When compiling for-in pass correct context value to the increment instruction.

Additionally force increment instruction to use int32 representation.

R=fschneider@google.com
BUG=http://crbug.com/115646
TEST=test/mjsunit/compiler/optimized-for-in.js

Review URL: https://chromiumcodereview.appspot.com/9463052

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@10844 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/flag-definitions.h

@@ -169,7 +169,7 @@ DEFINE_int(stress_runs, 0, "number of stress runs")
 DEFINE_bool(optimize_closures, true, "optimize closures")
 DEFINE_int(loop_weight, 1, "loop weight for representation inference")
 
-DEFINE_bool(optimize_for_in, false,
+DEFINE_bool(optimize_for_in, true,
             "optimize functions containing for-in loops")
 
 // Experimental profiler changes.

src/hydrogen.cc

@@ -3075,7 +3075,6 @@ void HGraphBuilder::PreProcessOsrEntry(IterationStatement* statement) {
     }
   }
 
-
   AddSimulate(osr_entry_id);
   AddInstruction(new(zone()) HOsrEntry(osr_entry_id));
   HContext* context = new(zone()) HContext;
@@ -3256,10 +3255,8 @@ void HGraphBuilder::VisitForInStatement(ForInStatement* stmt) {
   CHECK_ALIVE(VisitForValue(stmt->enumerable()));
   HValue* enumerable = Top();  // Leave enumerable at the top.
 
-  HValue* context = environment()->LookupContext();
-
   HInstruction* map = AddInstruction(new(zone()) HForInPrepareMap(
-      context, enumerable));
+      environment()->LookupContext(), enumerable));
   AddSimulate(stmt->PrepareId());
 
   HInstruction* array = AddInstruction(
@@ -3336,9 +3333,11 @@ void HGraphBuilder::VisitForInStatement(ForInStatement* stmt) {
     set_current_block(body_exit);
 
     HValue* current_index = Pop();
-    PushAndAdd(
-        new(zone()) HAdd(context, current_index, graph()->GetConstant1()));
-
+    HInstruction* new_index = new(zone()) HAdd(environment()->LookupContext(),
+                                               current_index,
+                                               graph()->GetConstant1());
+    new_index->AssumeRepresentation(Representation::Integer32());
+    PushAndAdd(new_index);
     body_exit = current_block();
   }
 

test/mjsunit/compiler/optimized-for-in.js

@@ -25,7 +25,7 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --allow-natives-syntax
+// Flags: --optimize-for-in --allow-natives-syntax
 
 // Test for-in support in Crankshaft.  For simplicity this tests assumes certain
 // fixed iteration order for properties and will have to be adjusted if V8
@@ -247,13 +247,15 @@ tryFunction("a1b2c3d4e5f6", function () {
 function osr_inner(t, limit) {
   var r = 1;
   for (var x in t) {
-    for (var i = 0; i < t[x].length; i++) {
-      r += t[x][i];
-      if (i === limit) {
-        %OptimizeFunctionOnNextCall(osr_inner, "osr");
+    if (t.hasOwnProperty(x)) {
+      for (var i = 0; i < t[x].length; i++) {
+        r += t[x][i];
+        if (i === limit) {
+          %OptimizeFunctionOnNextCall(osr_inner, "osr");
+        }
       }
+      r += x;
     }
-    r += x;
   }
   return r;
 }
@@ -290,7 +292,7 @@ function test_osr() {
     arr[i] = i + 1;
   }
   arr.push(":");  // Force deopt at the end of the loop.
-  assertEquals("211:x", osr_inner({x: arr}, (arr.length / 2) | 0));
+  assertEquals("211:x1234567891011121314151617181920:y", osr_inner({x: arr, y: arr}, (arr.length / 2) | 0));
   assertEquals("7x456y", osr_outer({x: [1,2,3], y: [4,5,6]}, "x"));
   assertEquals("101234567", osr_outer_and_deopt([1,2,3,4,5,6,7,8], "5"));
 }