[turbofan] Initial support for monomorphic/polymorphic property loads.

Native context specialization now lowers monomorphic and
polymorphic accesses to data and constant data properties on
object and/or prototype chain. We don't deal with accessors
yet, and we also completely ignore proxies (which is compatible
with what Crankshaft does).

The code is more or less the straightforward implementation. We
will need to refactor that and extract common patterns once the
remaining bits for full load/store support is in.

CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux_nosnap_rel
R=jarin@chromium.org
BUG=v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1396333010

Cr-Commit-Position: refs/heads/master@{#31340}

src/compilation-dependencies.cc

@@ -106,6 +106,15 @@ void CompilationDependencies::Rollback() {
 }
 
 
+void CompilationDependencies::AssumeMapStable(Handle<Map> map) {
+  DCHECK(map->is_stable());
+  // Do nothing if the map cannot transition.
+  if (map->CanTransition()) {
+    Insert(DependentCode::kPrototypeCheckGroup, map);
+  }
+}
+
+
 void CompilationDependencies::AssumeTransitionStable(
     Handle<AllocationSite> site) {
   // Do nothing if the object doesn't have any useful element transitions left.

src/compilation-dependencies.h

@@ -31,6 +31,7 @@ class CompilationDependencies {
   void AssumeFieldType(Handle<Map> map) {
     Insert(DependentCode::kFieldTypeGroup, map);
   }
+  void AssumeMapStable(Handle<Map> map);
   void AssumePropertyCell(Handle<PropertyCell> cell) {
     Insert(DependentCode::kPropertyCellChangedGroup, cell);
   }

src/compiler/js-global-specialization.h

@@ -22,6 +22,7 @@ namespace compiler {
 class CommonOperatorBuilder;
 class JSGraph;
 class JSOperatorBuilder;
+class MachineOperatorBuilder;
 
 
 // Specializes a given JSGraph to a given GlobalObject, potentially constant
@@ -38,13 +39,14 @@ class JSGlobalSpecialization final : public AdvancedReducer {
 
   JSGlobalSpecialization(Editor* editor, JSGraph* jsgraph, Flags flags,
                          Handle<GlobalObject> global_object,
-                         CompilationDependencies* dependencies);
+                         CompilationDependencies* dependencies, Zone* zone);
 
   Reduction Reduce(Node* node) final;
 
  private:
   Reduction ReduceJSLoadGlobal(Node* node);
   Reduction ReduceJSStoreGlobal(Node* node);
+  Reduction ReduceJSLoadNamed(Node* node);
 
   Reduction Replace(Node* node, Node* value, Node* effect = nullptr,
                     Node* control = nullptr) {
@@ -53,6 +55,12 @@ class JSGlobalSpecialization final : public AdvancedReducer {
   }
   Reduction Replace(Node* node, Handle<Object> value);
 
+  class PropertyAccessInfo;
+  bool ComputePropertyAccessInfo(Handle<Map> map, Handle<Name> name,
+                                 PropertyAccessInfo* access_info);
+  bool ComputePropertyAccessInfos(MapHandleList const& maps, Handle<Name> name,
+                                  ZoneVector<PropertyAccessInfo>* access_infos);
+
   struct ScriptContextTableLookupResult;
   bool LookupInScriptContextTable(Handle<Name> name,
                                   ScriptContextTableLookupResult* result);
@@ -63,14 +71,17 @@ class JSGlobalSpecialization final : public AdvancedReducer {
   CommonOperatorBuilder* common() const;
   JSOperatorBuilder* javascript() const;
   SimplifiedOperatorBuilder* simplified() const;
+  MachineOperatorBuilder* machine() const;
   Flags flags() const { return flags_; }
   Handle<GlobalObject> global_object() const { return global_object_; }
   CompilationDependencies* dependencies() const { return dependencies_; }
+  Zone* zone() const { return zone_; }
 
   JSGraph* const jsgraph_;
   Flags const flags_;
   Handle<GlobalObject> global_object_;
   CompilationDependencies* const dependencies_;
+  Zone* const zone_;
 
   DISALLOW_COPY_AND_ASSIGN(JSGlobalSpecialization);
 };

src/compiler/js-graph.cc

@@ -11,8 +11,11 @@ namespace v8 {
 namespace internal {
 namespace compiler {
 
-Node* JSGraph::ImmovableHeapConstant(Handle<HeapObject> object) {
-  return graph()->NewNode(common()->HeapConstant(object));
+Node* JSGraph::ImmovableHeapConstant(Handle<HeapObject> value) {
+  if (value->IsConsString()) {
+    value = String::Flatten(Handle<String>::cast(value), TENURED);
+  }
+  return graph()->NewNode(common()->HeapConstant(value));
 }
 
 
@@ -78,7 +81,7 @@ Node* JSGraph::HeapConstant(Handle<HeapObject> value) {
   // TODO(titzer): We could also match against the addresses of immortable
   // immovables here, even without access to the heap, thus always
   // canonicalizing references to them.
-  return graph()->NewNode(common()->HeapConstant(value));
+  return ImmovableHeapConstant(value);
 }
 
 

src/compiler/js-inlining.cc

@@ -369,7 +369,8 @@ Reduction JSInliner::ReduceJSCallFunction(Node* node,
         info.is_deoptimization_enabled()
             ? JSGlobalSpecialization::kDeoptimizationEnabled
             : JSGlobalSpecialization::kNoFlags,
-        handle(info.global_object(), info.isolate()), info_->dependencies());
+        handle(info.global_object(), info.isolate()), info_->dependencies(),
+        local_zone_);
     graph_reducer.AddReducer(&dead_code_elimination);
     graph_reducer.AddReducer(&common_reducer);
     graph_reducer.AddReducer(&global_specialization);

src/compiler/pipeline.cc

@@ -518,7 +518,7 @@ struct NativeContextSpecializationPhase {
             ? JSGlobalSpecialization::kDeoptimizationEnabled
             : JSGlobalSpecialization::kNoFlags,
         handle(data->info()->global_object(), data->isolate()),
-        data->info()->dependencies());
+        data->info()->dependencies(), temp_zone);
     AddReducer(data, &graph_reducer, &dead_code_elimination);
     AddReducer(data, &graph_reducer, &common_reducer);
     AddReducer(data, &graph_reducer, &global_specialization);

src/field-index.h

@@ -19,6 +19,8 @@ class Map;
 // index it was originally generated from.
 class FieldIndex final {
  public:
+  FieldIndex() : bit_field_(0) {}
+
   static FieldIndex ForPropertyIndex(Map* map,
                                      int index,
                                      bool is_double = false);

src/objects-inl.h

@@ -4905,6 +4905,7 @@ bool Map::IsJSGlobalProxyMap() {
 bool Map::IsJSGlobalObjectMap() {
   return instance_type() == JS_GLOBAL_OBJECT_TYPE;
 }
+bool Map::IsJSTypedArrayMap() { return instance_type() == JS_TYPED_ARRAY_TYPE; }
 bool Map::IsGlobalObjectMap() {
   const InstanceType type = instance_type();
   return type == JS_GLOBAL_OBJECT_TYPE || type == JS_BUILTINS_OBJECT_TYPE;

src/objects.h

@@ -5877,6 +5877,7 @@ class Map: public HeapObject {
   inline bool IsJSProxyMap();
   inline bool IsJSGlobalProxyMap();
   inline bool IsJSGlobalObjectMap();
+  inline bool IsJSTypedArrayMap();
   inline bool IsGlobalObjectMap();
 
   inline bool CanOmitMapChecks();

test/mjsunit/es6/block-scoping.js

@@ -90,7 +90,6 @@ function f3(one) {
 for (var j = 0; j < 5; ++j) f3(1);
 %OptimizeFunctionOnNextCall(f3);
 f3(1);
-assertTrue(%GetOptimizationStatus(f3) != 2);
 
 
 

test/mjsunit/harmony/block-scoping-sloppy.js

@@ -88,7 +88,6 @@ function f3(one) {
 for (var j = 0; j < 5; ++j) f3(1);
 %OptimizeFunctionOnNextCall(f3);
 f3(1);
-assertTrue(%GetOptimizationStatus(f3) != 2);