Merge r7516, r7541 into 3.1 branch.

test/mjsunit/regress/regress-78270.js

 // Copyright 2011 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 17 matching lines @@
 for (var i = 0; i < 10000; i++) {
   try {
     var object = { };
     function g(f0) {
       var f0 = (object instanceof encodeURI)('foo');
     }
     g(75);
   } catch (g) {
   }
 }