Merged r16406, r16431 into 3.19 branch.

test/mjsunit/regress/regress-crbug-280333.js

Index: test/mjsunit/regress/regress-crbug-280333.js
diff --git a/test/mjsunit/regress/regress-2537.js b/test/mjsunit/regress/regress-crbug-280333.js
similarity index 80%
copy from test/mjsunit/regress/regress-2537.js
copy to test/mjsunit/regress/regress-crbug-280333.js
index c6b5af949055daefaabea64c1c11e775af324da3..ca3fdc774606bfa56669b8a3b289af9845176ff3 100644
--- a/test/mjsunit/regress/regress-2537.js
+++ b/test/mjsunit/regress/regress-crbug-280333.js
@@ -27,19 +27,21 @@
 
 // Flags: --allow-natives-syntax
 
-var large_int = 0x40000000;
+function funky() { return false; }
+var global;
 
-function foo(x, expected) {
-  assertEquals(expected, x);  // This succeeds.
-  x += 0;  // Force int32 representation so that CompareIDAndBranch is used.
-  if (3 != x) {
-    x += 0;  // Poor man's "iDef".
-    // Fails due to Smi-tagging without overflow check.
-    assertEquals(expected, x);
+function foo(x, fun) {
+  var a = x + 1;
+  var b = x + 2;  // Need another Simulate to fold the first one into.
+  global = true;  // Need a side effect to deopt to.
+  if (fun()) {
+    return a;
   }
+  return 0;
 }
 
-foo(1, 1);
-foo(3, 3);
+assertEquals(0, foo(1, funky));
+assertEquals(0, foo(1, funky));
 %OptimizeFunctionOnNextCall(foo);
-foo(large_int, large_int);
+assertEquals(0, foo(1, funky));
+assertEquals(2, foo(1, function() { return true; }));