diff --git a/src/compiler/ast-graph-builder.cc b/src/compiler/ast-graph-builder.cc index 73ab72c333..c995ac83ec 100644 --- a/src/compiler/ast-graph-builder.cc +++ b/src/compiler/ast-graph-builder.cc @@ -3052,6 +3052,10 @@ void AstGraphBuilder::VisitNot(UnaryOperation* expr) { void AstGraphBuilder::VisitComma(BinaryOperation* expr) { VisitForEffect(expr->left()); Visit(expr->right()); + // Skip plugging AST evaluation contexts of the test kind. This is to stay in + // sync with full codegen which doesn't prepare the proper bailout point (see + // the implementation of FullCodeGenerator::VisitForControl). + if (ast_context()->IsTest()) return; ast_context()->ReplaceValue(expr); } diff --git a/test/mjsunit/regress/regress-crbug-624919.js b/test/mjsunit/regress/regress-crbug-624919.js new file mode 100644 index 0000000000..5a2b100daf --- /dev/null +++ b/test/mjsunit/regress/regress-crbug-624919.js @@ -0,0 +1,14 @@ +// Copyright 2016 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --allow-natives-syntax + +function f(a, b, c, d, e) { + if (a && (b, c ? d() : e())) return 0; +} + +f(); +f(); +%OptimizeFunctionOnNextCall(f); +f();