Try to switch Array builtins into strict mode.

test/mjsunit/regress/regress-1548.js

Index: test/mjsunit/regress/regress-1548.js
diff --git a/test/mjsunit/regress/regress-1548.js b/test/mjsunit/regress/regress-1548.js
index 074007b916cb27ac7de545daf7047683674b8c7f..5330e131ec45d1415f5da306deab6bf2044e5786 100644
--- a/test/mjsunit/regress/regress-1548.js
+++ b/test/mjsunit/regress/regress-1548.js
@@ -30,19 +30,19 @@
 
 function testfn(f) { return [1].map(f)[0]; }
 function foo() { return [].map.caller; }
-assertEquals(null, testfn(foo));
+assertThrows(function() { testfn(foo); } );

[Michael Starzinger, 2014/04/10 13:40:57]

These four are the changes that scare me. They reflect the behavioral change (3)
mentioned in my description.

 
 // Try to delete the caller property (to make sure that we can't get to the
 // caller accessor on the prototype.
 delete Array.prototype.map.caller;
-assertEquals(null, testfn(foo));
+assertThrows(function() { testfn(foo); } );
 
 // Redo tests with arguments object.
 function testarguments(f) { return [1].map(f)[0]; }
 function bar() { return [].map.arguments; }
-assertEquals(null, testfn(bar));
+assertThrows(function() { testarguments(bar); } );
 
 // Try to delete the arguments property (to make sure that we can't get to the
 // caller accessor on the prototype.
 delete Array.prototype.map.arguments;
-assertEquals(null, testarguments(bar));
+assertThrows(function() { testarguments(bar); } );