Fix GVN for polymorphic loads.

They must not be hoisted above the compare-map-and-branch.

Review URL: http://codereview.chromium.org/5971003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@6082 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/hydrogen.cc

@@ -3532,9 +3532,10 @@ void HGraphBuilder::HandlePolymorphicLoadNamedField(Property* expr,
       maps.Add(map);
       HSubgraph* subgraph = CreateBranchSubgraph(environment());
       SubgraphScope scope(this, subgraph);
-      HInstruction* instr =
+      HLoadNamedField* instr =
           BuildLoadNamedField(object, expr, map, &lookup, false);
       instr->set_position(expr->position());
+      instr->ClearFlag(HValue::kUseGVN);  // Don't do GVN on polymorphic loads.
       PushAndAdd(instr);
       subgraphs.Add(subgraph);
     } else {
@@ -3573,7 +3574,7 @@ void HGraphBuilder::HandlePolymorphicLoadNamedField(Property* expr,
 }
 
 
-HInstruction* HGraphBuilder::BuildLoadNamedField(HValue* object,
+HLoadNamedField* HGraphBuilder::BuildLoadNamedField(HValue* object,
                                                     Property* expr,
                                                     Handle<Map> type,
                                                     LookupResult* lookup,

src/hydrogen.h

@@ -786,7 +786,7 @@ class HGraphBuilder: public AstVisitor {
                                      HValue* left,
                                      HValue* right);
   HInstruction* BuildIncrement(HValue* value, bool increment);
-  HInstruction* BuildLoadNamedField(HValue* object,
+  HLoadNamedField* BuildLoadNamedField(HValue* object,
                                        Property* expr,
                                        Handle<Map> type,
                                        LookupResult* result,