[turbofan] Fix effect chain for polymorphic array access.

bmeurer · Commit bot · commit edfe391ef57e · 2016-10-12T08:31:55.000Z
We accidently dropped the effect on the floor that we have for the polymorphic map check in case of array elements access. BUG=chromium:655004 R=jarin@chromium.org Review-Url: https://codereview.chromium.org/2411273002 Cr-Commit-Position: refs/heads/master@{#40201}
diff --git a/src/compiler/js-native-context-specialization.cc b/src/compiler/js-native-context-specialization.cc
@@ -604,7 +604,7 @@ Reduction JSNativeContextSpecialization::ReduceElementAccess(
                                               fallthrough_control);
               this_controls.push_back(
                   graph()->NewNode(common()->IfTrue(), branch));
-              this_effects.push_back(effect);
+              this_effects.push_back(this_effect);
               fallthrough_control =
                   graph()->NewNode(common()->IfFalse(), branch);
             }
diff --git a/test/mjsunit/regress/regress-crbug-655004.js b/test/mjsunit/regress/regress-crbug-655004.js
@@ -0,0 +1,15 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(a) {
+  a.x = 0;
+  if (a.x === 0) a[1] = 0.1;
+  a.x = {};
+}
+foo(new Array(1));
+foo(new Array(1));
+%OptimizeFunctionOnNextCall(foo);
+foo(new Array(1));

Original file line number	Diff line number	Diff line change
`@@ -604,7 +604,7 @@ Reduction JSNativeContextSpecialization::ReduceElementAccess(`
`604`	`604`	`fallthrough_control);`
`605`	`605`	`this_controls.push_back(`
`606`	`606`	`graph()->NewNode(common()->IfTrue(), branch));`
`607`		`- this_effects.push_back(effect);`
	`607`	`+ this_effects.push_back(this_effect);`
`608`	`608`	`fallthrough_control =`
`609`	`609`	`graph()->NewNode(common()->IfFalse(), branch);`
`610`	`610`	`}`