Fixes bug where we would occasionally materialize a corrupted object.

runtime/vm/intermediate_language.cc

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/intermediate_language.h"
 
 #include "vm/bigint_operations.h"
 #include "vm/bit_vector.h"
 #include "vm/cpu.h"
 #include "vm/dart_entry.h"
@@ skipping 2022 matching lines @@
   UNREACHABLE();
   return NULL;
 }
 
 
 void MaterializeObjectInstr::EmitNativeCode(FlowGraphCompiler* compiler) {
   UNREACHABLE();
 }
 
 
+// This function should be kept in sync with
+// FlowGraphCompiler::SlowPathEnvironmentFor().
+void MaterializeObjectInstr::RemapRegisters(intptr_t* fpu_reg_slots,
+                                            intptr_t* cpu_reg_slots) {
+  for (intptr_t i = 0; i < InputCount(); i++) {
+    Location loc = LocationAt(i);
+    if (loc.IsRegister()) {
+      intptr_t index = cpu_reg_slots[loc.reg()];
+      ASSERT(index >= 0);
+      // OS::PrintErr("REMAPPING register xx(%d)\n", loc.reg());

[Florian Schneider, 2014/04/25 05:55:33]

Remove commented-out code.

[turnidge, 2014/04/25 20:16:33]

Done.

+      locations_[i] = Location::StackSlot(index);
+    } else if (loc.IsFpuRegister()) {
+      intptr_t index = fpu_reg_slots[loc.fpu_reg()];
+      ASSERT(index >= 0);
+      Value* value = InputAt(i);
+      switch (value->definition()->representation()) {
+        case kUnboxedDouble:
+        case kUnboxedMint:
+          locations_[i] = Location::DoubleStackSlot(index);
+          break;
+        case kUnboxedFloat32x4:
+        case kUnboxedInt32x4:
+        case kUnboxedFloat64x2:
+          locations_[i] = Location::QuadStackSlot(index);
+          break;
+        default:
+          UNREACHABLE();
+      }
+    } else if (loc.IsInvalid()) {
+      // TODO(turnidge): Can materialized objects refer to other

[Florian Schneider, 2014/04/25 05:55:33]

I think right now this is the case - it may change in the future if we want to
do allocation sinking for nested objects: Currently, we perform only one
iteration of allocation sinking. If we did it iteratively, then one materialize
object could reference another.

Also, a materialized object can't have a reference to itself, since all stores
would make the allocation-site aliased and therefore not considered a sinking
candidate.

[turnidge, 2014/04/25 20:16:33]

Updated comment.

+      // materialized objects?  If so, then we need to recurse here.
+      // Additionally, we might also need to check for cycles in the
+      // graph of materialized objects to avoid getting stuck.  For
+      // now, mark this UNREACHABLE.
+      UNREACHABLE();
+    }
+  }
+}
+
+
 LocationSummary* StoreContextInstr::MakeLocationSummary(bool optimizing) const {
   const intptr_t kNumInputs = 1;
   const intptr_t kNumTemps = 0;
   LocationSummary* summary =
       new LocationSummary(kNumInputs, kNumTemps, LocationSummary::kNoCall);
   summary->set_in(0, Location::RegisterLocation(CTX));
   return summary;
 }
 
 
@@ skipping 1198 matching lines @@
     case Token::kTRUNCDIV: return 0;
     case Token::kMOD: return 1;
     default: UNIMPLEMENTED(); return -1;
   }
 }
 
 
 #undef __
 
 }  // namespace dart