[turbofan] Materialize JSFunction from frame if possible.

This reduces the overhead of recursive calls when context specialization
is enabled. Based on this it might be possible to further reduce the
overhead by also specializing the call itself.

As a drive-by-fix, port the fast context materialization optimization to
arm and arm64, that was previously only supported on x64 and ia32.

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/1072743002

Cr-Commit-Position: refs/heads/master@{#27686}

src/compiler/arm/code-generator-arm.cc

@@ -1015,9 +1015,24 @@ void CodeGenerator::AssembleMove(InstructionOperand* source,
         case Constant::kExternalReference:
           __ mov(dst, Operand(src.ToExternalReference()));
           break;
-        case Constant::kHeapObject:
-          __ Move(dst, src.ToHeapObject());
+        case Constant::kHeapObject: {
+          Handle<HeapObject> src_object = src.ToHeapObject();
+          if (info()->IsOptimizing() &&
+              src_object.is_identical_to(info()->context())) {
+            // Loading the context from the frame is way cheaper than
+            // materializing the actual context heap object address.
+            __ ldr(dst, MemOperand(fp, StandardFrameConstants::kContextOffset));
+          } else if (info()->IsOptimizing() &&
+                     src_object.is_identical_to(info()->closure())) {
+            // Loading the JSFunction from the frame is way cheaper than
+            // materializing the actual JSFunction heap object address.
+            __ ldr(dst,
+                   MemOperand(fp, JavaScriptFrameConstants::kFunctionOffset));
+          } else {
+            __ Move(dst, src_object);
+          }
           break;
+        }
         case Constant::kRpoNumber:
           UNREACHABLE();  // TODO(dcarney): loading RPO constants on arm.
           break;

src/compiler/arm64/code-generator-arm64.cc

@@ -1126,7 +1126,21 @@ void CodeGenerator::AssembleMove(InstructionOperand* source,
       Register dst = destination->IsRegister() ? g.ToRegister(destination)
                                                : scope.AcquireX();
       if (src.type() == Constant::kHeapObject) {
-        __ LoadObject(dst, src.ToHeapObject());
+        Handle<HeapObject> src_object = src.ToHeapObject();
+        if (info()->IsOptimizing() &&
+            src_object.is_identical_to(info()->context())) {
+          // Loading the context from the frame is way cheaper than
+          // materializing the actual context heap object address.
+          __ Ldr(dst, MemOperand(fp, StandardFrameConstants::kContextOffset));
+        } else if (info()->IsOptimizing() &&
+                   src_object.is_identical_to(info()->closure())) {
+          // Loading the JSFunction from the frame is way cheaper than
+          // materializing the actual JSFunction heap object address.
+          __ Ldr(dst,
+                 MemOperand(fp, JavaScriptFrameConstants::kFunctionOffset));
+        } else {
+          __ LoadObject(dst, src_object);
+        }
       } else {
         __ Mov(dst, g.ToImmediate(source));
       }

src/compiler/ia32/code-generator-ia32.cc

@@ -1273,6 +1273,19 @@ void CodeGenerator::AssembleMove(InstructionOperand* source,
           __ push(Operand(ebp, StandardFrameConstants::kContextOffset));
           __ pop(dst);
         }
+      } else if (info()->IsOptimizing() &&
+                 src.is_identical_to(info()->closure())) {
+        // Loading the JSFunction from the frame is way cheaper than
+        // materializing the actual JSFunction heap object address.
+        if (destination->IsRegister()) {
+          Register dst = g.ToRegister(destination);
+          __ mov(dst, Operand(ebp, JavaScriptFrameConstants::kFunctionOffset));
+        } else {
+          DCHECK(destination->IsStackSlot());
+          Operand dst = g.ToOperand(destination);
+          __ push(Operand(ebp, JavaScriptFrameConstants::kFunctionOffset));
+          __ pop(dst);
+        }
       } else if (destination->IsRegister()) {
         Register dst = g.ToRegister(destination);
         __ LoadHeapObject(dst, src);

src/compiler/x64/code-generator-x64.cc

@@ -1464,6 +1464,12 @@ void CodeGenerator::AssembleMove(InstructionOperand* source,
             // Loading the context from the frame is way cheaper than
             // materializing the actual context heap object address.
             __ movp(dst, Operand(rbp, StandardFrameConstants::kContextOffset));
+          } else if (info()->IsOptimizing() &&
+                     src_object.is_identical_to(info()->closure())) {
+            // Loading the JSFunction from the frame is way cheaper than
+            // materializing the actual JSFunction heap object address.
+            __ movp(dst,
+                    Operand(rbp, JavaScriptFrameConstants::kFunctionOffset));
           } else {
             __ Move(dst, src_object);
           }