[turbofan] Fix eager bailout point after comma expression.

This ensures no eager bailout point is emitted after a comma expression
in test context where the right-hand side omitted an eager bailout point
as well. This is to stay in sync with full-codegen.

R=jarin@chromium.org
TEST=mjsunit/regress/regress-crbug-624919
BUG=chromium:624919

Review-Url: https://codereview.chromium.org/2113893004
Cr-Commit-Position: refs/heads/master@{#37475}

src/compiler/ast-graph-builder.cc

@@ -3052,6 +3052,10 @@ void AstGraphBuilder::VisitNot(UnaryOperation* expr) {
 void AstGraphBuilder::VisitComma(BinaryOperation* expr) {
   VisitForEffect(expr->left());
   Visit(expr->right());
+  // Skip plugging AST evaluation contexts of the test kind. This is to stay in
+  // sync with full codegen which doesn't prepare the proper bailout point (see
+  // the implementation of FullCodeGenerator::VisitForControl).
+  if (ast_context()->IsTest()) return;
   ast_context()->ReplaceValue(expr);
 }
 

test/mjsunit/regress/regress-crbug-624919.js

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f(a, b, c, d, e) {
+  if (a && (b, c ? d() : e())) return 0;
+}
+
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+f();