From: mstarzinger@chromium.org <mstarzinger@chromium.org@ce2b1a6d-e550-0410-aec6-3dcde31c8c00>
Date: Thu, 24 Jan 2013 12:35:56 +0000 (+0000)
Subject: Fix map check removal issue in r13488.
X-Git-Tag: upstream/4.7.83~15213
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=ef4d9d12451ee0922538c0cc8b4dcce53b644377;p=platform%2Fupstream%2Fv8.git

Fix map check removal issue in r13488.

The removal of HCheckMaps is invalid when the instruction has a virtual
usage, which can happen e.g. for HLoadElements or HJSArrayLength.

R=jkummerow@chromium.org
TEST=webkit:fast/js/regress/Float32Array-matrix-mult.html

Review URL: https://codereview.chromium.org/12033073

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13491 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
---

diff --git a/src/hydrogen-instructions.cc b/src/hydrogen-instructions.cc
index 9c808c7..0bf208b 100644
--- a/src/hydrogen-instructions.cc
+++ b/src/hydrogen-instructions.cc
@@ -1173,7 +1173,7 @@ void HCheckMaps::SetSideEffectDominator(GVNFlag side_effect,
   // TODO(mstarzinger): For now we specialize on HStoreNamedField, but once
   // type information is rich enough we should generalize this to any HType
   // for which the map is known.
-  if (dominator->IsStoreNamedField()) {
+  if (HasNoUses() && dominator->IsStoreNamedField()) {
     HStoreNamedField* store = HStoreNamedField::cast(dominator);
     Handle<Map> map = store->transition();
     if (map.is_null() || store->object() != value()) return;