Add bailout for large objects when allocating arrays in optimized code.

Add bailout for large objects when allocating arrays in optimized code.

BUG=

Committed: https://crrev.com/0c81c4e924d7bdb45fce98209c21985d754e047d
Cr-Commit-Position: refs/heads/master@{#31259}

[Michael Lippautz, 2015-10-14 11:04:37]

mlippautz@chromium.org changed reviewers:
+ bmeurer@chromium.org

[Michael Lippautz, 2015-10-14 11:04:37]

Benedikt: PTAL. Happy for suggestions that avoid the hammer.

Hannes: FYI.

[Hannes Payer (out of office), 2015-10-14 11:05:01]

hpayer@chromium.org changed reviewers:
+ hpayer@chromium.org

[Hannes Payer (out of office), 2015-10-14 11:05:01]

lgtm

[Benedikt Meurer, 2015-10-14 11:10:49]

LGTM, I guess we need the hammer here, especially since this was completely
unchecked before.

[Michael Lippautz, 2015-10-14 11:44:35]

The CQ bit was checked by mlippautz@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2015-10-14 11:44:45]

Dry run: CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1408553002/1
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1408553002/1

[commit-bot: I haz the power, 2015-10-14 12:41:39]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2015-10-14 12:41:40]

Dry run: This issue passed the CQ dry run.

[Michael Lippautz, 2015-10-14 12:57:16]

The CQ bit was checked by mlippautz@chromium.org

[commit-bot: I haz the power, 2015-10-14 12:57:36]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1408553002/1
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1408553002/1

[commit-bot: I haz the power, 2015-10-14 13:00:01]

Committed patchset #1 (id:1)

[commit-bot: I haz the power, 2015-10-14 13:00:19]

Patchset 1 (id:??) landed as
https://crrev.com/0c81c4e924d7bdb45fce98209c21985d754e047d
Cr-Commit-Position: refs/heads/master@{#31259}

[Michael Achenbach, 2015-10-14 15:01:10]

This breaks the deopt fuzzer, see:
http://build.chromium.org/p/client.v8/builders/V8%20Deopt%20Fuzzer/builds/5634

Local repro:
git co 0c81c4e924d7bdb45fce98209c21985d754e047d
GYP_GENERATORS=ninja GYP_DEFINES="target_arch=ia32 v8_target_arch=ia32
use_goma=1" gclient runhooks
ninja -C out/Release -j1000 d8
out/Release/d8 --test --random-seed=-1847853456 --deopt-every-n-times 1
--nohard-abort --nodead-code-elimination --nofold-constants
--noconcurrent-recompilation --allow-natives-syntax --expose-gc
test/mjsunit/mjsunit.js test/mjsunit/array-constructor-feedback.js

[Michael Achenbach, 2015-10-14 15:03:47]

A revert of this CL (patchset #1 id:1) has been created in
https://codereview.chromium.org/1409543002/ by machenbach@chromium.org.

The reason for reverting is: [Sheriff] Breaks deopt fuzzer:
http://build.chromium.org/p/client.v8/builders/V8%20Deopt%20Fuzzer/builds/5634

See comment in CL for repro..