Merged r14732, r14746, r14757 into 3.18 branch.

test/mjsunit/regress/regress-crbug-242924.js

Index: test/mjsunit/regress/regress-crbug-242924.js
diff --git a/test/mjsunit/regress/regress-2671-1.js b/test/mjsunit/regress/regress-crbug-242924.js
similarity index 83%
copy from test/mjsunit/regress/regress-2671-1.js
copy to test/mjsunit/regress/regress-crbug-242924.js
index 042a501e5adb86cd7d868ec721edef8edde27274..68ad7c6fd4e3e11b8f6d93e8b8afef01f4b143cd 100644
--- a/test/mjsunit/regress/regress-2671-1.js
+++ b/test/mjsunit/regress/regress-crbug-242924.js
@@ -25,21 +25,24 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --allow-natives-syntax
+// Flags: --allow-natives-syntax --expose-gc --gc-global
 
-var y;
 function f() {
-  var a = [];
-  a[20] = 0;
-  y = 3;
-  var i = 7 * (y + -0);
-  a[i]++;
-  assertTrue(isNaN(a[i]));
+  return [,{}];
 }
 
-f();
-f();
-f();
+assertEquals([,{}], f());
+assertEquals([,{}], f());
 %OptimizeFunctionOnNextCall(f);
-f();
+assertEquals([,{}], f());
+gc();
 
+function g() {
+  return [[,1.5],{}];
+}
+
+assertEquals([[,1.5],{}], g());
+assertEquals([[,1.5],{}], g());
+%OptimizeFunctionOnNextCall(g);
+assertEquals([[,1.5],{}], g());
+gc();