Avoid hydrogen compare-objects-equal assertions in dead code

test/mjsunit/regress/regress-359491.js

Index: test/mjsunit/regress/regress-359491.js
diff --git a/test/mjsunit/regress/regress-359491.js b/test/mjsunit/regress/regress-359491.js
new file mode 100644
index 0000000000000000000000000000000000000000..1c94329c225eb92b0f4d994884d599841f8cf5a2
--- /dev/null
+++ b/test/mjsunit/regress/regress-359491.js
@@ -0,0 +1,28 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc --stress-opt
+
+function deepEquals(a, b) {
+  if (a === b) { }
+  if (a.splice) {
+    deepEquals(a[0], b[0]);
+  }
+}
+
+function assertEquals(a, b) {
+  deepEquals(a, b);
+}
+
+assertEquals(["x"], ["x"]);
+
+function f() {
+  gc();
+  gc();
+  var v = 1e+10 | 0;
+  deepEquals(-1, v);
+}
+f();
+f();
+f();

[Yang, 2014/04/09 07:59:47]

function f(a, b, mode) {
  if (mode) {
    return a === b;
  } else {
    return a === b;
  }
}

// Gather type feedback for both branches.
f("a", "b", 1);
f("c", "d", 1);
f("a", "b", 0);
f("c", "d", 0);

function g(mode) {
  var x = 1e10 | 0;
  f(x, x, mode);
}

// Gather type feedback for g, but only on one branch for f.
g(1);
g(1);
%OptimizeFunctionOnNextCall(g);
// Optimize g, which inlines f. Both branches in f will see the constant.
g(0);