• bmeurer's avatar
    [turbofan] Add inlined Array.prototype.push support. · 50f223e4
    bmeurer authored
    This adds a very first version of inlined Array.prototype.push into
    TurboFan optimized code. The current inlined version has a potential
    deopt loop, but it's unlikely that we hit it currently (Crankshaft
    suffers from an even worse problem). Once we have a way to learn from
    deopts we can fix this deopt loops.
    
    It's also probably overly defensive in when it's safe to inline
    the call to Array.prototype.push, but we can always extend that
    later once we have sufficient trust in the implementation and see
    an actual need to extend it.
    
    BUG=v8:2229,v8:3952,v8:5267
    R=jarin@chromium.org
    
    Review-Url: https://codereview.chromium.org/2245533003
    Cr-Commit-Position: refs/heads/master@{#38603}
    50f223e4
js-builtin-reducer.cc 40.9 KB