Merged r11533 into 3.8 branch.

test/mjsunit/regress/regress-117409.js

Index: test/mjsunit/regress/regress-117409.js
diff --git a/test/mjsunit/regress/regress-109195.js b/test/mjsunit/regress/regress-117409.js
similarity index 67%
copy from test/mjsunit/regress/regress-109195.js
copy to test/mjsunit/regress/regress-117409.js
index 97538aa1674357798c1083e98cdca800c456e0a5..9222191ae67f4e69be0abd95cf113b091e4cb573 100644
--- a/test/mjsunit/regress/regress-109195.js
+++ b/test/mjsunit/regress/regress-117409.js
@@ -25,41 +25,28 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --expose-debug-as debug
-var Debug = debug.Debug;
+// Flags: --expose-gc
 
-function listener(event, exec_state, event_data, data) {
-  for (var i = 0, n = exec_state.frameCount(); i < n; i++) {
-    exec_state.frame().scopeCount(i);
-  }
-  exec_state.prepareStep(Debug.StepAction.Continue, 1);
-}
+function KeyedStoreIC(a) { a[0] = Math.E; }
 
-Debug.setListener(listener);
+// Create literal with a fast double elements backing store
+var literal = [1.2];
 
-var F = function () {
-  1, function () {
-    var d = 0;
-    (function () { d; });
-    debugger;
-  }();
-};
+// Specialize the IC for fast double elements
+KeyedStoreIC(literal);
+KeyedStoreIC(literal);
 
-var src = "(" + F.toString() + ")()";
-eval(src);
+// Trruncate array to 0 elements, at which point backing store will be replaced
+// with empty fixed array.
+literal.length = 0;
 
-Function.prototype.__defineGetter__("f", function () {
-  debugger;
-  return 0;
-});
+// ArrayPush built-in will replace empty fixed array backing store with 19
+// elements fixed array backing store.  This leads to a mismatch between the map
+// and the backing store.  Debug mode will crash here in set_elements accessor.
+literal.push(Math.E, Math.E);
 
-var G = function () {
-  1, function () {
-    var d = 0;
-    (function () { d; });
-    debugger;
-  }['f'];
-};
+// Corrupt the backing store!
+KeyedStoreIC(literal);
 
-var src = "(" + G.toString() + ")()";
-eval(src);
+// Release mode will crash here when trying to visit parts of E as pointers.
+gc();