[turbofan] A bug fix of loadElimination

test/unittests/compiler/load-elimination-unittest.cc

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/load-elimination.h"
 #include "src/compiler/access-builder.h"
 #include "src/compiler/js-graph.h"
 #include "src/compiler/node.h"
 #include "src/compiler/simplified-operator.h"
 #include "test/unittests/compiler/graph-reducer-unittest.h"
@@ skipping 156 matching lines @@
   load_elimination.Reduce(store);
 
   Node* load = effect = graph()->NewNode(simplified()->LoadField(access),
                                          object, effect, control);
   EXPECT_CALL(editor, ReplaceWithValue(load, value, store, _));
   Reduction r = load_elimination.Reduce(load);
   ASSERT_TRUE(r.Changed());
   EXPECT_EQ(value, r.replacement());
 }
 
+TEST_F(LoadEliminationTest, StoreFieldAndKillFields) {
+  Node* object = Parameter(Type::Any(), 0);
+  Node* value = Parameter(Type::Any(), 1);
+  Node* effect = graph()->start();
+  Node* control = graph()->start();
+
+  FieldAccess access1 = {kTaggedBase,         kPointerSize,
+                        MaybeHandle<Name>(), MaybeHandle<Map>(),
+                        Type::Any(),         MachineType::AnyTagged(),
+                        kNoWriteBarrier};
+
+  // Offset that out of field cache size.
+  FieldAccess access2 = {kTaggedBase,         2048 * kPointerSize,
+                        MaybeHandle<Name>(), MaybeHandle<Map>(),
+                        Type::Any(),         MachineType::AnyTagged(),
+                        kNoWriteBarrier};
+
+  StrictMock<MockAdvancedReducerEditor> editor;
+  LoadElimination load_elimination(&editor, jsgraph(), zone());
+
+  load_elimination.Reduce(graph()->start());
+
+  Node* store1 = effect = graph()->NewNode(simplified()->StoreField(access1),
+                                          object, value, effect, control);
+  load_elimination.Reduce(store1);
+
+  // Invalidate caches of object.
+  Node* store2 = effect = graph()->NewNode(simplified()->StoreField(access2),
+                                         object, value, effect, control);
+  load_elimination.Reduce(store2);
+
+  Node* store3 = graph()->NewNode(simplified()->StoreField(access1),
+                                          object, value, effect, control);
+
+  Reduction r = load_elimination.Reduce(store3);
+
+  // store3 shall not be replaced, since caches were invalidated.
+  EXPECT_EQ(store3, r.replacement());
+}
+
 TEST_F(LoadEliminationTest, StoreFieldAndStoreElementAndLoadField) {
   Node* object = Parameter(Type::Any(), 0);
   Node* value = Parameter(Type::Any(), 1);
   Node* index = Parameter(Type::UnsignedSmall(), 2);
   Node* effect = graph()->start();
   Node* control = graph()->start();
   FieldAccess access = {kTaggedBase,         kPointerSize,
                         MaybeHandle<Name>(), MaybeHandle<Map>(),
                         Type::Any(),         MachineType::AnyTagged(),
                         kNoWriteBarrier};
@@ skipping 271 matching lines @@
                                 effect, control);
   EXPECT_CALL(editor, ReplaceWithValue(load, value0, effect, _));
   Reduction r = load_elimination.Reduce(load);
   ASSERT_TRUE(r.Changed());
   EXPECT_EQ(value0, r.replacement());
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8