[crankshaft] [turbofan] Fix environment handling when generating a tail call from inlined function.

test/mjsunit/regress/regress-crbug-598998.js

Index: test/mjsunit/regress/regress-crbug-598998.js
diff --git a/test/mjsunit/regress/regress-crbug-598998.js b/test/mjsunit/regress/regress-crbug-598998.js
new file mode 100644
index 0000000000000000000000000000000000000000..4cfe1a13af3fdf31e97786f2ea7f42c4dd1d56c8
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-598998.js
@@ -0,0 +1,32 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-tailcalls --allow-natives-syntax
+
+"use strict";
+
+function deopt_function(func) {
+  %DeoptimizeFunction(func);
+}
+
+function f(x) {
+  return deopt_function(h);
+}
+
+function g(x) {
+  return f(x, 1);
+}
+
+function h(x) {
+  g(x, 1);
+}
+
+%SetForceInlineFlag(g);
+%SetForceInlineFlag(f);
+%NeverOptimizeFunction(deopt_function);
+
+h(1);
+h(1);
+%OptimizeFunctionOnNextCall(h);
+h(1);