Merge bleeding_edge r17376:17693.

test/mjsunit/regress/regress-298269.js

Index: test/mjsunit/regress/regress-298269.js
diff --git a/test/mjsunit/array-non-smi-length.js b/test/mjsunit/regress/regress-298269.js
similarity index 78%
copy from test/mjsunit/array-non-smi-length.js
copy to test/mjsunit/regress/regress-298269.js
index 23a25ee797bd68690ad2a7ce26a9135e23b486e2..329ff824dff4de0f52d91e6a4eeb08c344ec3e61 100644
--- a/test/mjsunit/array-non-smi-length.js
+++ b/test/mjsunit/regress/regress-298269.js
@@ -25,22 +25,21 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --allow-natives-syntax
-
-function TestNonSmiArrayLength() {
-  function f(a) {
-    return a.length+1;
+function Cb(a) {
+  var f, g;
+  for(f = a.length; f--;) {
+    g = a.charCodeAt(f);
+    // This will fail after OSR if Runtime_StringCharCodeAt is modified
+    // to iterates optimized frames and visit safepoint pointers.
   }
-
-  var a = [];
-  a.length = 0xFFFF;
-  assertSame(0x10000, f(a));
-  assertSame(0x10000, f(a));
-
-  %OptimizeFunctionOnNextCall(f);
-  a.length = 0xFFFFFFFF;
-  assertSame(0x100000000, f(a));
+  return g;
 }
 
-TestNonSmiArrayLength();
-
+var s1 = "long string to make cons string 1";
+var s2 = "long string to make cons string 2";
+Cb(s1 + s2);
+Cb(s1);
+var s3 = "string for triggering osr in Cb";
+for (var i = 0; i < 16; i++) s3 = s3 + s3;
+Cb(s3);
+Cb(s1 + s2);