[turbofan] Bounds check when lowering JSStoreProperty.

[turbofan] Bounds check when lowering JSStoreProperty.

R=titzer@chromium.org

Committed: https://code.google.com/p/v8/source/detail?r=24105

[Benedikt Meurer, 2014-09-12 08:46:32]

bmeurer@chromium.org changed reviewers:
+ titzer@chromium.org

[Benedikt Meurer, 2014-09-12 08:46:32]

This one fails, simple repro:

function module(stdlib, foreign, heap) {
    "use asm";

    var MEM32 = new stdlib.Int32Array(heap);

    function foo(i, j) {
        i = i|0;
        j = j|0;
      MEM32[i >> 2] = j;
      return 0;
    }
    return { foo: foo };
}

var instance = module(this, {}, new ArrayBuffer(1024 * 1024));
print(instance.foo(1, 6));

[titzer, 2014-09-15 16:02:03]

lgtm

This should work with the scheduler changes I landed, but I got failures when I
patched it in.

[Benedikt Meurer, 2014-09-22 07:16:39]

On 2014/09/15 at 16:02:03, titzer wrote:
> lgtm
> 
> This should work with the scheduler changes I landed, but I got failures when
I patched it in.

It's because the scheduler does not handle diamonds with multiple
inter-dependent effect phis correctly. Talked to danno@ and we disabled GVN for
now.

[Benedikt Meurer, 2014-09-22 07:17:22]

Committed patchset #1 (id:1) manually as 24105 (tree was closed).