[turbofan] Initial support for Array constructor specialization.

src/compiler/js-generic-lowering.cc

Index: src/compiler/js-generic-lowering.cc
diff --git a/src/compiler/js-generic-lowering.cc b/src/compiler/js-generic-lowering.cc
index 0261e4c6472a4f70c46eb311790ee389e81ba51e..30eed1e0c9d3fd780b5b3cb5002a5653a8498179 100644
--- a/src/compiler/js-generic-lowering.cc
+++ b/src/compiler/js-generic-lowering.cc
@@ -429,6 +429,15 @@ void JSGenericLowering::LowerJSStoreContext(Node* node) {
 }
 
 
+void JSGenericLowering::LowerJSLoadNativeContext(Node* node) {
+  node->ReplaceInput(
+      1, jsgraph()->IntPtrConstant(JSGlobalObject::kNativeContextOffset -
+                                   kHeapObjectTag));
+  node->AppendInput(zone(), graph()->start());
+  NodeProperties::ChangeOp(node, machine()->Load(kMachAnyTagged));
+}
+
+
 void JSGenericLowering::LowerJSLoadDynamic(Node* node) {
   const DynamicAccess& access = DynamicAccessOf(node->op());
   Runtime::FunctionId function_id =
@@ -465,6 +474,27 @@ void JSGenericLowering::LowerJSCreateArguments(Node* node) {
 }
 
 
+void JSGenericLowering::LowerJSCreateArray(Node* node) {
+  CreateArrayParameters const& p = CreateArrayParametersOf(node->op());
+  int const arity = static_cast<int>(p.arity());
+  Handle<AllocationSite> site;
+  Node* new_target = node->InputAt(1);
+  // TODO(turbofan): We embed the AllocationSite from the Operator at this
+  // point, which we should not do once we want to both consume the feedback
+  // but at the same time shared the optimized code across native contexts,
+  // as the AllocationSite is associated with a single native context (it's
+  // stored in the type feedback vector after all). Once we go for cross
+  // context code generation, we should somehow find a way to get to the
+  // allocation site for the actual native context at runtime.
+  Node* type_info = p.site().ToHandle(&site) ? jsgraph()->HeapConstant(site)
+                                             : jsgraph()->UndefinedConstant();
+  node->RemoveInput(1);
+  node->InsertInput(zone(), 1 + arity, new_target);
+  node->InsertInput(zone(), 2 + arity, type_info);
+  ReplaceWithRuntimeCall(node, Runtime::kNewArray, arity + 3);
+}
+
+
 void JSGenericLowering::LowerJSCreateClosure(Node* node) {
   CreateClosureParameters p = CreateClosureParametersOf(node->op());
   node->InsertInput(zone(), 0, jsgraph()->HeapConstant(p.shared_info()));
@@ -510,8 +540,9 @@ void JSGenericLowering::LowerJSCreateScriptContext(Node* node) {
 
 
 void JSGenericLowering::LowerJSCallConstruct(Node* node) {
+  CallConstructParameters const& p = CallConstructParametersOf(node->op());
+  int const arity = static_cast<int>(p.arity());
   // TODO(bmeurer): Use the Construct builtin here.
-  int arity = OpParameter<int>(node);
   CallConstructStub stub(isolate(), SUPER_CONSTRUCTOR_CALL);
   CallInterfaceDescriptor d = stub.GetCallInterfaceDescriptor();
   CallDescriptor::Flags flags = AdjustFrameStatesForCall(node);