Add dependency to HLoadKeyed* instructions to prevent invalid hoisting

test/mjsunit/regress/regress-137768.js

Index: test/mjsunit/regress/regress-137768.js
diff --git a/test/mjsunit/compiler/regress-funarguments.js b/test/mjsunit/regress/regress-137768.js
similarity index 56%
copy from test/mjsunit/compiler/regress-funarguments.js
copy to test/mjsunit/regress/regress-137768.js
index c913bd952136204256988321fc326a79971f03e9..a7c80c80467bacc86db896e1f14a149b8ebb7d3a 100644
--- a/test/mjsunit/compiler/regress-funarguments.js
+++ b/test/mjsunit/regress/regress-137768.js
@@ -27,60 +27,47 @@
 
 // Flags: --allow-natives-syntax
 
-// Test function.arguments.
-
-function A() {}
-function B() {}
-
-function fee(x, y) {
-  if (x == 1) return fee["arg" + "uments"];
-  if (x == 2) return gee["arg" + "uments"];
-  return 42;
-}
-
-function gee(x) { return this.f(2 - x, "f"); }
-
-function foo(x, y) {
-  if (x == 0) return foo["arg" + "uments"];
-  if (x == 1) return goo["arg" + "uments"];
-  return 42;
-}
-
-function goo(x) { return this.f(x, "f"); }
-
-A.prototype.f = fee;
-A.prototype.g = gee;
-
-B.prototype.f = foo;
-B.prototype.g = goo;
-
-var o = new A();
-
-function hej(x) {
-  if (x == 0) return o.g(x, "h");
-  if (x == 1) return o.g(x, "h");
-  return o.g(x, "z");
+// Create elements in a constructor function to ensure map sharing.
+function TestConstructor() {
+  this[0] = 1;
+  this[1] = 2;
+  this[2] = 3;
 }
 
-function opt() {
-  for (var k=0; k<2; k++) {
-    for (var i=0; i<5; i++) o.g(i, "g");
-    for (var j=0; j<5; j++) hej(j);
+function bad_func(o,a) {
+  var s = 0;
+  for (var i = 0; i < 1; ++i) {
+    o.newFileToChangeMap = undefined;
+    var x = a[0];
+    s += x;
   }
-  %OptimizeFunctionOnNextCall(o.g);
-  %OptimizeFunctionOnNextCall(hej);
+  return s;
 }
 
-opt();
-assertArrayEquals([0, "g"], o.g(0, "g"));
-assertArrayEquals([1, "f"], o.g(1, "g"));
-assertArrayEquals([0, "h"], hej(0));
-assertArrayEquals([1, "f"], hej(1));
+o = new Object();
+a = new TestConstructor();
+bad_func(o, a);
+
+// Make sure that we're out of pre-monomorphic state for the member add of
+// 'newFileToChangeMap' which causes a map transition.
+o = new Object();
+a = new TestConstructor();
+bad_func(o, a);
 
-o = new B();
+// Optimize, before the fix, the element load and subsequent tagged-to-i were
+// hoisted above the map check, which can't be hoisted due map-changing store
+// that adds

[Jakob Kummerow, 2012/07/23 13:54:23]

nit: this sentence is still incomplete.

+o = new Object();
+a = new TestConstructor();
+%OptimizeFunctionOnNextCall(bad_func);
+bad_func(o, a);
 
-opt();
-assertArrayEquals([0, "f"], o.g(0, "g"));
-assertArrayEquals([1, "g"], o.g(1, "g"));
-assertArrayEquals([0, "f"], hej(0));
-assertArrayEquals([1, "h"], hej(1));
+// Pass in a array of doubles. Before the fix, the optimized load and
+// tagged-to-i will treat part of a double value as a pointer and de-ref it
+// before the map check was executed that should have deopt.
+o = new Object();
+// Pass in an elements buffer where the bit representation of the double numbers
+// are two adjacent small 32-bit values with the lowest bit set to one, causing
+// tagged-to-i to SIGSEGV.
+a = [2.122e-314, 2.122e-314, 2.122e-314];
+bad_func(o, a);