Merge 15827, 15842, and 15912 into 3.19

test/mjsunit/regress/regress-crbug-258519.js

Index: test/mjsunit/regress/regress-crbug-258519.js
diff --git a/test/mjsunit/regress/regress-2489.js b/test/mjsunit/regress/regress-crbug-258519.js
similarity index 81%
copy from test/mjsunit/regress/regress-2489.js
copy to test/mjsunit/regress/regress-crbug-258519.js
index 882c4f794a88e24d1d64e86a466b27c39f51e625..b2015a8426f95dbd713afa5999ddd6d585ca7320 100644
--- a/test/mjsunit/regress/regress-2489.js
+++ b/test/mjsunit/regress/regress-crbug-258519.js
@@ -27,24 +27,19 @@
 
 // Flags: --allow-natives-syntax
 
-"use strict";
-
-function f(a, b) {
-  return g("c", "d");
-}
-
-function g(a, b) {
-  g.constructor.apply(this, arguments);
+var a = {
+  compare_null: function(x) { return null != x; },
+  kaboom: function() {}
 }
 
-g.constructor = function(a, b) {
-  assertEquals("c", a);
-  assertEquals("d", b);
+function crash(x) {
+  var b = a;
+  b.compare_null(x) && b.kaboom();
+  return "ok";
 }
 
-f("a", "b");
-f("a", "b");
-%OptimizeFunctionOnNextCall(f);
-f("a", "b");
-g.x = "deopt";
-f("a", "b");
+assertEquals("ok", crash(null));
+assertEquals("ok", crash(null));
+%OptimizeFunctionOnNextCall(crash);
+// Used to throw: "TypeError: Cannot call method 'kaboom' of undefined".
+assertEquals("ok", crash(1));