Synchronize with r15594.

test/intl/overrides/security.js

Index: test/intl/overrides/security.js
diff --git a/test/mjsunit/array-non-smi-length.js b/test/intl/overrides/security.js
similarity index 65%
copy from test/mjsunit/array-non-smi-length.js
copy to test/intl/overrides/security.js
index 23a25ee797bd68690ad2a7ce26a9135e23b486e2..e012753fa231e034bb7cb42b56de019e07a690fe 100644
--- a/test/mjsunit/array-non-smi-length.js
+++ b/test/intl/overrides/security.js
@@ -25,22 +25,26 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --allow-natives-syntax
+// Test that we always use original Intl.Constructors for toLocaleString calls.
 
-function TestNonSmiArrayLength() {
-  function f(a) {
-    return a.length+1;
-  }
+function throwError() {
+  throw new Error('Malicious method invoked.');
+}
 
-  var a = [];
-  a.length = 0xFFFF;
-  assertSame(0x10000, f(a));
-  assertSame(0x10000, f(a));
+Intl.Collator = Intl.NumberFormat = Intl.DateTimeFormat = throwError;
 
-  %OptimizeFunctionOnNextCall(f);
-  a.length = 0xFFFFFFFF;
-  assertSame(0x100000000, f(a));
-}
+Intl.Collator.prototype.compare = throwError;
+Intl.NumberFormat.prototype.format = throwError;
+Intl.DateTimeFormat.prototype.format = throwError;
 
-TestNonSmiArrayLength();
+// Make sure constructors actually throw now.
+assertThrows('new Intl.Collator()');
+assertThrows('new Intl.NumberFormat()');
+assertThrows('new Intl.DateTimeFormat()');
 
+// None of these should throw.
+assertDoesNotThrow('new Date().toLocaleString()');
+assertDoesNotThrow('new Date().toLocaleDateString()');
+assertDoesNotThrow('new Date().toLocaleTimeString()');
+assertDoesNotThrow('new Number(12345.412).toLocaleString()');
+assertDoesNotThrow('new String(\'abc\').localeCompare(\'bcd\')');