[turbofan] Materialize JSFunction from frame if possible.

src/compiler/ia32/code-generator-ia32.cc

Index: src/compiler/ia32/code-generator-ia32.cc
diff --git a/src/compiler/ia32/code-generator-ia32.cc b/src/compiler/ia32/code-generator-ia32.cc
index 447a8e3b1c75d7302a76c97ccf30543b44efbc57..298f53cca6337bcbba9f3cf6182f4a256555aa1f 100644
--- a/src/compiler/ia32/code-generator-ia32.cc
+++ b/src/compiler/ia32/code-generator-ia32.cc
@@ -1273,6 +1273,19 @@ void CodeGenerator::AssembleMove(InstructionOperand* source,
           __ push(Operand(ebp, StandardFrameConstants::kContextOffset));
           __ pop(dst);
         }
+      } else if (info()->IsOptimizing() &&
+                 src.is_identical_to(info()->closure())) {
+        // Loading the JSFunction from the frame is way cheaper than
+        // materializing the actual JSFunction heap object address.
+        if (destination->IsRegister()) {
+          Register dst = g.ToRegister(destination);
+          __ mov(dst, Operand(ebp, JavaScriptFrameConstants::kFunctionOffset));
+        } else {
+          DCHECK(destination->IsStackSlot());
+          Operand dst = g.ToOperand(destination);
+          __ push(Operand(ebp, JavaScriptFrameConstants::kFunctionOffset));
+          __ pop(dst);
+        }
       } else if (destination->IsRegister()) {
         Register dst = g.ToRegister(destination);
         __ LoadHeapObject(dst, src);