Merge bleeding edge up to 9192 into the GC branch.

test/mjsunit/regress/regress-95485.js

Index: test/mjsunit/regress/regress-95485.js
diff --git a/test/mjsunit/regress/regress-1110.js b/test/mjsunit/regress/regress-95485.js
similarity index 84%
copy from test/mjsunit/regress/regress-1110.js
copy to test/mjsunit/regress/regress-95485.js
index 204a87ba3d16743a945fb2fb5817538fd43e7315..2510072e0b3825d08ce9e1a3cf3885f07d83daf3 100644
--- a/test/mjsunit/regress/regress-1110.js
+++ b/test/mjsunit/regress/regress-95485.js
@@ -25,14 +25,18 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Test that the illegal continue is thrown at parse time.
-
-try {
-  function Crash() { continue;if (Crash) {
-    } } 
-  Crash();
-  assertTrue(false);
-} catch (e) {
-  assertTrue(e instanceof SyntaxError);
-  assertTrue(/continue/.test(e.message));
+function Test() {
+  var left  = 'XXX';
+  var right = 'YYY';
+  for (var i = 0; i < 3; i++) {
+    var cons = left + right;
+    var substring = cons.substring(2, 4);
+    try {
+      with ({Test: i})
+          continue;
+    } finally { }
+  }
+  return substring;
 }
+
+assertEquals('XY', Test());