Fixes bug where we would occasionally materialize a corrupted object.

runtime/vm/intermediate_language.cc

Index: runtime/vm/intermediate_language.cc
diff --git a/runtime/vm/intermediate_language.cc b/runtime/vm/intermediate_language.cc
index c296af7fc6af0b26e75b23c6c05cc73831f63700..bd24b37f97316d3ccd4ad4757794b6925c0aa842 100644
--- a/runtime/vm/intermediate_language.cc
+++ b/runtime/vm/intermediate_language.cc
@@ -2040,6 +2040,46 @@ void MaterializeObjectInstr::EmitNativeCode(FlowGraphCompiler* compiler) {
 }
 
 
+// This function should be kept in sync with
+// FlowGraphCompiler::SlowPathEnvironmentFor().
+void MaterializeObjectInstr::RemapRegisters(intptr_t* fpu_reg_slots,
+                                            intptr_t* cpu_reg_slots) {
+  for (intptr_t i = 0; i < InputCount(); i++) {
+    Location loc = LocationAt(i);
+    if (loc.IsRegister()) {
+      intptr_t index = cpu_reg_slots[loc.reg()];
+      ASSERT(index >= 0);
+      // OS::PrintErr("REMAPPING register xx(%d)\n", loc.reg());

[Florian Schneider, 2014/04/25 05:55:33]

Remove commented-out code.

[turnidge, 2014/04/25 20:16:33]

Done.

+      locations_[i] = Location::StackSlot(index);
+    } else if (loc.IsFpuRegister()) {
+      intptr_t index = fpu_reg_slots[loc.fpu_reg()];
+      ASSERT(index >= 0);
+      Value* value = InputAt(i);
+      switch (value->definition()->representation()) {
+        case kUnboxedDouble:
+        case kUnboxedMint:
+          locations_[i] = Location::DoubleStackSlot(index);
+          break;
+        case kUnboxedFloat32x4:
+        case kUnboxedInt32x4:
+        case kUnboxedFloat64x2:
+          locations_[i] = Location::QuadStackSlot(index);
+          break;
+        default:
+          UNREACHABLE();
+      }
+    } else if (loc.IsInvalid()) {
+      // TODO(turnidge): Can materialized objects refer to other

[Florian Schneider, 2014/04/25 05:55:33]

I think right now this is the case - it may change in the future if we want to
do allocation sinking for nested objects: Currently, we perform only one
iteration of allocation sinking. If we did it iteratively, then one materialize
object could reference another.

Also, a materialized object can't have a reference to itself, since all stores
would make the allocation-site aliased and therefore not considered a sinking
candidate.

[turnidge, 2014/04/25 20:16:33]

Updated comment.

+      // materialized objects?  If so, then we need to recurse here.
+      // Additionally, we might also need to check for cycles in the
+      // graph of materialized objects to avoid getting stuck.  For
+      // now, mark this UNREACHABLE.
+      UNREACHABLE();
+    }
+  }
+}
+
+
 LocationSummary* StoreContextInstr::MakeLocationSummary(bool optimizing) const {
   const intptr_t kNumInputs = 1;
   const intptr_t kNumTemps = 0;