Merge bleeding edge up to 9192 into the GC branch.

test/mjsunit/regress/regress-1548.js

Index: test/mjsunit/regress/regress-1548.js
diff --git a/test/mjsunit/regress/regress-1110.js b/test/mjsunit/regress/regress-1548.js
similarity index 68%
copy from test/mjsunit/regress/regress-1110.js
copy to test/mjsunit/regress/regress-1548.js
index 204a87ba3d16743a945fb2fb5817538fd43e7315..074007b916cb27ac7de545daf7047683674b8c7f 100644
--- a/test/mjsunit/regress/regress-1110.js
+++ b/test/mjsunit/regress/regress-1548.js
@@ -25,14 +25,24 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Test that the illegal continue is thrown at parse time.
+// Test that the caller and arguments objects are not available on native
+// functions.
 
-try {
-  function Crash() { continue;if (Crash) {
-    } } 
-  Crash();
-  assertTrue(false);
-} catch (e) {
-  assertTrue(e instanceof SyntaxError);
-  assertTrue(/continue/.test(e.message));
-}
+function testfn(f) { return [1].map(f)[0]; }
+function foo() { return [].map.caller; }
+assertEquals(null, testfn(foo));
+
+// Try to delete the caller property (to make sure that we can't get to the
+// caller accessor on the prototype.
+delete Array.prototype.map.caller;
+assertEquals(null, testfn(foo));
+
+// Redo tests with arguments object.
+function testarguments(f) { return [1].map(f)[0]; }
+function bar() { return [].map.arguments; }
+assertEquals(null, testfn(bar));
+
+// Try to delete the arguments property (to make sure that we can't get to the
+// caller accessor on the prototype.
+delete Array.prototype.map.arguments;
+assertEquals(null, testarguments(bar));