Avoid hydrogen compare-objects-equal assertions in dead code

Avoid hydrogen compare-objects-equal assertions in dead code

ClusterFuzz test is triggering assertions for dead code. This fix issues
HDeoptimize instruction when it finds out that the compare instruction
is dead (because of previous checks).

R=yangguo@chromium.org
BUG=359491
LOG=N

Committed: https://code.google.com/p/v8/source/detail?r=20620

[Yang, 2014-04-09 07:59:47]

https://codereview.chromium.org/228883005/diff/1/test/mjsunit/regress/regress...
File test/mjsunit/regress/regress-359491.js (right):

https://codereview.chromium.org/228883005/diff/1/test/mjsunit/regress/regress...
test/mjsunit/regress/regress-359491.js:28: f();
function f(a, b, mode) {
  if (mode) {
    return a === b;
  } else {
    return a === b;
  }
}

// Gather type feedback for both branches.
f("a", "b", 1);
f("c", "d", 1);
f("a", "b", 0);
f("c", "d", 0);

function g(mode) {
  var x = 1e10 | 0;
  f(x, x, mode);
}

// Gather type feedback for g, but only on one branch for f.
g(1);
g(1);
%OptimizeFunctionOnNextCall(g);
// Optimize g, which inlines f. Both branches in f will see the constant.
g(0);

[Jarin, 2014-04-09 12:23:39]

Thanks for the beautiful test case! As discussed in person, I have update the
change with your test and changed the deoptimization from eager to soft.

On 2014/04/09 07:59:47, Yang wrote:
>
https://codereview.chromium.org/228883005/diff/1/test/mjsunit/regress/regress...
> File test/mjsunit/regress/regress-359491.js (right):
> 
>
https://codereview.chromium.org/228883005/diff/1/test/mjsunit/regress/regress...
> test/mjsunit/regress/regress-359491.js:28: f();
> function f(a, b, mode) {
>   if (mode) {
>     return a === b;
>   } else {
>     return a === b;
>   }
> }
> 
> // Gather type feedback for both branches.
> f("a", "b", 1);
> f("c", "d", 1);
> f("a", "b", 0);
> f("c", "d", 0);
> 
> function g(mode) {
>   var x = 1e10 | 0;
>   f(x, x, mode);
> }
> 
> // Gather type feedback for g, but only on one branch for f.
> g(1);
> g(1);
> %OptimizeFunctionOnNextCall(g);
> // Optimize g, which inlines f. Both branches in f will see the constant.
> g(0);

[Yang, 2014-04-09 12:26:38]

On 2014/04/09 12:23:39, jarin wrote:
> Thanks for the beautiful test case! As discussed in person, I have update the
> change with your test and changed the deoptimization from eager to soft.
> 
> On 2014/04/09 07:59:47, Yang wrote:
> >
>
https://codereview.chromium.org/228883005/diff/1/test/mjsunit/regress/regress...
> > File test/mjsunit/regress/regress-359491.js (right):
> > 
> >
>
https://codereview.chromium.org/228883005/diff/1/test/mjsunit/regress/regress...
> > test/mjsunit/regress/regress-359491.js:28: f();
> > function f(a, b, mode) {
> >   if (mode) {
> >     return a === b;
> >   } else {
> >     return a === b;
> >   }
> > }
> > 
> > // Gather type feedback for both branches.
> > f("a", "b", 1);
> > f("c", "d", 1);
> > f("a", "b", 0);
> > f("c", "d", 0);
> > 
> > function g(mode) {
> >   var x = 1e10 | 0;
> >   f(x, x, mode);
> > }
> > 
> > // Gather type feedback for g, but only on one branch for f.
> > g(1);
> > g(1);
> > %OptimizeFunctionOnNextCall(g);
> > // Optimize g, which inlines f. Both branches in f will see the constant.
> > g(0);

lgtm.

[Jarin, 2014-04-09 13:08:36]

Committed patchset #4 manually as r20620 (presubmit successful).