[turbofan] Use correct lazy frame state for JSCreate.

[turbofan] Use correct lazy frame state for JSCreate.

If JSCreate (which corresponds to %NewObject) would ever trigger a lazy
deopt, we would deopt after the constructor call, skipping all the
initialization and what else in the constructor function, which is
wrong. Instead we can use the eager bailout point right before the
constructor function, because allocation is not observable and so we can
safely repeat the %NewObject in case of lazy bailout.

R=yangguo@chromium.org
BUG=v8:4544
LOG=n

Committed: https://crrev.com/476296b96b9c3ca7a6cb72e6999bde981fe52873
Cr-Commit-Position: refs/heads/master@{#32880}

[Benedikt Meurer, 2015-12-16 07:22:33]

Hey Yang,

Here's the fix for the potential bug in constructor call inlining I mentioned.
Please take a look.

Thanks,
Benedikt

[Yang, 2015-12-16 07:23:18]

On 2015/12/16 07:22:33, Benedikt Meurer wrote:
> Hey Yang,
> 
> Here's the fix for the potential bug in constructor call inlining I mentioned.
> Please take a look.
> 
> Thanks,
> Benedikt

lgtm.

[Benedikt Meurer, 2015-12-16 07:23:30]

The CQ bit was checked by bmeurer@chromium.org

[commit-bot: I haz the power, 2015-12-16 07:23:35]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1530583004/1
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1530583004/1

[commit-bot: I haz the power, 2015-12-16 07:52:27]

Committed patchset #1 (id:1)

[commit-bot: I haz the power, 2015-12-16 07:52:40]

Description was changed from

==========
[turbofan] Use correct lazy frame state for JSCreate.

If JSCreate (which corresponds to %NewObject) would ever trigger a lazy
deopt, we would deopt after the constructor call, skipping all the
initialization and what else in the constructor function, which is
wrong. Instead we can use the eager bailout point right before the
constructor function, because allocation is not observable and so we can
safely repeat the %NewObject in case of lazy bailout.

R=yangguo@chromium.org
BUG=v8:4544
LOG=n
==========

to

==========
[turbofan] Use correct lazy frame state for JSCreate.

If JSCreate (which corresponds to %NewObject) would ever trigger a lazy
deopt, we would deopt after the constructor call, skipping all the
initialization and what else in the constructor function, which is
wrong. Instead we can use the eager bailout point right before the
constructor function, because allocation is not observable and so we can
safely repeat the %NewObject in case of lazy bailout.

R=yangguo@chromium.org
BUG=v8:4544
LOG=n

Committed: https://crrev.com/476296b96b9c3ca7a6cb72e6999bde981fe52873
Cr-Commit-Position: refs/heads/master@{#32880}
==========

[commit-bot: I haz the power, 2015-12-16 07:52:41]

Patchset 1 (id:??) landed as
https://crrev.com/476296b96b9c3ca7a6cb72e6999bde981fe52873
Cr-Commit-Position: refs/heads/master@{#32880}