From ef4d9d12451ee0922538c0cc8b4dcce53b644377 Mon Sep 17 00:00:00 2001 From: "mstarzinger@chromium.org" Date: Thu, 24 Jan 2013 12:35:56 +0000 Subject: [PATCH] Fix map check removal issue in r13488. The removal of HCheckMaps is invalid when the instruction has a virtual usage, which can happen e.g. for HLoadElements or HJSArrayLength. R=jkummerow@chromium.org TEST=webkit:fast/js/regress/Float32Array-matrix-mult.html Review URL: https://codereview.chromium.org/12033073 git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@13491 ce2b1a6d-e550-0410-aec6-3dcde31c8c00 --- src/hydrogen-instructions.cc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/hydrogen-instructions.cc b/src/hydrogen-instructions.cc index 9c808c78f2..0bf208b733 100644 --- a/src/hydrogen-instructions.cc +++ b/src/hydrogen-instructions.cc @@ -1173,7 +1173,7 @@ void HCheckMaps::SetSideEffectDominator(GVNFlag side_effect, // TODO(mstarzinger): For now we specialize on HStoreNamedField, but once // type information is rich enough we should generalize this to any HType // for which the map is known. - if (dominator->IsStoreNamedField()) { + if (HasNoUses() && dominator->IsStoreNamedField()) { HStoreNamedField* store = HStoreNamedField::cast(dominator); Handle map = store->transition(); if (map.is_null() || store->object() != value()) return;