[turbofan] Allow to consume feedback on CallConstruct.

[turbofan] Allow to consume feedback on CallConstruct.

Add an eager deoptimization location for JSCallConstruct and adapt the
JSCallReducer to consume target feedback for construction sites (only
applies to explicit new F(...args) not the super constructor calls).
Also recognize the new Array(...args) constructs with only target
feedback.

R=jarin@chromium.org
BUG=v8:4470
LOG=n

Committed: https://crrev.com/a61a6f999884781481a237297da8c5f56d92d67f
Cr-Commit-Position: refs/heads/master@{#32177}

[Benedikt Meurer, 2015-11-23 11:50:30]

Hey Jaro,

Here's the CL you looked into previously.
Please take a look.

Thanks,
Benedikt

[Jarin, 2015-11-23 12:52:07]

lgtm with questions.

https://codereview.chromium.org/1467173002/diff/1/src/compiler/js-call-reduce...
File src/compiler/js-call-reducer.cc (right):

https://codereview.chromium.org/1467173002/diff/1/src/compiler/js-call-reduce...
src/compiler/js-call-reducer.cc:345: NodeProperties::RemoveFrameStateInput(node,
0);
Could you add a comment that explains that you remove the eager frame? (And
maybe even explain why.)

https://codereview.chromium.org/1467173002/diff/1/src/compiler/js-call-reduce...
src/compiler/js-call-reducer.cc:389: if (feedback->IsAllocationSite()) {
Perhaps explanation why allocation site implies array?

[Benedikt Meurer, 2015-11-23 12:59:03]

https://codereview.chromium.org/1467173002/diff/1/src/compiler/js-call-reduce...
File src/compiler/js-call-reducer.cc (right):

https://codereview.chromium.org/1467173002/diff/1/src/compiler/js-call-reduce...
src/compiler/js-call-reducer.cc:345: NodeProperties::RemoveFrameStateInput(node,
0);
Done. It's the eager one BTW.

https://codereview.chromium.org/1467173002/diff/1/src/compiler/js-call-reduce...
src/compiler/js-call-reducer.cc:389: if (feedback->IsAllocationSite()) {
On 2015/11/23 12:52:07, Jarin wrote:
> Perhaps explanation why allocation site implies array?

Done.

[Benedikt Meurer, 2015-11-23 12:59:07]

The CQ bit was checked by bmeurer@chromium.org

[Benedikt Meurer, 2015-11-23 12:59:07]

The patchset sent to the CQ was uploaded after l-g-t-m from jarin@chromium.org
Link to the patchset: https://codereview.chromium.org/1467173002/#ps20001
(title: "Address comments.")

[commit-bot: I haz the power, 2015-11-23 12:59:14]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1467173002/20001
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1467173002/20001

[Jarin, 2015-11-23 13:06:29]

https://codereview.chromium.org/1467173002/diff/1/src/compiler/js-call-reduce...
File src/compiler/js-call-reducer.cc (right):

https://codereview.chromium.org/1467173002/diff/1/src/compiler/js-call-reduce...
src/compiler/js-call-reducer.cc:345: NodeProperties::RemoveFrameStateInput(node,
0);
On 2015/11/23 12:59:03, Benedikt Meurer wrote:
> Done. It's the eager one BTW.

Right, it looks like we both meant 'lazy' and somehow wrote 'eager'.

https://codereview.chromium.org/1467173002/diff/20001/src/compiler/js-call-re...
File src/compiler/js-call-reducer.cc (right):

https://codereview.chromium.org/1467173002/diff/20001/src/compiler/js-call-re...
src/compiler/js-call-reducer.cc:348: // go back after throwing the exception.
FYI, the frame state will matter if we implement lazy deopt from throwing by
massaging the call's frame state.

[commit-bot: I haz the power, 2015-11-23 13:33:51]

Committed patchset #2 (id:20001)

[commit-bot: I haz the power, 2015-11-23 13:34:38]

Patchset 2 (id:??) landed as
https://crrev.com/a61a6f999884781481a237297da8c5f56d92d67f
Cr-Commit-Position: refs/heads/master@{#32177}