Merged r13788, r13658 into 3.16 branch.

test/mjsunit/regress/regress-2537.js

Index: test/mjsunit/regress/regress-2537.js
diff --git a/test/mjsunit/regress/regress-171641.js b/test/mjsunit/regress/regress-2537.js
similarity index 81%
copy from test/mjsunit/regress/regress-171641.js
copy to test/mjsunit/regress/regress-2537.js
index 8db6781821325f8f6253eb2df4abb2b362b001c0..c6b5af949055daefaabea64c1c11e775af324da3 100644
--- a/test/mjsunit/regress/regress-171641.js
+++ b/test/mjsunit/regress/regress-2537.js
@@ -27,14 +27,19 @@
 
 // Flags: --allow-natives-syntax
 
-function foo(k, p) {
-  for (var i = 0; i < 1; i++) {
-    p = Math.min(p, i);
+var large_int = 0x40000000;
+
+function foo(x, expected) {
+  assertEquals(expected, x);  // This succeeds.
+  x += 0;  // Force int32 representation so that CompareIDAndBranch is used.
+  if (3 != x) {
+    x += 0;  // Poor man's "iDef".
+    // Fails due to Smi-tagging without overflow check.
+    assertEquals(expected, x);
   }
-  m = Math.floor((k | 0) / p);
 }
 
-foo(0, 1);
-foo(0, 1);
+foo(1, 1);
+foo(3, 3);
 %OptimizeFunctionOnNextCall(foo);
-foo(0, 1);
+foo(large_int, large_int);