Merged r20033, r20138 into 3.24 branch.

test/mjsunit/regress/regress-352982.js

Index: test/mjsunit/regress/regress-352982.js
diff --git a/test/mjsunit/regress/regress-331444.js b/test/mjsunit/regress/regress-352982.js
similarity index 79%
copy from test/mjsunit/regress/regress-331444.js
copy to test/mjsunit/regress/regress-352982.js
index c78d6fb71b7c455abfcd1450d80b5c8a6dcb6e38..5d3ce1c67d2a42117de54b8a85ae981686698df7 100644
--- a/test/mjsunit/regress/regress-331444.js
+++ b/test/mjsunit/regress/regress-352982.js
@@ -25,20 +25,27 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --expose-gc
+// Flags: --allow-natives-syntax --expose-gc
 
-function boom() {
-  var args = [];
-  for (var i = 0; i < 125000; i++)
-    args.push(i);
-  return Array.apply(Array, args);
+function __f_4(i1) {
+  return __v_3[i1] * __v_3[0];
 }
-var array = boom();
-function fib(n) {
-  var f0 = 0, f1 = 1;
-  for (; n > 0; n = n - 1) {
-    f0 + f1;
-    f0 = array;
-  }
+function __f_3(i1) {
+  __f_4(i1);
+  __f_4(i1 + 16);
+  __f_4(i1 + 32);
+  %OptimizeFunctionOnNextCall(__f_4);
+  var x = __f_4(i1 + 993);
+  return x;
 }
-fib(12);
+function __f_5() {
+  __v_3[0] = +__v_3[0];
+  gc();
+  __f_3(0) | 0;
+  __v_3 = /\u23a1|x/;
+  return 0;
+}
+var __v_3 = new Float32Array(1000);
+__f_5();
+__f_5();
+__f_5();