Merged r12816, r12826, r12830 into 3.14 branch.

test/mjsunit/regress/regress-crbug-157520.js

Index: test/mjsunit/regress/regress-crbug-157520.js
diff --git a/test/mjsunit/regress/regress-148378.js b/test/mjsunit/regress/regress-crbug-157520.js
similarity index 90%
copy from test/mjsunit/regress/regress-148378.js
copy to test/mjsunit/regress/regress-crbug-157520.js
index d37cea1cf75b02888ec59231c65b5b6ac436d45c..17081dfa52eb34c0be6661e63706833cdd133d5d 100644
--- a/test/mjsunit/regress/regress-148378.js
+++ b/test/mjsunit/regress/regress-crbug-157520.js
@@ -25,14 +25,14 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-"a".replace(/a/g, function() { return "c"; });
+// Flags: --nocrankshaft
 
-function test() {
-  try {
-    test();
-  } catch(e) {
-    "b".replace(/(b)/g, function() { return "c"; });
+(function(){
+  var f = function(arg) {
+    arg = 2;
+    return arguments[0];
+  };
+  for (var i = 0; i < 50000; i++) {
+    assertSame(2, f(1));
   }
-}
-
-test();
+})();