[turbofan] Fixed reuse of nested ObjectState in escape analysis

src/compiler/escape-analysis.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/escape-analysis.h"
 
 #include <limits>
 
 #include "src/base/flags.h"
 #include "src/bootstrapper.h"
@@ skipping 1117 matching lines @@
     return new_state;
   }
   return state;
 }
 
 VirtualObject* EscapeAnalysis::CopyForModificationAt(VirtualObject* obj,
                                                      VirtualState* state,
                                                      Node* node) {
   if (obj->NeedCopyForModification()) {
     state = CopyForModificationAt(state, node);
-    return state->Copy(obj, status_analysis_->GetAlias(obj->id()));
+    // TODO(tebbi): this copies the complete virtual state. Replace with a more
+    // precise analysis of which objects are actually affected by the change.
+    Alias changed_alias = status_analysis_->GetAlias(obj->id());
+    for (Alias alias = 0; alias < state->size(); ++alias) {
+      if (VirtualObject* next_obj = state->VirtualObjectFromAlias(alias)) {
+        if (alias != changed_alias && next_obj->NeedCopyForModification()) {
+          state->Copy(next_obj, alias);
+        }
+      }
+    }
+    return state->Copy(obj, changed_alias);
   }
   return obj;
 }
 
 void EscapeAnalysis::ForwardVirtualState(Node* node) {
   DCHECK_EQ(node->op()->EffectInputCount(), 1);
 #ifdef DEBUG
   if (node->opcode() != IrOpcode::kLoadField &&
       node->opcode() != IrOpcode::kLoadElement &&
       node->opcode() != IrOpcode::kLoad &&
@@ skipping 523 matching lines @@
     }
   }
   return false;
 }
 
 Graph* EscapeAnalysis::graph() const { return status_analysis_->graph(); }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8