[turbofan] Fix missing break in EscapeAnalysis.

In the case of LoadElement in EscapeAnalysis we accidentally always set
the object as escaping, even in the case where the index was a constant
(or had a constant type).

This forced us to always allocate array backing stores even in the
trivial cases like swapping, i.e.

```js
function foo(a, b) {
  [a, b] = [b, a];
  return a - b;
}
```

Now with this change we do proper scalar replacement again, even for the
array backing stores.

Bug: v8:9183
Change-Id: I3b2dcade23e47df032087778aca1292c8b0d69d4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1612907
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61521}
This commit is contained in:
Benedikt Meurer 2019-05-15 11:19:18 +02:00 committed by Commit Bot
parent 9991b408d8
commit 444f83d937

View File

@ -622,6 +622,7 @@ void ReduceNode(const Operator* op, EscapeAnalysisTracker::Scope* current,
OffsetOfElementsAccess(op, index).To(&offset) &&
vobject->FieldAt(offset).To(&var) && current->Get(var).To(&value)) {
current->SetReplacement(value);
break;
} else if (vobject && !vobject->HasEscaped()) {
// Compute the known length (aka the number of elements) of {object}
// based on the virtual object information.