQ(opt ? 1 : 0, CountOptimizedUserFunctionsWithGC(ctx[0], 1));
+  CompileRun("f2()");
+  CHECK_EQ(opt ? 2 : 0, CountOptimizedUserFunctions(ctx[0]));
+  CHECK_EQ(opt ? 2 : 0, CountOptimizedUserFunctionsWithGC(ctx[0], 1));
+  CompileRun("f3()");
+  CHECK_EQ(opt ? 3 : 0, CountOptimizedUserFunctions(ctx[0]));
+  CHECK_EQ(opt ? 3 : 0, CountOptimizedUserFunctionsWithGC(ctx[0], 1));
+  CompileRun("f4()");
+  CHECK_EQ(opt ? 4 : 0, CountOptimizedUserFunctions(ctx[0]));
+  CHECK_EQ(opt ? 4 : 0, CountOptimizedUserFunctionsWithGC(ctx[0], 2));
+  CompileRun("f5()");
+  CHECK_EQ(opt ? 5 : 0, CountOptimizedUserFunctions(ctx[0]));
+  CHECK_EQ(opt ? 5 : 0, CountOptimizedUserFunctionsWithGC(ctx[0], 4));
+
+  ctx[0]->Exit();
 }
 
 
diff --git a/deps/v8/test/cctest/test-log-stack-tracer.cc b/deps/v8/test/cctest/test-log-stack-tracer.cc
index 65be6bd85..c85f6c0bc 100644
--- a/deps/v8/test/cctest/test-log-stack-tracer.cc
+++ b/deps/v8/test/cctest/test-log-stack-tracer.cc
@@ -39,6 +39,7 @@
 #include "cctest.h"
 #include "disassembler.h"
 #include "register-allocator-inl.h"
+#include "vm-state-inl.h"
 
 using v8::Function;
 using v8::Local;
@@ -200,6 +201,7 @@ static void InitializeVM() {
 
 
 static void CheckJSFunctionAtAddress(const char* func_name, Address addr) {
+  CHECK(i::Heap::Contains(addr));
   i::Object* obj = i::HeapObject::FromAddress(addr);
   CHECK(obj->IsJSFunction());
   CHECK(JSFunction::cast(obj)->shared()->name()->IsString());
@@ -298,10 +300,17 @@ TEST(CFromJSStackTrace) {
   //       trace(EBP) [native (extension)]
   //         DoTrace(EBP) [native]
   //           StackTracer::Trace
-  CHECK_GT(sample.frames_count, 1);
+
+  // The VM state tracking keeps track of external callbacks and puts
+  // them at the top of the sample stack.
+  int base = 0;
+  CHECK(sample.stack[0] == FUNCTION_ADDR(TraceExtension::Trace));
+  base++;
+
   // Stack tracing will start from the first JS function, i.e. "JSFuncDoTrace"
-  CheckJSFunctionAtAddress("JSFuncDoTrace", sample.stack[0]);
-  CheckJSFunctionAtAddress("JSTrace", sample.stack[1]);
+  CHECK_GT(sample.frames_count, base + 1);
+  CheckJSFunctionAtAddress("JSFuncDoTrace", sample.stack[base + 0]);
+  CheckJSFunctionAtAddress("JSTrace", sample.stack[base + 1]);
 }
 
 
@@ -311,6 +320,10 @@ TEST(CFromJSStackTrace) {
 // Top::c_entry_fp value. In this case, StackTracer uses passed frame
 // pointer value as a starting point for stack walking.
 TEST(PureJSStackTrace) {
+  // This test does not pass with inlining enabled since inlined functions
+  // don't appear in the stack trace.
+  i::FLAG_use_inlining = false;
+
   TickSample sample;
   InitTraceEnv(&sample);
 
@@ -341,10 +354,17 @@ TEST(PureJSStackTrace) {
   // The last JS function called. It is only visible through
   // sample.function, as its return address is above captured EBP value.
   CheckJSFunctionAtAddress("JSFuncDoTrace", sample.function);
-  CHECK_GT(sample.frames_count, 1);
+
+  // The VM state tracking keeps track of external callbacks and puts
+  // them at the top of the sample stack.
+  int base = 0;
+  CHECK(sample.stack[0] == FUNCTION_ADDR(TraceExtension::JSTrace));
+  base++;
+
   // Stack sampling will start from the caller of JSFuncDoTrace, i.e. "JSTrace"
-  CheckJSFunctionAtAddress("JSTrace", sample.stack[0]);
-  CheckJSFunctionAtAddress("OuterJSTrace", sample.stack[1]);
+  CHECK_GT(sample.frames_count, base + 1);
+  CheckJSFunctionAtAddress("JSTrace", sample.stack[base + 0]);
+  CheckJSFunctionAtAddress("OuterJSTrace", sample.stack[base + 1]);
 }
 
 
diff --git a/deps/v8/test/cctest/test-log.cc b/deps/v8/test/cctest/test-log.cc
index 710c10e99..503e0cf7c 100644
--- a/deps/v8/test/cctest/test-log.cc
+++ b/deps/v8/test/cctest/test-log.cc
@@ -16,6 +16,7 @@
 #include "cpu-profiler.h"
 #include "v8threads.h"
 #include "cctest.h"
+#include "vm-state-inl.h"
 
 using v8::internal::Address;
 using v8::internal::EmbeddedVector;
@@ -246,7 +247,8 @@ class LogBufferMatcher {
 
 
 static void CheckThatProfilerWorks(LogBufferMatcher* matcher) {
-  CHECK(!LoggerTestHelper::IsSamplerActive());
+  CHECK(i::RuntimeProfiler::IsEnabled() ||
+        !LoggerTestHelper::IsSamplerActive());
   LoggerTestHelper::ResetSamplesTaken();
 
   Logger::ResumeProfiler(v8::PROFILER_MODULE_CPU, 0);
@@ -272,7 +274,8 @@ static void CheckThatProfilerWorks(LogBufferMatcher* matcher) {
   }
 
   Logger::PauseProfiler(v8::PROFILER_MODULE_CPU, 0);
-  CHECK(!LoggerTestHelper::IsSamplerActive());
+  CHECK(i::RuntimeProfiler::IsEnabled() ||
+        !LoggerTestHelper::IsSamplerActive());
 
   // Wait 50 msecs to allow Profiler thread to process the last
   // tick sample it has got.
@@ -291,8 +294,12 @@ static void CheckThatProfilerWorks(LogBufferMatcher* matcher) {
 TEST(ProfLazyMode) {
   ScopedLoggerInitializer initialize_logger(true);
 
-  // No sampling should happen prior to resuming profiler.
-  CHECK(!LoggerTestHelper::IsSamplerActive());
+  if (!i::V8::UseCrankshaft()) return;
+
+  // No sampling should happen prior to resuming profiler unless we
+  // are runtime profiling.
+  CHECK(i::RuntimeProfiler::IsEnabled() ||
+        !LoggerTestHelper::IsSamplerActive());
 
   LogBufferMatcher matcher;
   // Nothing must be logged until profiling is resumed.
@@ -403,7 +410,7 @@ class LoopingNonJsThread : public LoopingThread {
 class TestSampler : public v8::internal::Sampler {
  public:
   TestSampler()
-      : Sampler(0, true),
+      : Sampler(0, true, true),
         semaphore_(v8::internal::OS::CreateSemaphore(0)),
         was_sample_stack_called_(false) {
   }
@@ -431,30 +438,38 @@ class TestSampler : public v8::internal::Sampler {
 }  // namespace
 
 TEST(ProfMultipleThreads) {
+  TestSampler* sampler = NULL;
+  {
+    v8::Locker locker;
+    sampler = new TestSampler();
+    sampler->Start();
+    CHECK(sampler->IsActive());
+  }
+
   LoopingJsThread jsThread;
   jsThread.Start();
   LoopingNonJsThread nonJsThread;
   nonJsThread.Start();
 
-  TestSampler sampler;
-  sampler.Start();
-  CHECK(!sampler.WasSampleStackCalled());
+  CHECK(!sampler->WasSampleStackCalled());
   jsThread.WaitForRunning();
   jsThread.SendSigProf();
-  CHECK(sampler.WaitForTick());
-  CHECK(sampler.WasSampleStackCalled());
-  sampler.Reset();
-  CHECK(!sampler.WasSampleStackCalled());
+  CHECK(sampler->WaitForTick());
+  CHECK(sampler->WasSampleStackCalled());
+  sampler->Reset();
+  CHECK(!sampler->WasSampleStackCalled());
   nonJsThread.WaitForRunning();
   nonJsThread.SendSigProf();
-  CHECK(!sampler.WaitForTick());
-  CHECK(!sampler.WasSampleStackCalled());
-  sampler.Stop();
+  CHECK(!sampler->WaitForTick());
+  CHECK(!sampler->WasSampleStackCalled());
+  sampler->Stop();
 
   jsThread.Stop();
   nonJsThread.Stop();
   jsThread.Join();
   nonJsThread.Join();
+
+  delete sampler;
 }
 
 #endif  // __linux__
diff --git a/deps/v8/test/cctest/test-mark-compact.cc b/deps/v8/test/cctest/test-mark-compact.cc
index 994256712..86f105f2c 100644
--- a/deps/v8/test/cctest/test-mark-compact.cc
+++ b/deps/v8/test/cctest/test-mark-compact.cc
@@ -71,6 +71,10 @@ TEST(MarkingStack) {
 
 
 TEST(Promotion) {
+  // This test requires compaction. If compaction is turned off, we
+  // skip the entire test.
+  if (FLAG_never_compact) return;
+
   // Ensure that we get a compacting collection so that objects are promoted
   // from new space.
   FLAG_gc_global = true;
diff --git a/deps/v8/test/cctest/test-parsing.cc b/deps/v8/test/cctest/test-parsing.cc
index a93fc2712..badbab5ee 100755
--- a/deps/v8/test/cctest/test-parsing.cc
+++ b/deps/v8/test/cctest/test-parsing.cc
@@ -257,15 +257,20 @@ TEST(StandAlonePreParser) {
       NULL
   };
 
+  uintptr_t stack_limit = i::StackGuard::real_climit();
   for (int i = 0; programs[i]; i++) {
     const char* program = programs[i];
     unibrow::Utf8InputBuffer<256> stream(program, strlen(program));
     i::CompleteParserRecorder log;
     i::V8JavaScriptScanner scanner;
     scanner.Initialize(i::Handle<i::String>::null(), &stream);
-    v8::preparser::PreParser preparser;
-    bool result = preparser.PreParseProgram(&scanner, &log, true);
-    CHECK(result);
+
+    v8::preparser::PreParser::PreParseResult result =
+        v8::preparser::PreParser::PreParseProgram(&scanner,
+                                                  &log,
+                                                  true,
+                                                  stack_limit);
+    CHECK_EQ(v8::preparser::PreParser::kPreParseSuccess, result);
     i::ScriptDataImpl data(log.ExtractData());
     CHECK(!data.has_error());
   }
@@ -327,3 +332,31 @@ TEST(Regress928) {
   CHECK_EQ('}', program[entry2.end_pos() - 1]);
   delete data;
 }
+
+
+TEST(PreParseOverflow) {
+  int marker;
+  i::StackGuard::SetStackLimit(
+      reinterpret_cast<uintptr_t>(&marker) - 128 * 1024);
+
+  size_t kProgramSize = 1024 * 1024;
+  i::SmartPointer<char> program(
+      reinterpret_cast<char*>(malloc(kProgramSize + 1)));
+  memset(*program, '(', kProgramSize);
+  program[kProgramSize] = '\0';
+
+  uintptr_t stack_limit = i::StackGuard::real_climit();
+
+  unibrow::Utf8InputBuffer<256> stream(*program, strlen(*program));
+  i::CompleteParserRecorder log;
+  i::V8JavaScriptScanner scanner;
+  scanner.Initialize(i::Handle<i::String>::null(), &stream);
+
+
+  v8::preparser::PreParser::PreParseResult result =
+      v8::preparser::PreParser::PreParseProgram(&scanner,
+                                                &log,
+                                                true,
+                                                stack_limit);
+  CHECK_EQ(v8::preparser::PreParser::kPreParseStackOverflow, result);
+}
diff --git a/deps/v8/test/cctest/test-profile-generator.cc b/deps/v8/test/cctest/test-profile-generator.cc
index f46191a22..a0733ef68 100644
--- a/deps/v8/test/cctest/test-profile-generator.cc
+++ b/deps/v8/test/cctest/test-profile-generator.cc
@@ -757,6 +757,10 @@ static const ProfileNode* PickChild(const ProfileNode* parent,
 
 
 TEST(RecordStackTraceAtStartProfiling) {
+  // This test does not pass with inlining enabled since inlined functions
+  // don't appear in the stack trace.
+  i::FLAG_use_inlining = false;
+
   if (env.IsEmpty()) {
     v8::HandleScope scope;
     const char* extensions[] = { "v8/profiler" };
diff --git a/deps/v8/test/cctest/test-regexp.cc b/deps/v8/test/cctest/test-regexp.cc
index 3e6709aef..3bf24a8ab 100644
--- a/deps/v8/test/cctest/test-regexp.cc
+++ b/deps/v8/test/cctest/test-regexp.cc
@@ -173,9 +173,6 @@ TEST(Parser) {
   CHECK_PARSE_EQ("[a-b-c]", "[a-b - c]");
   CHECK_PARSE_EQ("[\\d]", "[0-9]");
   CHECK_PARSE_EQ("[x\\dz]", "[x 0-9 z]");
-  CHECK_PARSE_EQ("[\\d-z]", "[0-9 - z]");
-  CHECK_PARSE_EQ("[\\d-\\d]", "[0-9 - 0-9]");
-  CHECK_PARSE_EQ("[z-\\d]", "[z - 0-9]");
   CHECK_PARSE_EQ("\\cj\\cJ\\ci\\cI\\ck\\cK",
                  "'\\x0a\\x0a\\x09\\x09\\x0b\\x0b'");
   CHECK_PARSE_EQ("\\c!", "'c!'");
diff --git a/deps/v8/test/cctest/test-reloc-info.cc b/deps/v8/test/cctest/test-reloc-info.cc
new file mode 100644
index 000000000..2b9beac12
--- /dev/null
+++ b/deps/v8/test/cctest/test-reloc-info.cc
@@ -0,0 +1,109 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+#include "cctest.h"
+#include "assembler.h"
+
+namespace v8 {
+namespace internal {
+
+static void WriteRinfo(RelocInfoWriter* writer,
+                       byte* pc, RelocInfo::Mode mode, intptr_t data) {
+  RelocInfo rinfo(pc, mode, data);
+  writer->Write(&rinfo);
+}
+
+
+// Tests that writing both types of positions and then reading either
+// or both works as expected.
+TEST(Positions) {
+  const int instr_size = 10 << 10;
+  const int reloc_size = 10 << 10;
+  const int buf_size = instr_size + reloc_size;
+  SmartPointer<byte> buf(new byte[buf_size]);
+  byte* pc = *buf;
+  CodeDesc desc = { *buf, buf_size, instr_size, reloc_size, NULL };
+
+  RelocInfoWriter writer(*buf + buf_size, pc);
+  for (int i = 0, pos = 0; i < 100; i++, pc += i, pos += i) {
+    RelocInfo::Mode mode = (i % 2 == 0) ?
+        RelocInfo::STATEMENT_POSITION : RelocInfo::POSITION;
+    WriteRinfo(&writer, pc, mode, pos);
+  }
+
+  // Read only (non-statement) positions.
+  {
+    RelocIterator it(desc, RelocInfo::ModeMask(RelocInfo::POSITION));
+    pc = *buf;
+    for (int i = 0, pos = 0; i < 100; i++, pc += i, pos += i) {
+      RelocInfo::Mode mode = (i % 2 == 0) ?
+          RelocInfo::STATEMENT_POSITION : RelocInfo::POSITION;
+      if (mode == RelocInfo::POSITION) {
+        CHECK_EQ(pc, it.rinfo()->pc());
+        CHECK_EQ(mode, it.rinfo()->rmode());
+        CHECK_EQ(pos, static_cast<int>(it.rinfo()->data()));
+        it.next();
+      }
+    }
+    CHECK(it.done());
+  }
+
+  // Read only statement positions.
+  {
+    RelocIterator it(desc, RelocInfo::ModeMask(RelocInfo::STATEMENT_POSITION));
+    pc = *buf;
+    for (int i = 0, pos = 0; i < 100; i++, pc += i, pos += i) {
+      RelocInfo::Mode mode = (i % 2 == 0) ?
+          RelocInfo::STATEMENT_POSITION : RelocInfo::POSITION;
+      if (mode == RelocInfo::STATEMENT_POSITION) {
+        CHECK_EQ(pc, it.rinfo()->pc());
+        CHECK_EQ(mode, it.rinfo()->rmode());
+        CHECK_EQ(pos, static_cast<int>(it.rinfo()->data()));
+        it.next();
+      }
+    }
+    CHECK(it.done());
+  }
+
+  // Read both types of positions.
+  {
+    RelocIterator it(desc, RelocInfo::kPositionMask);
+    pc = *buf;
+    for (int i = 0, pos = 0; i < 100; i++, pc += i, pos += i) {
+      RelocInfo::Mode mode = (i % 2 == 0) ?
+          RelocInfo::STATEMENT_POSITION : RelocInfo::POSITION;
+      CHECK_EQ(pc, it.rinfo()->pc());
+      CHECK_EQ(mode, it.rinfo()->rmode());
+      CHECK_EQ(pos, static_cast<int>(it.rinfo()->data()));
+      it.next();
+    }
+    CHECK(it.done());
+  }
+}
+
+} }  // namespace v8::internal
diff --git a/deps/v8/test/cctest/test-spaces.cc b/deps/v8/test/cctest/test-spaces.cc
index b399a4ef1..706c6bf9a 100644
--- a/deps/v8/test/cctest/test-spaces.cc
+++ b/deps/v8/test/cctest/test-spaces.cc
@@ -95,13 +95,13 @@ TEST(MemoryAllocator) {
 
   OldSpace faked_space(Heap::MaxReserved(), OLD_POINTER_SPACE, NOT_EXECUTABLE);
   int total_pages = 0;
-  int requested = 2;
+  int requested = MemoryAllocator::kPagesPerChunk;
   int allocated;
-  // If we request two pages, we should get one or two.
+  // If we request n pages, we should get n or n - 1.
   Page* first_page =
       MemoryAllocator::AllocatePages(requested, &allocated, &faked_space);
   CHECK(first_page->is_valid());
-  CHECK(allocated > 0 && allocated <= 2);
+  CHECK(allocated == requested || allocated == requested - 1);
   total_pages += allocated;
 
   Page* last_page = first_page;
@@ -110,11 +110,11 @@ TEST(MemoryAllocator) {
     last_page = p;
   }
 
-  // Again, we should get one or two pages.
+  // Again, we should get n or n - 1 pages.
   Page* others =
       MemoryAllocator::AllocatePages(requested, &allocated, &faked_space);
   CHECK(others->is_valid());
-  CHECK(allocated > 0 && allocated <= 2);
+  CHECK(allocated == requested || allocated == requested - 1);
   total_pages += allocated;
 
   MemoryAllocator::SetNextPage(last_page, others);
@@ -129,11 +129,10 @@ TEST(MemoryAllocator) {
   CHECK(second_page->is_valid());
 
   // Freeing pages at the first chunk starting at or after the second page
-  // should free the entire second chunk.  It will return the last page in the
-  // first chunk (if the second page was in the first chunk) or else an
-  // invalid page (if the second page was the start of the second chunk).
+  // should free the entire second chunk.  It will return the page it was passed
+  // (since the second page was in the first chunk).
   Page* free_return = MemoryAllocator::FreePages(second_page);
-  CHECK(free_return == last_page || !free_return->is_valid());
+  CHECK(free_return == second_page);
   MemoryAllocator::SetNextPage(first_page, free_return);
 
   // Freeing pages in the first chunk starting at the first page should free
diff --git a/deps/v8/test/cctest/test-utils.cc b/deps/v8/test/cctest/test-utils.cc
index 88ef0a204..b48dcb8b6 100644
--- a/deps/v8/test/cctest/test-utils.cc
+++ b/deps/v8/test/cctest/test-utils.cc
@@ -103,6 +103,7 @@ void TestMemCopy(Vector<byte> src,
 
 
 TEST(MemCopy) {
+  V8::Initialize(NULL);
   const int N = kMinComplexMemCopy + 128;
   Vector<byte> buffer1 = Vector<byte>::New(N);
   Vector<byte> buffer2 = Vector<byte>::New(N);
diff --git a/deps/v8/test/cctest/test-version.cc b/deps/v8/test/cctest/test-version.cc
index 6d2685596..6bec4b75e 100644
--- a/deps/v8/test/cctest/test-version.cc
+++ b/deps/v8/test/cctest/test-version.cc
@@ -74,6 +74,20 @@ static void CheckVersion(int major, int minor, int build,
 
 
 TEST(VersionString) {
+#ifdef USE_SIMULATOR
+  CheckVersion(0, 0, 0, 0, false, "0.0.0 SIMULATOR", "libv8-0.0.0.so");
+  CheckVersion(0, 0, 0, 0, true,
+               "0.0.0 (candidate) SIMULATOR", "libv8-0.0.0-candidate.so");
+  CheckVersion(1, 0, 0, 0, false, "1.0.0 SIMULATOR", "libv8-1.0.0.so");
+  CheckVersion(1, 0, 0, 0, true,
+               "1.0.0 (candidate) SIMULATOR", "libv8-1.0.0-candidate.so");
+  CheckVersion(1, 0, 0, 1, false, "1.0.0.1 SIMULATOR", "libv8-1.0.0.1.so");
+  CheckVersion(1, 0, 0, 1, true,
+               "1.0.0.1 (candidate) SIMULATOR", "libv8-1.0.0.1-candidate.so");
+  CheckVersion(2, 5, 10, 7, false, "2.5.10.7 SIMULATOR", "libv8-2.5.10.7.so");
+  CheckVersion(2, 5, 10, 7, true,
+               "2.5.10.7 (candidate) SIMULATOR", "libv8-2.5.10.7-candidate.so");
+#else
   CheckVersion(0, 0, 0, 0, false, "0.0.0", "libv8-0.0.0.so");
   CheckVersion(0, 0, 0, 0, true,
                "0.0.0 (candidate)", "libv8-0.0.0-candidate.so");
@@ -86,4 +100,5 @@ TEST(VersionString) {
   CheckVersion(2, 5, 10, 7, false, "2.5.10.7", "libv8-2.5.10.7.so");
   CheckVersion(2, 5, 10, 7, true,
                "2.5.10.7 (candidate)", "libv8-2.5.10.7-candidate.so");
+#endif
 }
diff --git a/deps/v8/test/es5conform/es5conform.status b/deps/v8/test/es5conform/es5conform.status
index 5add082c6..cc641dfe5 100644
--- a/deps/v8/test/es5conform/es5conform.status
+++ b/deps/v8/test/es5conform/es5conform.status
@@ -29,6 +29,8 @@ prefix es5conform
 def UNIMPLEMENTED = PASS || FAIL
 def FAIL_OK = FAIL, OKAY
 
+
+##############################################################################
 # Non UTF8 characters in test files.
 chapter10/10.4/10.4.2/10.4.2-3-c-2-s: FAIL_OK
 chapter10/10.4/10.4.2/10.4.2-3-c-1-s: FAIL_OK
diff --git a/deps/v8/test/message/message.status b/deps/v8/test/message/message.status
index c4a384275..70354ceec 100644
--- a/deps/v8/test/message/message.status
+++ b/deps/v8/test/message/message.status
@@ -30,6 +30,8 @@ prefix message
 # All tests in the bug directory are expected to fail.
 bugs: FAIL
 
+
+##############################################################################
 [ $arch == mips ]
 
 # Skip all tests on MIPS.
diff --git a/deps/v8/test/message/try-catch-finally-return-in-finally.js b/deps/v8/test/message/try-catch-finally-return-in-finally.js
index d23fe35c8..58a62a8bf 100644
--- a/deps/v8/test/message/try-catch-finally-return-in-finally.js
+++ b/deps/v8/test/message/try-catch-finally-return-in-finally.js
@@ -36,4 +36,5 @@ function f() {
   }
 }
 
-print(f());
+var result = f();
+if (result != 42) print("Wrong result: " + result);
diff --git a/deps/v8/test/message/try-catch-finally-return-in-finally.out b/deps/v8/test/message/try-catch-finally-return-in-finally.out
index 1c42ee01b..f59f5c6a6 100644
--- a/deps/v8/test/message/try-catch-finally-return-in-finally.out
+++ b/deps/v8/test/message/try-catch-finally-return-in-finally.out
@@ -24,5 +24,3 @@
 # THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 # (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-42
diff --git a/deps/v8/test/message/try-finally-return-in-finally.js b/deps/v8/test/message/try-finally-return-in-finally.js
index 6ec897065..0e461931d 100644
--- a/deps/v8/test/message/try-finally-return-in-finally.js
+++ b/deps/v8/test/message/try-finally-return-in-finally.js
@@ -34,4 +34,5 @@ function f() {
   }
 }
 
-print(f());
+var result = f();
+if (result != 42) print("Wrong result: " + result);
diff --git a/deps/v8/test/message/try-finally-return-in-finally.out b/deps/v8/test/message/try-finally-return-in-finally.out
index 1c42ee01b..f59f5c6a6 100644
--- a/deps/v8/test/message/try-finally-return-in-finally.out
+++ b/deps/v8/test/message/try-finally-return-in-finally.out
@@ -24,5 +24,3 @@
 # THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 # (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-42
diff --git a/deps/v8/test/mjsunit/accessors-on-global-object.js b/deps/v8/test/mjsunit/accessors-on-global-object.js
new file mode 100644
index 000000000..8d95692c5
--- /dev/null
+++ b/deps/v8/test/mjsunit/accessors-on-global-object.js
@@ -0,0 +1,72 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test that installing a getter on the global object instead of a
+// normal property works.
+
+var x = 0;
+
+function getX() { return x; }
+
+for (var i = 0; i < 10; i++) {
+  assertEquals(i < 5 ? 0 : 42, getX());
+  if (i == 4) __defineGetter__("x", function() { return 42; });
+}
+
+
+// Test that installing a setter on the global object instead of a
+// normal property works.
+
+var y = 0;
+var setter_y;
+
+function setY(value) { y = value; }
+
+for (var i = 0; i < 10; i++) {
+  setY(i);
+  assertEquals(i < 5 ? i : 2 * i, y);
+  if (i == 4) {
+    __defineSetter__("y", function(value) { setter_y = 2 * value; });
+    __defineGetter__("y", function() { return setter_y; });
+  }
+}
+
+
+// Test that replacing a getter with a normal property works as
+// expected.
+
+__defineGetter__("z", function() { return 42; });
+
+function getZ() { return z; }
+
+for (var i = 0; i < 10; i++) {
+  assertEquals(i < 5 ? 42 : 0, getZ());
+  if (i == 4) {
+    delete z;
+    var z = 0;
+  }
+}
diff --git a/deps/v8/test/mjsunit/apply-arguments-gc-safepoint.js b/deps/v8/test/mjsunit/apply-arguments-gc-safepoint.js
new file mode 100644
index 000000000..57ed8cc97
--- /dev/null
+++ b/deps/v8/test/mjsunit/apply-arguments-gc-safepoint.js
@@ -0,0 +1,44 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-gc
+
+// Test that safepoint tables are correctly generated for apply with
+// arguments in the case where arguments adaption is needed.
+
+function f(x, y) {
+  if (x == 149999) gc();
+  return x + y;
+}
+
+function g() {
+  f.apply(this, arguments);
+}
+
+for (var i = 0; i < 150000; i++) {
+  g(i);
+}
diff --git a/deps/v8/test/mjsunit/array-functions-prototype.js b/deps/v8/test/mjsunit/array-functions-prototype.js
index ea0dc61ef..b68ee734c 100644
--- a/deps/v8/test/mjsunit/array-functions-prototype.js
+++ b/deps/v8/test/mjsunit/array-functions-prototype.js
@@ -55,7 +55,7 @@ function assertHasOwnProperties(object, limit) {
 // shift.
 // ----------------------------------------------------------------------
 
-function runTest() {
+function runTest1() {
   var nonArray = new constructor();
   var array = ['zero', , 'two'];
   // Shift away the zero.
@@ -80,13 +80,13 @@ function runTest() {
   assertEquals('two', nonArray[2]);
 }
 
-runTest();
+runTest1();
 
 // ----------------------------------------------------------------------
 // unshift.
 // ----------------------------------------------------------------------
 
-runTest = function() {
+runTest2 = function() {
   var nonArray = new constructor();
   var array = ['zero', , 'two'];
   // Unshift a new 'zero'.
@@ -110,14 +110,14 @@ runTest = function() {
   assertEquals('two', nonArray[3]);
 }
 
-runTest();
+runTest2();
 
 
 // ----------------------------------------------------------------------
 // splice
 // ----------------------------------------------------------------------
 
-runTest = function() {
+runTest3 = function() {
   var nonArray = new constructor();
   var array = ['zero', , 'two'];
   // Delete the first element by splicing in nothing.
@@ -140,14 +140,14 @@ runTest = function() {
   assertEquals('two', nonArray[2]);
 };
 
-runTest();
+runTest3();
 
 
 // ----------------------------------------------------------------------
 // slice
 // ----------------------------------------------------------------------
 
-runTest = function() {
+runTest4 = function() {
   var nonArray = new constructor();
   var array = ['zero', , 'two'];
   // Again Spidermonkey is inconsistent.  (array.slice(0, 3))[1] is
@@ -156,4 +156,4 @@ runTest = function() {
   assertArrayEquals(['zero', 'one', 'two'], Array.prototype.slice.call(nonArray, 0, 3));
 };
 
-runTest();
+runTest4();
diff --git a/deps/v8/test/mjsunit/codegen-coverage.js b/deps/v8/test/mjsunit/codegen-coverage.js
index 8e7f1891a..cd538635d 100644
--- a/deps/v8/test/mjsunit/codegen-coverage.js
+++ b/deps/v8/test/mjsunit/codegen-coverage.js
@@ -25,8 +25,6 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --nofull-compiler --nofast-compiler
-
 // Test paths in the code generator where values in specific registers
 // get moved around.
 function identity(x) {
diff --git a/deps/v8/test/mjsunit/compiler/alloc-number.js b/deps/v8/test/mjsunit/compiler/alloc-number.js
new file mode 100644
index 000000000..85c39de43
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/alloc-number.js
@@ -0,0 +1,39 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+// Try to get a GC because of a heap number allocation while we
+// have live values (o) in a register.
+function f(o) {
+  var x = 1.5;
+  var y = 2.5;
+  for (var i = 1; i < 100000; i+=2) o.val = x + y + i;
+  return o;
+}
+
+var o = { val: 0 };
+for (var i = 0; i < 100; i++) f(o);
diff --git a/deps/v8/test/mjsunit/compiler/array-access.js b/deps/v8/test/mjsunit/compiler/array-access.js
new file mode 100644
index 000000000..65b3c99b4
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/array-access.js
@@ -0,0 +1,132 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function Get0(a) {
+  return a[0];
+}
+
+function GetN(a,n) {
+  return a[n];
+}
+
+function GetA0(a) {
+  return a[a[0]];
+}
+
+function GetAN(a,n) {
+  return a[a[n]];
+}
+
+function GetAAN(a,n) {
+  return a[a[a[n]]];
+}
+
+function RunGetTests() {
+  var a = [2,0,1];
+  assertEquals(2, Get0(a));
+
+  assertEquals(2, GetN(a, 0));
+  assertEquals(0, GetN(a, 1));
+  assertEquals(1, GetN(a, 2));
+
+  assertEquals(1, GetA0(a));
+
+  assertEquals(1, GetAN(a,0));
+  assertEquals(2, GetAN(a,1));
+  assertEquals(0, GetAN(a,2));
+
+  assertEquals(0, GetAAN(a,0));
+  assertEquals(1, GetAAN(a,1));
+  assertEquals(2, GetAAN(a,2));
+}
+
+
+function Set07(a) {
+  a[0] = 7;
+}
+
+function Set0V(a, v) {
+  a[0] = v;
+}
+
+function SetN7(a, n) {
+  a[n] = 7;
+}
+
+function SetNX(a, n, x) {
+  a[n] = x;
+}
+
+function RunSetTests(a) {
+  Set07(a);
+  assertEquals(7, a[0]);
+  assertEquals(0, a[1]);
+  assertEquals(0, a[2]);
+
+  Set0V(a, 1);
+  assertEquals(1, a[0]);
+  assertEquals(0, a[1]);
+  assertEquals(0, a[2]);
+
+  SetN7(a, 2);
+  assertEquals(1, a[0]);
+  assertEquals(0, a[1]);
+  assertEquals(7, a[2]);
+
+  SetNX(a, 1, 5);
+  assertEquals(1, a[0]);
+  assertEquals(5, a[1]);
+  assertEquals(7, a[2]);
+
+  for (var i = 0; i < 3; i++) SetNX(a, i, 0);
+  assertEquals(0, a[0]);
+  assertEquals(0, a[1]);
+  assertEquals(0, a[2]);
+}
+
+function RunArrayBoundsCheckTest() {
+  var g = [1,2,3];
+
+  function f(a, i) { a[i] = 42; }
+
+  for (var i = 0; i < 100000; i++) { f(g, 0); }
+
+  f(g, 4);
+
+  assertEquals(42, g[0]);
+  assertEquals(42, g[4]);
+}
+
+var a = [0,0,0];
+var o = {0: 0, 1: 0, 2: 0};
+for (var i = 0; i < 1000; i++) {
+  RunGetTests();
+  RunSetTests(a);
+  RunSetTests(o);
+}
+
+RunArrayBoundsCheckTest();
diff --git a/deps/v8/test/mjsunit/compiler/array-length.js b/deps/v8/test/mjsunit/compiler/array-length.js
new file mode 100644
index 000000000..7adb9abb3
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/array-length.js
@@ -0,0 +1,42 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function ArrayLength(a) { return a.length; }
+
+function Test(a0, a2, a5) {
+  assertEquals(0, ArrayLength(a0));
+  assertEquals(2, ArrayLength(a2));
+  assertEquals(5, ArrayLength(a5));
+}
+
+var a0 = [];
+var a2 = [1,2];
+var a5 = [1,2,3,4,5];
+for (var i = 0; i < 10000000; i++) Test(a0, a2, a5);
+assertEquals("undefined", typeof(ArrayLength(0)));
+for (var i = 0; i < 10000000; i++) Test(a0, a2, a5);
+assertEquals(4, ArrayLength("hest"));
diff --git a/deps/v8/test/mjsunit/compiler/assignment-deopt.js b/deps/v8/test/mjsunit/compiler/assignment-deopt.js
new file mode 100644
index 000000000..74f185bb1
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/assignment-deopt.js
@@ -0,0 +1,146 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test deopt with count operation on parameter.
+var max_smi = 1073741823;
+var o = {x:0};
+
+function assign1(x) { x += 1; o.x = x; }
+assign1(max_smi);
+assertEquals(max_smi + 1, o.x);
+
+assign1(1.1);
+assertEquals(2.1, o.x);
+
+
+// Test deopt with count operation on named property.
+function assign2(p) { p.x += 1 }
+
+o.x = "42";
+assign2(o);
+assertEquals("421", o.x);
+
+var s = max_smi - 10000;
+o.x = s;
+for(var i = 0; i < 20000; i++) {
+  assign2(o);
+}
+assertEquals(max_smi + 10000, o.x);
+
+
+// Test deopt with count operation on keyed property.
+function assign3(a, b) { a[b] += 1; }
+
+o = ["42"];
+assign3(o, 0);
+assertEquals("421", o[0]);
+
+var s = max_smi - 10000;
+o[0] = s;
+for(var i = 0; i < 20000; i++) {
+  assign3(o, 0);
+}
+assertEquals(max_smi + 10000, o[0]);
+
+assign3(o,"0");
+
+assertEquals(max_smi + 10001, o[0]);
+
+// Test bailout when accessing a non-existing array element.
+o[0] = 0;
+for(var i = 0; i < 10000; i++) {
+  assign3(o, 0);
+}
+assign3(o,1);
+
+// Test bailout with count operation in a value context.
+function assign5(x,y) { return (x += 1) + y; }
+for (var i = 0; i < 10000; ++i) assertEquals(4, assign5(2, 1));
+assertEquals(4.1, assign5(2, 1.1));
+assertEquals(4.1, assign5(2.1, 1));
+
+function assign7(o,y) { return (o.x += 1) + y; }
+o = {x:0};
+for (var i = 0; i < 10000; ++i) {
+  o.x = 42;
+  assertEquals(44, assign7(o, 1));
+}
+o.x = 42;
+assertEquals(44.1, assign7(o, 1.1));
+o.x = 42.1;
+assertEquals(44.1, assign7(o, 1));
+
+function assign9(o,y) { return (o[0] += 1) + y; }
+q = [0];
+for (var i = 0; i < 10000; ++i) {
+  q[0] = 42;
+  assertEquals(44, assign9(q, 1));
+}
+q[0] = 42;
+assertEquals(44.1, assign9(q, 1.1));
+q[0] = 42.1;
+assertEquals(44.1, assign9(q, 1));
+
+// Test deopt because of a failed map check on the load.
+function assign10(p) { return p.x += 1 }
+var g1 = {x:0};
+var g2 = {y:0, x:42};
+for (var i = 0; i < 10000; ++i) {
+  g1.x = 42;
+  assertEquals(43, assign10(g1));
+  assertEquals(43, g1.x);
+}
+assertEquals(43, assign10(g2));
+assertEquals(43, g2.x);
+
+// Test deopt because of a failed map check on the store.
+// The binary operation changes the map as a side effect.
+o = {x:0};
+var g3 = { valueOf: function() { o.y = "bar"; return 42; }};
+function assign11(p) { return p.x += 1; }
+
+for (var i = 0; i < 10000; i++) {
+  o.x = "a";
+  assign11(o);
+}
+assertEquals("a11", assign11(o));
+o.x = g3;
+assertEquals(43, assign11(o));
+assertEquals("bar", o.y);
+
+o = [0];
+var g4 = { valueOf: function() { o.y = "bar"; return 42; }};
+function assign12(p) { return p[0] += 1; }
+
+for (var i = 0; i < 1000000; i++) {
+  o[0] = "a";
+  assign12(o);
+}
+assertEquals("a11", assign12(o));
+o[0] = g4;
+assertEquals(43, assign12(o));
+assertEquals("bar", o.y);
diff --git a/deps/v8/test/mjsunit/compiler/assignment.js b/deps/v8/test/mjsunit/compiler/assignment.js
index 6aded4e9c..1f3f28221 100644
--- a/deps/v8/test/mjsunit/compiler/assignment.js
+++ b/deps/v8/test/mjsunit/compiler/assignment.js
@@ -264,6 +264,13 @@ function bar_loop() {
 bar_loop();
 
 
+// Test assignment in test context.
+function test_assign(x, y) { if (x = y) return x; }
+
+assertEquals(42, test_assign(0, 42));
+
+assertEquals("undefined", typeof test_assign(42, 0));
+
 // Test for assignment using a keyed store ic:
 function store_i_in_element_i_of_object_i() {
   var i = new Object();
diff --git a/deps/v8/test/mjsunit/compiler/binary-ops.js b/deps/v8/test/mjsunit/compiler/binary-ops.js
new file mode 100644
index 000000000..27745c13f
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/binary-ops.js
@@ -0,0 +1,55 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Values in distinct spans.
+function or_test0(x, y) { return x | y; }
+function and_test0(x, y) { return x & y; }
+function add_test0(x, y) { return x + y; }
+
+assertEquals(3, or_test0(1, 2));   // 1 | 2
+assertEquals(2, and_test0(3, 6));  // 3 & 6
+assertEquals(5, add_test0(2, 3));  // 2 + 3
+
+
+// Values in the same span.
+function or_test1(x, y) { return x | x; }
+function and_test1(x, y) { return x & x; }
+function add_test1(x, y) { return x + x; }
+
+assertEquals(1, or_test1(1, 2));   // 1 | 1
+assertEquals(3, and_test1(3, 6));  // 3 & 3
+assertEquals(4, add_test1(2, 3));  // 2 + 2
+
+
+// Values in distinct spans that alias.
+function or_test2(x, y) { x = y; return x | y; }
+function and_test2(x, y) { x = y; return x & y; }
+function add_test2(x, y) { x = y; return x + y; }
+
+assertEquals(2, or_test2(1, 2));   // 2 | 2
+assertEquals(6, and_test2(3, 6));  // 6 & 6
+assertEquals(6, add_test2(2, 3));  // 3 + 3
diff --git a/deps/v8/test/mjsunit/compiler/call-keyed.js b/deps/v8/test/mjsunit/compiler/call-keyed.js
new file mode 100644
index 000000000..d44221286
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/call-keyed.js
@@ -0,0 +1,38 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+A = {}
+A.i = [];
+A.i.push(function () { });
+A.i.push(function () { });
+
+function f (event) {
+ for(var i = 0, j = A.i.length; i < j; ++i)
+   A.i[i]();
+}
+
+f(null);
diff --git a/deps/v8/test/mjsunit/compiler/compare.js b/deps/v8/test/mjsunit/compiler/compare.js
new file mode 100644
index 000000000..3f9608700
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/compare.js
@@ -0,0 +1,108 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function MaxLT(x, y) {
+  if (x < y) return y;
+  return x;
+}
+
+function MaxLE(x, y) {
+  if (x <= y) return y;
+  return x;
+}
+
+function MaxGE(x, y) {
+  if (x >= y) return x;
+  return y;
+}
+
+function MaxGT(x, y) {
+  if (x > y) return x;
+  return y;
+}
+
+
+// First test primitive values.
+function TestPrimitive(max, x, y) {
+  assertEquals(max, MaxLT(x, y), "MaxLT - primitive");
+  assertEquals(max, MaxLE(x, y), "MaxLE - primitive");
+  assertEquals(max, MaxGE(x, y), "MaxGE - primitive");
+  assertEquals(max, MaxGT(x, y), "MaxGT - primitive");
+}
+
+TestPrimitive(1, 0, 1);
+TestPrimitive(1, 1, 0);
+TestPrimitive(4, 3, 4);
+TestPrimitive(4, 4, 3);
+TestPrimitive(0, -1, 0);
+TestPrimitive(0, 0, -1)
+TestPrimitive(-2, -2, -3);
+TestPrimitive(-2, -3, -2);
+
+TestPrimitive(1, 0.1, 1);
+TestPrimitive(1, 1, 0.1);
+TestPrimitive(4, 3.1, 4);
+TestPrimitive(4, 4, 3.1);
+TestPrimitive(0, -1.1, 0);
+TestPrimitive(0, 0, -1.1)
+TestPrimitive(-2, -2, -3.1);
+TestPrimitive(-2, -3.1, -2);
+
+
+// Test non-primitive values and watch for valueOf call order.
+function TestNonPrimitive(order, f) {
+  var result = "";
+  var x = { valueOf: function() { result += "x"; } };
+  var y = { valueOf: function() { result += "y"; } };
+  f(x, y);
+  assertEquals(order, result);
+}
+
+TestNonPrimitive("xy", MaxLT);
+TestNonPrimitive("yx", MaxLE);
+TestNonPrimitive("xy", MaxGE);
+TestNonPrimitive("yx", MaxGT);
+
+// Test compare in case of aliased registers.
+function CmpX(x) { if (x == x) return 42; }
+assertEquals(42, CmpX(0));
+
+function CmpXY(x) { var y = x; if (x == y) return 42; }
+assertEquals(42, CmpXY(0));
+
+
+// Test compare against null.
+function CmpNullValue(x) { return x == null; }
+assertEquals(false, CmpNullValue(42));
+
+function CmpNullTest(x) { if (x == null) return 42; return 0; }
+assertEquals(42, CmpNullTest(null));
+
+var g1 = 0;
+function CmpNullEffect() { (g1 = 42) == null; }
+CmpNullEffect();
+assertEquals(42, g1);
diff --git a/deps/v8/test/mjsunit/compiler/complex-for-in.js b/deps/v8/test/mjsunit/compiler/complex-for-in.js
new file mode 100644
index 000000000..883f20a9e
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/complex-for-in.js
@@ -0,0 +1,50 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function TestNamed(m) {
+  var o = {};
+  var result = [];
+  for (o.p in m) result.push(o.p);
+  return result;
+}
+
+assertArrayEquals(['x','y'], TestNamed({x:0, y:1}));
+assertArrayEquals(['0','1'], TestNamed([1,2]));
+
+
+function TestKeyed(m) {
+  var a = [];
+  var result = [];
+  var i = 0;
+  for (a[i++] in m) result.push(a[i - 1]);
+  assertEquals(i, a.length);
+  return result;
+}
+
+
+assertArrayEquals(['x','y'], TestKeyed({x:0, y:1}));
+assertArrayEquals(['0','1'], TestKeyed([1,2]));
diff --git a/deps/v8/test/mjsunit/compiler/control-flow-0.js b/deps/v8/test/mjsunit/compiler/control-flow-0.js
new file mode 100644
index 000000000..bcf4f2dc9
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/control-flow-0.js
@@ -0,0 +1,44 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function f() {
+  return (42 + (0 == 1 ? 1 : 2));
+}
+
+
+function g(x) {
+  return (x + (0 == 1 ? 1 : 2));
+}
+
+
+function h(x) {
+  return ((x + 1) + (0 == 1 ? 1 : 2));
+}
+
+assertEquals(44, f());
+assertEquals(45, g(43));
+assertEquals(47, h(44));
diff --git a/deps/v8/test/mjsunit/compiler/control-flow-1.js b/deps/v8/test/mjsunit/compiler/control-flow-1.js
new file mode 100644
index 000000000..973d9b666
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/control-flow-1.js
@@ -0,0 +1,55 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var global = this;
+
+function f0(x) {
+  assertTrue(this === global);
+  return x;
+}
+
+function g0(x, y) {
+  return f0(x == y);
+}
+
+assertTrue(g0(0, 0));
+assertFalse(g0(0, 1));
+
+
+var o = {};
+o.f1 = f1;
+function f1(x) {
+  assertTrue(this === o);
+  return x;
+}
+
+function g1(x, y) {
+  return o.f1(x == y);
+}
+
+assertTrue(g1(0, 0));
+assertFalse(g1(0, 1));
\ No newline at end of file
diff --git a/deps/v8/test/mjsunit/compiler/control-flow-2.js b/deps/v8/test/mjsunit/compiler/control-flow-2.js
new file mode 100644
index 000000000..26ed5643f
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/control-flow-2.js
@@ -0,0 +1,34 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function f(a,b) {
+  return (b < a) - (a < b);
+}
+
+assertEquals(0, f(0,0));
+assertEquals(1, f(1,0));
+assertEquals(-1, f(0,1));
diff --git a/deps/v8/test/mjsunit/compiler/count-deopt.js b/deps/v8/test/mjsunit/compiler/count-deopt.js
new file mode 100644
index 000000000..dcd82f877
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/count-deopt.js
@@ -0,0 +1,150 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test deopt with count operation on parameter.
+var max_smi = 1073741823;
+var o = {x:0};
+
+function inc1(x) { x++; o.x = x; }
+inc1(max_smi);
+assertEquals(max_smi + 1, o.x);
+
+inc1(1.1);
+assertEquals(2.1, o.x);
+
+
+// Test deopt with count operation on named property.
+function inc2(p) { p.x++ }
+
+o.x = "42";
+inc2(o);
+assertEquals(43, o.x);
+
+var s = max_smi - 10000;
+o.x = s;
+for(var i = 0; i < 20000; i++) {
+  inc2(o);
+}
+assertEquals(max_smi + 10000, o.x);
+
+
+// Test deopt with count operation on keyed property.
+function inc3(a, b) { a[b]++; }
+
+o = ["42"];
+inc3(o, 0);
+assertEquals(43, o[0]);
+
+var s = max_smi - 10000;
+o[0] = s;
+for(var i = 0; i < 20000; i++) {
+  inc3(o, 0);
+}
+assertEquals(max_smi + 10000, o[0]);
+
+inc3(o,"0");
+
+assertEquals(max_smi + 10001, o[0]);
+
+// Test bailout when accessing a non-existing array element.
+o[0] = 0;
+for(var i = 0; i < 10000; i++) {
+  inc3(o, 0);
+}
+inc3(o,1);
+
+// Test bailout with count operation in a value context.
+function inc4(x,y) { return (x++) + y; }
+for (var i = 0; i < 100000; ++i) assertEquals(3, inc4(2, 1));
+assertEquals(3.1, inc4(2, 1.1));
+
+function inc5(x,y) { return (++x) + y; }
+for (var i = 0; i < 100000; ++i) assertEquals(4, inc5(2, 1));
+assertEquals(4.1, inc5(2, 1.1));
+assertEquals(4.1, inc5(2.1, 1));
+
+function inc6(o,y) { return (o.x++) + y; }
+o = {x:0};
+for (var i = 0; i < 10000; ++i) {
+  o.x = 42;
+  assertEquals(43, inc6(o, 1));
+}
+o.x = 42;
+assertEquals(43.1, inc6(o, 1.1));
+o.x = 42.1;
+assertEquals(43.1, inc6(o, 1));
+
+function inc7(o,y) { return (++o.x) + y; }
+o = {x:0};
+for (var i = 0; i < 10000; ++i) {
+  o.x = 42;
+  assertEquals(44, inc7(o, 1));
+}
+o.x = 42;
+assertEquals(44.1, inc7(o, 1.1));
+o.x = 42.1;
+assertEquals(44.1, inc7(o, 1));
+
+function inc8(o,y) { return (o[0]++) + y; }
+var q = [0];
+for (var i = 0; i < 100000; ++i) {
+  q[0] = 42;
+  assertEquals(43, inc8(q, 1));
+}
+q[0] = 42;
+assertEquals(43.1, inc8(q, 1.1));
+q[0] = 42.1;
+assertEquals(43.1, inc8(q, 1));
+
+function inc9(o,y) { return (++o[0]) + y; }
+q = [0];
+for (var i = 0; i < 100000; ++i) {
+  q[0] = 42;
+  assertEquals(44, inc9(q, 1));
+}
+q[0] = 42;
+assertEquals(44.1, inc9(q, 1.1));
+q[0] = 42.1;
+assertEquals(44.1, inc9(q, 1));
+
+// Test deopt because of a failed map check.
+function inc10(p) { return p.x++ }
+var g1 = {x:0};
+var g2 = {y:0, x:42}
+for (var i = 0; i < 10000; ++i) {
+  g1.x = 42;
+  assertEquals(42, inc10(g1));
+  assertEquals(43, g1.x);
+}
+assertEquals(42, inc10(g2));
+assertEquals(43, g2.x);
+
+// Test deoptimization with postfix operation in a value context.
+function inc11(a) { return a[this.x++]; }
+var g3 = {x:null, f:inc11};
+var g4 = [42];
+assertEquals(42, g3.f(g4));
diff --git a/deps/v8/test/mjsunit/compiler/countoperation.js b/deps/v8/test/mjsunit/compiler/countoperation.js
index 5660cee16..dca4c11cf 100644
--- a/deps/v8/test/mjsunit/compiler/countoperation.js
+++ b/deps/v8/test/mjsunit/compiler/countoperation.js
@@ -109,3 +109,23 @@ assertEquals(1, ++b[c] && 1);
 assertEquals(45, b[c]);
 assertEquals(1, b[c]++ && 1);
 assertEquals(46, b[c]);
+
+// Test count operations with parameters.
+function f(x) { x++; return x; }
+assertEquals(43, f(42));
+
+function g(x) { ++x; return x; }
+assertEquals(43, g(42));
+
+function h(x) { var y = x++; return y; }
+assertEquals(42, h(42));
+
+function k(x) { var y = ++x; return y; }
+assertEquals(43, k(42));
+
+// Test count operation in a test context.
+function countTestPost(i) { var k = 0; while (i--) { k++; } return k; }
+assertEquals(10, countTestPost(10));
+
+function countTestPre(i) { var k = 0; while (--i) { k++; } return k; }
+assertEquals(9, countTestPre(10));
diff --git a/deps/v8/test/mjsunit/compiler/delete.js b/deps/v8/test/mjsunit/compiler/delete.js
new file mode 100644
index 000000000..373a1cbcf
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/delete.js
@@ -0,0 +1,71 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Tests of unary delete in cases where it is always true or always false.
+
+// In an effect context, expression is always true.
+assertEquals(undefined, void (delete 0));
+// In an effect context, expression is always false.
+assertEquals(undefined, (function (x) { delete x; })(0));
+
+// In a pure test context, expression is always true.
+assertEquals(1, (delete 0) ? 1 : 2);
+// In a pure test context, expression is always false.
+assertEquals(2, (function (x) { return (delete x) ? 1 : 2; })(0));
+// In a negated test context, expression is always false.
+assertEquals(1, (function (x) { return !(delete x) ? 1 : 2; })(0));
+
+// In a hybrid test/value context, expression is always true, value
+// expected in accumulator.
+assertEquals(3, 1 + ((delete 0) && 2));
+// In a hybrid test/value context, expression is always false, value
+// expected in accumulator.
+assertEquals(false, (function (x) { return (delete x) && 2; })(0));
+// In a hybrid test/value context, expression is always true, value
+// expected on stack.
+assertEquals(3, ((delete 0) && 2) + 1);
+// In a hybrid test/value context, expression is always false, value
+// expected on stack.
+assertEquals(1, (function (x) { return ((delete x) && 2) + 1; })(0));
+
+// In a hybrid value/test context, expression is always true, value
+// expected in accumulator.
+assertEquals(2, 1 + ((delete 0) || 2));
+// In a hybrid value/test context, expression is always false, value
+// expected in accumulator.
+assertEquals(2, (function (x) { return (delete x) || 2; })(0));
+// In a hybrid value/test context, expression is always true, value
+// expected on stack.
+assertEquals(2, ((delete 0) || 2) + 1);
+// In a hybrid value/test context, expression is always false, value
+// expected on stack.
+assertEquals(3, (function (x) { return ((delete x) || 2) + 1; })(0));
+
+
+// 'this' at toplevel is different from all other global variables---not
+// deletable.
+assertEquals(true, delete this);
diff --git a/deps/v8/test/mjsunit/compiler/deopt-args.js b/deps/v8/test/mjsunit/compiler/deopt-args.js
new file mode 100644
index 000000000..780e2a24a
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/deopt-args.js
@@ -0,0 +1,43 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function g(x) {
+  return x.f(0,1,2);
+}
+
+function f(a,b,c) {
+  return 42;
+}
+
+var object = { };
+object.f = f;
+for (var i = 0; i < 10000000; i++) {
+  assertEquals(42, g(object));
+}
+
+object.f = function(a,b,c) { return 87; };
+assertEquals(87, g(object));
diff --git a/deps/v8/test/mjsunit/compiler/deopt-inlined-smi.js b/deps/v8/test/mjsunit/compiler/deopt-inlined-smi.js
new file mode 100644
index 000000000..dda083e5b
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/deopt-inlined-smi.js
@@ -0,0 +1,64 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --always-opt --always-inline-smi-code
+
+// Test deoptimization into inlined smi code.
+
+function f(x) {
+  return ~x;
+}
+
+f(42);
+assertEquals(~12, f(12.45));
+assertEquals(~42, f(42.87));
+
+
+var a = 1, b = 2, c = 4, d = 8;
+function g() {
+  return a | (b | (c | d));
+}
+
+g();
+c = "16";
+assertEquals(1 | 2 | 16 | 8, g());
+
+
+function h() {
+  return 1 | a;
+}
+a = "2";
+h();
+assertEquals(3, h());
+
+
+function k() {
+  return a | 1;
+}
+a = "4";
+k();
+assertEquals(5, k());
diff --git a/deps/v8/test/mjsunit/compiler/expression-trees.js b/deps/v8/test/mjsunit/compiler/expression-trees.js
new file mode 100644
index 000000000..fac6b4cb6
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/expression-trees.js
@@ -0,0 +1,107 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --always-opt --nocompilation-cache
+
+// Given a binary operation string and an ordered array of leaf
+// strings, return an array of all binary tree strings with the leaves
+// (in order) as the fringe.
+function makeTrees(op, leaves) {
+  var len = leaves.length;
+  if (len == 1) {
+    // One leaf is a leaf.
+    return leaves;
+  } else {
+    // More than one leaf requires an interior node.
+    var result = [];
+    // Split the leaves into left and right subtrees in all possible
+    // ways.  For each split recursively compute all possible subtrees.
+    for (var i = 1; i < len; ++i) {
+      var leftTrees = makeTrees(op, leaves.slice(0, i));
+      var rightTrees = makeTrees(op, leaves.slice(i, len));
+      // Adjoin every possible left and right subtree.
+      for (var j = 0; j < leftTrees.length; ++j) {
+        for (var k = 0; k < rightTrees.length; ++k) {
+          var string = "(" + leftTrees[j] + op + rightTrees[k] + ")";
+          result.push(string);
+        }
+      }
+    }
+    return result;
+  }
+}
+
+// All 429 possible bitwise OR trees with eight leaves.
+var identifiers = ['a','b','c','d','e','f','g','h'];
+var or_trees = makeTrees("|", identifiers);
+var and_trees = makeTrees("&", identifiers);
+
+// Set up leaf masks to set 8 least-significant bits.
+var a = 1 << 0;
+var b = 1 << 1;
+var c = 1 << 2;
+var d = 1 << 3;
+var e = 1 << 4;
+var f = 1 << 5;
+var g = 1 << 6;
+var h = 1 << 7;
+
+for (var i = 0; i < or_trees.length; ++i) {
+  for (var j = 0; j < 8; ++j) {
+    var or_fun = new Function("return " + or_trees[i]);
+    if (j == 0) assertEquals(255, or_fun());
+
+    // Set the j'th variable to a string to force a bailout.
+    eval(identifiers[j] + "+= ''");
+    assertEquals(255, or_fun());
+    // Set it back to a number for the next iteration.
+    eval(identifiers[j] + "= +" + identifiers[j]);
+  }
+}
+
+// Set up leaf masks to clear 8 least-significant bits.
+a ^= 255;
+b ^= 255;
+c ^= 255;
+d ^= 255;
+e ^= 255;
+f ^= 255;
+g ^= 255;
+h ^= 255;
+
+for (i = 0; i < and_trees.length; ++i) {
+  for (var j = 0; j < 8; ++j) {
+    var and_fun = new Function("return " + and_trees[i]);
+    if (j == 0) assertEquals(0, and_fun());
+
+    // Set the j'th variable to a string to force a bailout.
+    eval(identifiers[j] + "+= ''");
+    assertEquals(0, and_fun());
+    // Set it back to a number for the next iteration.
+    eval(identifiers[j] + "= +" + identifiers[j]);
+  }
+}
diff --git a/deps/v8/test/mjsunit/compiler/for-stmt.js b/deps/v8/test/mjsunit/compiler/for-stmt.js
new file mode 100644
index 000000000..c8af01c6b
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/for-stmt.js
@@ -0,0 +1,59 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+// Test variants of for loops.
+function f(i, p) {
+  for(; i < 10; ) {
+    p.x = p.x + 1;
+    i = i+1;
+  }
+}
+var o = {x:42};
+f(1, o);
+assertEquals(51, o.x);
+
+
+function g(i, p) {
+  for(; ; ) {
+    if (i == 10) return;
+    p.x = p.x + 1;
+    i = i+1;
+  }
+}
+o = {x:42};
+g(1, o);
+assertEquals(51, o.x);
+
+
+function h(p) {
+  for(; p.x < 10; p.x++) {}
+}
+
+var o = {x:0};
+h(o);
+assertEquals(10, o.x);
diff --git a/deps/v8/test/mjsunit/compiler/globals.js b/deps/v8/test/mjsunit/compiler/globals.js
index 0abd5dd33..3b778daae 100644
--- a/deps/v8/test/mjsunit/compiler/globals.js
+++ b/deps/v8/test/mjsunit/compiler/globals.js
@@ -63,3 +63,14 @@ assertEquals(4, g);
 code = "g--; 1";
 assertEquals(1, eval(code));
 assertEquals(3, g);
+
+// Test simple assignment to non-deletable and deletable globals.
+var glo1 = 0;
+function f1(x) { glo1 = x; }
+f1(42);
+assertEquals(glo1, 42);
+
+glo2 = 0;
+function f2(x) { glo2 = x; }
+f2(42);
+assertEquals(42, glo2);
diff --git a/deps/v8/test/mjsunit/compiler/inline-compare.js b/deps/v8/test/mjsunit/compiler/inline-compare.js
new file mode 100644
index 000000000..6efe15424
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/inline-compare.js
@@ -0,0 +1,46 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test that we can inline a function that returns the result of
+// a compare operation.
+function TestInlineCompare(o) {
+  // Effect context.
+  o.f();
+  // Value context.
+  var x = o.f();
+  assertFalse(x);
+  assertFalse(o.f());
+  // Test context.
+  if (o.f()) {
+    assertTrue(false);  // Should not happen.
+  }
+}
+
+var o = {};
+o.f = function() { return 0 === 1; };
+for (var i = 0; i < 10000000; i++) TestInlineCompare(o);
+TestInlineCompare({f: o.f});
diff --git a/deps/v8/test/mjsunit/compiler/inline-conditional.js b/deps/v8/test/mjsunit/compiler/inline-conditional.js
new file mode 100644
index 000000000..941f74a11
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/inline-conditional.js
@@ -0,0 +1,46 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test that we can inline a function that returns the result of
+// a conditional operation.
+function TestInlineConditional(o) {
+  // Effect context.
+  o.f();
+  // Value context.
+  var x = o.f();
+  assertEquals(87, x);
+  assertEquals(87, o.f());
+  // Test context.
+  if (!o.f()) {
+    assertTrue(false);  // Should not happen.
+  }
+}
+
+var o = {x:false,y:42,z:87};
+o.f = function() { return this.x ? this.y : this.z; };
+for (var i = 0; i < 10000; i++) TestInlineConditional(o);
+TestInlineConditional({x:true,y:87,z:42,f: o.f});
diff --git a/deps/v8/test/mjsunit/compiler/inline-global-access.js b/deps/v8/test/mjsunit/compiler/inline-global-access.js
new file mode 100644
index 000000000..379517343
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/inline-global-access.js
@@ -0,0 +1,49 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test that we can inline a function that returns the result of a
+// global variable load.
+var GLOBAL;
+function TestInlineGlobalLoad(o) {
+  // Effect context.
+  GLOBAL = 42;
+  o.f();
+  // Value context.
+  var x = o.f();
+  assertEquals(42, x);
+  GLOBAL = 87;
+  assertEquals(87, o.f());
+  // Test context.
+  if (!o.f()) {
+    assertTrue(false);  // Should not happen.
+  }
+}
+
+var o = {};
+o.f = function() { return GLOBAL; };
+for (var i = 0; i < 10000000; i++) TestInlineGlobalLoad(o);
+TestInlineGlobalLoad({f: o.f});
diff --git a/deps/v8/test/mjsunit/compiler/inline-param.js b/deps/v8/test/mjsunit/compiler/inline-param.js
new file mode 100644
index 000000000..8e0933a39
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/inline-param.js
@@ -0,0 +1,80 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test that we can inline a call with a parameter.
+function TestInlineOneParam(o, p) {
+  // Effect context.
+  o.f(p);
+  // Value context.
+  var x = o.f(p);
+  assertEquals(42, x);
+  assertEquals(42, o.f(p));
+  // Test context.
+  if (!o.f(p)) {
+    assertTrue(false);  // Should not happen.
+  }
+}
+
+var obj = {x:42};
+var o1 = {};
+o1.f = function(o) { return o.x; };
+for (var i = 0; i < 10000; i++) TestInlineOneParam(o1, obj);
+TestInlineOneParam({f: o1.f}, {x:42});
+
+
+function TestInlineTwoParams(o, p) {
+  var y = 43;
+  // Effect context.
+  o.h(y, y);
+  // Value context.
+  var x = o.h(p, y);
+  assertEquals(true, x);
+  assertEquals(false, o.h(y, p));
+  // Test context.
+  if (!o.h(p, y)) {
+    assertTrue(false);  // Should not happen.
+  }
+
+  // Perform the same tests again, but this time with non-trivial
+  // expressions as the parameters.
+
+  // Effect context.
+  o.h(y + 1, y + 1);
+  // Value context.
+  var x = o.h(p + 1, y + 1);
+  assertEquals(true, x);
+  assertEquals(false, o.h(y + 1, p + 1));
+  // Test context.
+  if (!o.h(p + 1, y + 1)) {
+    assertTrue(false);  // Should not happen.
+  }
+}
+
+var o2 = {};
+o2.h = function(i, j) { return i < j; };
+for (var i = 0; i < 10000; i++) TestInlineTwoParams(o2, 42);
+TestInlineTwoParams({h: o2.h}, 42);
diff --git a/deps/v8/test/mjsunit/compiler/inline-two.js b/deps/v8/test/mjsunit/compiler/inline-two.js
new file mode 100644
index 000000000..30f579dfa
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/inline-two.js
@@ -0,0 +1,93 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test that we can inline a function that calls another function.
+function TestInlineX(o) {
+  // Effect context.
+  o.g();
+  // Value context.
+  var x = o.g();
+  assertEquals(42, x);
+  assertEquals(42, o.g());
+  // Test context.
+  if (!o.g()) {
+    assertTrue(false);  // Should not happen.
+  }
+}
+
+var o2 = {};
+o2.size = function() { return 42; }
+o2.g = function() { return this.size(); };
+for (var i = 0; i < 10000; i++) TestInlineX(o2);
+TestInlineX({g: o2.g, size:o2.size});
+
+
+// Test that we can inline a call on a non-variable receiver.
+function TestInlineX2(o) {
+  // Effect context.
+  o.h();
+  // Value context.
+  var x = o.h();
+  assertEquals(42, x);
+  assertEquals(42, o.h());
+  // Test context.
+  if (!o.h()) {
+    assertTrue(false);  // Should not happen.
+  }
+}
+
+var obj = {}
+obj.foo = function() { return 42; }
+var o3 = {};
+o3.v = obj;
+o3.h = function() { return this.v.foo(); };
+for (var i = 0; i < 10000; i++) TestInlineX2(o3);
+TestInlineX2({h: o3.h, v:obj});
+
+
+// Test that we can inline a call on a non-variable receiver.
+function TestInlineFG(o) {
+  // Effect context.
+  o.h();
+  // Value context.
+  var x = o.h();
+  assertEquals(42, x);
+  assertEquals(42, o.h());
+  // Test context.
+  if (!o.h()) {
+    assertTrue(false);  // Should not happen.
+  }
+}
+
+var obj = {}
+obj.g = function() { return 42; }
+var o3 = {};
+o3.v = obj;
+o3.f = function() { return this.v; }
+o3.h = function() { return this.f().g(); };
+for (var i = 0; i < 10000; i++) TestInlineFG(o3);
+TestInlineFG({h: o3.h, f: o3.f, v:obj});
diff --git a/deps/v8/test/mjsunit/compiler/logical-and.js b/deps/v8/test/mjsunit/compiler/logical-and.js
new file mode 100644
index 000000000..1d31a0a51
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/logical-and.js
@@ -0,0 +1,70 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function AndBB(x,y) {
+  return (x == 0) && (y == 0);
+}
+
+function AndBN(x,y) {
+  return (x == 0) && y;
+}
+
+function AndNB(x,y) {
+  return x && (y == 0);
+}
+
+function AndNN(x,y) {
+  return x && y;
+}
+
+assertTrue(AndBB(0, 0));
+assertFalse(AndBB(1, 0));
+assertFalse(AndBB(0, 1));
+assertFalse(AndBB(1, 1));
+
+assertFalse(AndBN(0, 0));
+assertTrue(AndBN(0, 1));
+assertFalse(AndBN(1, 0));
+assertEquals(1, AndBN(0, 1));
+assertEquals(2, AndBN(0, 2));
+assertFalse(AndBN(1, 1));
+assertFalse(AndBN(1, 2));
+
+assertEquals(0, AndNB(0, 0));
+assertTrue(AndNB(1, 0));
+assertEquals(0, AndNB(0, 1));
+assertEquals("", AndNB("", 1));
+assertFalse(AndNB(1, 1));
+assertTrue(AndNB(2, 0));
+
+assertEquals(0, AndNN(0, 0));
+assertEquals(0, AndNN(1, 0));
+assertEquals(0, AndNN(2, 0));
+assertEquals(0, AndNN(0, 1));
+assertEquals(0, AndNN(0, 2));
+assertEquals(1, AndNN(1, 1));
+assertEquals(2, AndNN(3, 2));
diff --git a/deps/v8/test/mjsunit/compiler/logical-or.js b/deps/v8/test/mjsunit/compiler/logical-or.js
new file mode 100644
index 000000000..87c630db3
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/logical-or.js
@@ -0,0 +1,66 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function OrBB(x,y) {
+  return (x == 0) || (y == 0);
+}
+
+function OrBN(x,y) {
+  return (x == 0) || y;
+}
+
+function OrNB(x,y) {
+  return x || (y == 0);
+}
+
+function OrNN(x,y) {
+  return x || y;
+}
+
+assertTrue(OrBB(0, 0));
+assertTrue(OrBB(1, 0));
+assertTrue(OrBB(0, 1));
+assertFalse(OrBB(1, 1));
+
+assertTrue(OrBN(0, 0));
+assertEquals(0, OrBN(1, 0));
+assertTrue(OrBN(0, 1));
+assertEquals(1, OrBN(1, 1));
+assertEquals(2, OrBN(1, 2));
+
+assertTrue(OrNB(0, 0));
+assertEquals(1, OrNB(1, 0));
+assertFalse(OrNB(0, 1));
+assertEquals(1, OrNB(1, 1));
+assertEquals(2, OrNB(2, 1));
+
+assertEquals(0, OrNN(0, 0));
+assertEquals(1, OrNN(1, 0));
+assertEquals(2, OrNN(2, 0));
+assertEquals(1, OrNN(0, 1));
+assertEquals(2, OrNN(0, 2));
+assertEquals(1, OrNN(1, 2));
diff --git a/deps/v8/test/mjsunit/compiler/loops.js b/deps/v8/test/mjsunit/compiler/loops.js
index 4de45e7f8..2195c6c93 100644
--- a/deps/v8/test/mjsunit/compiler/loops.js
+++ b/deps/v8/test/mjsunit/compiler/loops.js
@@ -33,3 +33,29 @@ for (var i = 1; (6 - i); i++) {
   n = n * i;
 }
 assertEquals(120, n);
+
+// Test assignments in the loop condition.
+function f(i, n) {
+  while((n = n - 1) >= 0) {
+    i = n + 1;
+  }
+  return i;
+}
+assertEquals(1, f(0, 42));
+
+
+// Test do-while loop and continue.
+function g(a) {
+  var x = 0, c = 0;
+  do {
+    x = x + 1;
+    if (x < 5) continue;
+    c = c + 1;
+  } while(x < a);
+  return c;
+}
+
+assertEquals(6, g(10));
+
+// Test deoptimization in the loop condition.
+assertEquals(0, g("foo"));
diff --git a/deps/v8/test/mjsunit/compiler/null-compare.js b/deps/v8/test/mjsunit/compiler/null-compare.js
new file mode 100644
index 000000000..e01b555ad
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/null-compare.js
@@ -0,0 +1,54 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function IsNull(x) {
+  if (x == null) return true; else return false;
+}
+
+assertTrue(IsNull(null), "null == null");
+assertTrue(IsNull(void 0), "void 0 == null");
+assertFalse(IsNull(42), "42 != null");
+
+
+function IsNullStrict(x) {
+  if (x === null) return true; else return false;
+}
+
+assertTrue(IsNullStrict(null), "null === null");
+assertFalse(IsNullStrict(void 0), "void 0 != null");
+assertFalse(IsNullStrict(87), "87 !== null");
+
+
+function GimmeFalse(x) {
+  if ((x & 1) == null) return true;
+  if ((x | 3) === null) return true;
+  return false;
+}
+
+assertFalse(GimmeFalse(1), "GimmeFalse(1)");
+assertFalse(GimmeFalse(null), "GimmeFalse(null)");
+assertFalse(GimmeFalse({}), "GimmeFalse({})");
diff --git a/deps/v8/test/mjsunit/compiler/optimized-function-calls.js b/deps/v8/test/mjsunit/compiler/optimized-function-calls.js
new file mode 100644
index 000000000..1b5f3b035
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/optimized-function-calls.js
@@ -0,0 +1,79 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-gc
+
+function f() {
+  gc();
+  return 87;
+}
+
+
+var x = 42, y = 99;
+function g() {
+  return x | f() | (y | (x | (f() | x)));
+}
+f();  // Give us a chance to optimize f.
+assertEquals(42 | 87 | 99, g());
+
+
+// Regression test for issue where we would try do an illegal
+// compile-time lookup on a null prototype.
+var object = { f: function() { return 42; }, x: 42 };
+delete object.x;
+function call_f(o) {
+  return o.f();
+}
+for (var i = 0; i < 10000000; i++) call_f(object);
+
+
+// Check that nested global function calls work.
+function f0() {
+  return 42;
+}
+
+function f1(a) {
+  return a;
+}
+
+function f2(a, b) {
+  return a * b;
+}
+
+function f3(a, b, c) {
+  return a + b - c;
+}
+
+function f4(a, b, c, d) {
+  return a * b + c - d;
+}
+
+function nested() {
+  return f4(f3(f2(f1(f0()),f0()),f1(f0()),f0()),f2(f1(f0()),f0()),f1(f0()),f0())
+    + f4(f0(),f1(f0()),f2(f1(f0()),f0()),f3(f2(f1(f0()),f0()),f1(f0()),f0()));
+}
+assertEquals(3113460, nested());
diff --git a/deps/v8/test/mjsunit/compiler/pic.js b/deps/v8/test/mjsunit/compiler/pic.js
new file mode 100644
index 000000000..a0b5d8f96
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/pic.js
@@ -0,0 +1,66 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function GetX(o) { return o.x; }
+function CallF(o) { return o.f(); }
+function SetX(o) { o.x = 42; }
+function SetXY(o,y) { return o.x = y; }
+
+
+function Test(o) {
+  SetX(o);
+  assertEquals(42, GetX(o));
+  assertEquals(87, SetXY(o, 87));
+  assertEquals(87, GetX(o));
+  assertTrue(SetXY(o, o) === o);
+  assertTrue(o === GetX(o), "o === GetX(o)");
+  assertEquals("hest", SetXY(o, "hest"));
+  assertEquals("hest", GetX(o));
+  assertTrue(SetXY(o, Test) === Test);
+  assertTrue(Test === GetX(o), "Test === GetX(o)");
+  assertEquals(99, CallF(o));
+}
+
+// Create a bunch of objects with different layouts.
+var o1 = { x: 0, y: 1 };
+var o2 = { y: 1, x: 0 };
+var o3 = { y: 1, z: 2, x: 0 };
+o1.f = o2.f = o3.f = function() { return 99; }
+
+// Run the test until we're fairly sure we've optimized the
+// polymorphic property access.
+for (var i = 0; i < 1000000; i++) {
+  Test(o1);
+  Test(o2);
+  Test(o3);
+}
+
+// Make sure that the following doesn't crash.
+GetX(0);
+SetX(0);
+SetXY(0, 0);
+assertThrows("CallF(0)", TypeError);
diff --git a/deps/v8/test/mjsunit/compiler/property-calls.js b/deps/v8/test/mjsunit/compiler/property-calls.js
new file mode 100644
index 000000000..3366971e8
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/property-calls.js
@@ -0,0 +1,37 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function f(o) { return o.g(); }
+function g() { return 42; }
+
+var object = { };
+object.g = g;
+for (var i = 0; i < 10000000; i++) f(object);
+assertEquals(42, f(object));
+
+object = { g: function() { return 87; } };
+assertEquals(87, f(object));
diff --git a/deps/v8/test/mjsunit/compiler/property-refs.js b/deps/v8/test/mjsunit/compiler/property-refs.js
new file mode 100644
index 000000000..3f6f7937c
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/property-refs.js
@@ -0,0 +1,51 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function Load(o) {
+  return o.outer.x | o.outer.inner.y;
+}
+
+function StoreXY(o, x, y) {
+  o.outer.x = x;
+  o.outer.inner.y = y;
+}
+
+function LoadXY(x, y) {
+  var object = {
+    outer: {
+      x: 0,
+      inner: { y: 0 }
+    }
+  };
+  StoreXY(object, x, y);
+  return Load(object);
+}
+
+for (var i = 0; i < 10000; i++) LoadXY(i, i);
+assertEquals(42 | 87, LoadXY(42, 87));
+assertEquals(42 | 87, LoadXY(42, 87));
+assertEquals(42 | 99, LoadXY(42, "99"));
diff --git a/deps/v8/test/mjsunit/compiler/property-stores.js b/deps/v8/test/mjsunit/compiler/property-stores.js
new file mode 100644
index 000000000..0dec82ad2
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/property-stores.js
@@ -0,0 +1,43 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var a = 42;
+
+var obj = {x: 0,
+           f: function() { this.x = 7; },
+           g: function() { this.x = a | 1; },
+           h: function() { this.x = a; }};
+
+var i;
+for (i = 0; i < 10000; i++) { obj.f(); }
+assertEquals(7, obj.x);
+
+for (i = 0; i < 10000; i++) { obj.g(); }
+assertEquals(43, obj.x);
+
+for (i = 0; i < 10000; i++) { obj.h(); }
+assertEquals(42, obj.x);
diff --git a/deps/v8/test/mjsunit/compiler/recursive-deopt.js b/deps/v8/test/mjsunit/compiler/recursive-deopt.js
new file mode 100644
index 000000000..366f59ae1
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/recursive-deopt.js
@@ -0,0 +1,48 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+function f(n) {
+  // Force deopt in both leaf case and when returning. To make
+  // debugging easier, the operation that bails out (<<) is so simple
+  // that it doesn't cause GCs.
+  if (n == 0) return 1 << one;
+  return f(n - 1) << one;
+}
+
+function RunTests() {
+  assertEquals(1 << 1, f(0));
+  assertEquals(1 << 2, f(1));
+  assertEquals(1 << 5, f(4));
+}
+
+
+var one = 1;
+for (var i = 0; i < 1000000; i++) RunTests();
+
+var one = { valueOf: function() { return 1; } };
+for (var j = 0; j < 100000; j++) RunTests();
diff --git a/deps/v8/test/mjsunit/compiler/regress-0.js b/deps/v8/test/mjsunit/compiler/regress-0.js
new file mode 100644
index 000000000..df6dfeed9
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-0.js
@@ -0,0 +1,37 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function TestNestedLoops() {
+  var sum = 0;
+  for (var i = 0; i < 200; i = i + 1) {
+    for (var j = 0; j < 200; j = j + 1) {
+      sum = sum + 1;
+    }
+  }
+  return sum;
+}
+assertEquals(200 * 200, TestNestedLoops());
diff --git a/deps/v8/test/mjsunit/compiler/regress-1.js b/deps/v8/test/mjsunit/compiler/regress-1.js
new file mode 100644
index 000000000..cbae1a83d
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-1.js
@@ -0,0 +1,35 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function DaysInYear(y) {
+  if (y % 4 != 0) return 365;
+  if (y % 4 == 0 && y % 100 != 0) return 366;
+  if (y % 100 == 0 && y % 400 != 0) return 365;
+  if (y % 400 == 0) return 366;
+}
+assertEquals(365, DaysInYear(1999));
+assertEquals(366, DaysInYear(2000));
diff --git a/deps/v8/test/mjsunit/compiler/regress-2.js b/deps/v8/test/mjsunit/compiler/regress-2.js
new file mode 100644
index 000000000..a26ef32a6
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-2.js
@@ -0,0 +1,44 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// The compilation of this function currently fails when resolving
+// control flow in the register allocator.
+function TestCreateString(n)
+{
+  var l = n * 1;
+  var r = 'r';
+  while (r.length < n)
+  {
+    r = r + r;
+  }
+  return r;
+}
+
+assertEquals("r", TestCreateString(1));
+assertEquals("rr", TestCreateString(2));
+assertEquals("rrrr", TestCreateString(3));
+assertEquals("rrrrrrrr", TestCreateString(6));
diff --git a/deps/v8/test/mjsunit/compiler/regress-3.js b/deps/v8/test/mjsunit/compiler/regress-3.js
new file mode 100644
index 000000000..6aa7078ae
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-3.js
@@ -0,0 +1,37 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function fib(n) {
+  var f0 = 0, f1 = 1;
+  for (; n > 0; n = n -1) {
+    var f2 = f0 + f1;
+    f0 = f1; f1 = f2;
+  }
+  return f0;
+}
+
+assertEquals(2111485077978050, fib(75));
diff --git a/deps/v8/test/mjsunit/compiler/regress-3136962.js b/deps/v8/test/mjsunit/compiler/regress-3136962.js
new file mode 100644
index 000000000..147d8331a
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-3136962.js
@@ -0,0 +1,51 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Reduced regression test for a global value numbering bug.  Original
+// value of global variable height was reused even after reassignment.
+
+var height = 267;
+
+var count = 0;
+function inner() { height = 0; ++count; }
+function outer() {}
+
+function test() {
+  for (var i = 0; i < height; ++i) {
+    for (var j = -6; j < 7; ++j) {
+      if (i + j < 0 || i + j >= height) continue;
+      for (var k = -6; k < 7; ++k) {
+        inner();
+      }
+    }
+    outer();
+  }
+}
+
+test();
+
+assertEquals(13, count);
diff --git a/deps/v8/test/mjsunit/compiler/regress-3185901.js b/deps/v8/test/mjsunit/compiler/regress-3185901.js
new file mode 100644
index 000000000..1e1bbe74a
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-3185901.js
@@ -0,0 +1,35 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Inlined function call in a test context.  Should never crash even
+// with --always-opt.
+var x;
+
+function f() { if (g()) { } }
+function g() { if (x) { return true; } }
+
+f();
diff --git a/deps/v8/test/mjsunit/compiler/regress-3218915.js b/deps/v8/test/mjsunit/compiler/regress-3218915.js
new file mode 100644
index 000000000..d27c319e4
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-3218915.js
@@ -0,0 +1,48 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Regression test for failure to deoptimize properly when the most recent
+// side effect occurred in a comma expression in an effect context.
+
+// An unoptimizable function, calling it is a side effect.
+function side_effect() { try {} finally {} return "wrong"; }
+
+// A function to observe the value of its first argument.
+function observe(x, y) { try {} finally {} return x; }
+
+// If we optimize for x a smi, then x a string will deopt.  The side effect
+// immediately before the deopt is in a comma expresion in an effect context
+// (i.e., itself the left subexpression of a comma expression).
+function test(x) { return observe(this, ((0, side_effect()), x + 1)); }
+
+// Run test enough times to get it optimized.
+for (var i = 0; i < 1000000; ++i) test(0);
+
+// Force test to deopt.  If it behaves normally, it should return the global
+// object.  If the value of the call to side_effect() is lingering after the
+// deopt, it will return the string "wrong".
+assertFalse(test("a") === "wrong");
diff --git a/deps/v8/test/mjsunit/compiler/regress-3249650.js b/deps/v8/test/mjsunit/compiler/regress-3249650.js
new file mode 100644
index 000000000..1f06090ec
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-3249650.js
@@ -0,0 +1,53 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Among other things, this code covers the case of deoptimization
+// after a compare expression in an effect context.
+
+function f0(x) { try { } catch (e) {}}
+function f1(x) { try { } catch (e) {}}
+function f2(x) { try { } catch (e) {}}
+function f3(x) { try { } catch (e) {}}
+
+var object = { a: "", b: false, c: {}};
+object.f = function(x) { return this; }
+
+
+function test(x) {
+  f0(x);
+  f1(x);
+  f2(x);
+  f3(x);
+  x.a.b == "";
+  object.f("A").b = true;
+  object.f("B").a = "";
+  object.f("C").c.display = "A";
+  object.f("D").c.display = "A";
+}
+
+var x = {a: {b: "" }};
+for (var i = 0; i < 1000000; i++) test(x);
diff --git a/deps/v8/test/mjsunit/compiler/regress-3260426.js b/deps/v8/test/mjsunit/compiler/regress-3260426.js
new file mode 100644
index 000000000..dfef424e7
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-3260426.js
@@ -0,0 +1,36 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Falling off the end of a function returns the undefined value
+// (false in a test context).  This should happen even when inlined
+// (e.g., if --always-opt) and when it is the only exit from the
+// function.
+function always_false() {}
+function test() { return always_false() ? 0 : 1; }
+
+assertEquals(1, test());
+
diff --git a/deps/v8/test/mjsunit/compiler/regress-4.js b/deps/v8/test/mjsunit/compiler/regress-4.js
new file mode 100644
index 000000000..0ec9a12b8
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-4.js
@@ -0,0 +1,40 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test deoptimization after a loop.
+function f(p) {
+  var y=0;
+  for (var x=0; x<10; x++) {
+    if (x > 5) { y=y+p; break;}
+  }
+  return y+x;
+}
+
+for (var i=0; i<10000000; i++) f(42);
+
+var result = f("foo");
+assertEquals("0foo6", result);
diff --git a/deps/v8/test/mjsunit/compiler/regress-5.js b/deps/v8/test/mjsunit/compiler/regress-5.js
new file mode 100644
index 000000000..5488d0ee6
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-5.js
@@ -0,0 +1,43 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test breaking out of labelled blocks.
+function f(y) {
+  var x = 0;
+
+  foo: {
+    x++;
+    bar: {
+       if (y == 0) break bar; else break foo;
+    }
+    x++;
+  }
+  return x;
+}
+
+assertEquals(2, f(0));
+assertEquals(1, f(1));
diff --git a/deps/v8/test/mjsunit/compiler/regress-6.js b/deps/v8/test/mjsunit/compiler/regress-6.js
new file mode 100644
index 000000000..e92b0e555
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-6.js
@@ -0,0 +1,42 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function f(a, b, c) {
+  if (a == 0 || b == 0) return a;
+  return a + c;
+}
+
+assertEquals(0, f(0, 0, 0));
+assertEquals(0, f(0, 1, 0));
+assertEquals(1, f(1, 0, 0));
+assertEquals(2, f(2, 1, 0));
+
+// Force deoptimization in --always-opt mode when evaluating
+// the 'a + c' expression. Make sure this doesn't end up
+// returning 'a'.
+assertEquals(1.5, f(1, 1, 0.5));
+assertEquals(2.5, f(2, 1, 0.5));
diff --git a/deps/v8/test/mjsunit/compiler/regress-7.js b/deps/v8/test/mjsunit/compiler/regress-7.js
new file mode 100644
index 000000000..d6034f99c
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-7.js
@@ -0,0 +1,41 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test correct truncation of tagged values.
+var G = 42;
+
+function f() {
+  var v = G;
+  var w = v >> 0;
+  return w;
+}
+
+for(var i=0; i<10000; i++) f();
+
+assertEquals(G, f());
+G = 2000000000;
+assertEquals(G, f());
diff --git a/deps/v8/test/mjsunit/compiler/regress-8.js b/deps/v8/test/mjsunit/compiler/regress-8.js
new file mode 100644
index 000000000..3a2388533
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-8.js
@@ -0,0 +1,109 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Regression test for the register allocator.
+var gp = "";
+var yE = "";
+var W = "";
+var LA = "";
+var zE = "";
+var Fp = "";
+var AE = "";
+var Gob = "";
+var Hob = "";
+var Iob = "";
+var Job = "";
+var Kob = "";
+var Lob = "";
+var Mob = "";
+var p = "";
+function O() { this.append = function(a,b,c,d,e) { return a + b + c + d + e; } }
+
+function Nob(b,a) {
+ var c;
+ if (b==2) {
+   c=new O;
+   c.append(gp,
+            yE,
+            W,
+            LA+(a.Un+(zE+(Fp+(LA+(a.Im+(zE+(AE+(LA+(a.total+Gob))))))))),
+            p);
+   c=c.toString();
+ } else {
+   if (b==1) {
+     if(a.total>=2E6) {
+       c=new O;
+       c.append(gp,yE,W,LA+(a.Un+(zE+(Fp+(LA+(a.Im+Hob))))),p);
+       c=c.toString();
+     } else {
+       if(a.total>=2E5) {
+         c=new O;
+         c.append(gp,yE,W,LA+(a.Un+(zE+(Fp+(LA+(a.Im+Iob))))),p);
+         c=c.toString();
+       } else {
+         if(a.total>=2E4) {
+           c=new O;
+           c.append(gp,yE,W,LA+(a.Un+(zE+(Fp+(LA+(a.Im+Job))))),p);
+           c=c.toString();
+         } else {
+           if(a.total>=2E3) {
+             c=new O;
+             c.append(gp,yE,W,LA+(a.Un+(zE+(Fp+(LA+(a.Im+Kob))))),p);
+             c=c.toString();
+           } else {
+             if(a.total>=200) {
+               c=new O;
+               c.append(gp,yE,W,LA+(a.Un+(zE+(Fp+(LA+(a.Im+Lob))))),p);
+               c=c.toString();
+             } else {
+               c=new O;
+               c.append(gp,yE,W,
+                        LA+(a.Un+(zE+(Fp+(LA+(a.Im+(zE+(Mob+(LA+(a.total+zE))))))))),
+                        p);
+               c=c.toString();
+             }
+             c=c;
+           }
+           c=c;
+         }
+         c=c;
+       }
+       c=c;
+     }
+     c=c;
+   } else {
+     c=new O;
+     c.append(gp,yE,W,
+              LA+(a.Un+(zE+(Fp+(LA+(a.Im+(zE+(AE+(LA+(a.total+zE))))))))),
+              p);
+     c=c.toString();
+   }
+   c=c;
+ }
+ return c;
+}
+Nob(2, { Un: "" , Im: "" , total: 42});
diff --git a/deps/v8/test/mjsunit/compiler/regress-arguments.js b/deps/v8/test/mjsunit/compiler/regress-arguments.js
new file mode 100644
index 000000000..234d3fbc9
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-arguments.js
@@ -0,0 +1,49 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test of arguments.
+
+// Test passing null or undefined as receiver.
+function f() { return this.foo; }
+
+function g() { return f.apply(null, arguments); }
+function h() { return f.apply(void 0, arguments); }
+
+var foo = 42;
+
+for (var i=0; i<1000000; i++) assertEquals(42, g());
+for (var i=0; i<1000000; i++) assertEquals(42, h());
+
+var G1 = 21;
+var G2 = 22;
+
+function u() {
+ var v = G1 + G2;
+ return f.apply(v, arguments);
+}
+
+for (var i=0; i<1000000; i++) assertEquals(void 0, u());
diff --git a/deps/v8/test/mjsunit/compiler/regress-arrayliteral.js b/deps/v8/test/mjsunit/compiler/regress-arrayliteral.js
new file mode 100644
index 000000000..893878500
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-arrayliteral.js
@@ -0,0 +1,33 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Regression test for array literals.
+
+var G = 41;
+var H = 42;
+function f() { var v = [G,H]; return v[1]; }
+assertEquals(42, f());
diff --git a/deps/v8/test/mjsunit/compiler/regress-funarguments.js b/deps/v8/test/mjsunit/compiler/regress-funarguments.js
new file mode 100644
index 000000000..cea40bc9b
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-funarguments.js
@@ -0,0 +1,82 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test function.arguments.
+
+function A() {}
+function B() {}
+
+function fee(x, y) {
+  if (x == 1) return fee["arg" + "uments"];
+  if (x == 2) return gee["arg" + "uments"];
+  return 42;
+}
+
+function gee(x) { return this.f(2 - x, "f"); }
+
+function foo(x, y) {
+  if (x == 0) return foo["arg" + "uments"];
+  if (x == 1) return goo["arg" + "uments"];
+  return 42;
+}
+
+function goo(x) { return this.f(x, "f"); }
+
+A.prototype.f = fee;
+A.prototype.g = gee;
+
+B.prototype.f = foo;
+B.prototype.g = goo;
+
+var o = new A();
+
+function hej(x) {
+  if (x == 0) return o.g(x, "h");
+  if (x == 1) return o.g(x, "h");
+  return o.g(x, "z");
+}
+
+function stress() {
+  for (var i=0; i<5000000; i++) o.g(i, "g");
+  for (var j=0; j<5000000; j++) hej(j);
+}
+
+stress();
+
+assertArrayEquals([0, "g"], o.g(0, "g"));
+assertArrayEquals([1, "f"], o.g(1, "g"));
+assertArrayEquals([0, "h"], hej(0));
+assertArrayEquals([1, "f"], hej(1));
+
+o = new B();
+
+stress();
+
+assertArrayEquals([0, "f"], o.g(0, "g"));
+assertArrayEquals([1, "g"], o.g(1, "g"));
+assertArrayEquals([0, "f"], hej(0));
+assertArrayEquals([1, "h"], hej(1));
diff --git a/deps/v8/test/mjsunit/compiler/regress-funcaller.js b/deps/v8/test/mjsunit/compiler/regress-funcaller.js
new file mode 100644
index 000000000..88db147a8
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-funcaller.js
@@ -0,0 +1,73 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test function.caller.
+function A() {}
+
+function fun(x) {
+  if (x == 0) return fun.caller;
+  if (x == 1) return gee.caller;
+  return 42;
+}
+function gee(x) { return this.f(x); }
+
+A.prototype.f = fun;
+A.prototype.g = gee;
+
+var o = new A();
+
+for (var i=0; i<5000000; i++) {
+  o.g(i);
+}
+assertEquals(gee, o.g(0));
+assertEquals(null, o.g(1));
+
+// Test when called from another function.
+function hej(x) {
+  if (x == 0) return o.g(x);
+  if (x == 1) return o.g(x);
+  return o.g(x);
+}
+
+for (var j=0; j<5000000; j++) {
+  hej(j);
+}
+assertEquals(gee, hej(0));
+assertEquals(hej, hej(1));
+
+// Test when called from eval.
+function from_eval(x) {
+  if (x == 0) return eval("o.g(x);");
+  if (x == 1) return eval("o.g(x);");
+  return o.g(x);
+}
+
+for (var j=0; j<5000000; j++) {
+  from_eval(j);
+}
+assertEquals(gee, from_eval(0));
+assertEquals(from_eval, from_eval(1));
diff --git a/deps/v8/test/mjsunit/compiler/regress-gap.js b/deps/v8/test/mjsunit/compiler/regress-gap.js
new file mode 100644
index 000000000..a812daa44
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-gap.js
@@ -0,0 +1,130 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Regression test that stresses the register allocator gap instruction.
+
+function small_select(n, v1, v2) {
+  for (var i = 0; i < n; ++i) {
+    var tmp = v1;
+    v1 = v2;
+    v2 = tmp;
+  }
+  return v1;
+}
+
+function select(n, v1, v2, v3, v4, v5, v6, v7, v8, v9, v10) {
+  for (var i = 0; i < n; ++i) {
+    var tmp = v1;
+    v1 = v2;
+    v2 = v3;
+    v3 = v4;
+    v4 = v5;
+    v5 = v6;
+    v6 = v7;
+    v7 = v8;
+    v8 = v9;
+    v9 = v10;
+    v10 = tmp;
+  }
+  return v1;
+}
+
+function select_while(n, v1, v2, v3, v4, v5, v6, v7, v8, v9, v10) {
+  var i = 0;
+  while (i < n) {
+    var tmp = v1;
+    v1 = v2;
+    v2 = v3;
+    v3 = v4;
+    v4 = v5;
+    v5 = v6;
+    v6 = v7;
+    v7 = v8;
+    v8 = v9;
+    v9 = v10;
+    v10 = tmp;
+    i++;
+  }
+  return v1;
+}
+
+function two_cycles(n, v1, v2, v3, v4, v5, x1, x2, x3, x4, x5) {
+  for (var i = 0; i < n; ++i) {
+    var tmp = v1;
+    v1 = v2;
+    v2 = v3;
+    v3 = v4;
+    v4 = v5;
+    v5 = tmp;
+    tmp = x1;
+    x1 = x2;
+    x2 = x3;
+    x3 = x4;
+    x4 = x5;
+    x5 = tmp;
+  }
+  return v1 + x1;
+}
+
+function two_cycles_while(n, v1, v2, v3, v4, v5, x1, x2, x3, x4, x5) {
+  var i = 0;
+  while (i < n) {
+    var tmp = v1;
+    v1 = v2;
+    v2 = v3;
+    v3 = v4;
+    v4 = v5;
+    v5 = tmp;
+    tmp = x1;
+    x1 = x2;
+    x2 = x3;
+    x3 = x4;
+    x4 = x5;
+    x5 = tmp;
+    i++;
+  }
+  return v1 + x1;
+}
+assertEquals(1, small_select(0, 1, 2));
+assertEquals(2, small_select(1, 1, 2));
+assertEquals(1, small_select(10, 1, 2));
+
+assertEquals(1, select(0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10));
+assertEquals(4, select(3, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10));
+assertEquals(10, select(9, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10));
+
+assertEquals(1 + 6, two_cycles(0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10));
+assertEquals(4 + 9, two_cycles(3, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10));
+assertEquals(5 + 10, two_cycles(9, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10));
+
+assertEquals(1, select_while(0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10));
+assertEquals(4, select_while(3, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10));
+assertEquals(10, select_while(9, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10));
+
+assertEquals(1 + 6, two_cycles_while(0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10));
+assertEquals(4 + 9, two_cycles_while(3, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10));
+assertEquals(5 + 10, two_cycles_while(9, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10));
diff --git a/deps/v8/test/mjsunit/compiler/regress-gvn.js b/deps/v8/test/mjsunit/compiler/regress-gvn.js
new file mode 100644
index 000000000..358daf711
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-gvn.js
@@ -0,0 +1,51 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --noalways-opt
+//
+// Regression test for global value numbering.
+
+function test(a) {
+  var res = a[0] + a[0];
+  if (res == 0) {
+    a[0] = 1;
+  }
+  return a[0];
+}
+
+var a = new Array();
+
+var n = 100000000;
+
+var result = 0;
+for (var i = 0; i < n; ++i) {
+  a[0] = 0;
+  result += test(a);
+}
+
+
+assertEquals(n, result);
diff --git a/deps/v8/test/mjsunit/compiler/regress-loop-deopt.js b/deps/v8/test/mjsunit/compiler/regress-loop-deopt.js
new file mode 100644
index 000000000..790676156
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-loop-deopt.js
@@ -0,0 +1,41 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test while loops and continue.
+function h() {
+  var i = 3, j = 0;
+  while(--i >= 0) {
+    var x = i & 1;
+    if(x > 0) {
+      continue;
+    }
+    j++;
+  }
+  return j;
+}
+
+assertEquals(2, h());
diff --git a/deps/v8/test/mjsunit/compiler/regress-max.js b/deps/v8/test/mjsunit/compiler/regress-max.js
new file mode 100644
index 000000000..94c543a6a
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-max.js
@@ -0,0 +1,34 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test Math.max with negative zero as input.
+function f(x, y) { return Math.max(x, y) }
+
+for (var i = 0; i < 1000000; i++) f(0, 0);
+
+var r = f(-0, -0);
+assertEquals(-Infinity, 1 / r);
diff --git a/deps/v8/test/mjsunit/compiler/regress-or.js b/deps/v8/test/mjsunit/compiler/regress-or.js
new file mode 100644
index 000000000..89f78025f
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-or.js
@@ -0,0 +1,57 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test deoptimization inside short-circuited expressions.
+function f1(x) {
+  var c = "fail";
+  if (!x || g1()) {
+    c = ~x;
+  }
+  return c;
+}
+
+function g1() { try { return 1; } finally {} }
+
+for (var i=0; i<10000000; i++) f1(42);
+
+assertEquals(-1, f1(0));
+assertEquals(-43, f1(42));
+assertEquals(-1, f1(""));
+
+function f2(x) {
+  var c = "fail";
+  if (!x || !g2()) {
+    c = ~x;
+  }
+  return c;
+}
+
+function g2() { try { return 0; } finally {} }
+
+for (var i=0; i<10000000; i++) f2(42);
+
+assertEquals(-1, f2(""));
diff --git a/deps/v8/test/mjsunit/compiler/regress-rep-change.js b/deps/v8/test/mjsunit/compiler/regress-rep-change.js
new file mode 100644
index 000000000..937099937
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-rep-change.js
@@ -0,0 +1,42 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Regression test for the case where a phi has two input operands with
+// the same value.
+
+function test(start) {
+  if (true) {
+    for (var i = start; i < 10; i++) { }
+  }
+  for (var i = start; i < 10; i++) { }
+}
+
+var n = 5000000;
+
+for (var i = 0; i < n; ++i) {
+  test(0);
+}
diff --git a/deps/v8/test/mjsunit/compiler/regress-stacktrace-methods.js b/deps/v8/test/mjsunit/compiler/regress-stacktrace-methods.js
new file mode 100644
index 000000000..4900ccf8d
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-stacktrace-methods.js
@@ -0,0 +1,64 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test stack traces with method calls.
+function Hest() {}
+function Svin() {}
+
+Svin.prototype.two = function() { /* xxxxxxx */ o.three(); }
+
+Hest.prototype.one = function(x) { x.two(); }
+
+Hest.prototype.three = function() { if (v == 42) throw new Error("urg"); }
+
+var o = new Hest();
+var s = new Svin();
+var v = 0;
+
+for (var i = 0; i < 1000000; i++) {
+  o.one(s);
+}
+
+v = 42;
+
+try {
+  o.one(s);
+} catch (e) {
+  var stack = e.stack.toString();
+  var p3 = stack.indexOf("at Hest.three");
+  var p2 = stack.indexOf("at Svin.two");
+  var p1 = stack.indexOf("at Hest.one");
+  assertTrue(p3 != -1);
+  assertTrue(p2 != -1);
+  assertTrue(p1 != -1);
+  assertTrue(p3 < p2);
+  assertTrue(p2 < p1);
+  assertTrue(stack.indexOf("36:56") != -1);
+  assertTrue(stack.indexOf("32:51") != -1);
+  assertTrue(stack.indexOf("34:38") != -1);
+  assertTrue(stack.indexOf("49:5") != -1);
+}
diff --git a/deps/v8/test/mjsunit/compiler/regress-stacktrace.js b/deps/v8/test/mjsunit/compiler/regress-stacktrace.js
new file mode 100644
index 000000000..843dd1208
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/regress-stacktrace.js
@@ -0,0 +1,52 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test correctness of stack traces with global functions.
+eval("function two() { /* xxxxxxx */ three(); }");
+
+function one() {
+  two();
+}
+
+function three() {
+  throw new Error("urg");
+}
+
+try {
+ one();
+} catch (e) {
+  var stack = e.stack.toString();
+  var p3 = stack.indexOf("at three");
+  var p2 = stack.indexOf("at two");
+  var p1 = stack.indexOf("at one");
+  assertTrue(p3 != -1);
+  assertTrue(p2 != -1);
+  assertTrue(p1 != -1);
+  assertTrue(p3 < p2);
+  assertTrue(p2 < p1);
+  print(stack);
+}
diff --git a/deps/v8/test/mjsunit/compiler/safepoint.js b/deps/v8/test/mjsunit/compiler/safepoint.js
new file mode 100644
index 000000000..ee8fcf0de
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/safepoint.js
@@ -0,0 +1,39 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-gc
+
+function Test(o) {
+  var x = o;
+  var y = this;
+  x.gc();
+  x.gc();
+  return y;
+}
+
+var o = {gc:gc};
+assertTrue(Test(o) === this);
diff --git a/deps/v8/test/mjsunit/compiler/simple-bailouts.js b/deps/v8/test/mjsunit/compiler/simple-bailouts.js
index af80b7f05..ef7a0f47b 100644
--- a/deps/v8/test/mjsunit/compiler/simple-bailouts.js
+++ b/deps/v8/test/mjsunit/compiler/simple-bailouts.js
@@ -25,8 +25,6 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --fast-compiler
-
 function Test() {
   this.result = 0;
   this.x = 0;
@@ -92,6 +90,14 @@ Test.prototype.test9 = function() {
        | a;             // 1.1
 }
 
+Test.prototype.test10 = function() {
+  this.z = (a >> b) | (c >> c);
+}
+
+Test.prototype.test11 = function(x) {
+  this.z = x >> x;
+}
+
 var t = new Test();
 
 t.test0();
@@ -125,3 +131,13 @@ t.test9();
 assertEquals(14, t.x);
 assertEquals(6, t.y);
 assertEquals(15, t.z);
+
+a = "2";
+t.test11(a);
+assertEquals(0, t.z);
+
+a = 4;
+b = "1";
+c = 2;
+t.test10();
+assertEquals(2, t.z);
diff --git a/deps/v8/test/mjsunit/compiler/simple-binary-op.js b/deps/v8/test/mjsunit/compiler/simple-binary-op.js
index 15e1a559c..a4e8ab5f8 100644
--- a/deps/v8/test/mjsunit/compiler/simple-binary-op.js
+++ b/deps/v8/test/mjsunit/compiler/simple-binary-op.js
@@ -25,8 +25,6 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --fast-compiler
-
 var a = 1;
 var b = 2;
 var c = 4;
diff --git a/deps/v8/test/mjsunit/compiler/simple-deopt.js b/deps/v8/test/mjsunit/compiler/simple-deopt.js
new file mode 100644
index 000000000..8befd9f6e
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/simple-deopt.js
@@ -0,0 +1,101 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function f(x) {
+  return ~x;
+}
+
+f(42);
+assertEquals(~12, f(12.45));
+assertEquals(~42, f(42.87));
+
+
+var a = 1, b = 2, c = 4, d = 8;
+function g() {
+  return a | (b | (c | d));
+}
+
+g();
+c = "16";
+assertEquals(1 | 2 | 16 | 8, g());
+
+
+// Test deopt when global function changes.
+function h() {
+  return g();
+}
+assertEquals(1 | 2 | 16 | 8, h());
+g = function() { return 42; };
+assertEquals(42, h());
+
+
+// Test deopt when map changes.
+var obj = {};
+obj.g = g;
+function k(o) {
+  return o.g();
+}
+for (var i = 0; i < 1000000; i++) k(obj);
+assertEquals(42, k(obj));
+assertEquals(87, k({g: function() { return 87; }}));
+
+
+// Test deopt with assignments to parameters.
+function p(x,y) {
+  x = 42;
+  y = 1;
+  y = y << "0";
+  return x | y;
+}
+assertEquals(43, p(0,0));
+
+
+// Test deopt with literals on the expression stack.
+function LiteralToStack(x) {
+  return 'lit[' + (x + ']');
+}
+
+assertEquals('lit[-87]', LiteralToStack(-87));
+assertEquals('lit[0]', LiteralToStack(0));
+assertEquals('lit[42]', LiteralToStack(42));
+
+
+// Test deopt before call.
+var str = "abc";
+var r;
+function CallCharAt(n) { return str.charAt(n); }
+for (var i = 0; i < 1000000; i++) {
+  r = CallCharAt(0);
+}
+assertEquals("a", r);
+
+
+// Test of deopt in presence of spilling.
+function add4(a,b,c,d) {
+  return a+b+c+d;
+}
+assertEquals(0x40000003, add4(1,1,2,0x3fffffff));
diff --git a/deps/v8/test/mjsunit/compiler/simple-global-access.js b/deps/v8/test/mjsunit/compiler/simple-global-access.js
index 35746ba82..87a641cc9 100644
--- a/deps/v8/test/mjsunit/compiler/simple-global-access.js
+++ b/deps/v8/test/mjsunit/compiler/simple-global-access.js
@@ -25,9 +25,7 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --fast-compiler
-
-// Test global variable loads with the fast compiler.
+// Test global variable loads.
 var g1 = 42;
 var g2 = 43;
 var g3 = 44;
diff --git a/deps/v8/test/mjsunit/compiler/simple-inlining.js b/deps/v8/test/mjsunit/compiler/simple-inlining.js
new file mode 100644
index 000000000..219580f08
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/simple-inlining.js
@@ -0,0 +1,146 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test that we can inline a function that returns a constant.
+function TestInlineConstant(o) {
+  // Effect context.
+  o.f();
+  // Value context.
+  var x = o.f();
+  assertEquals(42, x);
+  assertEquals(42, o.f());
+  // Test context.
+  if (!o.f()) {
+    assertTrue(false);  // Should not happen.
+  }
+}
+
+var o1 = {};
+o1.f = function() { return 42; };
+for (var i = 0; i < 10000; i++) TestInlineConstant(o1);
+TestInlineConstant({f: o1.f});
+
+
+// Test that we can inline a function that returns 'this'.
+function TestInlineThis(o) {
+  // Effect context.
+  o.g();
+  // Value context.
+  var x = o.g();
+  assertEquals(o, x);
+  assertEquals(o, o.g());
+  // Test context.
+  if (!o.g()) {
+    assertTrue(false);  // Should not happen.
+  }
+}
+
+var o2 = {};
+o2.g = function() { return this; };
+for (var i = 0; i < 10000; i++) TestInlineThis(o2);
+TestInlineThis({g: o2.g});
+
+
+// Test that we can inline a function that returns 'this.x'.
+function TestInlineThisX(o) {
+  // Effect context.
+  o.h();
+  // Value context.
+  var x = o.h();
+  assertEquals(42, x);
+  assertEquals(42, o.h());
+  // Test context.
+  if (!o.h()) {
+    assertTrue(false);  // Should not happen.
+  }
+}
+
+var o3 = {y:0,x:42};
+o3.h = function() { return this.x; };
+for (var i = 0; i < 10000; i++) TestInlineThisX(o3);
+TestInlineThisX({h: o3.h, x:42});
+
+
+// Test that we can inline a function that returns 'this.x.length'.
+function TestInlineThisXLength(o) {
+  // Effect context.
+  o.h();
+  // Value context.
+  var x = o.h();
+  assertEquals(3, x);
+  assertEquals(3, o.h());
+  // Test context.
+  if (!o.h()) {
+    assertTrue(false);  // Should not happen.
+  }
+}
+
+var o4 = {x:[1,2,3]};
+o4.h = function() { return this.x.length; };
+for (var i = 0; i < 10000; i++) TestInlineThisXLength(o4);
+TestInlineThisXLength({h: o4.h, x:[1,2,3]});
+
+
+// Test that we can inline a function that returns 'this.x.y'.
+function TestInlineThisXY(o) {
+  // Effect context.
+  o.h();
+  // Value context.
+  var x = o.h();
+  assertEquals(42, x);
+  assertEquals(42, o.h());
+  // Test context.
+  if (!o.h()) {
+    assertTrue(false);  // Should not happen.
+  }
+}
+
+var o6 = {y:42}
+var o5 = {e:o6};
+o5.h = function() { return this.e.y; };
+for (var i = 0; i < 10000; i++) TestInlineThisXY(o5);
+TestInlineThisXY({h: o5.h, e:o6});
+
+
+// Test that we can inline a function that returns 'this.x.length'.
+function TestInlineThisX0(o) {
+  // Effect context.
+  o.foo();
+  // Value context.
+  var x = o.foo();
+  assertEquals(42, x);
+  assertEquals(42, o.foo());
+  // Test context.
+  if (!o.foo()) {
+    assertTrue(false);  // Should not happen.
+  }
+}
+
+var o7 = {x:[42,43,44]};
+o7.foo = function() { return this.x[0]; };
+for (var i = 0; i < 10000; i++) TestInlineThisX0(o7);
+TestInlineThisX0({foo: o7.foo, x:[42,0,0]});
diff --git a/deps/v8/test/mjsunit/compiler/simple-osr.js b/deps/v8/test/mjsunit/compiler/simple-osr.js
new file mode 100644
index 000000000..8ec1b2b93
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/simple-osr.js
@@ -0,0 +1,44 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --use-osr
+
+function f() {
+  var sum = 0;
+  for (var i = 0; i < 1000000; i++) {
+    var x = i + 2;
+    var y = x + 5;
+    var z = y + 3;
+    sum += z;
+  }
+  return sum;
+}
+
+
+for (var i = 0; i < 2; i++) {
+  assertEquals(500009500000, f());
+}
diff --git a/deps/v8/test/mjsunit/compiler/switch-bailout.js b/deps/v8/test/mjsunit/compiler/switch-bailout.js
new file mode 100644
index 000000000..8011d44ab
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/switch-bailout.js
@@ -0,0 +1,39 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test that bailing out of the optimized compilation doesn't mess with
+// the labels in the AST.
+function f(x) {
+  switch (x) {
+    case "foo": return 87;
+    case "bar": return 42;
+  }
+  return 99;
+}
+
+for (var i = 0; i < 10000; i++) f("foo");
+assertEquals(42, f("bar"));
diff --git a/deps/v8/test/mjsunit/compiler/this-property-refs.js b/deps/v8/test/mjsunit/compiler/this-property-refs.js
index 5e8ea596c..1ee8e50ca 100644
--- a/deps/v8/test/mjsunit/compiler/this-property-refs.js
+++ b/deps/v8/test/mjsunit/compiler/this-property-refs.js
@@ -25,8 +25,6 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --fast-compiler
-
 // Test references to properties of this.
 function Test() {
   this.a = 0;
diff --git a/deps/v8/test/mjsunit/compiler/thisfunction.js b/deps/v8/test/mjsunit/compiler/thisfunction.js
index 098fc3a4e..7615561c5 100644
--- a/deps/v8/test/mjsunit/compiler/thisfunction.js
+++ b/deps/v8/test/mjsunit/compiler/thisfunction.js
@@ -25,8 +25,6 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --always-full-compiler
-
 // Test reference to this-function.
 
 var g = (function f(x) {
diff --git a/deps/v8/test/mjsunit/compiler/variables.js b/deps/v8/test/mjsunit/compiler/variables.js
new file mode 100644
index 000000000..fac487823
--- /dev/null
+++ b/deps/v8/test/mjsunit/compiler/variables.js
@@ -0,0 +1,73 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Simple tests of the various kinds of variable references in the
+// implementstion.
+
+// Global variables.
+var x = 0;
+function f0() { return x; }
+assertEquals(0, f0());
+
+
+// Parameters.
+function f1(x) { return x; }
+assertEquals(1, f1(1));
+
+
+// Stack-allocated locals.
+function f2() { var x = 2; return x; }
+assertEquals(2, f2());
+
+
+// Context-allocated locals.  Local function forces x into f3's context.
+function f3(x) {
+  function g() { return x; }
+  return x;
+}
+assertEquals(3, f3(3));
+
+// Local function reads x from an outer context.
+function f4(x) {
+  function g() { return x; }
+  return g();
+}
+assertEquals(4, f4(4));
+
+
+// Lookup slots.  'With' forces x to be looked up at runtime.
+function f5(x) {
+  with ({}) return x;
+}
+assertEquals(5, f5(5));
+
+
+// Parameters rewritten to property accesses.  Using the name 'arguments'
+// (even if it shadows the arguments object) forces all parameters to be
+// rewritten to explicit property accesses.
+function f6(arguments) { return arguments; }
+assertEquals(6, f6(6));
diff --git a/deps/v8/test/mjsunit/debug-changebreakpoint.js b/deps/v8/test/mjsunit/debug-changebreakpoint.js
index 936523a0e..897c3e391 100644
--- a/deps/v8/test/mjsunit/debug-changebreakpoint.js
+++ b/deps/v8/test/mjsunit/debug-changebreakpoint.js
@@ -33,6 +33,7 @@ Debug = debug.Debug
 listenerComplete = false;
 exception = false;
 
+var breakpoint = -1;
 var base_request = '"seq":0,"type":"request","command":"changebreakpoint"'
 
 function safeEval(code) {
@@ -68,21 +69,21 @@ function listener(event, exec_state, event_data, data) {
 
     testArguments(dcp, '{}', false);
     testArguments(dcp, '{"breakpoint":0,"condition":"false"}', false);
-    // TODO(1241036) change this to 2 when break points have been restructured.
-    testArguments(dcp, '{"breakpoint":3,"condition":"false"}', false);
+    testArguments(dcp, '{"breakpoint":' + (breakpoint + 1) + ',"condition":"false"}', false);
     testArguments(dcp, '{"breakpoint":"xx","condition":"false"}', false);
 
     // Test some legal clearbreakpoint requests.
-    testArguments(dcp, '{"breakpoint":1}', true);
-    testArguments(dcp, '{"breakpoint":1,"enabled":"true"}', true);
-    testArguments(dcp, '{"breakpoint":1,"enabled":"false"}', true);
-    testArguments(dcp, '{"breakpoint":1,"condition":"1==2"}', true);
-    testArguments(dcp, '{"breakpoint":1,"condition":"false"}', true);
-    testArguments(dcp, '{"breakpoint":1,"ignoreCount":7}', true);
-    testArguments(dcp, '{"breakpoint":1,"ignoreCount":0}', true);
+    var bp_str = '"breakpoint":' + breakpoint;;
+    testArguments(dcp, '{' + bp_str + '}', true);
+    testArguments(dcp, '{' + bp_str + ',"enabled":"true"}', true);
+    testArguments(dcp, '{' + bp_str + ',"enabled":"false"}', true);
+    testArguments(dcp, '{' + bp_str + ',"condition":"1==2"}', true);
+    testArguments(dcp, '{' + bp_str + ',"condition":"false"}', true);
+    testArguments(dcp, '{' + bp_str + ',"ignoreCount":7}', true);
+    testArguments(dcp, '{' + bp_str + ',"ignoreCount":0}', true);
     testArguments(
         dcp,
-        '{"breakpoint":1,"enabled":"true","condition":"false","ignoreCount":0}',
+        '{' + bp_str + ',"enabled":"true","condition":"false","ignoreCount":0}',
         true);
 
     // Indicate that all was processed.
@@ -99,8 +100,7 @@ Debug.setListener(listener);
 function g() {};
 
 // Set a break point and call to invoke the debug event listener.
-bp = Debug.setBreakPoint(g, 0, 0);
-assertEquals(1, bp);
+breakpoint = Debug.setBreakPoint(g, 0, 0);
 g();
 
 // Make sure that the debug event listener vas invoked.
diff --git a/deps/v8/test/mjsunit/debug-clearbreakpoint.js b/deps/v8/test/mjsunit/debug-clearbreakpoint.js
index 59479f2da..58e1531a1 100644
--- a/deps/v8/test/mjsunit/debug-clearbreakpoint.js
+++ b/deps/v8/test/mjsunit/debug-clearbreakpoint.js
@@ -33,6 +33,7 @@ Debug = debug.Debug
 listenerComplete = false;
 exception = false;
 
+var breakpoint = -1;
 var base_request = '"seq":0,"type":"request","command":"clearbreakpoint"'
 
 function safeEval(code) {
@@ -68,15 +69,14 @@ function listener(event, exec_state, event_data, data) {
 
     testArguments(dcp, '{}', false);
     testArguments(dcp, '{"breakpoint":0}', false);
-    // TODO(1241036) change this to 2 when break points have been restructured.
-    testArguments(dcp, '{"breakpoint":3}', false);
+    testArguments(dcp, '{"breakpoint":' + (breakpoint + 1)+ '}', false);
     testArguments(dcp, '{"breakpoint":"xx"}', false);
 
     // Test some legal clearbreakpoint requests.
-    testArguments(dcp, '{"breakpoint":1}', true);
+    testArguments(dcp, '{"breakpoint":' + breakpoint + '}', true);
 
     // Cannot clear the same break point twice.
-    testArguments(dcp, '{"breakpoint":1}', false);
+    testArguments(dcp, '{"breakpoint":' + breakpoint + '}', false);
 
     // Indicate that all was processed.
     listenerComplete = true;
@@ -92,8 +92,7 @@ Debug.setListener(listener);
 function g() {};
 
 // Set a break point and call to invoke the debug event listener.
-bp = Debug.setBreakPoint(g, 0, 0);
-assertEquals(1, bp);
+breakpoint = Debug.setBreakPoint(g, 0, 0);
 g();
 
 // Make sure that the debug event listener vas invoked.
diff --git a/deps/v8/test/mjsunit/debug-clearbreakpointgroup.js b/deps/v8/test/mjsunit/debug-clearbreakpointgroup.js
index e6677f939..0cfc5c958 100644
--- a/deps/v8/test/mjsunit/debug-clearbreakpointgroup.js
+++ b/deps/v8/test/mjsunit/debug-clearbreakpointgroup.js
@@ -115,3 +115,8 @@ var breakpointNumbers = breakpoints.map(
 assertEquals([bp2, bp3, bp5].sort(), breakpointNumbers.sort());
 
 assertFalse(exception, "exception in listener");
+
+// Clear all breakpoints to allow the test to run again (--stress-opt).
+Debug.clearBreakPoint(bp2);
+Debug.clearBreakPoint(bp3);
+Debug.clearBreakPoint(bp5);
diff --git a/deps/v8/test/mjsunit/debug-liveedit-2.js b/deps/v8/test/mjsunit/debug-liveedit-2.js
index 94e278089..39ebf3a74 100644
--- a/deps/v8/test/mjsunit/debug-liveedit-2.js
+++ b/deps/v8/test/mjsunit/debug-liveedit-2.js
@@ -31,17 +31,14 @@
 
 Debug = debug.Debug
 
-
-eval(
-    "function ChooseAnimal(p) {\n " +
-    "  if (p == 7) {\n" + // Use p
-    "    return;\n" +
-    "  }\n" +
-    "  return function Chooser() {\n" +
-    "    return 'Cat';\n" +
-    "  };\n" +
-    "}\n"
-);
+eval("function ChooseAnimal(p) {\n " +
+     "  if (p == 7) {\n" + // Use p
+     "    return;\n" +
+     "  }\n" +
+     "  return function Chooser() {\n" +
+     "    return 'Cat';\n" +
+     "  };\n" +
+     "}\n");
 
 var old_closure = ChooseAnimal(19);
 
@@ -67,4 +64,3 @@ assertEquals("Capybara19", new_closure());
 
 // Old instance of closure is not patched.
 assertEquals("Cat", old_closure());
-
diff --git a/deps/v8/test/mjsunit/debug-liveedit-breakpoints.js b/deps/v8/test/mjsunit/debug-liveedit-breakpoints.js
index f01a8c481..1d28ab9ff 100644
--- a/deps/v8/test/mjsunit/debug-liveedit-breakpoints.js
+++ b/deps/v8/test/mjsunit/debug-liveedit-breakpoints.js
@@ -62,6 +62,8 @@ assertEquals(26, F26());
 
 var script = Debug.findScript(F25);
 
+assertEquals(0, Debug.scriptBreakPoints().length);
+
 Debug.setScriptBreakPoint(Debug.ScriptBreakPointType.ScriptId, script.id, 1, 1, "true || false || false");
 Debug.setScriptBreakPoint(Debug.ScriptBreakPointType.ScriptId, script.id, 6, 1, "true || false || false");
 Debug.setScriptBreakPoint(Debug.ScriptBreakPointType.ScriptId, script.id, 14, 1, "true || false || false");
@@ -96,3 +98,16 @@ assertEquals(3, breakpoints_in_script);
 assertTrue(break_position_map[1]);
 assertTrue(break_position_map[11]);
 
+// Delete all breakpoints to make this test reentrant.
+var breaks = Debug.scriptBreakPoints();
+var breaks_ids = [];
+
+for (var i = 0; i < breaks.length; i++) {
+  breaks_ids.push(breaks[i].number());
+}
+
+for (var i = 0; i < breaks_ids.length; i++) {
+  Debug.clearBreakPoint(breaks_ids[i]);
+}
+
+assertEquals(0, Debug.scriptBreakPoints().length);
diff --git a/deps/v8/test/mjsunit/debug-liveedit-patch-positions.js b/deps/v8/test/mjsunit/debug-liveedit-patch-positions.js
index 027987f5e..b0d3c20d9 100644
--- a/deps/v8/test/mjsunit/debug-liveedit-patch-positions.js
+++ b/deps/v8/test/mjsunit/debug-liveedit-patch-positions.js
@@ -30,7 +30,7 @@
 
 // Scenario: some function is being edited; the outer function has to have its
 // positions patched. Accoring to a special markup of function text
-// corresponding byte-code PCs should conicide before change and after it.
+// corresponding byte-code PCs should coincide before change and after it.
 
 Debug = debug.Debug
 
@@ -62,32 +62,65 @@ function ReadMarkerPositions(func) {
 function ReadPCMap(func, positions) {
   var res = new Array();
   for (var i = 0; i < positions.length; i++) {
-    res.push(Debug.LiveEdit.GetPcFromSourcePos(func, positions[i]));
+    var pc = Debug.LiveEdit.GetPcFromSourcePos(func, positions[i]);
+
+    if (typeof pc === 'undefined') {
+      // Function was marked for recompilation and it's code was replaced with a
+      // stub. This can happen at any time especially if we are running with
+      // --stress-opt. There is no way to get PCs now.
+      return;
+    }
+
+    res.push(pc);
   }
+
   return res;
 }
 
-var res = ChooseAnimal();
-assertEquals("Cat15", res);
+function ApplyPatch(orig_animal, new_animal) {
+  var res = ChooseAnimal();
+  assertEquals(orig_animal + "15", res);
+
+  var script = Debug.findScript(ChooseAnimal);
+
+  var orig_string = "'" + orig_animal + "'";
+  var patch_string = "'" + new_animal + "'";
+  var patch_pos = script.source.indexOf(orig_string);
 
-var markerPositionsBefore = ReadMarkerPositions(ChooseAnimal);
-var pcArrayBefore = ReadPCMap(ChooseAnimal, markerPositionsBefore);
+  var change_log = new Array();
 
-var script = Debug.findScript(ChooseAnimal);
+  Debug.LiveEdit.TestApi.ApplySingleChunkPatch(script,
+                                               patch_pos,
+                                               orig_string.length,
+                                               patch_string,
+                                               change_log);
 
-var orig_animal = "'Cat'";
-var patch_pos = script.source.indexOf(orig_animal);
-var new_animal_patch = "'Capybara'";
+  print("Change log: " + JSON.stringify(change_log) + "\n");
 
-var change_log = new Array();
-Debug.LiveEdit.TestApi.ApplySingleChunkPatch(script, patch_pos, orig_animal.length, new_animal_patch, change_log);
-print("Change log: " + JSON.stringify(change_log) + "\n");
+  var markerPositions = ReadMarkerPositions(ChooseAnimal);
+  var pcArray = ReadPCMap(ChooseAnimal, markerPositions);
 
-var res = ChooseAnimal();
-assertEquals("Capybara15", res);
+  var res = ChooseAnimal();
+  assertEquals(new_animal + "15", res);
 
-var markerPositionsAfter = ReadMarkerPositions(ChooseAnimal);
-var pcArrayAfter = ReadPCMap(ChooseAnimal, markerPositionsAfter);
+  return pcArray;
+}
+
+var pcArray1 = ApplyPatch('Cat', 'Dog');
+
+// When we patched function for the first time it was deoptimized.
+// Check that after the second patch maping between sources position and
+// pcs will not change.
 
-assertArrayEquals(pcArrayBefore, pcArrayAfter);
+var pcArray2 = ApplyPatch('Dog', 'Capybara');
 
+print(pcArray1);
+print(pcArray2);
+
+// Function can be marked for recompilation at any point (especially if we are
+// running with --stress-opt). When we mark function for recompilation we
+// replace it's code with stub. So there is no reliable way to get PCs for
+// function.
+if (pcArray1 && pcArray2) {
+  assertArrayEquals(pcArray1, pcArray2);
+}
diff --git a/deps/v8/test/mjsunit/debug-stepout-recursive-function.js b/deps/v8/test/mjsunit/debug-stepout-recursive-function.js
index 475fe2659..3741f26a8 100644
--- a/deps/v8/test/mjsunit/debug-stepout-recursive-function.js
+++ b/deps/v8/test/mjsunit/debug-stepout-recursive-function.js
@@ -97,7 +97,7 @@ fact(3);
 EndTest(2);
 
 BeginTest('Test 4');
-shouldBreak = function(x) { print(x); return x == 1 || x == 3; };
+shouldBreak = function(x) { return x == 1 || x == 3; };
 step_out_count = 2;
 fact(3);
 EndTest(3);
diff --git a/deps/v8/test/mjsunit/fuzz-natives.js b/deps/v8/test/mjsunit/fuzz-natives.js
index cf08d7a12..0446cd38d 100644
--- a/deps/v8/test/mjsunit/fuzz-natives.js
+++ b/deps/v8/test/mjsunit/fuzz-natives.js
@@ -25,7 +25,7 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --allow-natives-syntax
+// Flags: --allow-natives-syntax --noalways-opt
 
 var RUN_WITH_ALL_ARGUMENT_ENTRIES = false;
 var kOnManyArgumentsRemove = 5;
@@ -144,6 +144,9 @@ var knownProblems = {
   "NewArgumentsFast": true,
   "PushContext": true,
   "LazyCompile": true,
+  "LazyRecompile": true,
+  "NotifyDeoptimized": true,
+  "NotifyOSR": true,
   "CreateObjectLiteralBoilerplate": true,
   "CloneLiteralBoilerplate": true,
   "CloneShallowLiteralBoilerplate": true,
diff --git a/deps/v8/test/mjsunit/json.js b/deps/v8/test/mjsunit/json.js
index 5353d6c54..1c55959d5 100644
--- a/deps/v8/test/mjsunit/json.js
+++ b/deps/v8/test/mjsunit/json.js
@@ -278,6 +278,12 @@ assertEquals('{\n "a": "b",\n "c": "d"\n}',
              JSON.stringify({a:"b",c:"d"}, null, 1));
 assertEquals('{"y":6,"x":5}', JSON.stringify({x:5,y:6}, ['y', 'x']));
 
+// toJSON get string keys.
+var checker = {};
+var array = [checker];
+checker.toJSON = function(key) { return 1 + key; };
+assertEquals('["10"]', JSON.stringify(array));
+
 // The gap is capped at ten characters if specified as string.
 assertEquals('{\n          "a": "b",\n          "c": "d"\n}',
               JSON.stringify({a:"b",c:"d"}, null, 
diff --git a/deps/v8/test/mjsunit/mirror-object.js b/deps/v8/test/mjsunit/mirror-object.js
index ad7add8ae..188855497 100644
--- a/deps/v8/test/mjsunit/mirror-object.js
+++ b/deps/v8/test/mjsunit/mirror-object.js
@@ -74,7 +74,7 @@ function testObjectMirror(obj, cls_name, ctor_name, hasSpecialProperties) {
     assertEquals('property', properties[i].type(), 'Unexpected mirror type');
     assertEquals(names[i], properties[i].name(), 'Unexpected property name');
   }
-  
+
   for (var p in obj) {
     var property_mirror = mirror.property(p);
     assertTrue(property_mirror instanceof debug.PropertyMirror);
diff --git a/deps/v8/test/mjsunit/mjsunit.status b/deps/v8/test/mjsunit/mjsunit.status
index 820dca7cd..24d9603b6 100644
--- a/deps/v8/test/mjsunit/mjsunit.status
+++ b/deps/v8/test/mjsunit/mjsunit.status
@@ -30,6 +30,13 @@ prefix mjsunit
 # All tests in the bug directory are expected to fail.
 bugs: FAIL
 
+
+##############################################################################
+# Too slow in debug mode with --stress-opt
+compiler/regress-stacktrace-methods: PASS, SKIP if $mode == debug
+
+
+##############################################################################
 # This one uses a built-in that's only present in debug mode. It takes
 # too long to run in debug mode on ARM.
 fuzz-natives: PASS, SKIP if ($mode == release || $arch == arm)
@@ -49,6 +56,8 @@ regress/regress-524: (PASS || TIMEOUT), SKIP if $mode == debug
 debug-liveedit-check-stack: SKIP
 debug-liveedit-patch-positions-replace: SKIP
 
+
+##############################################################################
 [ $arch == arm ]
 
 # Slow tests which times out in debug mode.
@@ -60,15 +69,44 @@ array-constructor: PASS, SKIP if $mode == debug
 unicode-test: PASS, (PASS || FAIL) if $mode == debug
 
 # Times out often in release mode on ARM.
+compiler/regress-stacktrace-methods: PASS, PASS || TIMEOUT if $mode == release
 array-splice: PASS || TIMEOUT
 
-# Skip long running test in debug mode on ARM.
-string-indexof-2: PASS, SKIP if $mode == debug
-
-
+# Long running test.
+mirror-object: PASS || TIMEOUT
+string-indexof-2: PASS || TIMEOUT
+
+# BUG(3251035): Timeouts in long looping crankshaft optimization
+# tests. Skipping because having them timeout takes too long on the
+# buildbot.
+compiler/alloc-number: SKIP
+compiler/array-length: SKIP
+compiler/assignment-deopt: SKIP
+compiler/deopt-args: SKIP
+compiler/inline-compare: SKIP
+compiler/inline-global-access: SKIP
+compiler/optimized-function-calls: SKIP
+compiler/pic: SKIP
+compiler/property-calls: SKIP
+compiler/recursive-deopt: SKIP
+compiler/regress-4: SKIP
+compiler/regress-funcaller: SKIP
+compiler/regress-gvn: SKIP
+compiler/regress-rep-change: SKIP
+compiler/regress-arguments: SKIP
+compiler/regress-funarguments: SKIP
+compiler/regress-or: SKIP
+compiler/regress-3249650: SKIP
+compiler/simple-deopt: SKIP
+regress/regress-490: SKIP
+regress/regress-634: SKIP
+regress/regress-create-exception: SKIP
+regress/regress-3218915: SKIP
+regress/regress-3247124: SKIP
+
+
+##############################################################################
 [ $arch == mips ]
 
 # Skip all tests on MIPS.
 *: SKIP
-
-
diff --git a/deps/v8/test/mjsunit/regexp.js b/deps/v8/test/mjsunit/regexp.js
index b57b86d2d..59c3ba8d2 100644
--- a/deps/v8/test/mjsunit/regexp.js
+++ b/deps/v8/test/mjsunit/regexp.js
@@ -110,44 +110,6 @@ assertFalse(re.test("\\]"));
 assertFalse(re.test("\x03]"));  // I.e., read as \cc
 
 
-// Test that we handle \s and \S correctly inside some bizarre
-// character classes.
-re = /[\s-:]/;
-assertTrue(re.test('-'));
-assertTrue(re.test(':'));
-assertTrue(re.test(' '));
-assertTrue(re.test('\t'));
-assertTrue(re.test('\n'));
-assertFalse(re.test('a'));
-assertFalse(re.test('Z'));
-
-re = /[\S-:]/;
-assertTrue(re.test('-'));
-assertTrue(re.test(':'));
-assertFalse(re.test(' '));
-assertFalse(re.test('\t'));
-assertFalse(re.test('\n'));
-assertTrue(re.test('a'));
-assertTrue(re.test('Z'));
-
-re = /[^\s-:]/;
-assertFalse(re.test('-'));
-assertFalse(re.test(':'));
-assertFalse(re.test(' '));
-assertFalse(re.test('\t'));
-assertFalse(re.test('\n'));
-assertTrue(re.test('a'));
-assertTrue(re.test('Z'));
-
-re = /[^\S-:]/;
-assertFalse(re.test('-'));
-assertFalse(re.test(':'));
-assertTrue(re.test(' '));
-assertTrue(re.test('\t'));
-assertTrue(re.test('\n'));
-assertFalse(re.test('a'));
-assertFalse(re.test('Z'));
-
 re = /[\s]/;
 assertFalse(re.test('-'));
 assertFalse(re.test(':'));
@@ -647,3 +609,47 @@ assertEquals(4, re.exec("zimzamzumba").index);
 assertEquals(["bc"], re.exec("zimzomzumbc"));
 assertFalse(re.test("c"));
 assertFalse(re.test(""));
+
+
+function testInvalidRange(str) {
+  try {
+    RegExp(str).test("x");
+  } catch (e) {
+    return;
+  }    
+  assetUnreachable("Allowed invalid range in " + str);
+}
+
+function testValidRange(str) {
+  try { 
+    RegExp(str).test("x");
+  } catch (e) {
+    assertUnreachable("Shouldn't fail parsing: " + str + ", was: " + e);
+  }
+}
+
+testInvalidRange("[\\d-z]");
+testInvalidRange("[z-\\d]");
+testInvalidRange("[\\d-\\d]");
+testInvalidRange("[z-x]");  // Larger value first.
+testInvalidRange("[x-\\d-\\d]");
+
+testValidRange("[x-z]");
+testValidRange("[!--\d]");  // Second "-" is end of range.
+testValidRange("[\d-]");
+testValidRange("[-\d]");
+testValidRange("[-\d-]");
+testValidRange("[^-\d-]");
+testValidRange("[^-\d-]");
+testValidRange("[0-9-\w]");
+
+// Escaped dashes do not count as range operators.
+testValidRange("[\\d\\-z]");
+testValidRange("[z\\-\\d]");
+testValidRange("[\\d\\-\\d]");
+testValidRange("[z\\-x]");
+testValidRange("[x\\-\\d\\-\\d]");
+
+
+
+
diff --git a/deps/v8/test/mjsunit/regress/regress-3006390.js b/deps/v8/test/mjsunit/regress/regress-3006390.js
new file mode 100644
index 000000000..4f916ef76
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-3006390.js
@@ -0,0 +1,33 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function X() { }
+X.prototype.valueOf = function () { return 7; }
+
+function f(x, y) { return x % y; }
+
+assertEquals(1, f(8, new X()));
diff --git a/deps/v8/test/mjsunit/regress/regress-3185905.js b/deps/v8/test/mjsunit/regress/regress-3185905.js
new file mode 100644
index 000000000..bd611ab14
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-3185905.js
@@ -0,0 +1,60 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function test1(x) {
+  var a = arguments.callee;
+  x = 1;
+  x = 2;
+  assertEquals(2, x);
+}
+test1(0)
+
+function test2(x) {
+  var a = arguments.callee;
+  x++;
+  x++;
+  assertEquals(2, x);
+}
+test2(0)
+
+function test3(x) {
+  var a = arguments.callee;
+  x += 1;
+  x += 1;
+  assertEquals(2, x);
+}
+test3(0)
+
+function test4(x) {
+  var arguments = { 0 : 3, 'x' : 4 };
+  x += 1;
+  x += 1;
+  assertEquals(2, x);
+  assertEquals(3, arguments[0])
+  assertEquals(4, arguments['x'])
+}
+test4(0)
diff --git a/deps/v8/test/mjsunit/regress/regress-3199913.js b/deps/v8/test/mjsunit/regress/regress-3199913.js
new file mode 100644
index 000000000..e202af18f
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-3199913.js
@@ -0,0 +1,44 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test that bailout during evaluation of the key for a keyed call works as
+// intended.
+
+var y = {
+  'a' : function (x, y) { return 'called a(' + x + ', ' + y + ')' },
+  'b' : function (x, y) { return 'called b(' + x + ', ' + y + ')' }
+}
+
+function C() {
+}
+
+C.prototype.f = function () {
+  return y[(this.a == 1 ? "a" : "b")](0, 1);
+}
+
+obj = new C()
+assertEquals('called b(0, 1)', obj.f())
diff --git a/deps/v8/test/mjsunit/regress/regress-3218530.js b/deps/v8/test/mjsunit/regress/regress-3218530.js
new file mode 100644
index 000000000..247f3dfe6
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-3218530.js
@@ -0,0 +1,39 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// This tests that a global key values are preserved when used in
+// an expression which will bail out.
+
+var m = Math;
+var p = "floor";
+
+function test() {
+  var bignumber = 31363200000;
+  assertDoesNotThrow(assertEquals(m[p](Math.round(bignumber/864E5)/7)+1, 52));
+}
+
+test();
diff --git a/deps/v8/test/mjsunit/regress/regress-3218915.js b/deps/v8/test/mjsunit/regress/regress-3218915.js
new file mode 100644
index 000000000..5fcbcec31
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-3218915.js
@@ -0,0 +1,42 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Checks that comma expression in conditional context is processed correctly.
+
+function withCommaExpressionInConditional(x) {
+  if (x > 1000) { for (var i = 0; i < 10000; i++) { } }
+  var y;
+  if (y = x, y > 1) {
+    return 'big';
+  }
+  return (y = x + 1, y > 1) ? 'medium' : 'small';
+}
+
+for (var i = 0; i < 10000; i++) {
+  withCommaExpressionInConditional(i);
+}
+withCommaExpressionInConditional("1")
diff --git a/deps/v8/test/mjsunit/regress/regress-3230771.js b/deps/v8/test/mjsunit/regress/regress-3230771.js
new file mode 100644
index 000000000..bd0079846
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-3230771.js
@@ -0,0 +1,35 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Regression test for missing stack-overflow check in
+// VisitForStatement in hydrogen graph building.
+
+function f() {
+  for (var h = typeof arguments[0] == "object" ? 0 : arguments; false; ) { }
+}
+
+f();
diff --git a/deps/v8/test/mjsunit/regress/regress-3247124.js b/deps/v8/test/mjsunit/regress/regress-3247124.js
new file mode 100644
index 000000000..7fda29992
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-3247124.js
@@ -0,0 +1,53 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var foo = unescape("%E0%E2%EA%F4%FB%E3%F5%E1%E9%ED%F3%FA%E7%FC%C0%C2%CA%D4%DB%C3%D5%C1%C9%CD%D3%DA%C7%DC");
+
+function bar(x) {
+  var s = new String(x);
+  var a = new String(foo);
+  var b = new String('aaeouaoaeioucuAAEOUAOAEIOUCU');
+
+  var i = new Number();
+  var j = new Number();
+  var c = new String();
+  var r = '';
+
+  for (i = 0; i < s.length; i++) {
+    c = s.substring(i, i + 1);
+    for (j = 0; j < a.length; j++) {
+      if (a.substring(j, j + 1) == c) {
+        c = b.substring(j, j + 1);
+      }
+    }
+    r += c;
+  }
+
+  return r.toLowerCase();
+}
+
+for (var i = 0; i < 10000; i++) bar(foo);
diff --git a/deps/v8/test/mjsunit/regress/regress-3252443.js b/deps/v8/test/mjsunit/regress/regress-3252443.js
new file mode 100644
index 000000000..cd7aa40e7
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-3252443.js
@@ -0,0 +1,45 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var document = new Object();
+document.getElementById = function(s) { return { style: {}}};
+function x(p0, p1, p2, p3) {
+  document.getElementById(p1+p0).style.display='';
+  document.getElementById(p1+''+p0).style.backgroundColor = "";
+  document.getElementById(p1+''+p0).style.color="";
+  document.getElementById(p1+''+p0).style.borderBottomColor = "";
+  for (var i = p3; i <= p2; ++i) {
+    if (i != p0) {
+      document.getElementById(p1+i).style.display='';
+      document.getElementById(p1+''+i).style.backgroundColor = "";
+      document.getElementById(p1+''+i).style.color="";
+      document.getElementById(p1+''+i).style.borderBottomColor = "";
+    }
+  }
+}
+
+x(1, "xxx", 10000, 1)
diff --git a/deps/v8/test/mjsunit/regress/regress-52801.js b/deps/v8/test/mjsunit/regress/regress-52801.js
index 80cc0c731..9a34b812f 100644
--- a/deps/v8/test/mjsunit/regress/regress-52801.js
+++ b/deps/v8/test/mjsunit/regress/regress-52801.js
@@ -67,5 +67,3 @@ assertEquals(5, re.lastIndex);  // Fails if caching.
 re.lastIndex = 0;
 re.exec(str);
 assertEquals(5, re.lastIndex);  // Fails if caching.
-
-
diff --git a/deps/v8/test/mjsunit/regress/regress-580.js b/deps/v8/test/mjsunit/regress/regress-580.js
index c6b3db7ad..6b1d098c0 100644
--- a/deps/v8/test/mjsunit/regress/regress-580.js
+++ b/deps/v8/test/mjsunit/regress/regress-580.js
@@ -32,22 +32,22 @@ function num_ops() {
   var x;
   var tmp = 0;
   x = (tmp = 1578221999, tmp)+(tmp = 572285336, tmp);
-  assertEquals(2150507335, x);
+  assertEquals(2150507335, x, "++");
   x = 1578221999 + 572285336;
   assertEquals(2150507335, x);
 
   x = (tmp = -1500000000, tmp)+(tmp = -2000000000, tmp);
-  assertEquals(-3500000000, x);
+  assertEquals(-3500000000, x, "+-");
   x = -1500000000 + -2000000000;
   assertEquals(-3500000000, x);
 
   x = (tmp = 1578221999, tmp)-(tmp = -572285336, tmp);
-  assertEquals(2150507335, x);
+  assertEquals(2150507335, x, "--");
   x = 1578221999 - -572285336;
   assertEquals(2150507335, x);
 
   x = (tmp = -1500000000, tmp)-(tmp = 2000000000, tmp);
-  assertEquals(-3500000000, x);
+  assertEquals(-3500000000, x, "-+");
   x = -1500000000 - 2000000000;
   assertEquals(-3500000000, x);
 }
diff --git a/deps/v8/test/mjsunit/smi-ops-inlined.js b/deps/v8/test/mjsunit/smi-ops-inlined.js
new file mode 100644
index 000000000..afc6cc076
--- /dev/null
+++ b/deps/v8/test/mjsunit/smi-ops-inlined.js
@@ -0,0 +1,673 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --always-inline-smi-code
+
+const SMI_MAX = (1 << 30) - 1;
+const SMI_MIN = -(1 << 30);
+const ONE = 1;
+const ONE_HUNDRED = 100;
+
+const OBJ_42 = new (function() {
+  this.valueOf = function() { return 42; };
+})();
+
+assertEquals(42, OBJ_42.valueOf());
+
+
+function Add1(x) {
+  return x + 1;
+}
+
+function Add100(x) {
+  return x + 100;
+}
+
+function Add1Reversed(x) {
+  return 1 + x;
+}
+
+function Add100Reversed(x) {
+  return 100 + x;
+}
+
+
+assertEquals(1, Add1(0));  // fast case
+assertEquals(1, Add1Reversed(0));  // fast case
+assertEquals(SMI_MAX + ONE, Add1(SMI_MAX), "smimax + 1");
+assertEquals(SMI_MAX + ONE, Add1Reversed(SMI_MAX), "1 + smimax");
+assertEquals(42 + ONE, Add1(OBJ_42));  // non-smi
+assertEquals(42 + ONE, Add1Reversed(OBJ_42));  // non-smi
+
+assertEquals(100, Add100(0));  // fast case
+assertEquals(100, Add100Reversed(0));  // fast case
+assertEquals(SMI_MAX + ONE_HUNDRED, Add100(SMI_MAX), "smimax + 100");
+assertEquals(SMI_MAX + ONE_HUNDRED, Add100Reversed(SMI_MAX), " 100 + smimax");
+assertEquals(42 + ONE_HUNDRED, Add100(OBJ_42));  // non-smi
+assertEquals(42 + ONE_HUNDRED, Add100Reversed(OBJ_42));  // non-smi
+
+
+
+function Sub1(x) {
+  return x - 1;
+}
+
+function Sub100(x) {
+  return x - 100;
+}
+
+function Sub1Reversed(x) {
+  return 1 - x;
+}
+
+function Sub100Reversed(x) {
+  return 100 - x;
+}
+
+
+assertEquals(0, Sub1(1));  // fast case
+assertEquals(-1, Sub1Reversed(2));  // fast case
+assertEquals(SMI_MIN - ONE, Sub1(SMI_MIN));  // overflow
+assertEquals(ONE - SMI_MIN, Sub1Reversed(SMI_MIN));  // overflow
+assertEquals(42 - ONE, Sub1(OBJ_42));  // non-smi
+assertEquals(ONE - 42, Sub1Reversed(OBJ_42));  // non-smi
+
+assertEquals(0, Sub100(100));  // fast case
+assertEquals(1, Sub100Reversed(99));  // fast case
+assertEquals(SMI_MIN - ONE_HUNDRED, Sub100(SMI_MIN));  // overflow
+assertEquals(ONE_HUNDRED - SMI_MIN, Sub100Reversed(SMI_MIN));  // overflow
+assertEquals(42 - ONE_HUNDRED, Sub100(OBJ_42));  // non-smi
+assertEquals(ONE_HUNDRED - 42, Sub100Reversed(OBJ_42));  // non-smi
+
+
+function Shr1(x) {
+  return x >>> 1;
+}
+
+function Shr100(x) {
+  return x >>> 100;
+}
+
+function Shr1Reversed(x) {
+  return 1 >>> x;
+}
+
+function Shr100Reversed(x) {
+  return 100 >>> x;
+}
+
+function Sar1(x) {
+  return x >> 1;
+}
+
+function Sar100(x) {
+  return x >> 100;
+}
+
+function Sar1Reversed(x) {
+  return 1 >> x;
+}
+
+function Sar100Reversed(x) {
+  return 100 >> x;
+}
+
+
+assertEquals(0, Shr1(1));
+assertEquals(0, Sar1(1));
+assertEquals(0, Shr1Reversed(2));
+assertEquals(0, Sar1Reversed(2));
+assertEquals(1610612736, Shr1(SMI_MIN));
+assertEquals(-536870912, Sar1(SMI_MIN));
+assertEquals(1, Shr1Reversed(SMI_MIN));
+assertEquals(1, Sar1Reversed(SMI_MIN));
+assertEquals(21, Shr1(OBJ_42));
+assertEquals(21, Sar1(OBJ_42));
+assertEquals(0, Shr1Reversed(OBJ_42));
+assertEquals(0, Sar1Reversed(OBJ_42));
+
+assertEquals(6, Shr100(100), "100 >>> 100");
+assertEquals(6, Sar100(100), "100 >> 100");
+assertEquals(12, Shr100Reversed(99));
+assertEquals(12, Sar100Reversed(99));
+assertEquals(201326592, Shr100(SMI_MIN));
+assertEquals(-67108864, Sar100(SMI_MIN));
+assertEquals(100, Shr100Reversed(SMI_MIN));
+assertEquals(100, Sar100Reversed(SMI_MIN));
+assertEquals(2, Shr100(OBJ_42));
+assertEquals(2, Sar100(OBJ_42));
+assertEquals(0, Shr100Reversed(OBJ_42));
+assertEquals(0, Sar100Reversed(OBJ_42));
+
+
+function Xor1(x) {
+  return x ^ 1;
+}
+
+function Xor100(x) {
+  return x ^ 100;
+}
+
+function Xor1Reversed(x) {
+  return 1 ^ x;
+}
+
+function Xor100Reversed(x) {
+  return 100 ^ x;
+}
+
+
+assertEquals(0, Xor1(1));
+assertEquals(3, Xor1Reversed(2));
+assertEquals(SMI_MIN + 1, Xor1(SMI_MIN));
+assertEquals(SMI_MIN + 1, Xor1Reversed(SMI_MIN));
+assertEquals(43, Xor1(OBJ_42));
+assertEquals(43, Xor1Reversed(OBJ_42));
+
+assertEquals(0, Xor100(100));
+assertEquals(7, Xor100Reversed(99));
+assertEquals(-1073741724, Xor100(SMI_MIN));
+assertEquals(-1073741724, Xor100Reversed(SMI_MIN));
+assertEquals(78, Xor100(OBJ_42));
+assertEquals(78, Xor100Reversed(OBJ_42));
+
+var x = 0x23; var y = 0x35;
+assertEquals(0x16, x ^ y);
+
+
+// Bitwise not.
+var v = 0;
+assertEquals(-1, ~v);
+v = SMI_MIN;
+assertEquals(0x3fffffff, ~v, "~smimin");
+v = SMI_MAX;
+assertEquals(-0x40000000, ~v, "~smimax");
+
+// Overflowing ++ and --.
+v = SMI_MAX;
+v++;
+assertEquals(0x40000000, v, "smimax++");
+v = SMI_MIN;
+v--;
+assertEquals(-0x40000001, v, "smimin--");
+
+// Not actually Smi operations.
+// Check that relations on unary ops work.
+var v = -1.2;
+assertTrue(v == v);
+assertTrue(v === v);
+assertTrue(v <= v);
+assertTrue(v >= v);
+assertFalse(v < v);
+assertFalse(v > v);
+assertFalse(v != v);
+assertFalse(v !== v);
+
+// Right hand side of unary minus is overwritable.
+v = 1.5
+assertEquals(-2.25, -(v * v));
+
+// Smi input to bitop gives non-smi result where the rhs is a float that
+// can be overwritten.
+var x1 = 0x10000000;
+var x2 = 0x40000002;
+var x3 = 0x40000000;
+assertEquals(0x40000000, x1 << (x2 - x3), "0x10000000<<1(1)");
+
+// Smi input to bitop gives non-smi result where the rhs could be overwritten
+// if it were a float, but it isn't.
+x1 = 0x10000000
+x2 = 4
+x3 = 2
+assertEquals(0x40000000, x1 << (x2 - x3), "0x10000000<<2(2)");
+
+
+// Test shift operators on non-smi inputs, giving smi and non-smi results.
+function testShiftNonSmis() {
+  var pos_non_smi = 2000000000;
+  var neg_non_smi = -pos_non_smi;
+  var pos_smi = 1000000000;
+  var neg_smi = -pos_smi;
+
+  // Begin block A
+  assertEquals(pos_non_smi, (pos_non_smi) >> 0);
+  assertEquals(pos_non_smi, (pos_non_smi) >>> 0);
+  assertEquals(pos_non_smi, (pos_non_smi) << 0);
+  assertEquals(neg_non_smi, (neg_non_smi) >> 0);
+  assertEquals(neg_non_smi + 0x100000000, (neg_non_smi) >>> 0);
+  assertEquals(neg_non_smi, (neg_non_smi) << 0);
+  assertEquals(pos_smi, (pos_smi) >> 0, "possmi >> 0");
+  assertEquals(pos_smi, (pos_smi) >>> 0, "possmi >>>0");
+  assertEquals(pos_smi, (pos_smi) << 0, "possmi << 0");
+  assertEquals(neg_smi, (neg_smi) >> 0, "negsmi >> 0");
+  assertEquals(neg_smi + 0x100000000, (neg_smi) >>> 0, "negsmi >>> 0");
+  assertEquals(neg_smi, (neg_smi) << 0), "negsmi << 0";
+
+  assertEquals(pos_non_smi / 2, (pos_non_smi) >> 1);
+  assertEquals(pos_non_smi / 2, (pos_non_smi) >>> 1);
+  assertEquals(-0x1194D800, (pos_non_smi) << 1);
+  assertEquals(pos_non_smi / 8, (pos_non_smi) >> 3);
+  assertEquals(pos_non_smi / 8, (pos_non_smi) >>> 3);
+  assertEquals(-0x46536000, (pos_non_smi) << 3);
+  assertEquals(0x73594000, (pos_non_smi) << 4);
+  assertEquals(pos_non_smi, (pos_non_smi + 0.5) >> 0);
+  assertEquals(pos_non_smi, (pos_non_smi + 0.5) >>> 0);
+  assertEquals(pos_non_smi, (pos_non_smi + 0.5) << 0);
+  assertEquals(pos_non_smi / 2, (pos_non_smi + 0.5) >> 1);
+  assertEquals(pos_non_smi / 2, (pos_non_smi + 0.5) >>> 1);
+  assertEquals(-0x1194D800, (pos_non_smi + 0.5) << 1);
+  assertEquals(pos_non_smi / 8, (pos_non_smi + 0.5) >> 3);
+  assertEquals(pos_non_smi / 8, (pos_non_smi + 0.5) >>> 3);
+  assertEquals(-0x46536000, (pos_non_smi + 0.5) << 3);
+  assertEquals(0x73594000, (pos_non_smi + 0.5) << 4);
+
+  assertEquals(neg_non_smi / 2, (neg_non_smi) >> 1, "negnonsmi >> 1");
+
+  assertEquals(neg_non_smi / 2 + 0x100000000 / 2, (neg_non_smi) >>> 1,
+               "negnonsmi >>> 1");
+  assertEquals(0x1194D800, (neg_non_smi) << 1);
+  assertEquals(neg_non_smi / 8, (neg_non_smi) >> 3);
+  assertEquals(neg_non_smi / 8 + 0x100000000 / 8, (neg_non_smi) >>> 3);
+  assertEquals(0x46536000, (neg_non_smi) << 3);
+  assertEquals(-0x73594000, (neg_non_smi) << 4);
+  assertEquals(neg_non_smi, (neg_non_smi - 0.5) >> 0);
+  assertEquals(neg_non_smi + 0x100000000, (neg_non_smi - 0.5) >>> 0,
+               "negnonsmi.5 >>> 0");
+  assertEquals(neg_non_smi, (neg_non_smi - 0.5) << 0);
+  assertEquals(neg_non_smi / 2, (neg_non_smi - 0.5) >> 1);
+  assertEquals(neg_non_smi / 2 + 0x100000000 / 2, (neg_non_smi - 0.5) >>> 1,
+               "negnonsmi.5 >>> 1");
+  assertEquals(0x1194D800, (neg_non_smi - 0.5) << 1);
+  assertEquals(neg_non_smi / 8, (neg_non_smi - 0.5) >> 3);
+  assertEquals(neg_non_smi / 8 + 0x100000000 / 8, (neg_non_smi - 0.5) >>> 3);
+  assertEquals(0x46536000, (neg_non_smi - 0.5) << 3);
+  assertEquals(-0x73594000, (neg_non_smi - 0.5) << 4);
+
+  assertEquals(pos_smi / 2, (pos_smi) >> 1);
+  assertEquals(pos_smi / 2, (pos_smi) >>> 1);
+  assertEquals(pos_non_smi, (pos_smi) << 1);
+  assertEquals(pos_smi / 8, (pos_smi) >> 3);
+  assertEquals(pos_smi / 8, (pos_smi) >>> 3);
+  assertEquals(-0x2329b000, (pos_smi) << 3);
+  assertEquals(0x73594000, (pos_smi) << 5);
+  assertEquals(pos_smi, (pos_smi + 0.5) >> 0, "possmi.5 >> 0");
+  assertEquals(pos_smi, (pos_smi + 0.5) >>> 0, "possmi.5 >>> 0");
+  assertEquals(pos_smi, (pos_smi + 0.5) << 0, "possmi.5 << 0");
+  assertEquals(pos_smi / 2, (pos_smi + 0.5) >> 1);
+  assertEquals(pos_smi / 2, (pos_smi + 0.5) >>> 1);
+  assertEquals(pos_non_smi, (pos_smi + 0.5) << 1);
+  assertEquals(pos_smi / 8, (pos_smi + 0.5) >> 3);
+  assertEquals(pos_smi / 8, (pos_smi + 0.5) >>> 3);
+  assertEquals(-0x2329b000, (pos_smi + 0.5) << 3);
+  assertEquals(0x73594000, (pos_smi + 0.5) << 5);
+
+  assertEquals(neg_smi / 2, (neg_smi) >> 1);
+  assertEquals(neg_smi / 2 + 0x100000000 / 2, (neg_smi) >>> 1);
+  assertEquals(neg_non_smi, (neg_smi) << 1);
+  assertEquals(neg_smi / 8, (neg_smi) >> 3);
+  assertEquals(neg_smi / 8 + 0x100000000 / 8, (neg_smi) >>> 3);
+  assertEquals(0x46536000, (neg_smi) << 4);
+  assertEquals(-0x73594000, (neg_smi) << 5);
+  assertEquals(neg_smi, (neg_smi - 0.5) >> 0, "negsmi.5 >> 0");
+  assertEquals(neg_smi + 0x100000000, (neg_smi - 0.5) >>> 0, "negsmi.5 >>> 0");
+  assertEquals(neg_smi, (neg_smi - 0.5) << 0, "negsmi.5 << 0");
+  assertEquals(neg_smi / 2, (neg_smi - 0.5) >> 1);
+  assertEquals(neg_smi / 2 + 0x100000000 / 2, (neg_smi - 0.5) >>> 1);
+  assertEquals(neg_non_smi, (neg_smi - 0.5) << 1);
+  assertEquals(neg_smi / 8, (neg_smi - 0.5) >> 3);
+  assertEquals(neg_smi / 8 + 0x100000000 / 8, (neg_smi - 0.5) >>> 3);
+  assertEquals(0x46536000, (neg_smi - 0.5) << 4);
+  assertEquals(-0x73594000, (neg_smi - 0.5) << 5);
+  // End block A
+
+  // Repeat block A with 2^32 added to positive numbers and
+  // 2^32 subtracted from negative numbers.
+  // Begin block A repeat 1
+  var two_32 = 0x100000000;
+  var neg_32 = -two_32;
+  assertEquals(pos_non_smi, (two_32 + pos_non_smi) >> 0);
+  assertEquals(pos_non_smi, (two_32 + pos_non_smi) >>> 0);
+  assertEquals(pos_non_smi, (two_32 + pos_non_smi) << 0);
+  assertEquals(neg_non_smi, (neg_32 + neg_non_smi) >> 0);
+  assertEquals(neg_non_smi + 0x100000000, (neg_32 + neg_non_smi) >>> 0);
+  assertEquals(neg_non_smi, (neg_32 + neg_non_smi) << 0);
+  assertEquals(pos_smi, (two_32 + pos_smi) >> 0, "2^32+possmi >> 0");
+  assertEquals(pos_smi, (two_32 + pos_smi) >>> 0, "2^32+possmi >>> 0");
+  assertEquals(pos_smi, (two_32 + pos_smi) << 0, "2^32+possmi << 0");
+  assertEquals(neg_smi, (neg_32 + neg_smi) >> 0, "2^32+negsmi >> 0");
+  assertEquals(neg_smi + 0x100000000, (neg_32 + neg_smi) >>> 0);
+  assertEquals(neg_smi, (neg_32 + neg_smi) << 0, "2^32+negsmi << 0");
+
+  assertEquals(pos_non_smi / 2, (two_32 + pos_non_smi) >> 1);
+  assertEquals(pos_non_smi / 2, (two_32 + pos_non_smi) >>> 1);
+  assertEquals(-0x1194D800, (two_32 + pos_non_smi) << 1);
+  assertEquals(pos_non_smi / 8, (two_32 + pos_non_smi) >> 3);
+  assertEquals(pos_non_smi / 8, (two_32 + pos_non_smi) >>> 3);
+  assertEquals(-0x46536000, (two_32 + pos_non_smi) << 3);
+  assertEquals(0x73594000, (two_32 + pos_non_smi) << 4);
+  assertEquals(pos_non_smi, (two_32 + pos_non_smi + 0.5) >> 0);
+  assertEquals(pos_non_smi, (two_32 + pos_non_smi + 0.5) >>> 0);
+  assertEquals(pos_non_smi, (two_32 + pos_non_smi + 0.5) << 0);
+  assertEquals(pos_non_smi / 2, (two_32 + pos_non_smi + 0.5) >> 1);
+  assertEquals(pos_non_smi / 2, (two_32 + pos_non_smi + 0.5) >>> 1);
+  assertEquals(-0x1194D800, (two_32 + pos_non_smi + 0.5) << 1);
+  assertEquals(pos_non_smi / 8, (two_32 + pos_non_smi + 0.5) >> 3);
+  assertEquals(pos_non_smi / 8, (two_32 + pos_non_smi + 0.5) >>> 3);
+  assertEquals(-0x46536000, (two_32 + pos_non_smi + 0.5) << 3);
+  assertEquals(0x73594000, (two_32 + pos_non_smi + 0.5) << 4);
+
+  assertEquals(neg_non_smi / 2, (neg_32 + neg_non_smi) >> 1);
+  assertEquals(neg_non_smi / 2 + 0x100000000 / 2, (neg_32 + neg_non_smi) >>> 1);
+  assertEquals(0x1194D800, (neg_32 + neg_non_smi) << 1);
+  assertEquals(neg_non_smi / 8, (neg_32 + neg_non_smi) >> 3);
+  assertEquals(neg_non_smi / 8 + 0x100000000 / 8, (neg_32 + neg_non_smi) >>> 3);
+  assertEquals(0x46536000, (neg_32 + neg_non_smi) << 3);
+  assertEquals(-0x73594000, (neg_32 + neg_non_smi) << 4);
+  assertEquals(neg_non_smi, (neg_32 + neg_non_smi - 0.5) >> 0);
+  assertEquals(neg_non_smi + 0x100000000, (neg_32 + neg_non_smi - 0.5) >>> 0);
+  assertEquals(neg_non_smi, (neg_32 + neg_non_smi - 0.5) << 0);
+  assertEquals(neg_non_smi / 2, (neg_32 + neg_non_smi - 0.5) >> 1);
+  assertEquals(neg_non_smi / 2 + 0x100000000 / 2, (neg_32 + neg_non_smi - 0.5)
+               >>> 1);
+  assertEquals(0x1194D800, (neg_32 + neg_non_smi - 0.5) << 1);
+  assertEquals(neg_non_smi / 8, (neg_32 + neg_non_smi - 0.5) >> 3);
+  assertEquals(neg_non_smi / 8 + 0x100000000 / 8, (neg_32 + neg_non_smi - 0.5)
+               >>> 3);
+  assertEquals(0x46536000, (neg_32 + neg_non_smi - 0.5) << 3);
+  assertEquals(-0x73594000, (neg_32 + neg_non_smi - 0.5) << 4);
+
+  assertEquals(pos_smi / 2, (two_32 + pos_smi) >> 1);
+  assertEquals(pos_smi / 2, (two_32 + pos_smi) >>> 1);
+  assertEquals(pos_non_smi, (two_32 + pos_smi) << 1);
+  assertEquals(pos_smi / 8, (two_32 + pos_smi) >> 3);
+  assertEquals(pos_smi / 8, (two_32 + pos_smi) >>> 3);
+  assertEquals(-0x2329b000, (two_32 + pos_smi) << 3);
+  assertEquals(0x73594000, (two_32 + pos_smi) << 5);
+  assertEquals(pos_smi, (two_32 + pos_smi + 0.5) >> 0);
+  assertEquals(pos_smi, (two_32 + pos_smi + 0.5) >>> 0);
+  assertEquals(pos_smi, (two_32 + pos_smi + 0.5) << 0);
+  assertEquals(pos_smi / 2, (two_32 + pos_smi + 0.5) >> 1);
+  assertEquals(pos_smi / 2, (two_32 + pos_smi + 0.5) >>> 1);
+  assertEquals(pos_non_smi, (two_32 + pos_smi + 0.5) << 1);
+  assertEquals(pos_smi / 8, (two_32 + pos_smi + 0.5) >> 3);
+  assertEquals(pos_smi / 8, (two_32 + pos_smi + 0.5) >>> 3);
+  assertEquals(-0x2329b000, (two_32 + pos_smi + 0.5) << 3);
+  assertEquals(0x73594000, (two_32 + pos_smi + 0.5) << 5);
+
+  assertEquals(neg_smi / 2, (neg_32 + neg_smi) >> 1);
+  assertEquals(neg_smi / 2 + 0x100000000 / 2, (neg_32 + neg_smi) >>> 1);
+  assertEquals(neg_non_smi, (neg_32 + neg_smi) << 1);
+  assertEquals(neg_smi / 8, (neg_32 + neg_smi) >> 3);
+  assertEquals((neg_smi + 0x100000000) / 8, (neg_32 + neg_smi) >>> 3);
+  assertEquals(0x46536000, (neg_32 + neg_smi) << 4);
+  assertEquals(-0x73594000, (neg_32 + neg_smi) << 5);
+  assertEquals(neg_smi, (neg_32 + neg_smi - 0.5) >> 0, "-2^32+negsmi.5 >> 0");
+  assertEquals(neg_smi + 0x100000000, (neg_32 + neg_smi - 0.5) >>> 0);
+  assertEquals(neg_smi, (neg_32 + neg_smi - 0.5) << 0, "-2^32+negsmi.5 << 0");
+  assertEquals(neg_smi / 2, (neg_32 + neg_smi - 0.5) >> 1);
+  assertEquals(neg_smi / 2 + 0x100000000 / 2, (neg_32 + neg_smi - 0.5) >>> 1);
+  assertEquals(neg_non_smi, (neg_32 + neg_smi - 0.5) << 1);
+  assertEquals(neg_smi / 8, (neg_32 + neg_smi - 0.5) >> 3);
+  assertEquals(neg_smi / 8 + 0x100000000 / 8, (neg_32 + neg_smi - 0.5) >>> 3);
+  assertEquals(0x46536000, (neg_32 + neg_smi - 0.5) << 4);
+  assertEquals(-0x73594000, (neg_32 + neg_smi - 0.5) << 5);
+  // End block A repeat 1
+  // Repeat block A with shift amounts in variables intialized with
+  // a constant.
+  var zero = 0;
+  var one = 1;
+  var three = 3;
+  var four = 4;
+  var five = 5;
+  // Begin block A repeat 2
+  assertEquals(pos_non_smi, (pos_non_smi) >> zero);
+  assertEquals(pos_non_smi, (pos_non_smi) >>> zero);
+  assertEquals(pos_non_smi, (pos_non_smi) << zero);
+  assertEquals(neg_non_smi, (neg_non_smi) >> zero);
+  assertEquals(neg_non_smi + 0x100000000, (neg_non_smi) >>> zero);
+  assertEquals(neg_non_smi, (neg_non_smi) << zero);
+  assertEquals(pos_smi, (pos_smi) >> zero);
+  assertEquals(pos_smi, (pos_smi) >>> zero);
+  assertEquals(pos_smi, (pos_smi) << zero);
+  assertEquals(neg_smi, (neg_smi) >> zero, "negsmi >> zero");
+  assertEquals(neg_smi + 0x100000000, (neg_smi) >>> zero);
+  assertEquals(neg_smi, (neg_smi) << zero, "negsmi << zero");
+
+  assertEquals(pos_non_smi / 2, (pos_non_smi) >> one);
+  assertEquals(pos_non_smi / 2, (pos_non_smi) >>> one);
+  assertEquals(-0x1194D800, (pos_non_smi) << one);
+  assertEquals(pos_non_smi / 8, (pos_non_smi) >> three);
+  assertEquals(pos_non_smi / 8, (pos_non_smi) >>> three);
+  assertEquals(-0x46536000, (pos_non_smi) << three);
+  assertEquals(0x73594000, (pos_non_smi) << four);
+  assertEquals(pos_non_smi, (pos_non_smi + 0.5) >> zero);
+  assertEquals(pos_non_smi, (pos_non_smi + 0.5) >>> zero);
+  assertEquals(pos_non_smi, (pos_non_smi + 0.5) << zero);
+  assertEquals(pos_non_smi / 2, (pos_non_smi + 0.5) >> one);
+  assertEquals(pos_non_smi / 2, (pos_non_smi + 0.5) >>> one);
+  assertEquals(-0x1194D800, (pos_non_smi + 0.5) << one);
+  assertEquals(pos_non_smi / 8, (pos_non_smi + 0.5) >> three);
+  assertEquals(pos_non_smi / 8, (pos_non_smi + 0.5) >>> three);
+  assertEquals(-0x46536000, (pos_non_smi + 0.5) << three);
+  assertEquals(0x73594000, (pos_non_smi + 0.5) << four);
+
+  assertEquals(neg_non_smi / 2, (neg_non_smi) >> one);
+  assertEquals(neg_non_smi / 2 + 0x100000000 / 2, (neg_non_smi) >>> one);
+  assertEquals(0x1194D800, (neg_non_smi) << one);
+  assertEquals(neg_non_smi / 8, (neg_non_smi) >> three);
+  assertEquals(neg_non_smi / 8 + 0x100000000 / 8, (neg_non_smi) >>> three);
+  assertEquals(0x46536000, (neg_non_smi) << three);
+  assertEquals(-0x73594000, (neg_non_smi) << four);
+  assertEquals(neg_non_smi, (neg_non_smi - 0.5) >> zero);
+  assertEquals(neg_non_smi + 0x100000000, (neg_non_smi - 0.5) >>> zero);
+  assertEquals(neg_non_smi, (neg_non_smi - 0.5) << zero);
+  assertEquals(neg_non_smi / 2, (neg_non_smi - 0.5) >> one);
+  assertEquals(neg_non_smi / 2 + 0x100000000 / 2, (neg_non_smi - 0.5) >>> one);
+  assertEquals(0x1194D800, (neg_non_smi - 0.5) << one);
+  assertEquals(neg_non_smi / 8, (neg_non_smi - 0.5) >> three);
+  assertEquals(neg_non_smi / 8 + 0x100000000 / 8, (neg_non_smi - 0.5)
+      >>> three);
+  assertEquals(0x46536000, (neg_non_smi - 0.5) << three);
+  assertEquals(-0x73594000, (neg_non_smi - 0.5) << four);
+
+  assertEquals(pos_smi / 2, (pos_smi) >> one);
+  assertEquals(pos_smi / 2, (pos_smi) >>> one);
+  assertEquals(pos_non_smi, (pos_smi) << one);
+  assertEquals(pos_smi / 8, (pos_smi) >> three);
+  assertEquals(pos_smi / 8, (pos_smi) >>> three);
+  assertEquals(-0x2329b000, (pos_smi) << three);
+  assertEquals(0x73594000, (pos_smi) << five);
+  assertEquals(pos_smi, (pos_smi + 0.5) >> zero);
+  assertEquals(pos_smi, (pos_smi + 0.5) >>> zero);
+  assertEquals(pos_smi, (pos_smi + 0.5) << zero);
+  assertEquals(pos_smi / 2, (pos_smi + 0.5) >> one);
+  assertEquals(pos_smi / 2, (pos_smi + 0.5) >>> one);
+  assertEquals(pos_non_smi, (pos_smi + 0.5) << one);
+  assertEquals(pos_smi / 8, (pos_smi + 0.5) >> three);
+  assertEquals(pos_smi / 8, (pos_smi + 0.5) >>> three);
+  assertEquals(-0x2329b000, (pos_smi + 0.5) << three);
+  assertEquals(0x73594000, (pos_smi + 0.5) << five);
+
+  assertEquals(neg_smi / 2, (neg_smi) >> one);
+  assertEquals(neg_smi / 2 + 0x100000000 / 2, (neg_smi) >>> one);
+  assertEquals(neg_non_smi, (neg_smi) << one);
+  assertEquals(neg_smi / 8, (neg_smi) >> three);
+  assertEquals(neg_smi / 8 + 0x100000000 / 8, (neg_smi) >>> three);
+  assertEquals(0x46536000, (neg_smi) << four);
+  assertEquals(-0x73594000, (neg_smi) << five);
+  assertEquals(neg_smi, (neg_smi - 0.5) >> zero);
+  assertEquals(neg_smi + 0x100000000, (neg_smi - 0.5) >>> zero);
+  assertEquals(neg_smi, (neg_smi - 0.5) << zero);
+  assertEquals(neg_smi / 2, (neg_smi - 0.5) >> one);
+  assertEquals(neg_smi / 2 + 0x100000000 / 2, (neg_smi - 0.5) >>> one);
+  assertEquals(neg_non_smi, (neg_smi - 0.5) << one);
+  assertEquals(neg_smi / 8, (neg_smi - 0.5) >> three);
+  assertEquals(neg_smi / 8 + 0x100000000 / 8, (neg_smi - 0.5) >>> three);
+  assertEquals(0x46536000, (neg_smi - 0.5) << four);
+  assertEquals(-0x73594000, (neg_smi - 0.5) << five);
+  // End block A repeat 2
+
+  // Repeat previous block, with computed values in the shift variables.
+  five = 0;
+  while (five < 5 ) ++five;
+  four = five - one;
+  three = four - one;
+  one = four - three;
+  zero = one - one;
+
+  // Begin block A repeat 3
+  assertEquals(pos_non_smi, (pos_non_smi) >> zero);
+  assertEquals(pos_non_smi, (pos_non_smi) >>> zero);
+  assertEquals(pos_non_smi, (pos_non_smi) << zero);
+  assertEquals(neg_non_smi, (neg_non_smi) >> zero);
+  assertEquals(neg_non_smi + 0x100000000, (neg_non_smi) >>> zero);
+  assertEquals(neg_non_smi, (neg_non_smi) << zero);
+  assertEquals(pos_smi, (pos_smi) >> zero);
+  assertEquals(pos_smi, (pos_smi) >>> zero);
+  assertEquals(pos_smi, (pos_smi) << zero);
+  assertEquals(neg_smi, (neg_smi) >> zero, "negsmi >> zero(2)");
+  assertEquals(neg_smi + 0x100000000, (neg_smi) >>> zero);
+  assertEquals(neg_smi, (neg_smi) << zero, "negsmi << zero(2)");
+
+  assertEquals(pos_non_smi / 2, (pos_non_smi) >> one);
+  assertEquals(pos_non_smi / 2, (pos_non_smi) >>> one);
+  assertEquals(-0x1194D800, (pos_non_smi) << one);
+  assertEquals(pos_non_smi / 8, (pos_non_smi) >> three);
+  assertEquals(pos_non_smi / 8, (pos_non_smi) >>> three);
+  assertEquals(-0x46536000, (pos_non_smi) << three);
+  assertEquals(0x73594000, (pos_non_smi) << four);
+  assertEquals(pos_non_smi, (pos_non_smi + 0.5) >> zero);
+  assertEquals(pos_non_smi, (pos_non_smi + 0.5) >>> zero);
+  assertEquals(pos_non_smi, (pos_non_smi + 0.5) << zero);
+  assertEquals(pos_non_smi / 2, (pos_non_smi + 0.5) >> one);
+  assertEquals(pos_non_smi / 2, (pos_non_smi + 0.5) >>> one);
+  assertEquals(-0x1194D800, (pos_non_smi + 0.5) << one);
+  assertEquals(pos_non_smi / 8, (pos_non_smi + 0.5) >> three);
+  assertEquals(pos_non_smi / 8, (pos_non_smi + 0.5) >>> three);
+  assertEquals(-0x46536000, (pos_non_smi + 0.5) << three);
+  assertEquals(0x73594000, (pos_non_smi + 0.5) << four);
+
+  assertEquals(neg_non_smi / 2, (neg_non_smi) >> one);
+  assertEquals(neg_non_smi / 2 + 0x100000000 / 2, (neg_non_smi) >>> one);
+  assertEquals(0x1194D800, (neg_non_smi) << one);
+  assertEquals(neg_non_smi / 8, (neg_non_smi) >> three);
+  assertEquals(neg_non_smi / 8 + 0x100000000 / 8, (neg_non_smi) >>> three);
+  assertEquals(0x46536000, (neg_non_smi) << three);
+  assertEquals(-0x73594000, (neg_non_smi) << four);
+  assertEquals(neg_non_smi, (neg_non_smi - 0.5) >> zero);
+  assertEquals(neg_non_smi + 0x100000000, (neg_non_smi - 0.5) >>> zero);
+  assertEquals(neg_non_smi, (neg_non_smi - 0.5) << zero);
+  assertEquals(neg_non_smi / 2, (neg_non_smi - 0.5) >> one);
+  assertEquals(neg_non_smi / 2 + 0x100000000 / 2, (neg_non_smi - 0.5) >>> one);
+  assertEquals(0x1194D800, (neg_non_smi - 0.5) << one);
+  assertEquals(neg_non_smi / 8, (neg_non_smi - 0.5) >> three);
+  assertEquals(neg_non_smi / 8 + 0x100000000 / 8, (neg_non_smi - 0.5)
+      >>> three);
+  assertEquals(0x46536000, (neg_non_smi - 0.5) << three);
+  assertEquals(-0x73594000, (neg_non_smi - 0.5) << four);
+
+  assertEquals(pos_smi / 2, (pos_smi) >> one);
+  assertEquals(pos_smi / 2, (pos_smi) >>> one);
+  assertEquals(pos_non_smi, (pos_smi) << one);
+  assertEquals(pos_smi / 8, (pos_smi) >> three);
+  assertEquals(pos_smi / 8, (pos_smi) >>> three);
+  assertEquals(-0x2329b000, (pos_smi) << three);
+  assertEquals(0x73594000, (pos_smi) << five);
+  assertEquals(pos_smi, (pos_smi + 0.5) >> zero);
+  assertEquals(pos_smi, (pos_smi + 0.5) >>> zero);
+  assertEquals(pos_smi, (pos_smi + 0.5) << zero);
+  assertEquals(pos_smi / 2, (pos_smi + 0.5) >> one);
+  assertEquals(pos_smi / 2, (pos_smi + 0.5) >>> one);
+  assertEquals(pos_non_smi, (pos_smi + 0.5) << one);
+  assertEquals(pos_smi / 8, (pos_smi + 0.5) >> three);
+  assertEquals(pos_smi / 8, (pos_smi + 0.5) >>> three);
+  assertEquals(-0x2329b000, (pos_smi + 0.5) << three);
+  assertEquals(0x73594000, (pos_smi + 0.5) << five);
+
+  assertEquals(neg_smi / 2, (neg_smi) >> one);
+  assertEquals(neg_smi / 2 + 0x100000000 / 2, (neg_smi) >>> one);
+  assertEquals(neg_non_smi, (neg_smi) << one);
+  assertEquals(neg_smi / 8, (neg_smi) >> three);
+  assertEquals(neg_smi / 8 + 0x100000000 / 8, (neg_smi) >>> three);
+  assertEquals(0x46536000, (neg_smi) << four);
+  assertEquals(-0x73594000, (neg_smi) << five);
+  assertEquals(neg_smi, (neg_smi - 0.5) >> zero, "negsmi.5 >> zero");
+  assertEquals(neg_smi + 0x100000000, (neg_smi - 0.5) >>> zero);
+  assertEquals(neg_smi, (neg_smi - 0.5) << zero, "negsmi.5 << zero");
+  assertEquals(neg_smi / 2, (neg_smi - 0.5) >> one);
+  assertEquals(neg_smi / 2 + 0x100000000 / 2, (neg_smi - 0.5) >>> one);
+  assertEquals(neg_non_smi, (neg_smi - 0.5) << one);
+  assertEquals(neg_smi / 8, (neg_smi - 0.5) >> three);
+  assertEquals(neg_smi / 8 + 0x100000000 / 8, (neg_smi - 0.5) >>> three);
+  assertEquals(0x46536000, (neg_smi - 0.5) << four);
+  assertEquals(-0x73594000, (neg_smi - 0.5) << five);
+  // End block A repeat 3
+
+  // Test non-integer shift value
+  assertEquals(5, 20.5 >> 2.4);
+  assertEquals(5, 20.5 >> 2.7);
+  var shift = 2.4;
+  assertEquals(5, 20.5 >> shift);
+  assertEquals(5, 20.5 >> shift + 0.3);
+  shift = shift + zero;
+  assertEquals(5, 20.5 >> shift);
+  assertEquals(5, 20.5 >> shift + 0.3);
+}
+
+testShiftNonSmis();
+
+function intConversion() {
+  function foo(x) {
+    assertEquals(x, (x * 1.0000000001) | 0, "foo more " + x);
+    assertEquals(x, x | 0, "foo " + x);
+    if (x > 0) {
+      assertEquals(x - 1, (x * 0.9999999999) | 0, "foo less " + x);
+    } else {
+      assertEquals(x + 1, (x * 0.9999999999) | 0, "foo less " + x);
+    }
+  }
+  for (var i = 1; i < 0x80000000; i *= 2) {
+    foo(i);
+    foo(-i);
+  }
+  for (var i = 1; i < 1/0; i *= 2) {
+    assertEquals(i | 0, (i * 1.0000000000000001) | 0, "b" + i);
+    assertEquals(-i | 0, (i * -1.0000000000000001) | 0, "c" + i);
+  }
+  for (var i = 0.5; i > 0; i /= 2) {
+    assertEquals(0, i | 0, "d" + i);
+    assertEquals(0, -i | 0, "e" + i);
+  }
+}
+
+intConversion();
+
+// Verify that we handle the (optimized) corner case of shifting by
+// zero even for non-smis.
+function shiftByZero(n) { return n << 0; }
+
+assertEquals(3, shiftByZero(3.1415));
diff --git a/deps/v8/test/mjsunit/smi-ops.js b/deps/v8/test/mjsunit/smi-ops.js
index 8fa6fec60..7945855f3 100644
--- a/deps/v8/test/mjsunit/smi-ops.js
+++ b/deps/v8/test/mjsunit/smi-ops.js
@@ -699,3 +699,6 @@ assertEquals(24, LeftShiftThreeBy(-29));
 // allocations we got the Smi overflow case wrong.
 function f(x, y) { return y +  ( 1 << (x & 31)); }
 assertEquals(-2147483647, f(31, 1));
+
+// Regression test for correct handling of overflow in smi comparison.
+assertTrue(-0x40000000 < 42);
diff --git a/deps/v8/test/mjsunit/string-replace-gc.js b/deps/v8/test/mjsunit/string-replace-gc.js
index 26fba103b..73b310f9c 100644
--- a/deps/v8/test/mjsunit/string-replace-gc.js
+++ b/deps/v8/test/mjsunit/string-replace-gc.js
@@ -25,7 +25,6 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --always-compact
 //
 // Regression test for the r1512 fix.
 
diff --git a/deps/v8/test/mjsunit/sum-0-plus-undefined-is-NaN.js b/deps/v8/test/mjsunit/sum-0-plus-undefined-is-NaN.js
new file mode 100644
index 000000000..fb98d0cfe
--- /dev/null
+++ b/deps/v8/test/mjsunit/sum-0-plus-undefined-is-NaN.js
@@ -0,0 +1,41 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+/**
+ * @fileoverview Test addition of 0 and undefined.
+ */
+
+function sum(a, b) { return a + b; }
+
+function test(x, y, expectNaN) {
+  for (var i = 0; i < 1000; i++) {
+    assertEquals(expectNaN, isNaN(sum(x, y)));
+  }
+}
+
+test(0, 1, false);
+test(0, undefined, true);
diff --git a/deps/v8/test/mjsunit/third_party/regexp-pcre.js b/deps/v8/test/mjsunit/third_party/regexp-pcre.js
index dcb1b320f..d9fa97685 100644
--- a/deps/v8/test/mjsunit/third_party/regexp-pcre.js
+++ b/deps/v8/test/mjsunit/third_party/regexp-pcre.js
@@ -962,7 +962,7 @@ res[882] = /[az-]+/;
 res[883] = /[a\-z]+/;
 res[884] = /[a-z]+/;
 res[885] = /[\d-]+/;
-res[886] = /[\d-z]+/;
+// res[886] - Disabled after making [\d-z] invalid to be compatible with JSC.
 res[887] = /\x5c/;
 res[888] = /\x20Z/;
 res[889] = /ab{3cd/;
@@ -1346,7 +1346,7 @@ res[1266] = /((Z)+|A)*/;
 res[1267] = /(Z()|A)*/;
 res[1268] = /(Z(())|A)*/;
 res[1269] = /a*/g;
-res[1270] = /^[\d-a]/;
+// res[1270] disabled after making /^[\d-a]/ invalid to be compatible with JSC.
 res[1271] = /[[:space:]]+/;
 res[1272] = /[[:blank:]]+/;
 res[1273] = /[\s]+/;
@@ -2530,7 +2530,7 @@ assertEquals(null, res[431].exec("a\x0db ", 882));
 assertEquals(null, res[431].exec("a\x85b", 883));
 assertThrows("var re = /(?-+a)/;", 884);
 assertEquals(null, res[443].exec("aaaa", 885));
-assertEquals(null, res[443].exec("bacxxx", 886));
+// assertEquals(null, res[443].exec("bacxxx", 886));
 assertEquals(null, res[443].exec("bbaccxxx ", 887));
 assertEquals(null, res[443].exec("bbbacccxx", 888));
 assertEquals(null, res[443].exec("aaaa", 889));
@@ -4391,9 +4391,10 @@ assertEquals("abcdxyz", res[884].exec("abcdxyz"), 2743);
 assertEquals("12-34", res[885].exec("12-34"), 2744);
 assertEquals(null, res[885].exec("*** Failers", 2745));
 assertEquals(null, res[885].exec("aaa", 2746));
-assertEquals("12-34z", res[886].exec("12-34z"), 2747);
-assertEquals(null, res[886].exec("*** Failers", 2748));
-assertEquals(null, res[886].exec("aaa", 2749));
+// Disabled. To be compatible with JSC, the regexp is no longer valid.
+// assertEquals("12-34z", res[886].exec("12-34z"), 2747);
+// assertEquals(null, res[886].exec("*** Failers", 2748));
+// assertEquals(null, res[886].exec("aaa", 2749));
 assertEquals("\\", res[887].exec("\\\\"), 2750);
 assertEquals(" Z", res[888].exec("the Zoo"), 2751);
 assertEquals(null, res[888].exec("*** Failers", 2752));
@@ -5355,11 +5356,12 @@ assertEquals("", res[1269].exec("-things"), 3707);
 assertEquals("", res[1269].exec("0digit"), 3708);
 assertEquals("", res[1269].exec("*** Failers"), 3709);
 assertEquals("", res[1269].exec("bcdef    "), 3710);
-assertEquals("a", res[1270].exec("abcde"), 3711);
-assertEquals("-", res[1270].exec("-things"), 3712);
-assertEquals("0", res[1270].exec("0digit"), 3713);
-assertEquals(null, res[1270].exec("*** Failers", 3714));
-assertEquals(null, res[1270].exec("bcdef    ", 3715));
+// Disabled. To be compatible with JSC, the RegExp is no longer valid.
+// assertEquals("a", res[1270].exec("abcde"), 3711);
+// assertEquals("-", res[1270].exec("-things"), 3712);
+// assertEquals("0", res[1270].exec("0digit"), 3713);
+// assertEquals(null, res[1270].exec("*** Failers", 3714));
+// assertEquals(null, res[1270].exec("bcdef    ", 3715));
 assertEquals(null, res[1271].exec("> \x09\n\x0c\x0d\x0b<", 3716));
 assertEquals(null, res[1271].exec(" ", 3717));
 assertEquals(null, res[1272].exec("> \x09\n\x0c\x0d\x0b<", 3718));
diff --git a/deps/v8/test/mjsunit/typeof.js b/deps/v8/test/mjsunit/typeof.js
index 15ab7bf34..39dec7296 100644
--- a/deps/v8/test/mjsunit/typeof.js
+++ b/deps/v8/test/mjsunit/typeof.js
@@ -25,8 +25,6 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --nofull-compiler
-
 // The type of a regular expression should be 'function', including in
 // the context of string equality comparisons.
 
diff --git a/deps/v8/test/mozilla/mozilla.status b/deps/v8/test/mozilla/mozilla.status
index 1768c3975..b1e9ba7d4 100644
--- a/deps/v8/test/mozilla/mozilla.status
+++ b/deps/v8/test/mozilla/mozilla.status
@@ -45,6 +45,7 @@
 prefix mozilla
 def FAIL_OK = FAIL, OKAY
 
+
 ##################### SKIPPED TESTS #####################
 
 # This test checks that we behave properly in an out-of-memory
@@ -288,6 +289,10 @@ js1_2/regexp/RegExp_multiline_as_array: FAIL_OK
 js1_2/regexp/beginLine: FAIL_OK
 js1_2/regexp/endLine: FAIL_OK
 
+# To be compatible with JSC, we no longer accept [\d-x], [x-\d] or 
+# [\d-\d] as valid ranges.
+ecma_3/RegExp/regress-375715-02: FAIL
+js1_5/extensions/regress-351463-01: FAIL
 
 # To be compatible with safari typeof a regexp yields 'function';
 # in firefox it yields 'object'.
@@ -809,6 +814,29 @@ js1_5/Regress/regress-312588: TIMEOUT || SKIP if $FAST == yes
 js1_5/Regress/regress-271716-n: PASS || SKIP if $FAST == yes
 
 
+[ $ARCH == arm ]
+
+# Times out and print so much output that we need to skip it to not
+# hang the builder.
+js1_5/extensions/regress-342960: SKIP
+
+# BUG(3251229): Times out when running new crankshaft test script.
+ecma/Date/15.9.5.12-2: SKIP
+ecma/Date/15.9.5.11-2: SKIP
+ecma/Date/15.9.5.10-2: SKIP
+ecma/Date/15.9.5.8: SKIP
+ecma_3/RegExp/regress-311414: SKIP
+js1_5/Array/regress-99120-02: SKIP
+js1_5/Regress/regress-203278-1: SKIP
+ecma/Date/15.9.5.8: SKIP
+ecma/Date/15.9.5.10-2: SKIP
+ecma/Date/15.9.5.11-2: SKIP
+ecma/Date/15.9.5.12-2: SKIP
+js1_5/Regress/regress-404755:  SKIP
+js1_5/Regress/regress-451322: SKIP
+js1_5/extensions/regress-371636: SKIP
+
+
 [ $FAST == yes && $ARCH == arm ]
 
 # In fast mode on arm we try to skip all tests that would time out,
diff --git a/deps/v8/test/sputnik/sputnik.status b/deps/v8/test/sputnik/sputnik.status
index bc8c1e399..966500d06 100644
--- a/deps/v8/test/sputnik/sputnik.status
+++ b/deps/v8/test/sputnik/sputnik.status
@@ -193,7 +193,6 @@ S9.9_A1: FAIL_OK
 S9.9_A2: FAIL_OK
 
 
-
 ##################### SKIPPED TESTS #####################
 
 # These tests take a looong time to run in debug mode.
@@ -254,6 +253,20 @@ S11.4.3_A3.6: FAIL_OK
 S15.10.7_A3_T2: FAIL_OK
 S15.10.7_A3_T1: FAIL_OK
 
+[ $arch == arm ]
+
+# BUG(3251225): Tests that timeout with --nocrankshaft.
+S15.1.3.1_A2.5_T1: SKIP
+S15.1.3.2_A2.5_T1: SKIP
+S15.1.3.1_A2.4_T1: SKIP
+S15.1.3.1_A2.5_T1: SKIP
+S15.1.3.2_A2.4_T1: SKIP
+S15.1.3.2_A2.5_T1: SKIP
+S15.1.3.3_A2.3_T1: SKIP
+S15.1.3.4_A2.3_T1: SKIP
+S15.1.3.1_A2.5_T1: SKIP
+S15.1.3.2_A2.5_T1: SKIP
+
 [ $arch == mips ]
 
 # Skip all tests on MIPS.