Merged r19848 into 3.24 branch.

test/mjsunit/regress/regress-sort-arguments.js

Index: test/mjsunit/regress/regress-sort-arguments.js
diff --git a/test/mjsunit/regress/regress-crbug-351262.js b/test/mjsunit/regress/regress-sort-arguments.js
similarity index 53%
copy from test/mjsunit/regress/regress-crbug-351262.js
copy to test/mjsunit/regress/regress-sort-arguments.js
index a2f4eadc0de5c2bd7d27f6e78ff9940fce7b0f85..54ebeb111bbc9ad7411f1c970660ab7c136244c1 100644
--- a/test/mjsunit/regress/regress-crbug-351262.js
+++ b/test/mjsunit/regress/regress-sort-arguments.js
@@ -2,5 +2,9 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-for (var x in this) {};
-JSON.stringify(this);
+function f(a) { return arguments; }
+var a = f(1,2,3);
+delete a[1];
+Array.prototype.sort.apply(a);
+a[10000000] = 4;
+Array.prototype.sort.apply(a);