| Index: src/hydrogen.cc
|
| diff --git a/src/hydrogen.cc b/src/hydrogen.cc
|
| index a6b60b1f77a8fc439409096fbd88cd6c7b79006c..0628bd7638332df3f8028bfc5b4e8ae056dc1c49 100644
|
| --- a/src/hydrogen.cc
|
| +++ b/src/hydrogen.cc
|
| @@ -1192,7 +1192,15 @@ void HValueMap::Kill(GVNFlagSet flags) {
|
|
|
| // Now possibly drop directly indexed element.
|
| value = array_[i].value;
|
| - if (value->gvn_flags().ContainsAnyOf(depends_flags)) { // Drop it.
|
| + // Remove a value from the value map is one of its dependencies has been
|
| + // changed, unless it's a TransitionElementsKind, in which case it's safe
|
| + // to keep it. TransitionElementsKinds that are dominated by another
|
| + // equivalent transition, even if there is an intervening side-effect.
|
| + // TransitionElementsKind only has a one-time side effect, so all
|
| + // subsequent Transitions are no-ops, even if there are other side effects
|
| + // in between.
|
| + if (value->gvn_flags().ContainsAnyOf(depends_flags) &&
|
| + !value->IsTransitionElementsKind()) { // Drop it.
|
| count_--;
|
| int head = array_[i].next;
|
| if (head == kNil) {
|
| @@ -4454,7 +4462,7 @@ HValue* HGraphBuilder::HandlePolymorphicElementAccess(HValue* object,
|
| Handle<Map> map = maps->at(i);
|
| ASSERT(map->IsMap());
|
| if (!transition_target.at(i).is_null()) {
|
| - object = AddInstruction(new(zone()) HTransitionElementsKind(
|
| + AddInstruction(new(zone()) HTransitionElementsKind(
|
| object, map, transition_target.at(i)));
|
| } else {
|
| type_todo[map->elements_kind()] = true;
|
|
|