[turbofan] Reland "Add new JSFrameSpecialization reducer." and "Perform OSR deconstruction early an…

src/compiler/verifier.cc

Index: src/compiler/verifier.cc
diff --git a/src/compiler/verifier.cc b/src/compiler/verifier.cc
index 9f886e6b7045a3f6c5ecb6316ea590456bd87d71..4574b6212c9450ba64b6698695a675598e9ffc5b 100644
--- a/src/compiler/verifier.cc
+++ b/src/compiler/verifier.cc
@@ -584,7 +584,9 @@ void Verifier::Visitor::Check(Node* node) {
       break;
     }
     case IrOpcode::kJSForInDone: {
-      CheckValueInputIs(node, 0, Type::UnsignedSmall());
+      // TODO(bmeurer): OSR breaks this invariant, although the node is not user
+      // visible, so we now it is safe (fullcodegen has an unsigned smi there).

[Jarin, 2015/07/06 10:34:49]

now -> know (here and below)

[Benedikt Meurer, 2015/07/06 10:37:39]

Done.

+      // CheckValueInputIs(node, 0, Type::UnsignedSmall());
       break;
     }
     case IrOpcode::kJSForInNext: {
@@ -592,7 +594,9 @@ void Verifier::Visitor::Check(Node* node) {
       break;
     }
     case IrOpcode::kJSForInStep: {
-      CheckValueInputIs(node, 0, Type::UnsignedSmall());
+      // TODO(bmeurer): OSR breaks this invariant, although the node is not user
+      // visible, so we now it is safe (fullcodegen has an unsigned smi there).
+      // CheckValueInputIs(node, 0, Type::UnsignedSmall());
       CheckUpperIs(node, Type::UnsignedSmall());
       break;
     }