Fix GVN for polymorphic loads.

They must not be hoisted above the compare-map-and-branch.

Review URL: http://codereview.chromium.org/5971003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6082 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/hydrogen.cc

@@ -3532,9 +3532,10 @@ void HGraphBuilder::HandlePolymorphicLoadNamedField(Property* expr,
       maps.Add(map);
       HSubgraph* subgraph = CreateBranchSubgraph(environment());
       SubgraphScope scope(this, subgraph);
-      HInstruction* instr =
+      HLoadNamedField* instr =
           BuildLoadNamedField(object, expr, map, &lookup, false);
       instr->set_position(expr->position());
+      instr->ClearFlag(HValue::kUseGVN);  // Don't do GVN on polymorphic loads.
       PushAndAdd(instr);
       subgraphs.Add(subgraph);
     } else {
@@ -3573,11 +3574,11 @@ void HGraphBuilder::HandlePolymorphicLoadNamedField(Property* expr,
 }
 
 
-HInstruction* HGraphBuilder::BuildLoadNamedField(HValue* object,
-                                                 Property* expr,
-                                                 Handle<Map> type,
-                                                 LookupResult* lookup,
-                                                 bool smi_and_map_check) {
+HLoadNamedField* HGraphBuilder::BuildLoadNamedField(HValue* object,
+                                                    Property* expr,
+                                                    Handle<Map> type,
+                                                    LookupResult* lookup,
+                                                    bool smi_and_map_check) {
   if (smi_and_map_check) {
     AddInstruction(new HCheckNonSmi(object));
     AddInstruction(new HCheckMap(object, type));

src/hydrogen.h

@@ -786,11 +786,11 @@ class HGraphBuilder: public AstVisitor {
                                      HValue* left,
                                      HValue* right);
   HInstruction* BuildIncrement(HValue* value, bool increment);
-  HInstruction* BuildLoadNamedField(HValue* object,
-                                    Property* expr,
-                                    Handle<Map> type,
-                                    LookupResult* result,
-                                    bool smi_and_map_check);
+  HLoadNamedField* BuildLoadNamedField(HValue* object,
+                                       Property* expr,
+                                       Handle<Map> type,
+                                       LookupResult* result,
+                                       bool smi_and_map_check);
   HInstruction* BuildLoadNamedGeneric(HValue* object, Property* expr);
   HInstruction* BuildLoadKeyedFastElement(HValue* object,
                                           HValue* key,