[turbofan] Initial support for Array constructor specialization.

[turbofan] Initial support for Array constructor specialization.

Introduce a JSCreateArray operator that represents the Array
constructor, and lower call and construct calls to the Array
constructor to JSCreateArray. Currently we don't yet replace
that with an inline allocation, but always use the specialized
stubs for the Array constructor.

This saves a lot of unnecessary deopts and elements transitions
because now we can actually consume the allocation site feedback
for the transitions.

R=mstarzinger@chromium.org
BUG=v8:4470
LOG=n

Committed: https://crrev.com/aeb41de0e64ad055a79ebd55f5d9930345500949
Cr-Commit-Position: refs/heads/master@{#32145}

[Benedikt Meurer, 2015-11-20 11:33:26]

Hey Michi,

This is the initial support for JSCreateArray, no fancy optimizations yet.
Please take a look.

Thanks,
Benedikt

[Michael Starzinger, 2015-11-20 12:06:48]

LGTM.

https://codereview.chromium.org/1466643002/diff/1/src/compiler/js-operator.h
File src/compiler/js-operator.h (right):

https://codereview.chromium.org/1466643002/diff/1/src/compiler/js-operator.h#...
src/compiler/js-operator.h:459: size_t arity, VectorSlotPair const& feedback =
VectorSlotPair());
nit: Could we drop the default value? I would vote for being explicit at call
sites.

https://codereview.chromium.org/1466643002/diff/1/src/compiler/js-operator.h#...
src/compiler/js-operator.h:487: const Operator* LoadNativeContext();
nit: Move this down a bit so that the variable loads are together again.

https://codereview.chromium.org/1466643002/diff/1/src/compiler/node-properties.h
File src/compiler/node-properties.h (right):

https://codereview.chromium.org/1466643002/diff/1/src/compiler/node-propertie...
src/compiler/node-properties.h:83: static void ReplaceValueInputs(Node* node,
Node* value);
The semantics of this function is "replace first value input and remove all
other value inputs". I think the current name is a bit misleading. Unfortunately
I don't have a better suggestion right now. But could we at least separate it
out of this block (i.e. move to line 91) and add a comment describing the
semantics?

https://codereview.chromium.org/1466643002/diff/1/src/compiler/opcodes.h
File src/compiler/opcodes.h (right):

https://codereview.chromium.org/1466643002/diff/1/src/compiler/opcodes.h#newc...
src/compiler/opcodes.h:131: V(JSLoadNativeContext)      \
nit: Move it down one line, to not split variable loads.

https://codereview.chromium.org/1466643002/diff/1/src/compiler/verifier.cc
File src/compiler/verifier.cc (right):

https://codereview.chromium.org/1466643002/diff/1/src/compiler/verifier.cc#ne...
src/compiler/verifier.cc:551: case IrOpcode::kJSLoadNativeContext:
nit: Move it down one line, to not split variable loads.

https://codereview.chromium.org/1466643002/diff/1/src/handles.h
File src/handles.h (right):

https://codereview.chromium.org/1466643002/diff/1/src/handles.h#newcode226
src/handles.h:226: V8_INLINE T** location() const { return location_; }
Nah, I worked so hard to get rid of this accessor. How would you feel about just
using plain Handle<> in the {CreateArrayParameters} instead?

[Benedikt Meurer, 2015-11-20 12:28:53]

https://codereview.chromium.org/1466643002/diff/1/src/compiler/js-operator.h
File src/compiler/js-operator.h (right):

https://codereview.chromium.org/1466643002/diff/1/src/compiler/js-operator.h#...
src/compiler/js-operator.h:459: size_t arity, VectorSlotPair const& feedback =
VectorSlotPair());
On 2015/11/20 12:06:47, Michael Starzinger wrote:
> nit: Could we drop the default value? I would vote for being explicit at call
> sites.

Done.

https://codereview.chromium.org/1466643002/diff/1/src/compiler/js-operator.h#...
src/compiler/js-operator.h:487: const Operator* LoadNativeContext();
On 2015/11/20 12:06:47, Michael Starzinger wrote:
> nit: Move this down a bit so that the variable loads are together again.

Done.

https://codereview.chromium.org/1466643002/diff/1/src/compiler/js-operator.h#...
src/compiler/js-operator.h:487: const Operator* LoadNativeContext();
As discussed offline: This will die once the contexts have a pointer to the
native context.

https://codereview.chromium.org/1466643002/diff/1/src/compiler/node-properties.h
File src/compiler/node-properties.h (right):

https://codereview.chromium.org/1466643002/diff/1/src/compiler/node-propertie...
src/compiler/node-properties.h:83: static void ReplaceValueInputs(Node* node,
Node* value);
On 2015/11/20 12:06:47, Michael Starzinger wrote:
> The semantics of this function is "replace first value input and remove all
> other value inputs". I think the current name is a bit misleading.
Unfortunately
> I don't have a better suggestion right now. But could we at least separate it
> out of this block (i.e. move to line 91) and add a comment describing the
> semantics?

Done.

https://codereview.chromium.org/1466643002/diff/1/src/compiler/opcodes.h
File src/compiler/opcodes.h (right):

https://codereview.chromium.org/1466643002/diff/1/src/compiler/opcodes.h#newc...
src/compiler/opcodes.h:131: V(JSLoadNativeContext)      \
On 2015/11/20 12:06:47, Michael Starzinger wrote:
> nit: Move it down one line, to not split variable loads.

Done.

https://codereview.chromium.org/1466643002/diff/1/src/compiler/verifier.cc
File src/compiler/verifier.cc (right):

https://codereview.chromium.org/1466643002/diff/1/src/compiler/verifier.cc#ne...
src/compiler/verifier.cc:551: case IrOpcode::kJSLoadNativeContext:
On 2015/11/20 12:06:47, Michael Starzinger wrote:
> nit: Move it down one line, to not split variable loads.

Done.

https://codereview.chromium.org/1466643002/diff/1/src/handles.h
File src/handles.h (right):

https://codereview.chromium.org/1466643002/diff/1/src/handles.h#newcode226
src/handles.h:226: V8_INLINE T** location() const { return location_; }
On 2015/11/20 12:06:47, Michael Starzinger wrote:
> Nah, I worked so hard to get rid of this accessor. How would you feel about
just
> using plain Handle<> in the {CreateArrayParameters} instead?

Done.

[Benedikt Meurer, 2015-11-20 12:29:33]

The CQ bit was checked by bmeurer@chromium.org

[Benedikt Meurer, 2015-11-20 12:29:34]

The patchset sent to the CQ was uploaded after l-g-t-m from
mstarzinger@chromium.org
Link to the patchset: https://codereview.chromium.org/1466643002/#ps20001
(title: "Addressed Michi's comments.")

[commit-bot: I haz the power, 2015-11-20 12:29:42]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1466643002/20001
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1466643002/20001

[commit-bot: I haz the power, 2015-11-20 12:50:07]

Committed patchset #2 (id:20001)

[commit-bot: I haz the power, 2015-11-20 12:50:21]

Patchset 2 (id:??) landed as
https://crrev.com/aeb41de0e64ad055a79ebd55f5d9930345500949
Cr-Commit-Position: refs/heads/master@{#32145}