diff --git a/lib/tokenize.cpp b/lib/tokenize.cpp
index 4455f96e8..5d39ac17c 100644
--- a/lib/tokenize.cpp
+++ b/lib/tokenize.cpp
@@ -11265,8 +11265,12 @@ void Tokenizer::simplifyOverloadedOperators()
                 while (Token::simpleMatch(start, ",")) {
                     if (Token::simpleMatch(start->previous(), ")"))
                         start = start->linkAt(-1);
+                    else
+                        break;
                     if (Token::Match(start->previous(), "%name%"))
                         start = start->tokAt(-2);
+                    else
+                        break;
                 }
                 const Token *after = tok->linkAt(1);
                 while (Token::Match(after, ")|} , %name% (|{"))
diff --git a/test/testtokenize.cpp b/test/testtokenize.cpp
index 7073bc062..d74f361f1 100644
--- a/test/testtokenize.cpp
+++ b/test/testtokenize.cpp
@@ -418,6 +418,7 @@ private:
 
         TEST_CASE(simplifyOverloadedOperators1);
         TEST_CASE(simplifyOverloadedOperators2); // (*this)(123)
+        TEST_CASE(simplifyOverloadedOperators3); // #9881 - hang
 
         TEST_CASE(simplifyNullArray);
 
@@ -6665,6 +6666,24 @@ private:
                       tokenizeAndStringify(code));
     }
 
+    void simplifyOverloadedOperators3() { // #9881
+        const char code[] = "struct Func { double operator()(double x) const; };\n"
+                            "void foo(double, double);\n"
+                            "void test() {\n"
+                            "    Func max;\n"
+                            "    double y = 0;\n"
+                            "    foo(0, max(y));\n"
+                            "}";
+        ASSERT_EQUALS("struct Func { double operator() ( double x ) const ; } ;\n"
+                      "void foo ( double , double ) ;\n"
+                      "void test ( ) {\n"
+                      "Func max ;\n"
+                      "double y ; y = 0 ;\n"
+                      "foo ( 0 , max . operator() ( y ) ) ;\n"
+                      "}",
+                      tokenizeAndStringify(code));
+    }
+
     void simplifyNullArray() {
         ASSERT_EQUALS("* ( foo . bar [ 5 ] ) = x ;", tokenizeAndStringify("0[foo.bar[5]] = x;"));
     }