[turbofan] Properly cover memory operands in comparisons.

src/compiler/instruction-selector.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/instruction-selector.h"
 
 #include <limits>
 
 #include "src/base/adapters.h"
 #include "src/compiler/instruction-selector-impl.h"
@@ skipping 200 matching lines @@
 }
 
 
 Instruction* InstructionSelector::Emit(Instruction* instr) {
   instructions_.push_back(instr);
   return instr;
 }
 
 
 bool InstructionSelector::CanCover(Node* user, Node* node) const {
-  return node->OwnedBy(user) &&
-         schedule()->block(node) == schedule()->block(user) &&
-         (node->op()->HasProperty(Operator::kPure) ||
-          GetEffectLevel(node) == GetEffectLevel(user));
+  // 1. Both {user} and {node} must be in the same basic block.
+  if (schedule()->block(node) != schedule()->block(user)) {
+    return false;
+  }
+  // 2. Pure {node}s must be owned by the {user}.
+  if (node->op()->HasProperty(Operator::kPure)) {
+    return node->OwnedBy(user);
+  }
+  // 3. Impure {node}s must match the effect level of {user}.
+  if (GetEffectLevel(node) != GetEffectLevel(user)) {
+    return false;
+  }
+  // 4. Only {node} must have value edges pointing to {user}.
+  for (Edge const edge : node->use_edges()) {
+    if (edge.from() != user && NodeProperties::IsValueEdge(edge)) {
+      return false;
+    }
+  }
+  return true;
 }
 
 int InstructionSelector::GetVirtualRegister(const Node* node) {
   DCHECK_NOT_NULL(node);
   size_t const id = node->id();
   DCHECK_LT(id, virtual_registers_.size());
   int virtual_register = virtual_registers_[id];
   if (virtual_register == InstructionOperand::kInvalidVirtualRegister) {
     virtual_register = sequence()->NextVirtualRegister();
     virtual_registers_[id] = virtual_register;
@@ skipping 1455 matching lines @@
   return new (instruction_zone()) FrameStateDescriptor(
       instruction_zone(), state_info.type(), state_info.bailout_id(),
       state_info.state_combine(), parameters, locals, stack,
       state_info.shared_info(), outer_state);
 }
 
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8