[turbofan] Add support for %_MaxSmi and %_TypedArrayMaxSizeInHeap.

These intrinsics are heavily used in typedarray.js and are part of the
reason why the typed array constructors are more than twice as slow in
TurboFan compared to Crankshaft.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2684193003
Cr-Commit-Position: refs/heads/master@{#43063}

src/compiler/js-intrinsic-lowering.cc

@@ -76,6 +76,10 @@ Reduction JSIntrinsicLowering::Reduce(Node* node) {
       return ReduceCall(node);
     case Runtime::kInlineGetSuperConstructor:
       return ReduceGetSuperConstructor(node);
+    case Runtime::kInlineMaxSmi:
+      return ReduceMaxSmi(node);
+    case Runtime::kInlineTypedArrayMaxSizeInHeap:
+      return ReduceTypedArrayMaxSizeInHeap(node);
     case Runtime::kInlineJSCollectionGetTable:
       return ReduceJSCollectionGetTable(node);
     case Runtime::kInlineStringGetRawHashField:
@@ -317,6 +321,18 @@ Reduction JSIntrinsicLowering::ReduceGetSuperConstructor(Node* node) {
                 active_function_map, effect, control);
 }
 
+Reduction JSIntrinsicLowering::ReduceMaxSmi(Node* node) {
+  Node* value = jsgraph()->Constant(Smi::kMaxValue);
+  ReplaceWithValue(node, value);
+  return Replace(value);
+}
+
+Reduction JSIntrinsicLowering::ReduceTypedArrayMaxSizeInHeap(Node* node) {
+  Node* value = jsgraph()->Constant(FLAG_typed_array_max_size_in_heap);
+  ReplaceWithValue(node, value);
+  return Replace(value);
+}
+
 Reduction JSIntrinsicLowering::ReduceJSCollectionGetTable(Node* node) {
   Node* collection = NodeProperties::GetValueInput(node, 0);
   Node* effect = NodeProperties::GetEffectInput(node);

src/compiler/js-intrinsic-lowering.h

@@ -61,6 +61,11 @@ class V8_EXPORT_PRIVATE JSIntrinsicLowering final
   Reduction ReduceCall(Node* node);
   Reduction ReduceGetSuperConstructor(Node* node);
 
+  // TODO(turbofan): typedarray.js support; drop once TypedArrays are
+  // converted to proper CodeStubAssembler based builtins.
+  Reduction ReduceMaxSmi(Node* node);
+  Reduction ReduceTypedArrayMaxSizeInHeap(Node* node);
+
   // TODO(turbofan): collection.js support; drop once Maps and Sets are
   // converted to proper CodeStubAssembler based builtins.
   Reduction ReduceJSCollectionGetTable(Node* node);