Add dependency to HLoadKeyed* instructions to prevent invalid hoisting

src/hydrogen-instructions.h

Index: src/hydrogen-instructions.h
diff --git a/src/hydrogen-instructions.h b/src/hydrogen-instructions.h
index edd93f0748e0ca90e5f884542a9bf38399177875..e01f5879898c4a636f839595223e16b498e59a8b 100644
--- a/src/hydrogen-instructions.h
+++ b/src/hydrogen-instructions.h
@@ -4027,10 +4027,11 @@ class ArrayInstructionInterface {
 };
 
 class HLoadKeyedFastElement
-    : public HTemplateInstruction<2>, public ArrayInstructionInterface {
+    : public HTemplateInstruction<3>, public ArrayInstructionInterface {
  public:
   HLoadKeyedFastElement(HValue* obj,
                         HValue* key,
+                        HValue* dependency,
                         ElementsKind elements_kind = FAST_ELEMENTS)
       : bit_field_(0) {
     ASSERT(IsFastSmiOrObjectElementsKind(elements_kind));
@@ -4041,6 +4042,7 @@ class HLoadKeyedFastElement
     }
     SetOperandAt(0, obj);
     SetOperandAt(1, key);
+    SetOperandAt(2, dependency);
     set_representation(Representation::Tagged());
     SetGVNFlag(kDependsOnArrayElements);
     SetFlag(kUseGVN);
@@ -4048,6 +4050,7 @@ class HLoadKeyedFastElement
 
   HValue* object() { return OperandAt(0); }
   HValue* key() { return OperandAt(1); }
+  HValue* dependency() { return OperandAt(2); }
   uint32_t index_offset() { return IndexOffsetField::decode(bit_field_); }
   void SetIndexOffset(uint32_t index_offset) {
     bit_field_ = IndexOffsetField::update(bit_field_, index_offset);
@@ -4064,9 +4067,9 @@ class HLoadKeyedFastElement
 
   virtual Representation RequiredInputRepresentation(int index) {
     // The key is supposed to be Integer32.
-    return index == 0
-      ? Representation::Tagged()
-      : Representation::Integer32();
+    if (index == 0) return Representation::Tagged();
+    if (index == 1) return Representation::Integer32();
+    return Representation::None();
   }
 
   virtual void PrintDataTo(StringStream* stream);
@@ -4096,17 +4099,19 @@ enum HoleCheckMode { PERFORM_HOLE_CHECK, OMIT_HOLE_CHECK };
 
 
 class HLoadKeyedFastDoubleElement
-    : public HTemplateInstruction<2>, public ArrayInstructionInterface {
+    : public HTemplateInstruction<3>, public ArrayInstructionInterface {
  public:
   HLoadKeyedFastDoubleElement(
     HValue* elements,
     HValue* key,
+    HValue* dependency,
     HoleCheckMode hole_check_mode = PERFORM_HOLE_CHECK)
       : index_offset_(0),
         is_dehoisted_(false),
         hole_check_mode_(hole_check_mode) {
     SetOperandAt(0, elements);
     SetOperandAt(1, key);
+    SetOperandAt(2, dependency);
     set_representation(Representation::Double());
     SetGVNFlag(kDependsOnDoubleArrayElements);
     SetFlag(kUseGVN);
@@ -4114,6 +4119,7 @@ class HLoadKeyedFastDoubleElement
 
   HValue* elements() { return OperandAt(0); }
   HValue* key() { return OperandAt(1); }
+  HValue* dependency() { return OperandAt(2); }
   uint32_t index_offset() { return index_offset_; }
   void SetIndexOffset(uint32_t index_offset) { index_offset_ = index_offset; }
   HValue* GetKey() { return key(); }
@@ -4123,9 +4129,9 @@ class HLoadKeyedFastDoubleElement
 
   virtual Representation RequiredInputRepresentation(int index) {
     // The key is supposed to be Integer32.
-    return index == 0
-      ? Representation::Tagged()
-      : Representation::Integer32();
+    if (index == 0) return Representation::Tagged();
+    if (index == 1) return Representation::Integer32();
+    return Representation::None();
   }
 
   bool RequiresHoleCheck() {
@@ -4152,16 +4158,18 @@ class HLoadKeyedFastDoubleElement
 
 
 class HLoadKeyedSpecializedArrayElement
-    : public HTemplateInstruction<2>, public ArrayInstructionInterface {
+    : public HTemplateInstruction<3>, public ArrayInstructionInterface {
  public:
   HLoadKeyedSpecializedArrayElement(HValue* external_elements,
                                     HValue* key,
+                                    HValue* dependency,
                                     ElementsKind elements_kind)
       :  elements_kind_(elements_kind),
          index_offset_(0),
          is_dehoisted_(false) {
     SetOperandAt(0, external_elements);
     SetOperandAt(1, key);
+    SetOperandAt(2, dependency);
     if (elements_kind == EXTERNAL_FLOAT_ELEMENTS ||
         elements_kind == EXTERNAL_DOUBLE_ELEMENTS) {
       set_representation(Representation::Double());
@@ -4177,15 +4185,15 @@ class HLoadKeyedSpecializedArrayElement
   virtual void PrintDataTo(StringStream* stream);
 
   virtual Representation RequiredInputRepresentation(int index) {
-    // The key is supposed to be Integer32, but the base pointer
-    // for the element load is a naked pointer.
-    return index == 0
-      ? Representation::External()
-      : Representation::Integer32();
+    // The key is supposed to be Integer32.
+    if (index == 0) return Representation::External();
+    if (index == 1) return Representation::Integer32();
+    return Representation::None();
   }
 
   HValue* external_pointer() { return OperandAt(0); }
   HValue* key() { return OperandAt(1); }
+  HValue* dependency() { return OperandAt(2); }
   ElementsKind elements_kind() const { return elements_kind_; }
   uint32_t index_offset() { return index_offset_; }
   void SetIndexOffset(uint32_t index_offset) { index_offset_ = index_offset; }