[turbofan] Add initial support for global specialization.

[turbofan] Add initial support for global specialization.

Introduce a new JSGlobalSpecialization advanced reducer that runs
during the initial inlining and context specialization, and specializes
the graph to the globals of the native context.  Currently we assume
that we do not inline cross native context, but long-term we will grab
the global object from the JSLoadGlobal/JSStoreGlobal feedback (with the
new global load/store ICs that are currently in the workings), and then
this whole specialization will be fully compositional even across
cross-context inlining.

Note that we cannot really handle most of the stores to global object
property cells because TurboFan doesn't have a mechanism to enforce
certain representations.  Also note that we cannot yet fully benefit
from the type feedback collected on the global object property cells,
because the type system cannot deal with maps in a reasonable way.

CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux_nosnap_rel
R=jarin@chromium.org
BUG=v8:4470
LOG=n

Committed: https://crrev.com/6fbf7903f94924ea066af481719898bd9667b6eb
Cr-Commit-Position: refs/heads/master@{#31139}

Committed: https://crrev.com/e16dd13d6db630dc4eb9849749846d1c742254b3
Cr-Commit-Position: refs/heads/master@{#31148}

[Benedikt Meurer, 2015-10-07 07:33:53]

The CQ bit was checked by bmeurer@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2015-10-07 07:33:59]

Dry run: CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1387393002/1
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1387393002/1

[commit-bot: I haz the power, 2015-10-07 07:43:36]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2015-10-07 07:43:36]

Dry run: Try jobs failed on following builders:
  v8_linux_gcc_compile_rel on tryserver.v8 (JOB_FAILED,
http://build.chromium.org/p/tryserver.v8/builders/v8_linux_gcc_compile_rel/bu...)

[Benedikt Meurer, 2015-10-07 08:06:35]

Hey Jaro,

This is the first part of the native context specialization.
Please take a look.

Thanks,
Benedikt

https://codereview.chromium.org/1387393002/diff/20001/test/mjsunit/call-runti...
File test/mjsunit/call-runtime-tail.js (right):

https://codereview.chromium.org/1387393002/diff/20001/test/mjsunit/call-runti...
test/mjsunit/call-runtime-tail.js:6: // Flags: --nonative-context-specialization
Note: We have to disable native context specialization, because otherwise we
deopt on the first iteration with the property cell changing von constant to
constant type, and we will continue running in fullcodegen, where we don't have
tail call optimization currently, and so we run out of stack space soonish.

[Benedikt Meurer, 2015-10-07 08:07:36]

The CQ bit was checked by bmeurer@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2015-10-07 08:07:44]

Dry run: CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1387393002/20001
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1387393002/20001

[commit-bot: I haz the power, 2015-10-07 08:16:41]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2015-10-07 08:16:41]

Dry run: Try jobs failed on following builders:
  v8_win_rel on tryserver.v8 (JOB_FAILED,
http://build.chromium.org/p/tryserver.v8/builders/v8_win_rel/builds/10367)

[Benedikt Meurer, 2015-10-07 09:30:37]

The CQ bit was checked by bmeurer@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2015-10-07 09:30:52]

Dry run: CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1387393002/40001
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1387393002/40001

[Jarin, 2015-10-07 09:32:11]

lgtm.

https://codereview.chromium.org/1387393002/diff/1/src/compiler/js-global-spec...
File src/compiler/js-global-specialization.h (right):

https://codereview.chromium.org/1387393002/diff/1/src/compiler/js-global-spec...
src/compiler/js-global-specialization.h:27: // foloding some {LoadGlobal} nodes
or strength reducing some {StoreGlobal}
foloding -> folding

[Benedikt Meurer, 2015-10-07 09:36:07]

https://codereview.chromium.org/1387393002/diff/1/src/compiler/js-global-spec...
File src/compiler/js-global-specialization.h (right):

https://codereview.chromium.org/1387393002/diff/1/src/compiler/js-global-spec...
src/compiler/js-global-specialization.h:27: // foloding some {LoadGlobal} nodes
or strength reducing some {StoreGlobal}
On 2015/10/07 09:32:11, Jarin wrote:
> foloding -> folding

Done.

[Benedikt Meurer, 2015-10-07 09:36:19]

The CQ bit was checked by bmeurer@chromium.org

[Benedikt Meurer, 2015-10-07 09:36:19]

The patchset sent to the CQ was uploaded after l-g-t-m from jarin@chromium.org
Link to the patchset: https://codereview.chromium.org/1387393002/#ps60001
(title: "Fix typo.")

[commit-bot: I haz the power, 2015-10-07 09:36:29]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1387393002/60001
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1387393002/60001

[commit-bot: I haz the power, 2015-10-07 10:26:04]

Committed patchset #4 (id:60001)

[commit-bot: I haz the power, 2015-10-07 10:26:23]

Patchset 4 (id:??) landed as
https://crrev.com/6fbf7903f94924ea066af481719898bd9667b6eb
Cr-Commit-Position: refs/heads/master@{#31139}

[Benedikt Meurer, 2015-10-07 11:41:45]

A revert of this CL (patchset #4 id:60001) has been created in
https://codereview.chromium.org/1390073004/ by bmeurer@chromium.org.

The reason for reverting is: Breaks GC stress:
http://build.chromium.org/p/client.v8/builders/V8%20Linux64%20GC%20Stress%20-....

[Benedikt Meurer, 2015-10-07 12:09:30]

The CQ bit was checked by bmeurer@chromium.org

[commit-bot: I haz the power, 2015-10-07 12:09:39]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1387393002/60001
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1387393002/60001

[commit-bot: I haz the power, 2015-10-07 12:10:52]

Committed patchset #4 (id:60001)

[commit-bot: I haz the power, 2015-10-07 12:11:06]

Patchset 4 (id:??) landed as
https://crrev.com/e16dd13d6db630dc4eb9849749846d1c742254b3
Cr-Commit-Position: refs/heads/master@{#31148}