Fix incorrect handling of refined aliases during load forwarding.

runtime/vm/flow_graph_optimizer.cc

 // Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 #include "vm/flow_graph_optimizer.h"
 
 #include "vm/bit_vector.h"
 #include "vm/cha.h"
 #include "vm/cpu.h"
 #include "vm/dart_entry.h"
@@ skipping 5662 matching lines @@
     return (result != NULL) ? result->id() : static_cast<intptr_t>(kNoAlias);
   }
 
   bool IsStore(Instruction* instr, BitVector** killed) {
     bool is_load = false, is_store = false;
     Place place(instr, &is_load, &is_store);
     if (is_store && (place.kind() != Place::kNone)) {
       const intptr_t alias_id = LookupAliasId(place.ToAlias());
       if (alias_id != kNoAlias) {
         *killed = GetKilledSet(alias_id);
+      } else if (!place.IsFinalField()) {
+        // We encountered unknown alias: this means intrablock load forwarding
+        // refined parameter of this store, for example
+        //
+        //     o   <- alloc()
+        //     a.f <- o
+        //     u   <- a.f
+        //     u.x <- null ;; this store alias is *.x
+        //
+        // after intrablock load forwarding
+        //
+        //     o   <- alloc()
+        //     a.f <- o
+        //     o.x <- null ;; this store alias is o.x
+        //
+        // In this case we fallback to using place id recorded in the
+        // instruction that still points to the old place with a more generic
+        // alias.
+        *killed = GetKilledSet(
+            LookupAliasId(places_[instr->place_id()]->ToAlias()));
       }
     }
     return is_store;
   }
 
   BitVector* GetKilledSet(intptr_t alias) {
     return (alias < killed_.length()) ? killed_[alias] : NULL;
   }
 
   intptr_t max_place_id() const { return places().length(); }
@@ skipping 498 matching lines @@
   Isolate* isolate = graph->isolate();
   ZoneGrowableArray<Place*>* places =
       new(isolate) ZoneGrowableArray<Place*>(10);
 
   bool has_loads = false;
   bool has_stores = false;
   for (BlockIterator it = graph->reverse_postorder_iterator();
        !it.Done();
        it.Advance()) {
     BlockEntryInstr* block = it.Current();
+
     for (ForwardInstructionIterator instr_it(block);
          !instr_it.Done();
          instr_it.Advance()) {
       Instruction* instr = instr_it.Current();
       Place place(instr, &has_loads, &has_stores);
       if (place.kind() == Place::kNone) {
         continue;
       }
 
       Place* result = map->Lookup(&place);
@@ skipping 3863 matching lines @@
 
   // Insert materializations at environment uses.
   for (intptr_t i = 0; i < exits_collector_.exits().length(); i++) {
     CreateMaterializationAt(
         exits_collector_.exits()[i], alloc, alloc->cls(), *slots);
   }
 }
 
 
 }  // namespace dart