[turbofan] Temporarily disable write barrier elimination for stores of small integers.

The proper fix would be to make TruncatingUseInfoFromRepresentation
respect tagged signed use representation, but requires extra work
to refine typing for all values that are stored into Smi fields.

Bug: chromium:791245
Change-Id: I83965bcc18a836d2c758a6a8b1477a4aa2c6133d
Reviewed-on: https://chromium-review.googlesource.com/808866Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49870}

src/compiler/simplified-lowering.cc

@@ -2547,12 +2547,6 @@ class RepresentationSelector {
         MachineRepresentation field_representation =
             access.machine_type.representation();
 
-        // Make sure we convert to Smi if possible. This should help write
-        // barrier elimination.
-        if (field_representation == MachineRepresentation::kTagged &&
-            TypeOf(value_node)->Is(Type::SignedSmall())) {
-          field_representation = MachineRepresentation::kTaggedSigned;
-        }
         WriteBarrierKind write_barrier_kind = WriteBarrierKindFor(
             access.base_is_tagged, field_representation, access.offset,
             access.type, input_info->representation(), value_node);
@@ -2586,12 +2580,6 @@ class RepresentationSelector {
         MachineRepresentation element_representation =
             access.machine_type.representation();
 
-        // Make sure we convert to Smi if possible. This should help write
-        // barrier elimination.
-        if (element_representation == MachineRepresentation::kTagged &&
-            TypeOf(value_node)->Is(Type::SignedSmall())) {
-          element_representation = MachineRepresentation::kTaggedSigned;
-        }
         WriteBarrierKind write_barrier_kind = WriteBarrierKindFor(
             access.base_is_tagged, element_representation, access.type,
             input_info->representation(), value_node);

test/mjsunit/compiler/regress-791245.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc
+
+var a, b;  // Global variables that will end up with number map.
+
+for (var i = 0; i < 100000; i++) {
+  b = 1;
+  a = i + -0;  // -0 is a number, so this will make "a" a heap object.
+  b = a;
+}
+
+assertTrue(a === b);
+gc();
+assertTrue(a === b);