[turbofan] Properly type field access to stable heap object maps.

[turbofan] Properly type field access to stable heap object maps.

Introduce new typing rules for LoadField[Map], which try to take into
account stable map information if the object either has type Constant or
type Class. If the map of the object is stable but can transition we
have to introduce a code dependency in the Typer to make sure that the
information (the Constant type we infer for LoadField[Map]) is valid
(and stays valid).

This also settles the policy for depending on map stability: The
definition can introduce any number of maps, without having to pay
attention to stability (i.e. you can always use Type::Class to introduce
a map that is propagated along the value edges), and the use site is
responsible for checking that the type information is valid before using
it. I.e. if you use stable map information, you'll have to add a
stability dependency (or make sure the map cannot transition).

Drive-by-improvement: Add ReferenceEqualTyper which takes input types
into account for improved constant folding.

Drive-by-fix: Apply policy mentioned above to JSNativeContextSpecialization.

R=jarin@chromium.org, rossberg@chromium.org
BUG=v8:4470
LOG=n

Committed: https://crrev.com/44b9122d9f66e746f8f2126b04f30d0eac83fceb
Cr-Commit-Position: refs/heads/master@{#31567}

[Benedikt Meurer, 2015-10-26 11:38:12]

Hey Jaro, Andreas,

As discussed offline, take map feedback into account for LoadField[map] typing.
Please take a look.

Thanks,
Benedikt

[rossberg, 2015-10-26 11:44:19]

https://codereview.chromium.org/1410953006/diff/1/src/compiler/typer.cc
File src/compiler/typer.cc (right):

https://codereview.chromium.org/1410953006/diff/1/src/compiler/typer.cc#newco...
src/compiler/typer.cc:1591: if (lhs->Is(rhs) && rhs->Is(lhs)) return
t->singleton_true_;
I don't understand. This seems to say that if the types are the same, we know
that the values are the same? That only holds if the types are Constants.

[Jarin, 2015-10-26 11:44:21]

lgtm

[Benedikt Meurer, 2015-10-26 11:46:40]

https://codereview.chromium.org/1410953006/diff/1/src/compiler/typer.cc
File src/compiler/typer.cc (right):

https://codereview.chromium.org/1410953006/diff/1/src/compiler/typer.cc#newco...
src/compiler/typer.cc:1591: if (lhs->Is(rhs) && rhs->Is(lhs)) return
t->singleton_true_;
Of course (similar to JSStrictEqualTyper). Thanks for catching.

[Jarin, 2015-10-26 11:47:32]

ah, andreas is right, the reference equality needs fixing.

[Benedikt Meurer, 2015-10-26 11:47:56]

On 2015/10/26 11:47:32, Jarin wrote:
> ah, andreas is right, the reference equality needs fixing.

Done.

[Benedikt Meurer, 2015-10-26 11:48:02]

The CQ bit was checked by bmeurer@chromium.org

[Benedikt Meurer, 2015-10-26 11:48:02]

The patchset sent to the CQ was uploaded after l-g-t-m from jarin@chromium.org
Link to the patchset: https://codereview.chromium.org/1410953006/#ps40001
(title: "Fix Andreas' comment.")

[commit-bot: I haz the power, 2015-10-26 11:48:07]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1410953006/40001
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1410953006/40001

[rossberg, 2015-10-26 11:49:12]

lgtm

[commit-bot: I haz the power, 2015-10-26 11:56:38]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2015-10-26 11:56:38]

Try jobs failed on following builders:
  v8_mac_rel on tryserver.v8 (JOB_FAILED,
http://build.chromium.org/p/tryserver.v8/builders/v8_mac_rel/builds/11102)

[Benedikt Meurer, 2015-10-26 12:04:33]

The CQ bit was checked by bmeurer@chromium.org

[Benedikt Meurer, 2015-10-26 12:04:34]

The patchset sent to the CQ was uploaded after l-g-t-m from jarin@chromium.org,
rossberg@chromium.org
Link to the patchset: https://codereview.chromium.org/1410953006/#ps60001
(title: "Fixes")

[commit-bot: I haz the power, 2015-10-26 12:04:38]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1410953006/60001
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1410953006/60001

[commit-bot: I haz the power, 2015-10-26 12:13:10]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2015-10-26 12:13:10]

Try jobs failed on following builders:
  v8_linux_gcc_compile_rel on tryserver.v8 (JOB_FAILED,
http://build.chromium.org/p/tryserver.v8/builders/v8_linux_gcc_compile_rel/bu...)

[Benedikt Meurer, 2015-10-26 13:09:39]

The CQ bit was checked by bmeurer@chromium.org

[Benedikt Meurer, 2015-10-26 13:09:39]

The patchset sent to the CQ was uploaded after l-g-t-m from jarin@chromium.org,
rossberg@chromium.org
Link to the patchset: https://codereview.chromium.org/1410953006/#ps100001
(title: "Final workarounds. ")

[commit-bot: I haz the power, 2015-10-26 13:09:44]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1410953006/100001
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1410953006/100001

[commit-bot: I haz the power, 2015-10-26 14:04:06]

Committed patchset #6 (id:100001)

[commit-bot: I haz the power, 2015-10-26 14:04:42]

Patchset 6 (id:??) landed as
https://crrev.com/44b9122d9f66e746f8f2126b04f30d0eac83fceb
Cr-Commit-Position: refs/heads/master@{#31567}