Load elimination fix with a test case.

src/hydrogen.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 1181 matching lines @@
 
 
 void HGraphBuilder::AddIncrementCounter(StatsCounter* counter) {
   if (FLAG_native_code_counters && counter->Enabled()) {
     HValue* reference = Add<HConstant>(ExternalReference(counter));
     HValue* old_value = Add<HLoadNamedField>(reference,
                                              HObjectAccess::ForCounter());
     HValue* new_value = AddUncasted<HAdd>(old_value, graph()->GetConstant1());
     new_value->ClearFlag(HValue::kCanOverflow);  // Ignore counter overflow
     Add<HStoreNamedField>(reference, HObjectAccess::ForCounter(),
-                          new_value);
+                          new_value, STORE_TO_INITIALIZED_ENTRY);

[Igor Sheludko, 2014/01/27 15:14:16]

The counter should have been already initialized.

   }
 }
 
 
 void HGraphBuilder::AddSimulate(BailoutId id,
                                 RemovableSimulate removable) {
   ASSERT(current_block() != NULL);
   ASSERT(!graph()->IsInsideNoSideEffectsScope());
   current_block()->AddNewSimulate(id, position_, removable);
 }
@@ skipping 117 matching lines @@
   capacity_checker.Else();
 
   environment()->Push(elements);
   capacity_checker.End();
 
   if (is_js_array) {
     HValue* new_length = AddUncasted<HAdd>(key, graph_->GetConstant1());
     new_length->ClearFlag(HValue::kCanOverflow);
 
     Add<HStoreNamedField>(object, HObjectAccess::ForArrayLength(kind),
-                          new_length);
+                          new_length, INITIALIZING_STORE);
   }
 
   if (is_store && kind == FAST_SMI_ELEMENTS) {
     HValue* checked_elements = environment()->Top();
 
     // Write zero to ensure that the new element is initialized with some smi.
     Add<HStoreKeyed>(checked_elements, key, graph()->GetConstant0(), kind);
   }
 
   length_checker.Else();
@@ skipping 63 matching lines @@
     HInstruction* array_length = is_jsarray
         ? Add<HLoadNamedField>(object, HObjectAccess::ForArrayLength(from_kind))
         : elements_length;
 
     BuildGrowElementsCapacity(object, elements, from_kind, to_kind,
                               array_length, elements_length);
 
     if_builder.End();
   }
 
-  Add<HStoreNamedField>(object, HObjectAccess::ForMap(), map);
+  Add<HStoreNamedField>(object, HObjectAccess::ForMap(), map,
+                        INITIALIZING_STORE);
 }
 
 
 HValue* HGraphBuilder::BuildUncheckedDictionaryElementLoadHelper(
     HValue* elements,
     HValue* key,
     HValue* hash,
     HValue* mask,
     int current_probe) {
   if (current_probe == kNumberDictionaryProbes) {
@@ skipping 366 matching lines @@
   if_onebyte.Else();
   {
     // We can safely skip the write barrier for storing the map here.
     Handle<Map> map = isolate()->factory()->cons_string_map();
     AddStoreMapConstantNoWriteBarrier(result, map);
   }
   if_onebyte.End();
 
   // Initialize the cons string fields.
   Add<HStoreNamedField>(result, HObjectAccess::ForStringHashField(),
-                        Add<HConstant>(String::kEmptyHashField));
-  Add<HStoreNamedField>(result, HObjectAccess::ForStringLength(), length);
-  Add<HStoreNamedField>(result, HObjectAccess::ForConsStringFirst(), left);
-  Add<HStoreNamedField>(result, HObjectAccess::ForConsStringSecond(), right);
+                        Add<HConstant>(String::kEmptyHashField),
+                        INITIALIZING_STORE);
+  Add<HStoreNamedField>(result, HObjectAccess::ForStringLength(), length,
+                        INITIALIZING_STORE);
+  Add<HStoreNamedField>(result, HObjectAccess::ForConsStringFirst(), left,
+                        INITIALIZING_STORE);
+  Add<HStoreNamedField>(result, HObjectAccess::ForConsStringSecond(), right,
+                        INITIALIZING_STORE);
 
   // Count the native string addition.
   AddIncrementCounter(isolate()->counters()->string_add_native());
 
   return result;
 }
 
 
 void HGraphBuilder::BuildCopySeqStringChars(HValue* src,
                                             HValue* src_offset,
@@ skipping 128 matching lines @@
       // Allocate the string object. HAllocate does not care whether we pass
       // STRING_TYPE or ASCII_STRING_TYPE here, so we just use STRING_TYPE here.
       HAllocate* result = BuildAllocate(
           size, HType::String(), STRING_TYPE, allocation_mode);
 
       // We can safely skip the write barrier for storing map here.
       AddStoreMapNoWriteBarrier(result, map);
 
       // Initialize the string fields.
       Add<HStoreNamedField>(result, HObjectAccess::ForStringHashField(),
-                            Add<HConstant>(String::kEmptyHashField));
-      Add<HStoreNamedField>(result, HObjectAccess::ForStringLength(), length);
+                            Add<HConstant>(String::kEmptyHashField),
+                            INITIALIZING_STORE);
+      Add<HStoreNamedField>(result, HObjectAccess::ForStringLength(), length,
+                            INITIALIZING_STORE);
 
       // Copy characters to the result string.
       IfBuilder if_twobyte(this);
       if_twobyte.If<HCompareObjectEqAndBranch>(map, string_map);
       if_twobyte.Then();
       {
         // Copy characters from the left string.
         BuildCopySeqStringChars(
             left, graph()->GetConstant0(), String::TWO_BYTE_ENCODING,
             result, graph()->GetConstant0(), String::TWO_BYTE_ENCODING,
@@ skipping 276 matching lines @@
 void HGraphBuilder::BuildInitializeElementsHeader(HValue* elements,
                                                   ElementsKind kind,
                                                   HValue* capacity) {
   Factory* factory = isolate()->factory();
   Handle<Map> map = IsFastDoubleElementsKind(kind)
       ? factory->fixed_double_array_map()
       : factory->fixed_array_map();
 
   AddStoreMapConstant(elements, map);
   Add<HStoreNamedField>(elements, HObjectAccess::ForFixedArrayLength(),
-                        capacity);
+                        capacity, INITIALIZING_STORE);
 }
 
 
 HValue* HGraphBuilder::BuildAllocateElementsAndInitializeElementsHeader(
     ElementsKind kind,
     HValue* capacity) {
   // The HForceRepresentation is to prevent possible deopt on int-smi
   // conversion after allocation but before the new object fields are set.
   capacity = AddUncasted<HForceRepresentation>(capacity, Representation::Smi());
   HValue* new_elements = BuildAllocateElements(kind, capacity);
   BuildInitializeElementsHeader(new_elements, kind, capacity);
   return new_elements;
 }
 
 
 HInnerAllocatedObject* HGraphBuilder::BuildJSArrayHeader(HValue* array,
     HValue* array_map,
     AllocationSiteMode mode,
     ElementsKind elements_kind,
     HValue* allocation_site_payload,
     HValue* length_field) {
 
-  Add<HStoreNamedField>(array, HObjectAccess::ForMap(), array_map);
+  Add<HStoreNamedField>(array, HObjectAccess::ForMap(), array_map,
+                        INITIALIZING_STORE);
 
   HConstant* empty_fixed_array =
     Add<HConstant>(isolate()->factory()->empty_fixed_array());
 
   HObjectAccess access = HObjectAccess::ForPropertiesPointer();
-  Add<HStoreNamedField>(array, access, empty_fixed_array);
+  Add<HStoreNamedField>(array, access, empty_fixed_array, INITIALIZING_STORE);
   Add<HStoreNamedField>(array, HObjectAccess::ForArrayLength(elements_kind),
-                        length_field);
+                        length_field, INITIALIZING_STORE);
 
   if (mode == TRACK_ALLOCATION_SITE) {
     BuildCreateAllocationMemento(
         array, Add<HConstant>(JSArray::kSize), allocation_site_payload);
   }
 
   int elements_location = JSArray::kSize;
   if (mode == TRACK_ALLOCATION_SITE) {
     elements_location += AllocationMemento::kSize;
   }
 
   HInnerAllocatedObject* elements = Add<HInnerAllocatedObject>(
       array, Add<HConstant>(elements_location));
-  Add<HStoreNamedField>(array, HObjectAccess::ForElementsPointer(), elements);
+  Add<HStoreNamedField>(array, HObjectAccess::ForElementsPointer(), elements,
+                        INITIALIZING_STORE);
   return elements;
 }
 
 
 HInstruction* HGraphBuilder::AddElementAccess(
     HValue* elements,
     HValue* checked_key,
     HValue* val,
     HValue* dependency,
     ElementsKind elements_kind,
@@ skipping 70 matching lines @@
   BuildNewSpaceArrayCheck(new_capacity, new_kind);
 
   HValue* new_elements = BuildAllocateElementsAndInitializeElementsHeader(
       new_kind, new_capacity);
 
   BuildCopyElements(elements, kind,
                     new_elements, new_kind,
                     length, new_capacity);
 
   Add<HStoreNamedField>(object, HObjectAccess::ForElementsPointer(),
-                        new_elements);
+                        new_elements, INITIALIZING_STORE);
 
   return new_elements;
 }
 
 
 void HGraphBuilder::BuildFillElementsWithHole(HValue* elements,
                                               ElementsKind elements_kind,
                                               HValue* from,
                                               HValue* to) {
   // Fast elements kinds need to be initialized in case statements below cause
@@ skipping 20 matching lines @@
 
   // Since we're about to store a hole value, the store instruction below must
   // assume an elements kind that supports heap object values.
   if (IsFastSmiOrObjectElementsKind(elements_kind)) {
     elements_kind = FAST_HOLEY_ELEMENTS;
   }
 
   if (initial_capacity >= 0) {
     for (int i = 0; i < initial_capacity; i++) {
       HInstruction* key = Add<HConstant>(i);
-      Add<HStoreKeyed>(elements, key, hole, elements_kind);
+      Add<HStoreKeyed>(elements, key, hole, elements_kind,
+                       PREINITIALIZING_STORE);
     }
   } else {
     LoopBuilder builder(this, context(), LoopBuilder::kPostIncrement);
 
     HValue* key = builder.BeginBody(from, to, Token::LT);
 
-    Add<HStoreKeyed>(elements, key, hole, elements_kind);
+    Add<HStoreKeyed>(elements, key, hole, elements_kind, PREINITIALIZING_STORE);
 
     builder.EndBody();
   }
 }
 
 
 void HGraphBuilder::BuildCopyElements(HValue* from_elements,
                                       ElementsKind from_elements_kind,
                                       HValue* to_elements,
                                       ElementsKind to_elements_kind,
@@ skipping 69 matching lines @@
   HInstruction* object = Add<HAllocate>(size_in_bytes,
                                         HType::JSObject(),
                                         NOT_TENURED,
                                         JS_OBJECT_TYPE);
 
   // Copy the JS array part.
   for (int i = 0; i < JSArray::kSize; i += kPointerSize) {
     if ((i != JSArray::kElementsOffset) || (length == 0)) {
       HObjectAccess access = HObjectAccess::ForJSArrayOffset(i);
       Add<HStoreNamedField>(object, access,
-                            Add<HLoadNamedField>(boilerplate, access));
+                            Add<HLoadNamedField>(boilerplate, access),
+                            INITIALIZING_STORE);
     }
   }
 
   // Create an allocation site info if requested.
   if (mode == TRACK_ALLOCATION_SITE) {
     BuildCreateAllocationMemento(
         object, Add<HConstant>(JSArray::kSize), allocation_site);
   }
 
   if (length > 0) {
     HValue* boilerplate_elements = AddLoadElements(boilerplate);
     HValue* object_elements;
     if (IsFastDoubleElementsKind(kind)) {
       HValue* elems_size = Add<HConstant>(FixedDoubleArray::SizeFor(length));
       object_elements = Add<HAllocate>(elems_size, HType::JSArray(),
           NOT_TENURED, FIXED_DOUBLE_ARRAY_TYPE);
     } else {
       HValue* elems_size = Add<HConstant>(FixedArray::SizeFor(length));
       object_elements = Add<HAllocate>(elems_size, HType::JSArray(),
           NOT_TENURED, FIXED_ARRAY_TYPE);
     }
     Add<HStoreNamedField>(object, HObjectAccess::ForElementsPointer(),
-                          object_elements);
+                          object_elements, INITIALIZING_STORE);
 
     // Copy the elements array header.
     for (int i = 0; i < FixedArrayBase::kHeaderSize; i += kPointerSize) {
       HObjectAccess access = HObjectAccess::ForFixedArrayHeader(i);
       Add<HStoreNamedField>(object_elements, access,
-                            Add<HLoadNamedField>(boilerplate_elements, access));
+                            Add<HLoadNamedField>(boilerplate_elements, access),
+                            INITIALIZING_STORE);
     }
 
     // Copy the elements array contents.
     // TODO(mstarzinger): Teach HGraphBuilder::BuildCopyElements to unfold
     // copying loops with constant length up to a given boundary and use this
     // helper here instead.
     for (int i = 0; i < length; i++) {
       HValue* key_constant = Add<HConstant>(i);
       HInstruction* value = Add<HLoadKeyed>(boilerplate_elements, key_constant,
                                             static_cast<HValue*>(NULL), kind);
@@ skipping 60 matching lines @@
 void HGraphBuilder::BuildCreateAllocationMemento(
     HValue* previous_object,
     HValue* previous_object_size,
     HValue* allocation_site) {
   ASSERT(allocation_site != NULL);
   HInnerAllocatedObject* allocation_memento = Add<HInnerAllocatedObject>(
       previous_object, previous_object_size);
   AddStoreMapConstant(
       allocation_memento, isolate()->factory()->allocation_memento_map());
   Add<HStoreNamedField>(
-      allocation_memento,
-      HObjectAccess::ForAllocationMementoSite(),
-      allocation_site);
+      allocation_memento, HObjectAccess::ForAllocationMementoSite(),
+      allocation_site, INITIALIZING_STORE);
   if (FLAG_allocation_site_pretenuring) {
     HValue* memento_create_count = Add<HLoadNamedField>(
         allocation_site, HObjectAccess::ForAllocationSiteOffset(
             AllocationSite::kPretenureCreateCountOffset));
     memento_create_count = AddUncasted<HAdd>(
         memento_create_count, graph()->GetConstant1());
     // This smi value is reset to zero after every gc, overflow isn't a problem
     // since the counter is bounded by the new space size.
     memento_create_count->ClearFlag(HValue::kCanOverflow);
     HStoreNamedField* store = Add<HStoreNamedField>(
         allocation_site, HObjectAccess::ForAllocationSiteOffset(
-            AllocationSite::kPretenureCreateCountOffset), memento_create_count);
+            AllocationSite::kPretenureCreateCountOffset), memento_create_count,
+        INITIALIZING_STORE);
     // No write barrier needed to store a smi.
     store->SkipWriteBarrier();
   }
 }
 
 
 HInstruction* HGraphBuilder::BuildGetNativeContext(HValue* closure) {
   // Get the global context, then the native context
   HInstruction* context =
       Add<HLoadNamedField>(closure, HObjectAccess::ForFunctionContextPointer());
@@ skipping 194 matching lines @@
                                          graph()->GetConstant0(), capacity);
   }
 
   return new_object;
 }
 
 
 HStoreNamedField* HGraphBuilder::AddStoreMapConstant(HValue *object,
                                                      Handle<Map> map) {
   return Add<HStoreNamedField>(object, HObjectAccess::ForMap(),
-                               Add<HConstant>(map));
+                               Add<HConstant>(map), INITIALIZING_STORE);
 }
 
 
 HValue* HGraphBuilder::AddLoadJSBuiltin(Builtins::JavaScript builtin) {
   HGlobalObject* global_object = Add<HGlobalObject>();
   HObjectAccess access = HObjectAccess::ForJSObjectOffset(
       GlobalObject::kBuiltinsOffset);
   HValue* builtins = Add<HLoadNamedField>(global_object, access);
   HObjectAccess function_access = HObjectAccess::ForJSObjectOffset(
       JSBuiltinsObject::OffsetOfFunctionWithId(builtin));
@@ skipping 2371 matching lines @@
         field_access.WithRepresentation(Representation::Tagged());
     if (transition_to_field) {
       // The store requires a mutable HeapNumber to be allocated.
       NoObservableSideEffectsScope no_side_effects(this);
       HInstruction* heap_number_size = Add<HConstant>(HeapNumber::kSize);
       HInstruction* heap_number = Add<HAllocate>(heap_number_size,
           HType::HeapNumber(), isolate()->heap()->GetPretenureMode(),
           HEAP_NUMBER_TYPE);
       AddStoreMapConstant(heap_number, isolate()->factory()->heap_number_map());
       Add<HStoreNamedField>(heap_number, HObjectAccess::ForHeapNumberValue(),
-                            value);
+                            value, INITIALIZING_STORE);
       instr = New<HStoreNamedField>(checked_object->ActualValue(),
                                     heap_number_access,
-                                    heap_number);
+                                    heap_number, INITIALIZING_STORE);
     } else {
       // Already holds a HeapNumber; load the box and write its value field.
       HInstruction* heap_number = Add<HLoadNamedField>(checked_object,
                                                        heap_number_access);
       heap_number->set_type(HType::HeapNumber());
       instr = New<HStoreNamedField>(heap_number,
                                     HObjectAccess::ForHeapNumberValue(),
-                                    value);
+                                    value, STORE_TO_INITIALIZED_ENTRY);

[Igor Sheludko, 2014/01/27 15:14:16]

The heap number should have been initialized when the field was added.

     }
   } else {
     // This is a normal store.
     instr = New<HStoreNamedField>(
         checked_object->ActualValue(), field_access, value,
         transition_to_field ? INITIALIZING_STORE : STORE_TO_INITIALIZED_ENTRY);
   }
 
   if (transition_to_field) {
     Handle<Map> transition(lookup->GetTransitionMapFromMap(*map));
@@ skipping 2359 matching lines @@
             ? Add<HConstant>(factory->the_hole_value())
             : Add<HConstant>(nan_double);
         if (IsFastSmiOrObjectElementsKind(elements_kind)) {
           elements_kind = FAST_HOLEY_ELEMENTS;
         }
         AddElementAccess(
             elements, reduced_length, hole, bounds_check, elements_kind, true);
       }
       Add<HStoreNamedField>(
           checked_object, HObjectAccess::ForArrayLength(elements_kind),
-          reduced_length);
+          reduced_length, STORE_TO_INITIALIZED_ENTRY);

[Igor Sheludko, 2014/01/27 15:14:16]

The array length should have been initialized earlier.

       if (!ast_context()->IsEffect()) Push(result);
       Add<HSimulate>(expr->id(), REMOVABLE_SIMULATE);
       if (!ast_context()->IsEffect()) Drop(1);
       ast_context()->ReturnValue(result);
       return true;
     }
     case kArrayPush: {
       if (!expr->IsMonomorphic() || expr->check_type() != RECEIVER_MAP_CHECK) {
         return false;
       }
@@ skipping 517 matching lines @@
     HValue* constructor_value = Add<HConstant>(constructor);
     HValue* initial_map_value =
       Add<HLoadNamedField>(constructor_value, HObjectAccess::ForJSObjectOffset(
             JSFunction::kPrototypeOrInitialMapOffset));
 
     // Initialize map and fields of the newly allocated object.
     { NoObservableSideEffectsScope no_effects(this);
       ASSERT(initial_map->instance_type() == JS_OBJECT_TYPE);
       Add<HStoreNamedField>(receiver,
           HObjectAccess::ForJSObjectOffset(JSObject::kMapOffset),
-          initial_map_value);
+          initial_map_value, INITIALIZING_STORE);
       HValue* empty_fixed_array = Add<HConstant>(factory->empty_fixed_array());
       Add<HStoreNamedField>(receiver,
           HObjectAccess::ForJSObjectOffset(JSObject::kPropertiesOffset),
-          empty_fixed_array);
+          empty_fixed_array, INITIALIZING_STORE);
       Add<HStoreNamedField>(receiver,
           HObjectAccess::ForJSObjectOffset(JSObject::kElementsOffset),
-          empty_fixed_array);
+          empty_fixed_array, INITIALIZING_STORE);
       if (initial_map->inobject_properties() != 0) {
         HConstant* undefined = graph()->GetConstantUndefined();
         for (int i = 0; i < initial_map->inobject_properties(); i++) {
           int property_offset = JSObject::kHeaderSize + i * kPointerSize;
           Add<HStoreNamedField>(receiver,
               HObjectAccess::ForJSObjectOffset(property_offset),
-              undefined);
+              undefined, PREINITIALIZING_STORE);
         }
       }
     }
 
     // Replace the constructor function with a newly allocated receiver using
     // the index of the receiver from the top of the expression stack.
     const int receiver_index = argument_count - 1;
     ASSERT(environment()->ExpressionStackAt(receiver_index) == function);
     environment()->SetExpressionStackAt(receiver_index, receiver);
 
@@ skipping 64 matching lines @@
     HValue* obj,
     HValue* buffer,
     HValue* byte_offset,
     HValue* byte_length) {
 
   for (int offset = ViewClass::kSize;
        offset < ViewClass::kSizeWithInternalFields;
        offset += kPointerSize) {
     Add<HStoreNamedField>(obj,
         HObjectAccess::ForJSObjectOffset(offset),
-        Add<HConstant>(static_cast<int32_t>(0)));
+        graph()->GetConstant0(), INITIALIZING_STORE);
   }
 
   Add<HStoreNamedField>(
       obj,
-      HObjectAccess::ForJSArrayBufferViewBuffer(), buffer);
+      HObjectAccess::ForJSArrayBufferViewBuffer(), buffer, INITIALIZING_STORE);
   Add<HStoreNamedField>(
       obj,
       HObjectAccess::ForJSArrayBufferViewByteOffset(),
-      byte_offset);
+      byte_offset, INITIALIZING_STORE);
   Add<HStoreNamedField>(
       obj,
       HObjectAccess::ForJSArrayBufferViewByteLength(),
-      byte_length);
+      byte_length, INITIALIZING_STORE);
 
   HObjectAccess weak_first_view_access =
       HObjectAccess::ForJSArrayBufferWeakFirstView();
   Add<HStoreNamedField>(obj,
       HObjectAccess::ForJSArrayBufferViewWeakNext(),
-      Add<HLoadNamedField>(buffer, weak_first_view_access));
-  Add<HStoreNamedField>(buffer, weak_first_view_access, obj);
+      Add<HLoadNamedField>(buffer, weak_first_view_access),
+      INITIALIZING_STORE);
+  Add<HStoreNamedField>(
+      buffer, weak_first_view_access, obj, INITIALIZING_STORE);
 }
 
 
 void HOptimizedGraphBuilder::VisitDataViewInitialize(
     CallRuntime* expr) {
   ZoneList<Expression*>* arguments = expr->arguments();
 
   NoObservableSideEffectsScope scope(this);
   ASSERT(arguments->length()== 4);
   CHECK_ALIVE(VisitForValue(arguments->at(0)));
@@ skipping 69 matching lines @@
 
     ExternalArrayType array_type = kExternalInt8Array;  // Bogus initialization.
     size_t element_size = 1;  // Bogus initialization.
     Runtime::ArrayIdToTypeAndSize(array_id, &array_type, &element_size);
 
     HInstruction* length = AddUncasted<HDiv>(byte_length,
         Add<HConstant>(static_cast<int32_t>(element_size)));
 
     Add<HStoreNamedField>(obj,
         HObjectAccess::ForJSTypedArrayLength(),
-        length);
+        length, INITIALIZING_STORE);
 
     HValue* elements =
         Add<HAllocate>(
             Add<HConstant>(ExternalArray::kAlignedSize),
             HType::JSArray(),
             NOT_TENURED,
             static_cast<InstanceType>(FIRST_EXTERNAL_ARRAY_TYPE + array_type));
 
     Handle<Map> external_array_map(
         isolate()->heap()->MapForExternalArrayType(array_type));
-    Add<HStoreNamedField>(elements,
-        HObjectAccess::ForMap(),
-        Add<HConstant>(external_array_map));
+    AddStoreMapConstant(elements, external_array_map);
 
     HValue* backing_store = Add<HLoadNamedField>(
         buffer, HObjectAccess::ForJSArrayBufferBackingStore());
 
     HValue* typed_array_start;
     if (is_zero_byte_offset) {
       typed_array_start = backing_store;
     } else {
       HInstruction* external_pointer =
           AddUncasted<HAdd>(backing_store, byte_offset);
       // Arguments are checked prior to call to TypedArrayInitialize,
       // including byte_offset.
       external_pointer->ClearFlag(HValue::kCanOverflow);
       typed_array_start = external_pointer;
     }
 
-    Add<HStoreNamedField>(elements,
-        HObjectAccess::ForExternalArrayExternalPointer(),
-        typed_array_start);
-    Add<HStoreNamedField>(elements,
-        HObjectAccess::ForFixedArrayLength(),
-        length);
     Add<HStoreNamedField>(
-        obj, HObjectAccess::ForElementsPointer(), elements);
+        elements, HObjectAccess::ForExternalArrayExternalPointer(),
+        typed_array_start, INITIALIZING_STORE);
+    Add<HStoreNamedField>(
+        elements, HObjectAccess::ForFixedArrayLength(), length,
+        INITIALIZING_STORE);
+    Add<HStoreNamedField>(
+        obj, HObjectAccess::ForElementsPointer(), elements, INITIALIZING_STORE);
   }
 
   if (!is_zero_byte_offset) {
     byte_offset_smi.Else();
     { //  byte_offset is not Smi.
       Push(Add<HPushArgument>(obj));
       VisitArgument(arguments->at(kArrayIdArg));
       Push(Add<HPushArgument>(buffer));
       Push(Add<HPushArgument>(byte_offset));
       Push(Add<HPushArgument>(byte_length));
@@ skipping 1216 matching lines @@
   ASSERT(boilerplate_object->properties()->length() == 0);
 
   Handle<Map> boilerplate_object_map(boilerplate_object->map());
   AddStoreMapConstant(object, boilerplate_object_map);
 
   Handle<Object> properties_field =
       Handle<Object>(boilerplate_object->properties(), isolate());
   ASSERT(*properties_field == isolate()->heap()->empty_fixed_array());
   HInstruction* properties = Add<HConstant>(properties_field);
   HObjectAccess access = HObjectAccess::ForPropertiesPointer();
-  Add<HStoreNamedField>(object, access, properties);
+  Add<HStoreNamedField>(object, access, properties, INITIALIZING_STORE);
 
   if (boilerplate_object->IsJSArray()) {
     Handle<JSArray> boilerplate_array =
         Handle<JSArray>::cast(boilerplate_object);
     Handle<Object> length_field =
         Handle<Object>(boilerplate_array->length(), isolate());
     HInstruction* length = Add<HConstant>(length_field);
 
     ASSERT(boilerplate_array->length()->IsSmi());
     Add<HStoreNamedField>(object, HObjectAccess::ForArrayLength(
-        boilerplate_array->GetElementsKind()), length);
+        boilerplate_array->GetElementsKind()), length, INITIALIZING_STORE);
   }
 }
 
 
 void HOptimizedGraphBuilder::BuildInitElementsInObjectHeader(
     Handle<JSObject> boilerplate_object,
     HInstruction* object,
     HInstruction* object_elements) {
   ASSERT(boilerplate_object->properties()->length() == 0);
   if (object_elements == NULL) {
     Handle<Object> elements_field =
         Handle<Object>(boilerplate_object->elements(), isolate());
     object_elements = Add<HConstant>(elements_field);
   }
   Add<HStoreNamedField>(object, HObjectAccess::ForElementsPointer(),
-      object_elements);
+      object_elements, INITIALIZING_STORE);
 }
 
 
 void HOptimizedGraphBuilder::BuildEmitInObjectProperties(
     Handle<JSObject> boilerplate_object,
     HInstruction* object,
     AllocationSiteUsageContext* site_context,
     PretenureFlag pretenure_flag) {
   Handle<DescriptorArray> descriptors(
       boilerplate_object->map()->instance_descriptors());
@@ skipping 15 matching lines @@
     HObjectAccess access = boilerplate_object->IsJSArray() ?
         HObjectAccess::ForJSArrayOffset(property_offset) :
         HObjectAccess::ForJSObjectOffset(property_offset);
 
     if (value->IsJSObject()) {
       Handle<JSObject> value_object = Handle<JSObject>::cast(value);
       Handle<AllocationSite> current_site = site_context->EnterNewScope();
       HInstruction* result =
           BuildFastLiteral(value_object, site_context);
       site_context->ExitScope(current_site, value_object);
-      Add<HStoreNamedField>(object, access, result);
+      Add<HStoreNamedField>(object, access, result, INITIALIZING_STORE);
     } else {
       Representation representation = details.representation();
       HInstruction* value_instruction;
 
       if (representation.IsDouble()) {
         // Allocate a HeapNumber box and store the value into it.
         HValue* heap_number_constant = Add<HConstant>(HeapNumber::kSize);
         // This heap number alloc does not have a corresponding
         // AllocationSite. That is okay because
         // 1) it's a child object of another object with a valid allocation site
         // 2) we can just use the mode of the parent object for pretenuring
         HInstruction* double_box =
             Add<HAllocate>(heap_number_constant, HType::HeapNumber(),
                 pretenure_flag, HEAP_NUMBER_TYPE);
         AddStoreMapConstant(double_box,
             isolate()->factory()->heap_number_map());
         Add<HStoreNamedField>(double_box, HObjectAccess::ForHeapNumberValue(),
-                              Add<HConstant>(value));
+                              Add<HConstant>(value), INITIALIZING_STORE);
         value_instruction = double_box;
       } else if (representation.IsSmi() && value->IsUninitialized()) {
         value_instruction = graph()->GetConstant0();
       } else {
         value_instruction = Add<HConstant>(value);
       }
 
-      Add<HStoreNamedField>(object, access, value_instruction);
+      Add<HStoreNamedField>(object, access, value_instruction,
+                            INITIALIZING_STORE);
     }
   }
 
   int inobject_properties = boilerplate_object->map()->inobject_properties();
   HInstruction* value_instruction =
       Add<HConstant>(isolate()->factory()->one_pointer_filler_map());
   for (int i = copied_fields; i < inobject_properties; i++) {
     ASSERT(boilerplate_object->IsJSObject());
     int property_offset = boilerplate_object->GetInObjectPropertyOffset(i);
     HObjectAccess access = HObjectAccess::ForJSObjectOffset(property_offset);
-    Add<HStoreNamedField>(object, access, value_instruction);
+    Add<HStoreNamedField>(object, access, value_instruction,
+                          PREINITIALIZING_STORE);

[Igor Sheludko, 2014/01/27 15:14:16]

It seems that we are initializing data "outside" of the object.

   }
 }
 
 
 void HOptimizedGraphBuilder::BuildEmitElements(
     Handle<JSObject> boilerplate_object,
     Handle<FixedArrayBase> elements,
     HValue* object_elements,
     AllocationSiteUsageContext* site_context) {
   ElementsKind kind = boilerplate_object->map()->elements_kind();
@@ skipping 432 matching lines @@
   HBasicBlock* if_js_value = graph()->CreateBasicBlock();
   HBasicBlock* not_js_value = graph()->CreateBasicBlock();
   typecheck->SetSuccessorAt(0, if_js_value);
   typecheck->SetSuccessorAt(1, not_js_value);
   FinishCurrentBlock(typecheck);
   Goto(not_js_value, join);
 
   // Create in-object property store to kValueOffset.
   set_current_block(if_js_value);
   Add<HStoreNamedField>(object,
-      HObjectAccess::ForJSObjectOffset(JSValue::kValueOffset), value);
+      HObjectAccess::ForJSObjectOffset(JSValue::kValueOffset), value,
+      INITIALIZING_STORE);
   Goto(if_js_value, join);
   join->SetJoinId(call->id());
   set_current_block(join);
   return ast_context()->ReturnValue(value);
 }
 
 
 // Fast support for charCodeAt(n).
 void HOptimizedGraphBuilder::GenerateStringCharCodeAt(CallRuntime* call) {
   ASSERT(call->arguments()->length() == 2);
@@ skipping 841 matching lines @@
   if (ShouldProduceTraceOutput()) {
     isolate()->GetHTracer()->TraceHydrogen(name(), graph_);
   }
 
 #ifdef DEBUG
   graph_->Verify(false);  // No full verify.
 #endif
 }
 
 } }  // namespace v8::internal