Fix bug with GVN on array loads.

src/hydrogen.cc

Index: src/hydrogen.cc
===================================================================
--- src/hydrogen.cc	(revision 8219)
+++ src/hydrogen.cc	(working copy)
@@ -3722,16 +3722,17 @@
   bool is_array = (map->instance_type() == JS_ARRAY_TYPE);
   HLoadElements* elements = new(zone()) HLoadElements(object);
   HInstruction* length = NULL;
+  HBoundsCheck* checked_key = NULL;
   if (is_array) {
     length = AddInstruction(new(zone()) HJSArrayLength(object));
-    AddInstruction(new(zone()) HBoundsCheck(key, length));
+    AddInstruction(checked_key = new(zone()) HBoundsCheck(key, length));

[Mads Ager (chromium), 2011/06/08 12:27:25]

To match the line above can we do:

checked_key = AddInstruction(new(zone()) H...); ?

I don't like the assignment in the arguments list. So I would pull that out in
any case.

[fschneider, 2011/06/08 12:33:55]

Done.

     AddInstruction(elements);
   } else {
     AddInstruction(elements);
     length = AddInstruction(new(zone()) HFixedArrayLength(elements));
-    AddInstruction(new(zone()) HBoundsCheck(key, length));
+    AddInstruction(checked_key = new(zone()) HBoundsCheck(key, length));

[Mads Ager (chromium), 2011/06/08 12:27:25]

Ditto.

[fschneider, 2011/06/08 12:33:55]

Done.

   }
-  return new(zone()) HLoadKeyedFastElement(elements, key);
+  return new(zone()) HLoadKeyedFastElement(elements, checked_key);
 }