Merged r16205, r16220, r16237, r16249, r16262, r16269, r16273 into 3.20 branch.

test/mjsunit/regress/regress-crbug-274438.js

Index: test/mjsunit/regress/regress-crbug-274438.js
diff --git a/test/mjsunit/regress/regress-2489.js b/test/mjsunit/regress/regress-crbug-274438.js
similarity index 89%
copy from test/mjsunit/regress/regress-2489.js
copy to test/mjsunit/regress/regress-crbug-274438.js
index 882c4f794a88e24d1d64e86a466b27c39f51e625..5d6817d129173955045334e4f5e872972ad84de6 100644
--- a/test/mjsunit/regress/regress-2489.js
+++ b/test/mjsunit/regress/regress-crbug-274438.js
@@ -27,24 +27,17 @@
 
 // Flags: --allow-natives-syntax
 
-"use strict";
-
 function f(a, b) {
-  return g("c", "d");
-}
-
-function g(a, b) {
-  g.constructor.apply(this, arguments);
-}
-
-g.constructor = function(a, b) {
-  assertEquals("c", a);
-  assertEquals("d", b);
+  var x = { a:a };
+  switch(b) { case "string": }
+  var y = { b:b };
+  return y;
 }
 
 f("a", "b");
 f("a", "b");
 %OptimizeFunctionOnNextCall(f);
 f("a", "b");
-g.x = "deopt";
-f("a", "b");
+%SetAllocationTimeout(100, 0);
+var killer = f("bang", "bo" + "om");
+assertEquals("boom", killer.b);