Array() in optimized code can create with wrong ElementsKind in corner cases.

Array() in optimized code can create with wrong ElementsKind in corner cases.

Calling new Array(JSObject::kInitialMaxFastElementArray) in optimized code
makes a stub call that bails out due to the length. Currently, the bailout
code a) doesn't have the allocation site, and b) wouldn't use it if it did
because the length is perceived to be too high.

This CL passes the allocation site to the stub call (rather than undefined),
and alters the bailout code to utilize the feedback.

BUG=

Committed: https://crrev.com/13459c1ae3caa4cc546c522177bac5450a3252bf
Cr-Commit-Position: refs/heads/master@{#27857}

[mvstanton, 2015-04-15 10:23:17]

mvstanton@chromium.org changed reviewers:
+ verwaest@chromium.org

[mvstanton, 2015-04-15 10:23:17]

Hi Toon, here is the repair we discussed, have a look and I'll upload ports,
--Michael

[Toon Verwaest, 2015-04-15 12:56:23]

You have some tests failing it seems...

https://codereview.chromium.org/1086873003/diff/40001/src/objects-inl.h
File src/objects-inl.h (right):

https://codereview.chromium.org/1086873003/diff/40001/src/objects-inl.h#newco...
src/objects-inl.h:7210: if (new_length_handle->IsNumber() &&
return new_length_handle->IsNumber() && NumberToInt32(*new_length_handle) >=
max_fast_array_size ;)

https://codereview.chromium.org/1086873003/diff/40001/src/runtime/runtime-arr...
File src/runtime/runtime-array.cc (right):

https://codereview.chromium.org/1086873003/diff/40001/src/runtime/runtime-arr...
src/runtime/runtime-array.cc:1048: bool cant_inline_array_constructor = false;
avoid double negation... can_inline_.. = true;

[mvstanton, 2015-04-15 14:10:34]

Thx Toon, and the test failure was because we allocate such a large array, there
is danger that a gc occurs after allocating the JSArray but before the elements.
If this happens, our memento gets lost. I force a gc before the problematic
allocation in order to test the behavior.

https://codereview.chromium.org/1086873003/diff/40001/src/objects-inl.h
File src/objects-inl.h (right):

https://codereview.chromium.org/1086873003/diff/40001/src/objects-inl.h#newco...
src/objects-inl.h:7210: if (new_length_handle->IsNumber() &&
On 2015/04/15 12:56:23, Toon Verwaest wrote:
> return new_length_handle->IsNumber() && NumberToInt32(*new_length_handle) >=
> max_fast_array_size ;)

Done.

https://codereview.chromium.org/1086873003/diff/40001/src/runtime/runtime-arr...
File src/runtime/runtime-array.cc (right):

https://codereview.chromium.org/1086873003/diff/40001/src/runtime/runtime-arr...
src/runtime/runtime-array.cc:1048: bool cant_inline_array_constructor = false;
On 2015/04/15 12:56:23, Toon Verwaest wrote:
> avoid double negation... can_inline_.. = true;

Thanks! Done.

[Toon Verwaest, 2015-04-15 15:04:30]

lgtm

[mvstanton, 2015-04-15 21:00:17]

The CQ bit was checked by mvstanton@chromium.org

[commit-bot: I haz the power, 2015-04-15 21:00:37]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1086873003/60001

[commit-bot: I haz the power, 2015-04-15 21:02:21]

Committed patchset #4 (id:60001)

[commit-bot: I haz the power, 2015-04-15 21:02:35]

Patchset 4 (id:??) landed as
https://crrev.com/13459c1ae3caa4cc546c522177bac5450a3252bf
Cr-Commit-Position: refs/heads/master@{#27857}