Merge bleeding edge up to 9192 into the GC branch.

test/mjsunit/regress/regress-1647.js

Index: test/mjsunit/regress/regress-1647.js
diff --git a/test/mjsunit/regress/regress-1447.js b/test/mjsunit/regress/regress-1647.js
similarity index 84%
copy from test/mjsunit/regress/regress-1447.js
copy to test/mjsunit/regress/regress-1647.js
index 3c64929d1d113efec61792f040d15ceaab6aa4e8..a6afcc0be2872d8d29a9e0aef69c36c9fc5b07e9 100644
--- a/test/mjsunit/regress/regress-1447.js
+++ b/test/mjsunit/regress/regress-1647.js
@@ -25,5 +25,19 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-[0].forEach(function(){ Object.freeze(Array.prototype.forEach); });
-[0].every(function(){ Object.seal(Array.prototype.every); });
+// Flags: --allow-natives-syntax
+
+// Test for correct deoptimization in named function expressions.
+
+var t = { foo: function() {} };
+
+var f = (function bar() {
+ t.foo();
+ assertEquals("function", typeof bar);
+});
+
+for (var i = 0; i < 10; i++) f();
+%OptimizeFunctionOnNextCall(f);
+t.number = 2;
+f();
+