Merged r17569 into 3.22 branch.

test/mjsunit/regress/regress-2987.js

Index: test/mjsunit/regress/regress-2987.js
diff --git a/test/mjsunit/compiler/osr-warm.js b/test/mjsunit/regress/regress-2987.js
similarity index 70%
copy from test/mjsunit/compiler/osr-warm.js
copy to test/mjsunit/regress/regress-2987.js
index 65ada1e114856109ab2261d0bc670bf59daa983c..7dd727e46cd9a75f1315ecd8e34bad6a0038f7f0 100644
--- a/test/mjsunit/compiler/osr-warm.js
+++ b/test/mjsunit/regress/regress-2987.js
@@ -25,26 +25,33 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --use-osr
+// Flags: --allow-natives-syntax --dead-code-elimination
 
-function f1(x) {
-  while (x > 0) {
-    x--;
-  }
-  return x;
-}
+// This tests that stores on captured objects are correctly tracked even
+// when DCE is enabled. We cannot delete simulations of captured objects
+// that are still needed to replay the environment correctly.
 
-assertEquals(0, f1(1));
-assertEquals(0, f1(10000000));
+function constructor() {
+  this.x = 0;
+}
 
-function f2(x) {
-  var sum = 1;
-  while (x > 0) {
-    x--;
-    sum++;
+var deopt = { deopt:false };
+function boogeyman(mode, value) {
+  var object = new constructor();
+  if (mode) {
+    object.x = 1;
+  } else {
+    object.x = 2;
   }
-  return sum;
+  deopt.deopt;
+  assertEquals(value, object.x);
 }
 
-assertEquals(2, f2(1));
-assertEquals(10000001, f2(10000000));
+boogeyman(true, 1);
+boogeyman(true, 1);
+boogeyman(false, 2);
+boogeyman(false, 2);
+%OptimizeFunctionOnNextCall(boogeyman);
+boogeyman(false, 2);
+delete deopt.deopt;
+boogeyman(false, 2);