[turbofan] Initial support for monomorphic/polymorphic property loads.

[turbofan] Initial support for monomorphic/polymorphic property loads.

Native context specialization now lowers monomorphic and
polymorphic accesses to data and constant data properties on
object and/or prototype chain. We don't deal with accessors
yet, and we also completely ignore proxies (which is compatible
with what Crankshaft does).

The code is more or less the straightforward implementation. We
will need to refactor that and extract common patterns once the
remaining bits for full load/store support is in.

CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux_nosnap_rel
R=jarin@chromium.org
BUG=v8:4470
LOG=n

Committed: https://crrev.com/3a0bf860b7177f7abef01ff308a53603389d958e
Cr-Commit-Position: refs/heads/master@{#31340}

Committed: https://crrev.com/e1088b27b5739cda7d38c4f6865654b783c486f9
Cr-Commit-Position: refs/heads/master@{#31352}

[Benedikt Meurer, 2015-10-16 06:07:58]

The CQ bit was checked by bmeurer@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2015-10-16 06:08:08]

Dry run: CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1396333010/20001
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1396333010/20001

[commit-bot: I haz the power, 2015-10-16 06:44:20]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2015-10-16 06:44:21]

Dry run: This issue passed the CQ dry run.

[Benedikt Meurer, 2015-10-16 11:03:59]

Patchset #2 (id:20001) has been deleted

[Benedikt Meurer, 2015-10-16 11:04:06]

Patchset #1 (id:1) has been deleted

[Benedikt Meurer, 2015-10-16 11:04:15]

The CQ bit was checked by bmeurer@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2015-10-16 11:04:22]

Dry run: CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1396333010/40001
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1396333010/40001

[commit-bot: I haz the power, 2015-10-16 11:14:44]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2015-10-16 11:14:45]

Dry run: Try jobs failed on following builders:
  v8_linux64_avx2_rel on tryserver.v8 (JOB_FAILED,
http://build.chromium.org/p/tryserver.v8/builders/v8_linux64_avx2_rel/builds/...)

[Benedikt Meurer, 2015-10-16 11:29:17]

The CQ bit was checked by bmeurer@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2015-10-16 11:29:29]

Dry run: CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1396333010/60001
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1396333010/60001

[Benedikt Meurer, 2015-10-16 11:29:56]

bmeurer@chromium.org changed reviewers:
+ jarin@chromium.org

[Benedikt Meurer, 2015-10-16 11:29:57]

Hey Jaro,

Please take a look.

Thanks,
Benedikt

[Benedikt Meurer, 2015-10-16 11:39:29]

Patchset #1 (id:40001) has been deleted

[Jarin, 2015-10-16 12:33:09]

Looks mostly good, but readability of that big method is terrible. I understand
the complexity is necessary, but could you try to name the variables better
there?

https://codereview.chromium.org/1396333010/diff/60001/src/compiler/js-global-...
File src/compiler/js-global-specialization.cc (right):

https://codereview.chromium.org/1396333010/diff/60001/src/compiler/js-global-...
src/compiler/js-global-specialization.cc:374: Reduction
JSGlobalSpecialization::ReduceJSLoadNamed(Node* node) {
Could we rename the file/class, please?

https://codereview.chromium.org/1396333010/diff/60001/src/compiler/js-global-...
src/compiler/js-global-specialization.cc:425: for (PropertyAccessInfo const&
info : infos) {
info -> access_info?

In general, names in this method are not very informative.

https://codereview.chromium.org/1396333010/diff/60001/src/compiler/js-global-...
src/compiler/js-global-specialization.cc:442: control =
graph()->NewNode(common()->IfFalse(), branch);
control -> exit_control? or maybe even check_fail_control

https://codereview.chromium.org/1396333010/diff/60001/src/compiler/js-global-...
src/compiler/js-global-specialization.cc:550: // Generate the single "exit"
point.
Please better comment here. It should say that we are merging all the
check-failed branches here and deoptimize.

[commit-bot: I haz the power, 2015-10-16 12:36:00]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2015-10-16 12:36:01]

Dry run: This issue passed the CQ dry run.

[Benedikt Meurer, 2015-10-16 13:22:15]

https://codereview.chromium.org/1396333010/diff/60001/src/compiler/js-global-...
File src/compiler/js-global-specialization.cc (right):

https://codereview.chromium.org/1396333010/diff/60001/src/compiler/js-global-...
src/compiler/js-global-specialization.cc:374: Reduction
JSGlobalSpecialization::ReduceJSLoadNamed(Node* node) {
As discussed offline: Separate CL :-)

https://codereview.chromium.org/1396333010/diff/60001/src/compiler/js-global-...
src/compiler/js-global-specialization.cc:425: for (PropertyAccessInfo const&
info : infos) {
On 2015/10/16 12:33:09, Jarin wrote:
> info -> access_info?
> 
> In general, names in this method are not very informative.

Done.

https://codereview.chromium.org/1396333010/diff/60001/src/compiler/js-global-...
src/compiler/js-global-specialization.cc:442: control =
graph()->NewNode(common()->IfFalse(), branch);
Ok, renamed to fallthrough_control as discussed offline, because this is the
main control flow, not the check fail paths.

https://codereview.chromium.org/1396333010/diff/60001/src/compiler/js-global-...
src/compiler/js-global-specialization.cc:550: // Generate the single "exit"
point.
On 2015/10/16 12:33:09, Jarin wrote:
> Please better comment here. It should say that we are merging all the
> check-failed branches here and deoptimize.

Done.

[Jarin, 2015-10-16 13:25:28]

lgtm

[Benedikt Meurer, 2015-10-16 13:32:08]

The CQ bit was checked by bmeurer@chromium.org

[Benedikt Meurer, 2015-10-16 13:32:08]

The patchset sent to the CQ was uploaded after l-g-t-m from jarin@chromium.org
Link to the patchset: https://codereview.chromium.org/1396333010/#ps100001
(title: "REBASE")

[commit-bot: I haz the power, 2015-10-16 13:32:20]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1396333010/100001
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1396333010/100001

[commit-bot: I haz the power, 2015-10-16 14:09:06]

Committed patchset #3 (id:100001)

[commit-bot: I haz the power, 2015-10-16 14:09:26]

Patchset 3 (id:??) landed as
https://crrev.com/3a0bf860b7177f7abef01ff308a53603389d958e
Cr-Commit-Position: refs/heads/master@{#31340}

[Jarin, 2015-10-16 14:55:44]

A revert of this CL (patchset #3 id:100001) has been created in
https://codereview.chromium.org/1408123002/ by jarin@chromium.org.

The reason for reverting is: Waterfall redness..

[Benedikt Meurer, 2015-10-19 04:47:00]

The CQ bit was checked by bmeurer@chromium.org

[Benedikt Meurer, 2015-10-19 04:47:00]

The patchset sent to the CQ was uploaded after l-g-t-m from jarin@chromium.org
Link to the patchset: https://codereview.chromium.org/1396333010/#ps120001
(title: "Work-around register allocator bug.")

[commit-bot: I haz the power, 2015-10-19 04:47:16]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1396333010/120001
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1396333010/120001

[commit-bot: I haz the power, 2015-10-19 05:24:43]

Committed patchset #4 (id:120001)

[commit-bot: I haz the power, 2015-10-19 05:24:58]

Patchset 4 (id:??) landed as
https://crrev.com/e1088b27b5739cda7d38c4f6865654b783c486f9
Cr-Commit-Position: refs/heads/master@{#31352}