Disable merging simulates across captured objects.

src/hydrogen-removable-simulates.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/hydrogen-flow-engine.h"
 #include "src/hydrogen-instructions.h"
 #include "src/hydrogen-removable-simulates.h"
 
 namespace v8 {
 namespace internal {
@@ skipping 35 matching lines @@
       // effects are never added to the merge list. The same reasoning holds for
       // return instructions.
       RemoveSimulates();
       return this;
     }
     if (instr->IsControlInstruction()) {
       // Merge the accumulated simulates at the end of the block.
       FlushSimulates();
       return this;
     }
+    if (instr->IsCapturedObject()) {
+      // Do not merge simulates across captured objects - captured objects
+      // change environments during environment replay, and such changes
+      // would not be reflected in the simulate.
+      FlushSimulates();
+      return this;
+    }
     // Skip the non-simulates and the first simulate.
     if (!instr->IsSimulate()) return this;
     if (first_) {
       first_ = false;
       return this;
     }
     HSimulate* current_simulate = HSimulate::cast(instr);
     if (!current_simulate->is_candidate_for_removal()) {
       Remember(current_simulate);
       FlushSimulates();
@@ skipping 105 matching lines @@
 };
 
 
 void HMergeRemovableSimulatesPhase::Run() {
   HFlowEngine<State, Effects> engine(graph(), zone());
   State* state = new(zone()) State(zone());
   engine.AnalyzeDominatedBlocks(graph()->blocks()->at(0), state);
 }
 
 } }  // namespace v8::internal