Merged r14732, r14746, r14757 into 3.18 branch.

test/mjsunit/regress/regress-241344.js

Index: test/mjsunit/regress/regress-241344.js
diff --git a/test/mjsunit/regress/regress-2489.js b/test/mjsunit/regress/regress-241344.js
similarity index 80%
copy from test/mjsunit/regress/regress-2489.js
copy to test/mjsunit/regress/regress-241344.js
index 882c4f794a88e24d1d64e86a466b27c39f51e625..32a9dd33762cb625079b18c3a6c4318b720ccb68 100644
--- a/test/mjsunit/regress/regress-2489.js
+++ b/test/mjsunit/regress/regress-241344.js
@@ -25,26 +25,16 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --allow-natives-syntax
+// Create a JSON string for an object with indexed properties.
+// Parsing that string creates a sparse array that grows dense.
 
-"use strict";
-
-function f(a, b) {
-  return g("c", "d");
-}
-
-function g(a, b) {
-  g.constructor.apply(this, arguments);
+var jsonstring = '{"0":0.1, "10000":0.4, ';
+for (var i = 1; i < 9999; i++) {
+  jsonstring += '"' + i + '":0.2, ';
 }
+jsonstring += '"9999":0.3}';
 
-g.constructor = function(a, b) {
-  assertEquals("c", a);
-  assertEquals("d", b);
+var jsonobject = JSON.parse(jsonstring);
+for (var i = 1; i < 9999; i++) {
+  assertEquals(0.2, jsonobject[i]);
 }
-
-f("a", "b");
-f("a", "b");
-%OptimizeFunctionOnNextCall(f);
-f("a", "b");
-g.x = "deopt";
-f("a", "b");