diff --git a/src/compiler/js-native-context-specialization.cc b/src/compiler/js-native-context-specialization.cc index 1881cd02bc53..35b3c82756be 100644 --- a/src/compiler/js-native-context-specialization.cc +++ b/src/compiler/js-native-context-specialization.cc @@ -818,13 +818,14 @@ JSNativeContextSpecialization::BuildPropertyAccess( DCHECK_EQ(AccessMode::kLoad, access_mode); value = jsgraph()->UndefinedConstant(); } else if (access_info.IsDataConstant()) { - value = jsgraph()->Constant(access_info.constant()); + Node* constant_value = jsgraph()->Constant(access_info.constant()); if (access_mode == AccessMode::kStore) { - Node* check = - graph()->NewNode(simplified()->ReferenceEqual(), value, value); + Node* check = graph()->NewNode(simplified()->ReferenceEqual(), value, + constant_value); effect = graph()->NewNode(simplified()->CheckIf(), check, effect, control); } + value = constant_value; } else if (access_info.IsAccessorConstant()) { // TODO(bmeurer): Properly rewire the IfException edge here if there's any. Node* target = jsgraph()->Constant(access_info.constant()); diff --git a/test/mjsunit/compiler/regress-626986.js b/test/mjsunit/compiler/regress-626986.js new file mode 100644 index 000000000000..5e02918423dc --- /dev/null +++ b/test/mjsunit/compiler/regress-626986.js @@ -0,0 +1,23 @@ +// Copyright 2016 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --allow-natives-syntax + +function g() { + return 42; +} + +var o = {}; + +function f(o, x) { + o.f = x; +} + +f(o, g); +f(o, g); +f(o, g); +assertEquals(42, o.f()); +%OptimizeFunctionOnNextCall(f); +f(o, function() { return 0; }); +assertEquals(0, o.f());