Scoping error caused crash in CallICNexus::StateFromFeedback

test/mjsunit/regress/regress-503565.js

Index: test/mjsunit/regress/regress-503565.js
diff --git a/test/mjsunit/regress/regress-503565.js b/test/mjsunit/regress/regress-503565.js
new file mode 100644
index 0000000000000000000000000000000000000000..9aebe8d7d1ed166fbafc3e6c818a2b2b6f030de4
--- /dev/null
+++ b/test/mjsunit/regress/regress-503565.js
@@ -0,0 +1,21 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Crashes without the fix for bug 503565.
+function f() {}
+function g() {}
+function h() {
+    g()
+}
+(function() {
+    eval("\
+        \"use strict\";\
+        g = (function(x) {\
+            +Math.log(+Math.log((+(+x>0)), f(Math.log())))\
+        })\
+    ")
+})()
+for (var j = 0; j < 999; j++) {
+    h()
+}