Merged r16406, r16431 into 3.19 branch.

test/mjsunit/regress/regress-2843.js

Index: test/mjsunit/regress/regress-2843.js
diff --git a/test/mjsunit/regress/regress-2499.js b/test/mjsunit/regress/regress-2843.js
similarity index 81%
copy from test/mjsunit/regress/regress-2499.js
copy to test/mjsunit/regress/regress-2843.js
index 52aad874db6fcdc89f5ee1ae4db45304e64b0e77..5b28c2d7948ee5b71f2cc072aea326057f8156db 100644
--- a/test/mjsunit/regress/regress-2499.js
+++ b/test/mjsunit/regress/regress-2843.js
@@ -27,14 +27,19 @@
 
 // Flags: --allow-natives-syntax
 
-function foo(word, nBits) {
-  return (word[1] >>> nBits) | (word[0] << (32 - nBits));
-}
+function bailout() { throw "bailout"; }
+var global;
 
-word = [0x1001, 0];
+function foo(x, fun) {
+  var a = x + 1;
+  var b = x + 2;  // Need another Simulate to fold the first one into.
+  global = true;  // Need a side effect to deopt to.
+  fun();
+  return a;
+}
 
-var expected = foo(word, 1);
-foo(word, 1);
+assertThrows("foo(1, bailout)");
+assertThrows("foo(1, bailout)");
 %OptimizeFunctionOnNextCall(foo);
-var optimized = foo(word, 1);
-assertEquals(expected, optimized)
+assertThrows("foo(1, bailout)");
+assertEquals(2, foo(1, function() {}));