[ic] Also collect known map for relational comparison.

[ic] Also collect known map for relational comparison.

Previously we only collected the known map for equality comparisons. But
if we also collect it for relational comparisons, we can inline a fast
path of ToPrimitive on the objects, which is especially interesting
since both sides have the same map.

For now we only inline a very limited subset of ToPrimitive in
Crankshaft, which is when the receiver map (and its prototype chain)
doesn't have @@toPrimitive, and both valueOf and toString are the
default versions on the %ObjectPrototype%. In this case the relational
comparison would reduce to a string comparison of "[object CLASS]" with
itself and so we can reduce that to a boolean constant plus map checks
on both left and right hand side, plus code dependencies on the
prototype chain. This repairs the regression on box2d.

R=jkummerow@chromium.org
BUG=chromium:534200
LOG=n

Committed: https://crrev.com/e56f265f6d41fadbcea2be65d9b573bad8b4709d
Cr-Commit-Position: refs/heads/master@{#30852}

[Benedikt Meurer, 2015-09-21 13:05:00]

Hey Jakob,

Here's the - actually not even so hacky - fix for the Box2d performance
regression. The Crankshaft part is kinda adhoc and ugly. If you feel strongly
about it, I can split that into helper functions, but otherwise I'd try to keep
this thing local and minimal in Crankshaft.
Please take a look.

Thanks,
Benedikt

[Jakob Kummerow, 2015-09-21 13:36:26]

LGTM, but please test ALL the affected comparison operators.

https://codereview.chromium.org/1355113002/diff/1/test/mjsunit/compare-known-...
File test/mjsunit/compare-known-objects.js (right):

https://codereview.chromium.org/1355113002/diff/1/test/mjsunit/compare-known-...
test/mjsunit/compare-known-objects.js:46: function ge(a, b) {
Please add tests for "le" and "gt" too.

[Benedikt Meurer, 2015-09-21 15:39:49]

https://codereview.chromium.org/1355113002/diff/1/test/mjsunit/compare-known-...
File test/mjsunit/compare-known-objects.js (right):

https://codereview.chromium.org/1355113002/diff/1/test/mjsunit/compare-known-...
test/mjsunit/compare-known-objects.js:46: function ge(a, b) {
On 2015/09/21 13:36:26, Jakob wrote:
> Please add tests for "le" and "gt" too.

Done.

[Benedikt Meurer, 2015-09-21 15:39:53]

The CQ bit was checked by bmeurer@chromium.org

[Benedikt Meurer, 2015-09-21 15:39:53]

The patchset sent to the CQ was uploaded after l-g-t-m from
jkummerow@chromium.org
Link to the patchset: https://codereview.chromium.org/1355113002/#ps20001
(title: "Address Jakob's comment.")

[commit-bot: I haz the power, 2015-09-21 15:39:56]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1355113002/20001
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1355113002/20001

[commit-bot: I haz the power, 2015-09-21 16:05:32]

Committed patchset #2 (id:20001)

[commit-bot: I haz the power, 2015-09-21 16:05:53]

Patchset 2 (id:??) landed as
https://crrev.com/e56f265f6d41fadbcea2be65d9b573bad8b4709d
Cr-Commit-Position: refs/heads/master@{#30852}

[adamk, 2015-09-21 22:27:07]

adamk@chromium.org changed reviewers:
+ adamk@chromium.org

[adamk, 2015-09-21 22:27:08]

I don't see mention of @@toStringTag in this patch, but it seems like you're
expecting that you know the output of Object.prototype.toString. How does this
work with objects that have a  @@toStringTag property?

[Benedikt Meurer, 2015-09-22 03:30:59]

On 2015/09/21 22:27:08, adamk wrote:
> I don't see mention of @@toStringTag in this patch, but it seems like you're
> expecting that you know the output of Object.prototype.toString. How does this
> work with objects that have a  @@toStringTag property?

Nice catch, thanks. We need to make sure that if @@toStringTag is present, it
must not be an accessor property.