diff --git a/src/compiler/js-native-context-specialization.cc b/src/compiler/js-native-context-specialization.cc index 95f8f5e663..31c776213b 100644 --- a/src/compiler/js-native-context-specialization.cc +++ b/src/compiler/js-native-context-specialization.cc @@ -2902,11 +2902,10 @@ JSNativeContextSpecialization::BuildPropertyStore( if (access_info.IsFastDataConstant() && access_mode == AccessMode::kStore && !access_info.HasTransitionMap()) { Node* deoptimize = graph()->NewNode( - common()->DeoptimizeIf(DeoptimizeReason::kStoreToConstant, - FeedbackSource()), - jsgraph()->TrueConstant(), frame_state, effect, control); + simplified()->CheckIf(DeoptimizeReason::kStoreToConstant), + jsgraph()->FalseConstant(), effect, control); return ValueEffectControl(jsgraph()->UndefinedConstant(), deoptimize, - deoptimize); + control); } FieldAccess field_access = { kTaggedBase, diff --git a/test/mjsunit/regress/regress-crbug-1399695.js b/test/mjsunit/regress/regress-crbug-1399695.js new file mode 100644 index 0000000000..cd8fb6cc66 --- /dev/null +++ b/test/mjsunit/regress/regress-crbug-1399695.js @@ -0,0 +1,13 @@ +// Copyright 2022 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --allow-natives-syntax + +function __f_3() { + isNaN.prototype = 14; +} +%PrepareFunctionForOptimization(__f_3); +__f_3(); +%OptimizeFunctionOnNextCall(__f_3); +__f_3();