Merge bleeding edge up to 9192 into the GC branch.

test/mjsunit/regress/regress-94425.js

Index: test/mjsunit/regress/regress-94425.js
diff --git a/test/mjsunit/this-property-assignment.js b/test/mjsunit/regress/regress-94425.js
similarity index 81%
copy from test/mjsunit/this-property-assignment.js
copy to test/mjsunit/regress/regress-94425.js
index c6819996c0898adfed62fbbcb1f54bdb94ad1bfb..4a48f4ad5ce972a3cfbe75c2f49bd6806cedb5b0 100644
--- a/test/mjsunit/this-property-assignment.js
+++ b/test/mjsunit/regress/regress-94425.js
@@ -25,17 +25,22 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Tests the handling of multiple assignments to the same property in a 
-// constructor that only has simple this property assignments.
+// Flags: --expose-gc
 
-function Node() {
-  this.a = 1;
-  this.a = 2;
-  this.a = 3;
-}
+var N = 2040 - 2 + 10;
+var arr = new Array(N);
 
-var n1 = new Node();
-assertEquals(3, n1.a);
+gc();
+gc();
+gc();
 
-var n2 = new Node();
-assertEquals(3, n2.a);
+// arr is in the large object space now.
+// Write new space object into it.
+arr[arr.length - 2] = new Object;
+
+// Shift array multiple times to ensure that young
+// object crosses region boundary.
+for (var i = 0; i < 9; i++) arr.shift();
+
+// Do a GC to verify region dirty marks.
+gc();