Fix reference counting bug in StatementRewriter.

pkg/compiler/lib/src/tree_ir/optimization/statement_rewriter.dart

 // Copyright (c) 2014, the Dart project authors.  Please see the AUTHORS file
 // for details. All rights reserved. Use of this source code is governed by a
 // BSD-style license that can be found in the LICENSE file.
 
 part of tree_ir.optimization;
 
 /**
  * Performs the following transformations on the tree:
  * - Assignment propagation
  * - If-to-conditional conversion
@@ skipping 151 matching lines @@
     });
     return node;
   }
 
   Expression visitExpression(Expression e) => e.processed ? e : e.accept(this);
 
   @override
   Expression visitVariableUse(VariableUse node) {
     // Propagate constant to use site.
     Expression constant = constantEnvironment[node.variable];
-    if (constant != null) return constant;
+    if (constant != null) {
+      node.variable.readCount--;
+      return constant;
+    }
 
     // Propagate a variable's definition to its use site if:
     // 1.  It has a single use, to avoid code growth and potential duplication
     //     of side effects, AND
     // 2.  It was the most recent expression evaluated so that we do not
     //     reorder expressions with side effects.
     if (!environment.isEmpty &&
         environment.last.variable == node.variable &&
-        environment.last.hasExactlyOneUse) {
+        node.variable.readCount == 1) {
+      node.variable.readCount--;
       return visitExpression(environment.removeLast().definition);
     }
 
     // If the definition could not be propagated, leave the variable use.
     return node;
   }
 
   /// Returns true if [exp] has no side effects and has a constant value within
   /// any given activation of the enclosing method.
   bool isEffectivelyConstant(Expression exp) {
     // TODO(asgerf): Can be made more aggressive e.g. by checking conditional
     // expressions recursively. Determine if that is a valuable optimization
     // and/or if it is better handled at the CPS level.
     return exp is Constant ||
            exp is This ||
            exp is ReifyTypeVar ||
            exp is VariableUse && constantEnvironment.containsKey(exp.variable);
   }
 
   Statement visitAssign(Assign node) {
     if (isEffectivelyConstant(node.definition) &&
         node.variable.writeCount == 1) {
       // Handle constant assignments specially.
       // They are always safe to propagate (though we should avoid duplication).
       // Moreover, they should not prevent other expressions from propagating.
       if (node.variable.readCount <= 1) {
         // A single-use constant should always be propagted to its use site.
         constantEnvironment[node.variable] = visitExpression(node.definition);
+        node.variable.writeCount--;
         return visitStatement(node.next);
       } else {
         // With more than one use, we cannot propagate the constant.
         // Visit the following statement without polluting [environment] so
         // that any preceding non-constant assignments might still propagate.
         node.next = visitStatement(node.next);
         node.definition = visitExpression(node.definition);
         return node;
       }
     } else {
       // Try to propagate assignment, and block previous assignment until this
       // has propagated.
       environment.add(node);
       Statement next = visitStatement(node.next);
       if (!environment.isEmpty && environment.last == node) {
         // The definition could not be propagated. Residualize the let binding.
         node.next = next;
         environment.removeLast();
         node.definition = visitExpression(node.definition);
         return node;
       }
       assert(!environment.contains(node));
+      node.variable.writeCount--; // This assignment was removed.
       return next;
     }
   }
 
   Expression visitInvokeStatic(InvokeStatic node) {
     // Process arguments right-to-left, the opposite of evaluation order.
     for (int i = node.arguments.length - 1; i >= 0; --i) {
       node.arguments[i] = visitExpression(node.arguments[i]);
     }
     return node;
@@ skipping 268 matching lines @@
   static Statement combineStatementsWithSubexpressions(
       Statement s,
       Statement t,
       Expression combine(Expression s, Expression t)) {
     if (s is Return && t is Return) {
       return new Return(combine(s.value, t.value));
     }
     if (s is Assign && t is Assign && s.variable == t.variable) {
       Statement next = combineStatements(s.next, t.next);
       if (next != null) {
-        --t.variable.writeCount; // Two assignments become one.
+        // Destroy both original assignments to the variable.
+        --s.variable.writeCount;

[Kevin Millikin (Google), 2015/03/04 10:35:30]

I guess we should be consistent within this file about whether we use pre- or
post-decrement.

I tend to use pre-increment and decrement when I don't care about the value
because in English (and Lisp) the verb normally comes before the object:
"decrement writeCount".  But I don't really care too much one way or the other.

+        --t.variable.writeCount;
+        // The Assign constructor will increment the reference count again.
         return new Assign(s.variable,
                           combine(s.definition, t.definition),
                           next);
       }
     }
     if (s is ExpressionStatement && t is ExpressionStatement) {
       Statement next = combineStatements(s.next, t.next);
       if (next != null) {
         return new ExpressionStatement(combine(s.expression, t.expression),
                                        next);
@@ skipping 117 matching lines @@
   }
 
   Expression makeCondition(Expression e, bool polarity) {
     return polarity ? e : new Not(e);
   }
 
   Statement getBranch(If node, bool polarity) {
     return polarity ? node.thenStatement : node.elseStatement;
   }
 }