Update V8 to r6238 as required by WebKit r75993

Change-Id: I12f638fcdd02d9102abab17d81c23cde63c08f22

13 files changed, 512 insertions, 22 deletions

diff --git a/test/cctest/cctest.status b/test/cctest/cctest.status
index 4dfe51aa..7c1197ae 100644
--- a/test/cctest/cctest.status
+++ b/test/cctest/cctest.status
@@ -1,4 +1,4 @@
-# Copyright 2008 the V8 project authors. All rights reserved.
+# Copyright 2011 the V8 project authors. All rights reserved.
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions are
 # met:
@@ -57,6 +57,24 @@ test-heap/TestInternalWeakListsTraverseWithGC: PASS || FAIL
 
 
 ##############################################################################
+[ $arch == x64 && $crankshaft ]
+
+# Tests that fail with crankshaft.
+test-deoptimization/DeoptimizeBinaryOperationADDString: FAIL
+test-deoptimization/DeoptimizeBinaryOperationADD: FAIL
+test-deoptimization/DeoptimizeBinaryOperationSUB: FAIL
+test-deoptimization/DeoptimizeBinaryOperationMUL: FAIL
+test-deoptimization/DeoptimizeBinaryOperationMOD: FAIL
+test-deoptimization/DeoptimizeBinaryOperationDIV: FAIL
+test-deoptimization/DeoptimizeLoadICStoreIC: FAIL
+test-deoptimization/DeoptimizeLoadICStoreICNested: FAIL
+test-deoptimization/DeoptimizeCompare: FAIL
+
+# Tests that time out with crankshaft.
+test-api/Threading: SKIP
+
+
+##############################################################################
 [ $arch == arm ]
 
 # Optimization is currently not working on crankshaft x64 and ARM.
@@ -80,8 +98,9 @@ test-sockets/Socket: SKIP
 ##############################################################################
 [ $arch == arm && $crankshaft ]
 
-# Tests that fail with crankshaft.
-test-deoptimization/DeoptimizeBinaryOperationMOD: FAIL
+# Tests that can fail with crankshaft.
+test-deoptimization/DeoptimizeBinaryOperationMOD: PASS || FAIL
+test-deoptimization/DeoptimizeBinaryOperationDIV: PASS || FAIL
 
 # Tests that time out with crankshaft.
 test-debug/ThreadedDebugging: SKIP
diff --git a/test/cctest/test-debug.cc b/test/cctest/test-debug.cc
index 87f9cab9..b9f60383 100644
--- a/test/cctest/test-debug.cc
+++ b/test/cctest/test-debug.cc
@@ -3712,7 +3712,7 @@ TEST(BreakOnException) {
   v8::V8::AddMessageListener(MessageCallbackCount);
   v8::Debug::SetDebugEventListener(DebugEventCounter);
 
-  // Initial state should be break on uncaught exception.
+  // Initial state should be no break on exceptions.
   DebugEventCounterClear();
   MessageCallbackCountClear();
   caught->Call(env->Global(), 0, NULL);
@@ -3720,8 +3720,8 @@ TEST(BreakOnException) {
   CHECK_EQ(0, uncaught_exception_hit_count);
   CHECK_EQ(0, message_callback_count);
   notCaught->Call(env->Global(), 0, NULL);
-  CHECK_EQ(1, exception_hit_count);
-  CHECK_EQ(1, uncaught_exception_hit_count);
+  CHECK_EQ(0, exception_hit_count);
+  CHECK_EQ(0, uncaught_exception_hit_count);
   CHECK_EQ(1, message_callback_count);
 
   // No break on exception
@@ -3841,6 +3841,9 @@ TEST(BreakOnCompileException) {
   v8::HandleScope scope;
   DebugLocalContext env;
 
+  // For this test, we want to break on uncaught exceptions:
+  ChangeBreakOnException(false, true);
+
   v8::internal::Top::TraceException(false);
 
   // Create a function for checking the function when hitting a break point.
@@ -3892,6 +3895,9 @@ TEST(StepWithException) {
   v8::HandleScope scope;
   DebugLocalContext env;
 
+  // For this test, we want to break on uncaught exceptions:
+  ChangeBreakOnException(false, true);
+
   // Create a function for checking the function when hitting a break point.
   frame_function_name = CompileFunction(&env,
                                         frame_function_name_source,
@@ -6523,6 +6529,10 @@ static void ExceptionMessageHandler(const v8::Debug::Message& message) {
 TEST(ExceptionMessageWhenMessageHandlerIsReset) {
   v8::HandleScope scope;
   DebugLocalContext env;
+
+  // For this test, we want to break on uncaught exceptions:
+  ChangeBreakOnException(false, true);
+
   exception_event_count = 0;
   const char* script = "function f() {throw new Error()};";
 
diff --git a/test/cctest/test-parsing.cc b/test/cctest/test-parsing.cc
index da5d771d..151cf50a 100755
--- a/test/cctest/test-parsing.cc
+++ b/test/cctest/test-parsing.cc
@@ -645,3 +645,58 @@ TEST(StreamScanner) {
      TestStreamScanner(&stream3, expectations3, 1, 1 + i);
   }
 }
+
+
+void TestScanRegExp(const char* re_source, const char* expected) {
+  i::Utf8ToUC16CharacterStream stream(
+       reinterpret_cast<const i::byte*>(re_source),
+       static_cast<unsigned>(strlen(re_source)));
+  i::V8JavaScriptScanner scanner;
+  scanner.Initialize(&stream);
+
+  i::Token::Value start = scanner.peek();
+  CHECK(start == i::Token::DIV || start == i::Token::ASSIGN_DIV);
+  CHECK(scanner.ScanRegExpPattern(start == i::Token::ASSIGN_DIV));
+  scanner.Next();  // Current token is now the regexp literal.
+  CHECK(scanner.is_literal_ascii());
+  i::Vector<const char> actual = scanner.literal_ascii_string();
+  for (int i = 0; i < actual.length(); i++) {
+    CHECK_NE('\0', expected[i]);
+    CHECK_EQ(expected[i], actual[i]);
+  }
+}
+
+
+TEST(RegExpScanning) {
+  // RegExp token with added garbage at the end. The scanner should only
+  // scan the RegExp until the terminating slash just before "flipperwald".
+  TestScanRegExp("/b/flipperwald", "b");
+  // Incomplete escape sequences doesn't hide the terminating slash.
+  TestScanRegExp("/\\x/flipperwald", "\\x");
+  TestScanRegExp("/\\u/flipperwald", "\\u");
+  TestScanRegExp("/\\u1/flipperwald", "\\u1");
+  TestScanRegExp("/\\u12/flipperwald", "\\u12");
+  TestScanRegExp("/\\u123/flipperwald", "\\u123");
+  TestScanRegExp("/\\c/flipperwald", "\\c");
+  TestScanRegExp("/\\c//flipperwald", "\\c");
+  // Slashes inside character classes are not terminating.
+  TestScanRegExp("/[/]/flipperwald", "[/]");
+  TestScanRegExp("/[\\s-/]/flipperwald", "[\\s-/]");
+  // Incomplete escape sequences inside a character class doesn't hide
+  // the end of the character class.
+  TestScanRegExp("/[\\c/]/flipperwald", "[\\c/]");
+  TestScanRegExp("/[\\c]/flipperwald", "[\\c]");
+  TestScanRegExp("/[\\x]/flipperwald", "[\\x]");
+  TestScanRegExp("/[\\x1]/flipperwald", "[\\x1]");
+  TestScanRegExp("/[\\u]/flipperwald", "[\\u]");
+  TestScanRegExp("/[\\u1]/flipperwald", "[\\u1]");
+  TestScanRegExp("/[\\u12]/flipperwald", "[\\u12]");
+  TestScanRegExp("/[\\u123]/flipperwald", "[\\u123]");
+  // Escaped ']'s wont end the character class.
+  TestScanRegExp("/[\\]/]/flipperwald", "[\\]/]");
+  // Escaped slashes are not terminating.
+  TestScanRegExp("/\\//flipperwald", "\\/");
+  // Starting with '=' works too.
+  TestScanRegExp("/=/", "=");
+  TestScanRegExp("/=?/", "=?");
+}
diff --git a/test/cctest/test-regexp.cc b/test/cctest/test-regexp.cc
index 3e6709ae..51fef714 100644
--- a/test/cctest/test-regexp.cc
+++ b/test/cctest/test-regexp.cc
@@ -176,11 +176,23 @@ TEST(Parser) {
   CHECK_PARSE_EQ("[\\d-z]", "[0-9 - z]");
   CHECK_PARSE_EQ("[\\d-\\d]", "[0-9 - 0-9]");
   CHECK_PARSE_EQ("[z-\\d]", "[z - 0-9]");
+  // Control character outside character class.
   CHECK_PARSE_EQ("\\cj\\cJ\\ci\\cI\\ck\\cK",
                  "'\\x0a\\x0a\\x09\\x09\\x0b\\x0b'");
-  CHECK_PARSE_EQ("\\c!", "'c!'");
-  CHECK_PARSE_EQ("\\c_", "'c_'");
-  CHECK_PARSE_EQ("\\c~", "'c~'");
+  CHECK_PARSE_EQ("\\c!", "'\\c!'");
+  CHECK_PARSE_EQ("\\c_", "'\\c_'");
+  CHECK_PARSE_EQ("\\c~", "'\\c~'");
+  CHECK_PARSE_EQ("\\c1", "'\\c1'");
+  // Control character inside character class.
+  CHECK_PARSE_EQ("[\\c!]", "[\\ c !]");
+  CHECK_PARSE_EQ("[\\c_]", "[\\x1f]");
+  CHECK_PARSE_EQ("[\\c~]", "[\\ c ~]");
+  CHECK_PARSE_EQ("[\\ca]", "[\\x01]");
+  CHECK_PARSE_EQ("[\\cz]", "[\\x1a]");
+  CHECK_PARSE_EQ("[\\cA]", "[\\x01]");
+  CHECK_PARSE_EQ("[\\cZ]", "[\\x1a]");
+  CHECK_PARSE_EQ("[\\c1]", "[\\x11]");
+
   CHECK_PARSE_EQ("[a\\]c]", "[a ] c]");
   CHECK_PARSE_EQ("\\[\\]\\{\\}\\(\\)\\%\\^\\#\\ ", "'[]{}()%^# '");
   CHECK_PARSE_EQ("[\\[\\]\\{\\}\\(\\)\\%\\^\\#\\ ]", "[[ ] { } ( ) % ^ #  ]");
@@ -234,7 +246,7 @@ TEST(Parser) {
   CHECK_PARSE_EQ("\\x34", "'\x34'");
   CHECK_PARSE_EQ("\\x60", "'\x60'");
   CHECK_PARSE_EQ("\\x3z", "'x3z'");
-  CHECK_PARSE_EQ("\\c", "'c'");
+  CHECK_PARSE_EQ("\\c", "'\\c'");
   CHECK_PARSE_EQ("\\u0034", "'\x34'");
   CHECK_PARSE_EQ("\\u003z", "'u003z'");
   CHECK_PARSE_EQ("foo[z]*", "(: 'foo' (# 0 - g [z]))");
diff --git a/test/mjsunit/compiler/regress-3249650.js b/test/mjsunit/compiler/regress-3249650.js
index 1f06090e..289e061c 100644
--- a/test/mjsunit/compiler/regress-3249650.js
+++ b/test/mjsunit/compiler/regress-3249650.js
@@ -50,4 +50,4 @@ function test(x) {
 }
 
 var x = {a: {b: "" }};
-for (var i = 0; i < 1000000; i++) test(x);
+for (var i = 0; i < 20000; i++) test(x);
diff --git a/test/mjsunit/debug-listbreakpoints.js b/test/mjsunit/debug-listbreakpoints.js
new file mode 100644
index 00000000..de0114fe
--- /dev/null
+++ b/test/mjsunit/debug-listbreakpoints.js
@@ -0,0 +1,210 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-debug-as debug
+// Get the Debug object exposed from the debug context global object.
+Debug = debug.Debug
+
+// Note: the following tests only checks the debugger handling of the
+// setexceptionbreak command.  It does not test whether the debugger
+// actually breaks on exceptions or not.  That functionality is tested
+// in test-debug.cc instead.
+
+// Note: The following function g() is purposedly placed here so that
+// its line numbers will not change should we add more lines of test code
+// below.  The test checks for these line numbers.
+
+function g() { // line 40
+  var x = 5; 
+  var y = 6;
+  var z = 7;
+};
+
+var first_lineno = 40; // Must be the line number of g() above.
+                       // The first line of the file is line 0.
+
+// Simple function which stores the last debug event.
+listenerComplete = false;
+exception = false;
+
+var breakpoint1 = -1;
+var base_request = '"seq":0,"type":"request","command":"listbreakpoints"'
+
+function safeEval(code) {
+  try {
+    return eval('(' + code + ')');
+  } catch (e) {
+    assertEquals(void 0, e);
+    return undefined;
+  }
+}
+
+
+function clearBreakpoint(dcp, breakpoint_id) {
+  var base_request = '"seq":0,"type":"request","command":"clearbreakpoint"'
+  var arguments = '{"breakpoint":' + breakpoint_id + '}'
+  var request = '{' + base_request + ',"arguments":' + arguments + '}'
+  var json_response = dcp.processDebugJSONRequest(request);
+}
+
+
+function setBreakOnException(dcp, type, enabled) {
+  var base_request = '"seq":0,"type":"request","command":"setexceptionbreak"'
+  var arguments = '{"type":"' + type + '","enabled":' + enabled + '}'
+  var request = '{' + base_request + ',"arguments":' + arguments + '}'
+  var json_response = dcp.processDebugJSONRequest(request);
+}
+
+
+function testArguments(dcp, success, breakpoint_ids, breakpoint_linenos,
+                       break_on_all, break_on_uncaught) {
+  var request = '{' + base_request + '}'
+  var json_response = dcp.processDebugJSONRequest(request);
+  var response = safeEval(json_response);
+  var num_breakpoints = breakpoint_ids.length;
+
+  if (success) {
+    assertTrue(response.success, json_response);
+    assertEquals(response.body.breakpoints.length, num_breakpoints);
+    if (num_breakpoints > 0) {
+      var breakpoints = response.body.breakpoints;
+      for (var i = 0; i < breakpoints.length; i++) {
+        var id = breakpoints[i].number;
+        var found = false;
+        for (var j = 0; j < num_breakpoints; j++) {
+          if (breakpoint_ids[j] == id) {
+            assertEquals(breakpoints[i].line, breakpoint_linenos[j]);
+            found = true;
+            break;
+          }
+        }
+        assertTrue(found, "found unexpected breakpoint " + id);
+      }
+    }
+    assertEquals(response.body.breakOnExceptions, break_on_all);
+    assertEquals(response.body.breakOnUncaughtExceptions, break_on_uncaught);
+  } else {
+    assertFalse(response.success, json_response);
+  }
+}
+
+
+function listener(event, exec_state, event_data, data) {
+  try {
+  if (event == Debug.DebugEvent.Break) {
+    // Get the debug command processor.
+    var dcp = exec_state.debugCommandProcessor("unspecified_running_state");
+
+    // Test with the 1 breakpoint already set:
+    testArguments(dcp, true, [ breakpoint1 ], [ first_lineno ], false, false);
+
+    setBreakOnException(dcp, "all", true);
+    testArguments(dcp, true, [ breakpoint1 ], [ first_lineno ], true, false);
+
+    setBreakOnException(dcp, "uncaught", true);
+    testArguments(dcp, true, [ breakpoint1 ], [ first_lineno ], true, true);
+
+    setBreakOnException(dcp, "all", false);
+    testArguments(dcp, true, [ breakpoint1 ], [ first_lineno ], false, true);
+
+    setBreakOnException(dcp, "uncaught", false);
+    testArguments(dcp, true, [ breakpoint1 ], [ first_lineno ], false, false);
+
+    // Clear the one breakpoint and retest:
+    clearBreakpoint(dcp, breakpoint1);
+    testArguments(dcp, true, [], [], false, false);
+
+    setBreakOnException(dcp, "all", true);
+    testArguments(dcp, true, [], [], true, false);
+
+    setBreakOnException(dcp, "uncaught", true);
+    testArguments(dcp, true, [], [], true, true);
+
+    setBreakOnException(dcp, "all", false);
+    testArguments(dcp, true, [], [], false, true);
+
+    setBreakOnException(dcp, "uncaught", false);
+    testArguments(dcp, true, [], [], false, false);
+
+    // Set some more breakpoints, and clear them in various orders:
+    var bp2 = Debug.setBreakPoint(g, 1, 0);
+    testArguments(dcp, true, [ bp2 ],
+                  [ first_lineno + 1 ],
+                  false, false);
+
+    var bp3 = Debug.setBreakPoint(g, 2, 0);
+    testArguments(dcp, true, [ bp2, bp3 ],
+                  [ first_lineno + 1, first_lineno + 2 ],
+                  false, false);
+
+    var bp4 = Debug.setBreakPoint(g, 3, 0);
+    testArguments(dcp, true, [ bp2, bp3, bp4 ],
+                  [ first_lineno + 1, first_lineno + 2, first_lineno + 3 ],
+                  false, false);
+
+    clearBreakpoint(dcp, bp3);
+    testArguments(dcp, true, [ bp2, bp4 ],
+                  [ first_lineno + 1, first_lineno + 3 ],
+                  false, false);
+
+    clearBreakpoint(dcp, bp4);
+    testArguments(dcp, true, [ bp2 ],
+                  [ first_lineno + 1 ],
+                  false, false);
+
+    var bp5 = Debug.setBreakPoint(g, 3, 0);
+    testArguments(dcp, true, [ bp2, bp5 ],
+                  [ first_lineno + 1, first_lineno + 3 ],
+                  false, false);
+
+    clearBreakpoint(dcp, bp2);
+    testArguments(dcp, true, [ bp5 ],
+                  [ first_lineno + 3 ],
+                  false, false);
+
+    clearBreakpoint(dcp, bp5);
+    testArguments(dcp, true, [], [], false, false);
+
+    // Indicate that all was processed.
+    listenerComplete = true;
+
+  }
+  } catch (e) {
+    exception = e
+  };
+};
+
+// Add the debug event listener.
+Debug.setListener(listener);
+
+// Set a break point and call to invoke the debug event listener.
+breakpoint1 = Debug.setBreakPoint(g, 0, 0);
+g();
+
+// Make sure that the debug event listener vas invoked.
+assertFalse(exception, "exception in listener")
+assertTrue(listenerComplete, "listener did not run to completion");
diff --git a/test/mjsunit/debug-setexceptionbreak.js b/test/mjsunit/debug-setexceptionbreak.js
new file mode 100644
index 00000000..3dc27dd5
--- /dev/null
+++ b/test/mjsunit/debug-setexceptionbreak.js
@@ -0,0 +1,119 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-debug-as debug
+// Get the Debug object exposed from the debug context global object.
+Debug = debug.Debug
+
+// Note: the following tests only checks the debugger handling of the
+// setexceptionbreak command.  It does not test whether the debugger
+// actually breaks on exceptions or not.  That functionality is tested
+// in test-debug.cc instead.
+
+// Simple function which stores the last debug event.
+listenerComplete = false;
+exception = false;
+
+var breakpoint = -1;
+var base_request = '"seq":0,"type":"request","command":"setexceptionbreak"'
+
+function safeEval(code) {
+  try {
+    return eval('(' + code + ')');
+  } catch (e) {
+    assertEquals(void 0, e);
+    return undefined;
+  }
+}
+
+function testArguments(dcp, arguments, success, type, enabled) {
+  var request = '{' + base_request + ',"arguments":' + arguments + '}'
+  var json_response = dcp.processDebugJSONRequest(request);
+  var response = safeEval(json_response);
+  if (success) {
+    assertTrue(response.success, json_response);
+    assertEquals(response.body.type, type);
+    assertEquals(response.body.enabled, enabled);
+  } else {
+    assertFalse(response.success, json_response);
+  }
+}
+
+function listener(event, exec_state, event_data, data) {
+  try {
+  if (event == Debug.DebugEvent.Break) {
+    // Get the debug command processor.
+    var dcp = exec_state.debugCommandProcessor("unspecified_running_state");
+
+    // Test some illegal setexceptionbreak requests.
+    var request = '{' + base_request + '}'
+    var response = safeEval(dcp.processDebugJSONRequest(request));
+    assertFalse(response.success);
+
+    testArguments(dcp, '{}', false);
+    testArguments(dcp, '{"type":0}', false);
+
+    // Test some legal setexceptionbreak requests with default.
+    // Note: by default, break on exceptions should be disabled.  Hence,
+    // the first time, we send the command with no enabled arg, the debugger
+    // should toggle it on.  The second time, it should toggle it off.
+    testArguments(dcp, '{"type":"all"}', true, "all", true);
+    testArguments(dcp, '{"type":"all"}', true, "all", false);
+    testArguments(dcp, '{"type":"uncaught"}', true, "uncaught", true);
+    testArguments(dcp, '{"type":"uncaught"}', true, "uncaught", false);
+
+    // Test some legal setexceptionbreak requests with explicit enabled arg.
+    testArguments(dcp, '{"type":"all","enabled":true}', true, "all", true);
+    testArguments(dcp, '{"type":"all","enabled":false}', true, "all", false);
+
+    testArguments(dcp, '{"type":"uncaught","enabled":true}', true,
+                  "uncaught", true);
+    testArguments(dcp, '{"type":"uncaught","enabled":false}', true,
+                  "uncaught", false);
+
+    // Indicate that all was processed.
+    listenerComplete = true;
+
+  }
+  } catch (e) {
+    exception = e
+  };
+};
+
+// Add the debug event listener.
+Debug.setListener(listener);
+
+function g() {};
+
+
+// Set a break point and call to invoke the debug event listener.
+breakpoint = Debug.setBreakPoint(g, 0, 0);
+g();
+
+// Make sure that the debug event listener vas invoked.
+assertFalse(exception, "exception in listener")
+assertTrue(listenerComplete, "listener did not run to completion");
diff --git a/test/mjsunit/mjsunit.status b/test/mjsunit/mjsunit.status
index eeeb3dc1..057c0fa8 100644
--- a/test/mjsunit/mjsunit.status
+++ b/test/mjsunit/mjsunit.status
@@ -109,11 +109,18 @@ regress/regress-3247124: SKIP
 ##############################################################################
 [ $arch == arm && $crankshaft ]
 
-# Test that currently fail with crankshaft on ARM.
+# Test that currently fails with crankshaft on ARM.
 compiler/simple-osr: FAIL
 
 
 ##############################################################################
+[ $arch == x64 && $crankshaft ]
+
+# BUG (1026) This test is currently flaky.
+compiler/simple-osr: SKIP
+
+
+##############################################################################
 [ $arch == mips ]
 
 # Skip all tests on MIPS.
diff --git a/test/mjsunit/regexp.js b/test/mjsunit/regexp.js
index 4c1d2e31..8d776ad5 100644
--- a/test/mjsunit/regexp.js
+++ b/test/mjsunit/regexp.js
@@ -84,15 +84,14 @@ assertEquals(result[4], 'D');
 assertEquals(result[5], 'E');
 assertEquals(result[6], 'F');
 
-// Some tests from the Mozilla tests, where our behavior differs from
+// Some tests from the Mozilla tests, where our behavior used to differ from
 // SpiderMonkey.
 // From ecma_3/RegExp/regress-334158.js
 assertTrue(/\ca/.test( "\x01" ));
 assertFalse(/\ca/.test( "\\ca" ));
-// Passes in KJS, fails in IrregularExpressions.
-// See http://code.google.com/p/v8/issues/detail?id=152
-//assertTrue(/\c[a/]/.test( "\x1ba/]" ));
-
+assertFalse(/\ca/.test( "ca" ));
+assertTrue(/\c[a/]/.test( "\\ca" ));
+assertTrue(/\c[a/]/.test( "\\c/" ));
 
 // Test \c in character class
 re = /^[\cM]$/;
@@ -104,11 +103,29 @@ assertFalse(re.test("\x03"));  // I.e., read as \cc
 
 re = /^[\c]]$/;
 assertTrue(re.test("c]"));
-assertFalse(re.test("\\]"));
+assertTrue(re.test("\\]"));
 assertFalse(re.test("\x1d"));  // ']' & 0x1f
-assertFalse(re.test("\\]"));
 assertFalse(re.test("\x03]"));  // I.e., read as \cc
 
+re = /^[\c1]$/;  // Digit control characters are masked in character classes.
+assertTrue(re.test("\x11"));
+assertFalse(re.test("\\"));
+assertFalse(re.test("c"));
+assertFalse(re.test("1"));
+
+re = /^[\c_]$/;  // Underscore control character is masked in character classes.
+assertTrue(re.test("\x1f"));
+assertFalse(re.test("\\"));
+assertFalse(re.test("c"));
+assertFalse(re.test("_"));
+
+re = /^[\c$]$/;  // Other characters are interpreted literally.
+assertFalse(re.test("\x04"));
+assertTrue(re.test("\\"));
+assertTrue(re.test("c"));
+assertTrue(re.test("$"));
+
+assertTrue(/^[Z-\c-e]*$/.test("Z[\\cde"));
 
 // Test that we handle \s and \S correctly inside some bizarre
 // character classes.
diff --git a/test/mjsunit/bugs/bug-1015.js b/test/mjsunit/regress/regress-1015.js
index 9e4406a9..9e4406a9 100644
--- a/test/mjsunit/bugs/bug-1015.js
+++ b/test/mjsunit/regress/regress-1015.js
diff --git a/test/mjsunit/regress/regress-1020.js b/test/mjsunit/regress/regress-1020.js
new file mode 100644
index 00000000..307a61e4
--- /dev/null
+++ b/test/mjsunit/regress/regress-1020.js
@@ -0,0 +1,32 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function isObject(o) {
+  return o instanceof Object;
+}
+
+assertTrue(isObject(Object));
diff --git a/test/mjsunit/regress/regress-192.js b/test/mjsunit/regress/regress-192.js
index 8f0978f1..a8e5e9da 100644
--- a/test/mjsunit/regress/regress-192.js
+++ b/test/mjsunit/regress/regress-192.js
@@ -30,9 +30,16 @@
 
 // See http://code.google.com/p/v8/issues/detail?id=192
 
+// UPDATE: This bug report is no longer valid. In ES5, creating object
+// literals MUST NOT trigger inherited accessors, but act as if creating
+// the properties using DefineOwnProperty.
+
 Object.prototype.__defineGetter__("x", function() {});
+Object.prototype.__defineSetter__("y",
+                                  function() { assertUnreachable("setter"); });
 
-// Creating this object literal will throw an exception because we are
+// Creating this object literal will *not* throw an exception because we are
 // assigning to a property that has only a getter.
-assertThrows("({ x: 42 })");
-
+var x = ({ x: 42, y: 37 });
+assertEquals(42, x.x);
+assertEquals(37, x.y);
diff --git a/test/mozilla/mozilla.status b/test/mozilla/mozilla.status
index 5688cf8d..1d989edd 100644
--- a/test/mozilla/mozilla.status
+++ b/test/mozilla/mozilla.status
@@ -840,6 +840,8 @@ js1_5/extensions/regress-371636: SKIP
 js1_5/Regress/regress-416628: CRASH
 js1_5/Regress/regress-96128-n: PASS || CRASH
 
+# BUG(1031).
+ecma/TypeConversion/9.2: FAIL
 
 [ $fast == yes && $arch == arm ]