The removal of HCheckMaps is invalid when the instruction has a virtual
usage, which can happen e.g. for HLoadElements or HJSArrayLength.
R=jkummerow@chromium.org
TEST=webkit:fast/js/regress/Float32Array-matrix-mult.html
Review URL: https://codereview.chromium.org/
12033073
git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13491
ce2b1a6d-e550-0410-aec6-
3dcde31c8c00
// TODO(mstarzinger): For now we specialize on HStoreNamedField, but once
// type information is rich enough we should generalize this to any HType
// for which the map is known.
- if (dominator->IsStoreNamedField()) {
+ if (HasNoUses() && dominator->IsStoreNamedField()) {
HStoreNamedField* store = HStoreNamedField::cast(dominator);
Handle<Map> map = store->transition();
if (map.is_null() || store->object() != value()) return;