Revert of [turbofan] Initial support for monomorphic/polymorphic property...

Revert of [turbofan] Initial support for monomorphic/polymorphic property loads. (patchset #3 id:100001 of https://codereview.chromium.org/1396333010/ )

Reason for revert:
Waterfall redness.

Original issue's description:
> [turbofan] Initial support for monomorphic/polymorphic property loads.
>
> Native context specialization now lowers monomorphic and
> polymorphic accesses to data and constant data properties on
> object and/or prototype chain. We don't deal with accessors
> yet, and we also completely ignore proxies (which is compatible
> with what Crankshaft does).
>
> The code is more or less the straightforward implementation. We
> will need to refactor that and extract common patterns once the
> remaining bits for full load/store support is in.
>
> CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux_nosnap_rel
> R=jarin@chromium.org
> BUG=v8:4470
> LOG=n
>
> Committed: https://crrev.com/3a0bf860b7177f7abef01ff308a53603389d958e
> Cr-Commit-Position: refs/heads/master@{#31340}

TBR=bmeurer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4470

Review URL: https://codereview.chromium.org/1408123002

Cr-Commit-Position: refs/heads/master@{#31341}

src/compilation-dependencies.cc

@@ -106,15 +106,6 @@ void CompilationDependencies::Rollback() {
 }
 
 
-void CompilationDependencies::AssumeMapStable(Handle<Map> map) {
-  DCHECK(map->is_stable());
-  // Do nothing if the map cannot transition.
-  if (map->CanTransition()) {
-    Insert(DependentCode::kPrototypeCheckGroup, map);
-  }
-}
-
-
 void CompilationDependencies::AssumeTransitionStable(
     Handle<AllocationSite> site) {
   // Do nothing if the object doesn't have any useful element transitions left.

src/compilation-dependencies.h

@@ -31,7 +31,6 @@ class CompilationDependencies {
   void AssumeFieldType(Handle<Map> map) {
     Insert(DependentCode::kFieldTypeGroup, map);
   }
-  void AssumeMapStable(Handle<Map> map);
   void AssumePropertyCell(Handle<PropertyCell> cell) {
     Insert(DependentCode::kPropertyCellChangedGroup, cell);
   }

src/compiler/js-global-specialization.h

@@ -22,7 +22,6 @@ namespace compiler {
 class CommonOperatorBuilder;
 class JSGraph;
 class JSOperatorBuilder;
-class MachineOperatorBuilder;
 
 
 // Specializes a given JSGraph to a given GlobalObject, potentially constant
@@ -39,14 +38,13 @@ class JSGlobalSpecialization final : public AdvancedReducer {
 
   JSGlobalSpecialization(Editor* editor, JSGraph* jsgraph, Flags flags,
                          Handle<GlobalObject> global_object,
-                         CompilationDependencies* dependencies, Zone* zone);
+                         CompilationDependencies* dependencies);
 
   Reduction Reduce(Node* node) final;
 
  private:
   Reduction ReduceJSLoadGlobal(Node* node);
   Reduction ReduceJSStoreGlobal(Node* node);
-  Reduction ReduceJSLoadNamed(Node* node);
 
   Reduction Replace(Node* node, Node* value, Node* effect = nullptr,
                     Node* control = nullptr) {
@@ -55,12 +53,6 @@ class JSGlobalSpecialization final : public AdvancedReducer {
   }
   Reduction Replace(Node* node, Handle<Object> value);
 
-  class PropertyAccessInfo;
-  bool ComputePropertyAccessInfo(Handle<Map> map, Handle<Name> name,
-                                 PropertyAccessInfo* access_info);
-  bool ComputePropertyAccessInfos(MapHandleList const& maps, Handle<Name> name,
-                                  ZoneVector<PropertyAccessInfo>* access_infos);
-
   struct ScriptContextTableLookupResult;
   bool LookupInScriptContextTable(Handle<Name> name,
                                   ScriptContextTableLookupResult* result);
@@ -71,17 +63,14 @@ class JSGlobalSpecialization final : public AdvancedReducer {
   CommonOperatorBuilder* common() const;
   JSOperatorBuilder* javascript() const;
   SimplifiedOperatorBuilder* simplified() const;
-  MachineOperatorBuilder* machine() const;
   Flags flags() const { return flags_; }
   Handle<GlobalObject> global_object() const { return global_object_; }
   CompilationDependencies* dependencies() const { return dependencies_; }
-  Zone* zone() const { return zone_; }
 
   JSGraph* const jsgraph_;
   Flags const flags_;
   Handle<GlobalObject> global_object_;
   CompilationDependencies* const dependencies_;
-  Zone* const zone_;
 
   DISALLOW_COPY_AND_ASSIGN(JSGlobalSpecialization);
 };

src/compiler/js-graph.cc

@@ -11,11 +11,8 @@ namespace v8 {
 namespace internal {
 namespace compiler {
 
-Node* JSGraph::ImmovableHeapConstant(Handle<HeapObject> value) {
-  if (value->IsConsString()) {
-    value = String::Flatten(Handle<String>::cast(value), TENURED);
-  }
-  return graph()->NewNode(common()->HeapConstant(value));
+Node* JSGraph::ImmovableHeapConstant(Handle<HeapObject> object) {
+  return graph()->NewNode(common()->HeapConstant(object));
 }
 
 
@@ -81,7 +78,7 @@ Node* JSGraph::HeapConstant(Handle<HeapObject> value) {
   // TODO(titzer): We could also match against the addresses of immortable
   // immovables here, even without access to the heap, thus always
   // canonicalizing references to them.
-  return ImmovableHeapConstant(value);
+  return graph()->NewNode(common()->HeapConstant(value));
 }
 
 

src/compiler/js-inlining.cc

@@ -369,8 +369,7 @@ Reduction JSInliner::ReduceJSCallFunction(Node* node,
         info.is_deoptimization_enabled()
             ? JSGlobalSpecialization::kDeoptimizationEnabled
             : JSGlobalSpecialization::kNoFlags,
-        handle(info.global_object(), info.isolate()), info_->dependencies(),
-        local_zone_);
+        handle(info.global_object(), info.isolate()), info_->dependencies());
     graph_reducer.AddReducer(&dead_code_elimination);
     graph_reducer.AddReducer(&common_reducer);
     graph_reducer.AddReducer(&global_specialization);

src/compiler/pipeline.cc

@@ -518,7 +518,7 @@ struct NativeContextSpecializationPhase {
             ? JSGlobalSpecialization::kDeoptimizationEnabled
             : JSGlobalSpecialization::kNoFlags,
         handle(data->info()->global_object(), data->isolate()),
-        data->info()->dependencies(), temp_zone);
+        data->info()->dependencies());
     AddReducer(data, &graph_reducer, &dead_code_elimination);
     AddReducer(data, &graph_reducer, &common_reducer);
     AddReducer(data, &graph_reducer, &global_specialization);

src/field-index.h

@@ -19,8 +19,6 @@ class Map;
 // index it was originally generated from.
 class FieldIndex final {
  public:
-  FieldIndex() : bit_field_(0) {}
-
   static FieldIndex ForPropertyIndex(Map* map,
                                      int index,
                                      bool is_double = false);

src/objects-inl.h

@@ -4905,7 +4905,6 @@ bool Map::IsJSGlobalProxyMap() {
 bool Map::IsJSGlobalObjectMap() {
   return instance_type() == JS_GLOBAL_OBJECT_TYPE;
 }
-bool Map::IsJSTypedArrayMap() { return instance_type() == JS_TYPED_ARRAY_TYPE; }
 bool Map::IsGlobalObjectMap() {
   const InstanceType type = instance_type();
   return type == JS_GLOBAL_OBJECT_TYPE || type == JS_BUILTINS_OBJECT_TYPE;

src/objects.h

@@ -5877,7 +5877,6 @@ class Map: public HeapObject {
   inline bool IsJSProxyMap();
   inline bool IsJSGlobalProxyMap();
   inline bool IsJSGlobalObjectMap();
-  inline bool IsJSTypedArrayMap();
   inline bool IsGlobalObjectMap();
 
   inline bool CanOmitMapChecks();

test/mjsunit/es6/block-scoping.js

@@ -90,6 +90,7 @@ function f3(one) {
 for (var j = 0; j < 5; ++j) f3(1);
 %OptimizeFunctionOnNextCall(f3);
 f3(1);
+assertTrue(%GetOptimizationStatus(f3) != 2);
 
 
 

test/mjsunit/harmony/block-scoping-sloppy.js

@@ -88,6 +88,7 @@ function f3(one) {
 for (var j = 0; j < 5; ++j) f3(1);
 %OptimizeFunctionOnNextCall(f3);
 f3(1);
+assertTrue(%GetOptimizationStatus(f3) != 2);