Merged r13617, r13622 into trunk branch.

test/mjsunit/regress/regress-crbug-173907.js

Index: test/mjsunit/regress/regress-crbug-173907.js
diff --git a/test/mjsunit/compiler/property-static.js b/test/mjsunit/regress/regress-crbug-173907.js
similarity index 54%
copy from test/mjsunit/compiler/property-static.js
copy to test/mjsunit/regress/regress-crbug-173907.js
index 07021340cd7aa94440638f925eeed921ee78c9c7..9f92fefa7880d65771fbbe70aedb13d2d039f58e 100644
--- a/test/mjsunit/compiler/property-static.js
+++ b/test/mjsunit/regress/regress-crbug-173907.js
@@ -27,43 +27,62 @@
 
 // Flags: --allow-natives-syntax
 
-// Test usage of static type information for loads that would otherwise
-// turn into polymorphic or generic loads.
+var X = 1.1;
+var K = 0.5;
 
-// Prepare a highly polymorphic load to be used by all tests.
-Object.prototype.load = function() { return this.property; };
-Object.prototype.load.call({ A:0, property:10 });
-Object.prototype.load.call({ A:0, B:0, property:11 });
-Object.prototype.load.call({ A:0, B:0, C:0, property:12 });
-Object.prototype.load.call({ A:0, B:0, C:0, D:0, property:13 });
-Object.prototype.load.call({ A:0, B:0, C:0, D:0, E:0, property:14 });
-Object.prototype.load.call({ A:0, B:0, C:0, D:0, E:0, F:0, property:15 });
+var O = 0;
+var result = new Float64Array(2);
 
-// Test for object literals.
-(function() {
-  function f(x) {
-    var object = { property:x };
-    return object.load();
-  }
+function spill() {
+  try { } catch (e) { }
+}
 
-  assertSame(1, f(1));
-  assertSame(2, f(2));
-  %OptimizeFunctionOnNextCall(f);
-  assertSame(3, f(3));
-})();
+function buggy() {
+  var v = X;
+  var phi1 = v + K;
+  var phi2 = v - K;
 
-// Test for inlined constructors.
-(function() {
-  function c(x) {
-    this.property = x;
-  }
-  function f(x) {
-    var object = new c(x);
-    return object.load();
+  spill();  // At this point initial values for phi1 and phi2 are spilled.
+
+  var xmm1 = v;
+  var xmm2 = v*v*v;
+  var xmm3 = v*v*v*v;
+  var xmm4 = v*v*v*v*v;
+  var xmm5 = v*v*v*v*v*v;
+  var xmm6 = v*v*v*v*v*v*v;
+  var xmm7 = v*v*v*v*v*v*v*v;
+  var xmm8 = v*v*v*v*v*v*v*v*v;
+
+  // All registers are blocked and phis for phi1 and phi2 are spilled because
+  // their left (incoming) value is spilled, there are no free registers,
+  // and phis themselves have only ANY-policy uses.
+
+  for (var x = 0; x < 2; x++) {
+    xmm1 += xmm1 * xmm6;
+    xmm2 += xmm1 * xmm5;
+    xmm3 += xmm1 * xmm4;
+    xmm4 += xmm1 * xmm3;
+    xmm5 += xmm1 * xmm2;
+
+    // Now swap values of phi1 and phi2 to create cycle between phis.
+    var t = phi1;
+    phi1 = phi2;
+    phi2 = t;
   }
 
-  assertSame(1, f(1));
-  assertSame(2, f(2));
-  %OptimizeFunctionOnNextCall(f);
-  assertSame(3, f(3));
-})();
+  // Now we want to get values of phi1 and phi2. However we would like to
+  // do it in a way that does not produce any uses of phi1&phi2 that have
+  // a register beneficial policy. How? We just hide these uses behind phis.
+  result[0] = (O === 0) ? phi1 : phi2;
+  result[1] = (O !== 0) ? phi1 : phi2;
+}
+
+function test() {
+  buggy();
+  assertArrayEquals([X + K, X - K], result);
+}
+
+test();
+test();
+%OptimizeFunctionOnNextCall(buggy);
+test();