Add dependency to HLoadKeyed* instructions to prevent invalid hoisting

Add dependency to HLoadKeyed* instructions to prevent invalid hoisting


BUG=chromium:137768
TEST=test/mjsunit/regress/regress-137768.js

Committed: https://code.google.com/p/v8/source/detail?r=12173

[danno, 2012-07-19 15:55:14]

PTAL

[Jakob Kummerow, 2012-07-20 08:45:18]

The patch looks good, but the regression test doesn't seem to trigger the wrong
behavior.

http://codereview.chromium.org/10802038/diff/6/test/mjsunit/regress/regress-1...
File test/mjsunit/regress/regress-137768.js (right):

http://codereview.chromium.org/10802038/diff/6/test/mjsunit/regress/regress-1...
test/mjsunit/regress/regress-137768.js:35: s += Math.floor(a);
Did you mean floor(x)? Either way, this test works just fine for me with
bleeding_edge r12151, it doesn't crash and the load is not hoisted out of the
loop (interestingly, with --packed-arrays it's a generic load). Am I missing
something?

http://codereview.chromium.org/10802038/diff/6/test/mjsunit/regress/regress-1...
test/mjsunit/regress/regress-137768.js:50: // Optimize, bofre the fix, the
element load and subsequent tagged-to-i were
nit: messed up comment ("bofre", incomplete sentence).

http://codereview.chromium.org/10802038/diff/6/test/mjsunit/regress/regress-1...
test/mjsunit/regress/regress-137768.js:59: // tagged-to-i will treat part of a
double value as a pointer and de-ref the
nit: slightly messed up comment. s/de-ref the/de-ref it/ ?

[danno, 2012-07-23 13:49:31]

Please take another look

[Jakob Kummerow, 2012-07-23 13:54:23]

LGTM with nit.

http://codereview.chromium.org/10802038/diff/11001/test/mjsunit/regress/regre...
File test/mjsunit/regress/regress-137768.js (right):

http://codereview.chromium.org/10802038/diff/11001/test/mjsunit/regress/regre...
test/mjsunit/regress/regress-137768.js:59: // that adds
nit: this sentence is still incomplete.