Merged r18697 into 3.23 branch.

test/mjsunit/regress-333594.js

Index: test/mjsunit/regress-333594.js
diff --git a/test/mjsunit/regress/regress-334708.js b/test/mjsunit/regress-333594.js
similarity index 90%
copy from test/mjsunit/regress/regress-334708.js
copy to test/mjsunit/regress-333594.js
index f0291bbdab61128baad9df89457d045b66644f1b..6f6dbaafcd64d8b752226a290df525ca200b69a0 100644
--- a/test/mjsunit/regress/regress-334708.js
+++ b/test/mjsunit/regress-333594.js
@@ -27,16 +27,16 @@
 
 // Flags: --allow-natives-syntax
 
-function foo(x, y) {
-  return Math.floor(x / y);
-}
+var a = { x: 1.1 };
+a.x = 0;
+var G = a.x;
+var o = { x: {} };
 
-function bar(x, y) {
-  return foo(x + 1, y + 1);
+function func() {
+  return {x: G};
 }
 
-foo(16, "4");
-
-bar(64, 2);
-%OptimizeFunctionOnNextCall(bar);
-bar(64, 2);
+func();
+func();
+%OptimizeFunctionOnNextCall(func);
+assertEquals(0, func().x);