Pretenure code generation corner case with new space COW arrays.

Pretenure code generation corner case with new space COW arrays.

When advised to pretenure in crankshaft, and the boilerplate is a cow
array, move the elements to old space if it's not already there to avoid
overflowing the store buffer.

R=hpayer@chromium.org

Committed: https://code.google.com/p/v8/source/detail?r=19995

[mvstanton, 2014-03-12 15:09:14]

Hi Hannes, here is the issue with splay pause times we diagnosed Monday. After
landing pretenure call new support, I'd like to revisit and just always
pretenure boilerplates (if possible), then this change can be removed.
PTAL, thanks,
--Michael

[Hannes Payer (out of office), 2014-03-17 09:37:18]

https://codereview.chromium.org/197473004/diff/1/src/heap.cc
File src/heap.cc (right):

https://codereview.chromium.org/197473004/diff/1/src/heap.cc#newcode5042
src/heap.cc:5042: ASSERT(InNewSpace(src));
This ASSERT may be wrong here, but it should hold in factory.cc.
This is what can happen: The factory may trigger a gc which may move src to old
space.

In that case, you could just return the old src instead of allocating a new one.
WDYT?

https://codereview.chromium.org/197473004/diff/1/src/heap.cc#newcode5048
src/heap.cc:5048:
HeapObject::cast(obj)->set_map_no_write_barrier(fixed_array_map());
Can you set fixed_cow_array_map() here?

https://codereview.chromium.org/197473004/diff/1/src/hydrogen.cc
File src/hydrogen.cc (right):

https://codereview.chromium.org/197473004/diff/1/src/hydrogen.cc#newcode9776
src/hydrogen.cc:9776: 
This method needs more comments... please explain what is going on here.

[mvstanton, 2014-03-17 12:25:28]

Thanks for the look Hannes, addressed comments.
--Michael

https://codereview.chromium.org/197473004/diff/1/src/heap.cc
File src/heap.cc (right):

https://codereview.chromium.org/197473004/diff/1/src/heap.cc#newcode5042
src/heap.cc:5042: ASSERT(InNewSpace(src));
On 2014/03/17 09:37:18, Hannes Payer wrote:
> This ASSERT may be wrong here, but it should hold in factory.cc.
> This is what can happen: The factory may trigger a gc which may move src to
old
> space.
> 
> In that case, you could just return the old src instead of allocating a new
one.
> WDYT?

Great idea, thx, done.

https://codereview.chromium.org/197473004/diff/1/src/heap.cc#newcode5048
src/heap.cc:5048:
HeapObject::cast(obj)->set_map_no_write_barrier(fixed_array_map());
On 2014/03/17 09:37:18, Hannes Payer wrote:
> Can you set fixed_cow_array_map() here?

No because of protections in FixedArray::set() against setting elements in a COW
array. Created issue v8:3221 to track an alternate approach, that of pretenuring
all boilerplates, allowing us to remove this approach completely.

Also added a comment to that effect.

https://codereview.chromium.org/197473004/diff/1/src/hydrogen.cc
File src/hydrogen.cc (right):

https://codereview.chromium.org/197473004/diff/1/src/hydrogen.cc#newcode9776
src/hydrogen.cc:9776: 
On 2014/03/17 09:37:18, Hannes Payer wrote:
> This method needs more comments... please explain what is going on here.

Done.

[Hannes Payer (out of office), 2014-03-17 12:52:09]

LGTM

[mvstanton, 2014-03-17 13:42:45]

Committed patchset #3 manually as r19995 (presubmit successful).