Add %GetCallerJSFunction intrinsic

src/compiler/js-intrinsic-lowering.cc

Index: src/compiler/js-intrinsic-lowering.cc
diff --git a/src/compiler/js-intrinsic-lowering.cc b/src/compiler/js-intrinsic-lowering.cc
index 2a3bdf8fa85bfe3dd54589852432fdefce70d93a..499afbcc9fbf6f6767480a69ee166f3fe71585c2 100644
--- a/src/compiler/js-intrinsic-lowering.cc
+++ b/src/compiler/js-intrinsic-lowering.cc
@@ -84,6 +84,8 @@ Reduction JSIntrinsicLowering::Reduce(Node* node) {
       return ReduceFixedArraySet(node);
     case Runtime::kInlineGetTypeFeedbackVector:
       return ReduceGetTypeFeedbackVector(node);
+    case Runtime::kInlineGetCallerJSFunction:
+      return ReduceGetCallerJSFunction(node);
     default:
       break;
   }
@@ -455,6 +457,38 @@ Reduction JSIntrinsicLowering::ReduceGetTypeFeedbackVector(Node* node) {
 }
 
 
+Reduction JSIntrinsicLowering::ReduceGetCallerJSFunction(Node* node) {
+  Node* effect = NodeProperties::GetEffectInput(node);
+  Node* control = NodeProperties::GetControlInput(node);
+
+  if (FLAG_turbo_deoptimization) {
+    Node* const frame_state = NodeProperties::GetFrameStateInput(node, 0);
+    Node* const outer_frame = frame_state->InputAt(kFrameStateOuterStateInput);
+    if (outer_frame->opcode() == IrOpcode::kFrameState) {
+      // The intrinsic is inlined, return the function from the outer frame.
+      Node* outer_function = outer_frame->InputAt(kFrameStateFunctionInput);
+      NodeProperties::ReplaceWithValue(node, outer_frame, effect, control);

[Michael Starzinger, 2015/05/20 14:25:18]

nit: Please use AdvancedReducer::ReplaceWithValue here, I am currently switching
the reducers over to this method, the old NodeProperties::ReplaceWithValue is
deprecated.

[danno, 2015/05/22 11:21:35]

Done.

+      return Changed(outer_function);
+    }
+  }
+
+  // TODO(danno): If FLAG_turbo_deoptimization is false then this intrinsic
+  // always returns the JSFunction from the caller's frame, regardless of
+  // inlining depth, which isn't correct. This implementation also forces
+  // intrinsic lowering to happen after inlining, which is fine for now, but
+  // eventually the frame-querying logic probably should go later, e.g. in
+  // instruction selection, so that there is no phase-ordering dependency.
+  FieldAccess access = AccessBuilder::ForFrameCallerFramePtr();
+  Node* fp = graph()->NewNode(machine()->LoadFramePointer());
+  Node* next_fp =
+      graph()->NewNode(simplified()->LoadField(access), fp, effect, control);
+
+  access = AccessBuilder::ForFrameMarker();

[Michael Starzinger, 2015/05/20 14:25:18]

Does this work with arguments adapter frames and construct frames? Can we have
tests for those?

[danno, 2015/05/22 11:21:35]

Now it does :-)

+  return Change(node, simplified()->LoadField(access), next_fp, effect,
+                control);
+}
+
+
 Reduction JSIntrinsicLowering::Change(Node* node, const Operator* op, Node* a,
                                       Node* b) {
   node->set_op(op);