Merged r16150, r16174, r16175 into 3.19 branch.

test/mjsunit/regress/regress-map-invalidation-1.js

Index: test/mjsunit/regress/regress-map-invalidation-1.js
diff --git a/test/mjsunit/regress/regress-crbug-217858.js b/test/mjsunit/regress/regress-map-invalidation-1.js
similarity index 85%
copy from test/mjsunit/regress/regress-crbug-217858.js
copy to test/mjsunit/regress/regress-map-invalidation-1.js
index 8563e07eee9e1acbcdc8c5c28c461f2d27fad6f1..ae3156380dc414a33e588bbd91c69636a88d616f 100644
--- a/test/mjsunit/regress/regress-crbug-217858.js
+++ b/test/mjsunit/regress/regress-map-invalidation-1.js
@@ -27,14 +27,23 @@
 
 // Flags: --allow-natives-syntax
 
-var r = /r/;
-var a = "";
+var c = { x: 2, y: 1 };
+
+function h() {
+  try { // do not optimize this function
+    var o = { x: 2.2, y: 1.1 };
+    return 2;
+  } catch (e) { }
+}
+
 function f() {
-  %OptimizeFunctionOnNextCall(f, "osr");
-  for (var i = 0; i < 1000000; i++) {
-    a += i.toString();
-    r[r] = function() {};
+  for (var i = 0; i < 100000; i++) {
+    var n = c.x + h();
+    assertEquals(4, n);
   }
+  var o2 = [{ x: 2.5, y:1 }];
+  return o2;
 }
 
 f();
+