Don't try to unlink instructions twice during GVN

src/hydrogen.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 2702 matching lines @@
                       instr->id(),
                       instr->Mnemonic(),
                       other->id(),
                       other->Mnemonic());
           if (instr->HasSideEffects()) removed_side_effects_ = true;
           instr->DeleteAndReplaceWith(other);
         } else {
           map->Add(instr, zone());
         }
       }
-      if (instr->CheckFlag(HValue::kTrackSideEffectDominators)) {
+      if (instr->IsLinked() &&
+          instr->CheckFlag(HValue::kTrackSideEffectDominators)) {
         for (int i = 0; i < kNumberOfTrackedSideEffects; i++) {
           HValue* other = dominators->at(i);
           GVNFlag changes_flag = HValue::ChangesFlagFromInt(i);
           GVNFlag depends_on_flag = HValue::DependsOnFlagFromInt(i);
           if (instr->DependsOnFlags().Contains(depends_on_flag) &&
               (other != NULL)) {
             TRACE_GVN_5("Side-effect #%d in %d (%s) is dominated by %d (%s)\n",
                         i,
                         instr->id(),
                         instr->Mnemonic(),
                         other->id(),
                         other->Mnemonic());
             instr->SetSideEffectDominator(changes_flag, other);

[Michael Starzinger, 2013/02/12 13:58:23]

There is another corner-case that is not yet covered. If
SetSideEffectDominator() removes the instruction from the graph, it might still
be present in the GVN map. This might lead to a subsequent call to
DeleteAndReplaceWith() where "other" is no longer in the graph.

I don't think this happens with the graphs we build ATM, but it is a general
problem when we allow SetSideEffectDominator() so delete instructions from the
graph. I am find with landing this change to fix the immediate problem though.

           }
         }
       }
       instr = next;
     }
 
     HBasicBlock* dominator_block;
     GvnBasicBlockState* next =
         current->next_in_dominator_tree_traversal(zone(), &dominator_block);
 
@@ skipping 7883 matching lines @@
     }
   }
 
 #ifdef DEBUG
   if (graph_ != NULL) graph_->Verify(false);  // No full verify.
   if (allocator_ != NULL) allocator_->Verify();
 #endif
 }
 
 } }  // namespace v8::internal