Merge up to 8597 to experimental/gc from the bleeding edge.

test/mjsunit/fuzz-natives.js

Index: test/mjsunit/fuzz-natives.js
===================================================================
--- test/mjsunit/fuzz-natives.js	(revision 8618)
+++ test/mjsunit/fuzz-natives.js	(working copy)
@@ -1,4 +1,4 @@
-// Copyright 2008 the V8 project authors. All rights reserved.
+// Copyright 2011 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
@@ -141,9 +141,11 @@
   "EnableAccessChecks": true,
 
   // These functions should not be callable as runtime functions.
-  "NewContext": true,
+  "NewFunctionContext": true,
   "NewArgumentsFast": true,
-  "PushContext": true,
+  "NewStrictArgumentsFast": true,
+  "PushWithContext": true,
+  "PushCatchContext": true,
   "LazyCompile": true,
   "LazyRecompile": true,
   "NotifyDeoptimized": true,
@@ -165,7 +167,8 @@
 
   "_SwapElements": true,
 
-  // Performance critical function which cannot afford type checks.
+  // Performance critical functions which cannot afford type checks.
+  "_IsNativeOrStrictMode": true,
   "_CallFunction": true,
 
   // Tries to allocate based on argument, and (correctly) throws