[turbofan] Add support for storing to double fields.

[turbofan] Add support for storing to double fields.

Adds new Guard[Type] common operator, which takes value and control
inputs and records a guaranty that a certain value has a certain type
in that control path.  This is some kind of ad-hoc SSI similar to what
we have to do in Crankshaft in some places.

Also introduces an ObjectIsNumber simplified operator, which checks
whether a certain value is a number (either a Smi or a HeapNumber).

This doesn't yet support transitioning stores to double fields, which
require support for allocating mutable heap numbers.

R=jarin@chromium.org
BUG=v8:4470
LOG=n

Committed: https://crrev.com/0df0e254a380edb019fb2a85acd6e562b6309598
Cr-Commit-Position: refs/heads/master@{#31675}

[Benedikt Meurer, 2015-10-29 12:42:17]

Hey Jaro,

This is the initial patch for double stores.
Please take a look.

Thanks,
Benedikt

[Jarin, 2015-10-30 10:05:13]

https://codereview.chromium.org/1420283009/diff/1/src/compiler/js-native-cont...
File src/compiler/js-native-context-specialization.cc (right):

https://codereview.chromium.org/1420283009/diff/1/src/compiler/js-native-cont...
src/compiler/js-native-context-specialization.cc:687: field_access.name =
MaybeHandle<Name>();
I am confused, are we going to store into heap number here?

[Benedikt Meurer, 2015-10-30 10:07:19]

https://codereview.chromium.org/1420283009/diff/1/src/compiler/js-native-cont...
File src/compiler/js-native-context-specialization.cc (right):

https://codereview.chromium.org/1420283009/diff/1/src/compiler/js-native-cont...
src/compiler/js-native-context-specialization.cc:687: field_access.name =
MaybeHandle<Name>();
Yes, when double field unboxing is disabled, we allocate MutableHeapNumbers for
double fields and store directly to them.

[Jarin, 2015-10-30 10:11:05]

lgtm

https://codereview.chromium.org/1420283009/diff/1/src/compiler/js-native-cont...
File src/compiler/js-native-context-specialization.cc (right):

https://codereview.chromium.org/1420283009/diff/1/src/compiler/js-native-cont...
src/compiler/js-native-context-specialization.cc:687: field_access.name =
MaybeHandle<Name>();
On 2015/10/30 10:07:19, Benedikt Meurer wrote:
> Yes, when double field unboxing is disabled, we allocate MutableHeapNumbers
for
> double fields and store directly to them.

Ok, I will trust you that we will not store into a normal HeapNumber, then.

[Benedikt Meurer, 2015-10-30 10:11:31]

The CQ bit was checked by bmeurer@chromium.org

[commit-bot: I haz the power, 2015-10-30 10:11:43]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1420283009/1
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1420283009/1

[commit-bot: I haz the power, 2015-10-30 10:19:21]

Committed patchset #1 (id:1)

[commit-bot: I haz the power, 2015-10-30 10:19:55]

Patchset 1 (id:??) landed as
https://crrev.com/0df0e254a380edb019fb2a85acd6e562b6309598
Cr-Commit-Position: refs/heads/master@{#31675}