Don't propagate information through phis in loop headers.

To properly do this, we'd have to iterate over CompareMaps (and their bodies) handling phis, until we have learned enough to decide which paths can be taken. For now, just disable learning from phis in loop headers.

BUG=
R=ishell@chromium.org

Review URL: https://codereview.chromium.org/147023005

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@19341 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/hydrogen-check-elimination.cc

@@ -164,7 +164,7 @@ class HCheckTable : public ZoneObject {
     copy->size_ = size_;
 
     // Create entries for succ block's phis.
-    if (succ->phis()->length() > 0) {
+    if (!succ->IsLoopHeader() && succ->phis()->length() > 0) {
       int pred_index = succ->PredecessorIndexOf(from_block);
       for (int phi_index = 0;
            phi_index < succ->phis()->length();

test/mjsunit/regress/regress-check-eliminate-loop-phis.js

+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f() {
+  var o = {x:1};
+  var y = {y:2.5, x:0};
+  var result;
+  for (var i = 0; i < 2; i++) {
+    result = o.x + 3;
+    o = y;
+  }
+  return result;
+}
+
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+assertEquals(3, f());