Fix harmless HGraph verification failure after hoisting inlined bounds checks

BUG=chromium:487608
LOG=y
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1133343003

Cr-Commit-Position: refs/heads/master@{#28463}

diff --git a/src/hydrogen-bce.cc b/src/hydrogen-bce.cc
index 729317e..48c1f77 100644 (file)
--- a/src/hydrogen-bce.cc
+++ b/src/hydrogen-bce.cc
@@ -231,12 +231,15 @@ class BoundsCheckBbData: public ZoneObject {
           HArithmeticBinaryOperation::cast(index_raw);
       HValue* left_input = index->left();
       HValue* right_input = index->right();
+      HValue* context = index->context();
       bool must_move_index = false;
       bool must_move_left_input = false;
       bool must_move_right_input = false;
+      bool must_move_context = false;
       for (HInstruction* cursor = end_of_scan_range; cursor != insert_before;) {
         if (cursor == left_input) must_move_left_input = true;
         if (cursor == right_input) must_move_right_input = true;
+        if (cursor == context) must_move_context = true;
         if (cursor == index) must_move_index = true;
         if (cursor->previous() == NULL) {
           cursor = cursor->block()->dominator()->end();
@@ -258,6 +261,11 @@ class BoundsCheckBbData: public ZoneObject {
         HConstant::cast(right_input)->Unlink();
         HConstant::cast(right_input)->InsertBefore(index);
       }
+      if (must_move_context) {
+        // Contexts are always constants.
+        HConstant::cast(context)->Unlink();
+        HConstant::cast(context)->InsertBefore(index);
+      }
     } else if (index_raw->IsConstant()) {
       HConstant* index = HConstant::cast(index_raw);
       bool must_move = false;

diff --git a/test/mjsunit/regress/regress-crbug-487608.js b/test/mjsunit/regress/regress-crbug-487608.js
new file mode 100644 (file)
index 0000000..c1eafce
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-487608.js
@@ -0,0 +1,22 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function inlined(a, i) {
+  return a[i + 1];
+}
+
+function foo(index) {
+  var a = [0, 1, 2, 3];
+  var result = 0;
+  result += a[index];
+  result += inlined(a, index);
+  return result;
+}
+
+foo(0);
+foo(0);
+%OptimizeFunctionOnNextCall(foo);
+foo(0);