From e6c5b6cb3a656b95eb8849d2c274f92bfd29ef32 Mon Sep 17 00:00:00 2001
From: Toon Verwaest <verwaest@chromium.org>
Date: Fri, 27 Mar 2026 17:20:06 +0100
Subject: [PATCH] [maglev] Restore mergepoint scope info in OsrPrewalk

Bug: 496627235
Change-Id: I69bdb19b37e0f56c3094112123fca75dd8d4b01d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7705960
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#106118}
---

diff --git a/src/maglev/maglev-graph-builder.cc b/src/maglev/maglev-graph-builder.cc
index 2e874f3..524a78c 100644
--- a/src/maglev/maglev-graph-builder.cc
+++ b/src/maglev/maglev-graph-builder.cc
@@ -17046,6 +17046,9 @@
     auto it = saved_states.find(offset);
     if (it != saved_states.end()) {
       SetCurrentScopeInfo(it->second);
+    } else if (merge_states_[offset] != nullptr &&
+               merge_states_[offset]->has_context_scope_info()) {
+      SetCurrentScopeInfo(merge_states_[offset]->context_scope_info());
     }
 
     PrewalkBytecode();
diff --git a/test/mjsunit/maglev/regress-496627235.js b/test/mjsunit/maglev/regress-496627235.js
new file mode 100644
index 0000000..9236a7c
--- /dev/null
+++ b/test/mjsunit/maglev/regress-496627235.js
@@ -0,0 +1,24 @@
+// Copyright 2026 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+let x = 100;
+function f(osr) {
+  try { let x; ()=>x; throw "bla" } catch(e) {};
+  let y;
+  for (let i = 0; i < 10; i++) {
+    if (osr) %OptimizeOsr();
+    osr = false;
+    y = x;
+  }
+  return y;
+}
+
+%PrepareFunctionForOptimization(f);
+f(false);
+f(false);
+f(false);
+f(false);
+assertEquals(100, f(true));

diff --git a/test/mjsunit/maglev/regress-496627235.js b/test/mjsunit/maglev/regress-496627235.js
new file mode 100644
index 0000000..9236a7c
--- /dev/null
+++ b/test/mjsunit/maglev/regress-496627235.js
@@ -0,0 +1,24 @@
+// Copyright 2026 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+let x = 100;
+function f(osr) {
+  try { let x; ()=>x; throw "bla" } catch(e) {};
+  let y;
+  for (let i = 0; i < 10; i++) {
+    if (osr) %OptimizeOsr();
+    osr = false;
+    y = x;
+  }
+  return y;
+}
+
+%PrepareFunctionForOptimization(f);
+f(false);
+f(false);
+f(false);
+f(false);
+assertEquals(100, f(true));