Merge changes up to V8 version 2.1.3 into the partial snapshots

test/mjsunit/undeletable-functions.js

Index: test/mjsunit/undeletable-functions.js
===================================================================
--- test/mjsunit/undeletable-functions.js	(revision 3964)
+++ test/mjsunit/undeletable-functions.js	(working copy)
@@ -39,6 +39,13 @@
   "every", "map", "indexOf", "lastIndexOf", "reduce", "reduceRight"];
 CheckJSCSemantics(Array.prototype, array, "Array prototype");
 
+var old_Array_prototype = Array.prototype;
+var new_Array_prototype = {};
+for (var i = 0; i < 7; i++) {
+  Array.prototype = new_Array_prototype;
+  assertEquals(old_Array_prototype, Array.prototype);
+}
+
 array = [
   "toString", "toDateString", "toTimeString", "toLocaleString",
   "toLocaleDateString", "toLocaleTimeString", "valueOf", "getTime",
@@ -79,6 +86,13 @@
   "__lookupGetter__", "__defineSetter__", "__lookupSetter__"];
 CheckEcmaSemantics(Object.prototype, array, "Object prototype");
 
+var old_Object_prototype = Object.prototype;
+var new_Object_prototype = {};
+for (var i = 0; i < 7; i++) {
+  Object.prototype = new_Object_prototype;
+  assertEquals(old_Object_prototype, Object.prototype);
+}
+
 array = [
   "toString", "valueOf", "toJSON"];
 CheckEcmaSemantics(Boolean.prototype, array, "Boolean prototype");