Fix for issue 91 (http://code.google.com/p/v8/issues/detail?id=91)

src/date-delay.js

 // Copyright 2006-2008 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 939 matching lines @@
 
 
 // ECMA 262 - B.2.5
 function DateSetYear(year) {
   var t = LocalTime(GetTimeFrom(this));
   if ($isNaN(t)) t = 0;
   year = ToNumber(year);
   if ($isNaN(year)) return %_SetValueOf(this, $NaN);
   year = (0 <= TO_INTEGER(year) && TO_INTEGER(year) <= 99)
       ? 1900 + TO_INTEGER(year) : year;
-  var day = MakeDay(year, GetMonthFrom(this), GetDateFrom(this));
+  var day = MakeDay(year, MonthFromTime(t), DateFromTime(t));
   return %_SetValueOf(this, TimeClip(UTC(MakeDate(day, TimeWithinDay(t)))));
 }
 
 
 // ECMA 262 - B.2.6
 //
 // Notice that this does not follow ECMA 262 completely.  ECMA 262
 // says that toGMTString should be the same Function object as
 // toUTCString.  JSC does not do this, so for compatibility we do not
 // do that either.  Instead, we create a new function whose name
@@ skipping 60 matching lines @@
     "setFullYear", DateSetFullYear,
     "setUTCFullYear", DateSetUTCFullYear,
     "toGMTString", DateToGMTString,
     "toUTCString", DateToUTCString,
     "getYear", DateGetYear,
     "setYear", DateSetYear
   ));
 }
 
 SetupDate();