Remake of the load elimination fix made earlier (r18884).

src/hydrogen-load-elimination.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 175 matching lines @@
   }
 
   friend class HLoadEliminationEffects;  // Calls Kill() and others.
   friend class HLoadEliminationPhase;
 
  private:
   // Process a load instruction, updating internal table state. If a previous
   // load or store for this object and field exists, return the new value with
   // which the load should be replaced. Otherwise, return {instr}.
   HValue* load(HLoadNamedField* instr) {
+    // There must be no loads from non observable in-object properties.

[Igor Sheludko, 2014/02/03 19:17:58]

New code.

+    ASSERT(!instr->access().IsInobject() ||
+           instr->access().existing_inobject_property());
+
     int field = FieldOf(instr->access());
     if (field < 0) return instr;
 
     HValue* object = instr->object()->ActualValue();
     HFieldApproximation* approx = FindOrCreate(object, field);
 
     if (approx->last_value_ == NULL) {
       // Load is not redundant. Fill out a new entry.
       approx->last_value_ = instr;
       return instr;
     } else if (approx->last_value_->block()->EqualToOrDominates(
         instr->block())) {
       // Eliminate the load. Reuse previously stored value or load instruction.
       return approx->last_value_;
     } else {
       return instr;
     }
   }
 
   // Process a store instruction, updating internal table state. If a previous
   // store to the same object and field makes this store redundant (e.g. because
   // the stored values are the same), return NULL indicating that this store
   // instruction is redundant. Otherwise, return {instr}.
   HValue* store(HStoreNamedField* instr) {
-    if (instr->store_mode() == PREINITIALIZING_STORE) {
-      TRACE(("  skipping preinitializing store\n"));
+    if (instr->access().IsInobject() &&

[Igor Sheludko, 2014/02/03 19:17:58]

New code.

+        !instr->access().existing_inobject_property()) {
+      TRACE(("  skipping non existing property initialization store\n"));
       return instr;
     }
 
     int field = FieldOf(instr->access());
     if (field < 0) return KillIfMisaligned(instr);
 
     HValue* object = instr->object()->ActualValue();
     HValue* value = instr->value();
 
     if (instr->has_transition()) {
@@ skipping 279 matching lines @@
   } else {
     // Perform only local analysis.
     for (int i = 0; i < graph()->blocks()->length(); i++) {
       table->Kill();
       engine.AnalyzeOneBlock(graph()->blocks()->at(i), table);
     }
   }
 }
 
 } }  // namespace v8::internal