[turbofan] Lower unmapped arguments objects in inline frame.

[turbofan] Lower unmapped arguments objects in inline frame.

This lowers JSCreateArguments nodes within inline (i.e. non-outermost)
frames that create "unmapped arguments objects" to inline allocations.

The arguments count as well as each value is statically known and can be
directly stored into the arguments object. Note that the object is still
context-dependent and the map is loaded from the current context. The
object size is not taken into account for now, we might want to limit it
later though to keep code size bounded.

R=jarin@chromium.org

Committed: https://crrev.com/0af58d24e7249f7c203f943a571b65e2f779e4e0
Cr-Commit-Position: refs/heads/master@{#31550}

[Michael Starzinger, 2015-10-23 13:02:27]

Description was changed from

==========
[turbofan] Lower unmapped arguments objects in inline frame.

This lowers JSCreateArguments nodes within inline (i.e. non-outermost)
frames that create "unmapped arguments objects" to inline allocations.

The arguments count as well as each value is statically known and can be
directly stored into the arguments object. Note that the object is still
context-dependent and the map is loaded from the current context. The
object size is not taken into account for now, we might want to limit it
later though to keep code size bounded.

R=bmeurer@chromium.org
==========

to

==========
[turbofan] Lower unmapped arguments objects in inline frame.

This lowers JSCreateArguments nodes within inline (i.e. non-outermost)
frames that create "unmapped arguments objects" to inline allocations.

The arguments count as well as each value is statically known and can be
directly stored into the arguments object. Note that the object is still
context-dependent and the map is loaded from the current context. The
object size is not taken into account for now, we might want to limit it
later though to keep code size bounded.

R=bmeurer@chromium.org
==========

[Michael Starzinger, 2015-10-23 13:02:27]

mstarzinger@chromium.org changed reviewers:
+ jarin@chromium.org

[Jarin, 2015-10-23 14:09:23]

https://codereview.chromium.org/1412113004/diff/1/src/compiler/access-builder.h
File src/compiler/access-builder.h (right):

https://codereview.chromium.org/1412113004/diff/1/src/compiler/access-builder...
src/compiler/access-builder.h:72: static FieldAccess ForArgumentsCallee();
I could not find the implementation ForArgumentsCallee(). Perhaps remove it we
if are not using it yet?

https://codereview.chromium.org/1412113004/diff/1/src/compiler/js-typed-lower...
File src/compiler/js-typed-lowering.cc (right):

https://codereview.chromium.org/1412113004/diff/1/src/compiler/js-typed-lower...
src/compiler/js-typed-lowering.cc:80: Node* Finish() {
I would prefer not to overload Finish. Perhaps rename to ChangeToFinish and
CreateAndFinish (or just leave the creating version be Finish).

https://codereview.chromium.org/1412113004/diff/1/src/compiler/js-typed-lower...
src/compiler/js-typed-lowering.cc:1872: for (int i = 0; i < length; ++i) {
Could you use StateValuesIterator for this?

[Michael Starzinger, 2015-10-23 15:09:40]

https://codereview.chromium.org/1412113004/diff/1/src/compiler/access-builder.h
File src/compiler/access-builder.h (right):

https://codereview.chromium.org/1412113004/diff/1/src/compiler/access-builder...
src/compiler/access-builder.h:72: static FieldAccess ForArgumentsCallee();
On 2015/10/23 14:09:22, Jarin wrote:
> I could not find the implementation ForArgumentsCallee(). Perhaps remove it we
> if are not using it yet?

Done. Will be used for the "mapped arguments object", but removed it for now.

https://codereview.chromium.org/1412113004/diff/1/src/compiler/js-typed-lower...
File src/compiler/js-typed-lowering.cc (right):

https://codereview.chromium.org/1412113004/diff/1/src/compiler/js-typed-lower...
src/compiler/js-typed-lowering.cc:80: Node* Finish() {
On 2015/10/23 14:09:22, Jarin wrote:
> I would prefer not to overload Finish. Perhaps rename to ChangeToFinish and
> CreateAndFinish (or just leave the creating version be Finish).

Done. As discussed offline, I went with "FinishAndChange" and plain "Finish".

https://codereview.chromium.org/1412113004/diff/1/src/compiler/js-typed-lower...
src/compiler/js-typed-lowering.cc:1872: for (int i = 0; i < length; ++i) {
On 2015/10/23 14:09:22, Jarin wrote:
> Could you use StateValuesIterator for this?

Done.

[Jarin, 2015-10-25 14:14:26]

lgtm. Thanks!

[Benedikt Meurer, 2015-10-26 04:42:53]

Nice. LGTM.

[Michael Starzinger, 2015-10-26 09:03:02]

Description was changed from

==========
[turbofan] Lower unmapped arguments objects in inline frame.

This lowers JSCreateArguments nodes within inline (i.e. non-outermost)
frames that create "unmapped arguments objects" to inline allocations.

The arguments count as well as each value is statically known and can be
directly stored into the arguments object. Note that the object is still
context-dependent and the map is loaded from the current context. The
object size is not taken into account for now, we might want to limit it
later though to keep code size bounded.

R=bmeurer@chromium.org
==========

to

==========
[turbofan] Lower unmapped arguments objects in inline frame.

This lowers JSCreateArguments nodes within inline (i.e. non-outermost)
frames that create "unmapped arguments objects" to inline allocations.

The arguments count as well as each value is statically known and can be
directly stored into the arguments object. Note that the object is still
context-dependent and the map is loaded from the current context. The
object size is not taken into account for now, we might want to limit it
later though to keep code size bounded.

R=jarin@chromium.org
==========

[Michael Starzinger, 2015-10-26 09:03:06]

The CQ bit was checked by mstarzinger@chromium.org

[commit-bot: I haz the power, 2015-10-26 09:03:15]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1412113004/20001
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1412113004/20001

[commit-bot: I haz the power, 2015-10-26 09:36:50]

Committed patchset #2 (id:20001)

[commit-bot: I haz the power, 2015-10-26 09:37:06]

Patchset 2 (id:??) landed as
https://crrev.com/0af58d24e7249f7c203f943a571b65e2f779e4e0
Cr-Commit-Position: refs/heads/master@{#31550}