[builtins] Properly optimize TypedArray/DataView accessors.

[builtins] Properly optimize TypedArray/DataView accessors.

The following getters were moved to the TypedArray/DataView prototype
chain with ES2015, and hence need different treatment now:

- DataView.prototype.buffer
- DataView.prototype.byteLength
- DataView.prototype.byteOffset
- TypedArray.prototype.buffer
- TypedArray.prototype.byteLength
- TypedArray.prototype.byteOffset
- TypedArray.prototype.length

Instead of having special magic on the LoadIC in the IC system and the
optimizing compilers, as we used to do before (and which we got rid of
already), we just treat those as normal accessors and make them
recognizable via the BuiltinFunctionId mechanism. This allows us to
remove some of the additional magic from the IC subsystem, and just
extend the BuiltinFunctionId mechanism in Crankshaft slightly to cover
these cases too (TurboFan doesn't yet support accessors, but that will
be fixed soonish anyways).

This addresses most of the 15-20% regression we saw on the Octane
GameBoy emulator benchmark.

BUG=chromium:579905, chromium:593634, v8:4085, v8:5073
R=yangguo@chromium.org

Committed: https://crrev.com/1ef737026565ea2becc84f30cfd432e581d50c6b
Cr-Commit-Position: refs/heads/master@{#36782}

[Benedikt Meurer, 2016-06-07 08:00:56]

Hey Yang,

Here's the TypedArray/DataView prototype chain accessor fix.
Please take a look.

Thanks,
Benedikt

[Yang, 2016-06-07 08:27:39]

LGTM aside from nits.

https://codereview.chromium.org/2042013003/diff/1/src/builtins.cc
File src/builtins.cc (right):

https://codereview.chromium.org/2042013003/diff/1/src/builtins.cc#newcode3122
src/builtins.cc:3122: // Check if the {receiver}s JSArrayBuffer was neutered.
{receiver}'s :)

https://codereview.chromium.org/2042013003/diff/1/src/builtins.cc#newcode3132
src/builtins.cc:3132: 1 << JSArrayBuffer::WasNeutered::kShift)),
You can simply use JSArrayBuffer::WasNeutered::kMask

[Benedikt Meurer, 2016-06-07 09:24:36]

https://codereview.chromium.org/2042013003/diff/1/src/builtins.cc
File src/builtins.cc (right):

https://codereview.chromium.org/2042013003/diff/1/src/builtins.cc#newcode3122
src/builtins.cc:3122: // Check if the {receiver}s JSArrayBuffer was neutered.
On 2016/06/07 08:27:39, Yang wrote:
> {receiver}'s :)

Done.

https://codereview.chromium.org/2042013003/diff/1/src/builtins.cc#newcode3132
src/builtins.cc:3132: 1 << JSArrayBuffer::WasNeutered::kShift)),
On 2016/06/07 08:27:39, Yang wrote:
> You can simply use JSArrayBuffer::WasNeutered::kMask

Done.

[Benedikt Meurer, 2016-06-07 09:27:16]

The CQ bit was checked by bmeurer@chromium.org

[Benedikt Meurer, 2016-06-07 09:27:17]

The patchset sent to the CQ was uploaded after l-g-t-m from yangguo@chromium.org
Link to the patchset: https://codereview.chromium.org/2042013003/#ps40001
(title: "Address Yang's comments.")

[commit-bot: I haz the power, 2016-06-07 09:27:23]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/2042013003/40001

[commit-bot: I haz the power, 2016-06-07 09:56:04]

Committed patchset #3 (id:40001)

[commit-bot: I haz the power, 2016-06-07 09:58:09]

Description was changed from

==========
[builtins] Properly optimize TypedArray/DataView accessors.

The following getters were moved to the TypedArray/DataView prototype
chain with ES2015, and hence need different treatment now:

- DataView.prototype.buffer
- DataView.prototype.byteLength
- DataView.prototype.byteOffset
- TypedArray.prototype.buffer
- TypedArray.prototype.byteLength
- TypedArray.prototype.byteOffset
- TypedArray.prototype.length

Instead of having special magic on the LoadIC in the IC system and the
optimizing compilers, as we used to do before (and which we got rid of
already), we just treat those as normal accessors and make them
recognizable via the BuiltinFunctionId mechanism. This allows us to
remove some of the additional magic from the IC subsystem, and just
extend the BuiltinFunctionId mechanism in Crankshaft slightly to cover
these cases too (TurboFan doesn't yet support accessors, but that will
be fixed soonish anyways).

This addresses most of the 15-20% regression we saw on the Octane
GameBoy emulator benchmark.

BUG=chromium:579905,chromium:593634,v8:4085,v8:5073
R=yangguo@chromium.org
==========

to

==========
[builtins] Properly optimize TypedArray/DataView accessors.

The following getters were moved to the TypedArray/DataView prototype
chain with ES2015, and hence need different treatment now:

- DataView.prototype.buffer
- DataView.prototype.byteLength
- DataView.prototype.byteOffset
- TypedArray.prototype.buffer
- TypedArray.prototype.byteLength
- TypedArray.prototype.byteOffset
- TypedArray.prototype.length

Instead of having special magic on the LoadIC in the IC system and the
optimizing compilers, as we used to do before (and which we got rid of
already), we just treat those as normal accessors and make them
recognizable via the BuiltinFunctionId mechanism. This allows us to
remove some of the additional magic from the IC subsystem, and just
extend the BuiltinFunctionId mechanism in Crankshaft slightly to cover
these cases too (TurboFan doesn't yet support accessors, but that will
be fixed soonish anyways).

This addresses most of the 15-20% regression we saw on the Octane
GameBoy emulator benchmark.

BUG=chromium:579905,chromium:593634,v8:4085,v8:5073
R=yangguo@chromium.org

Committed: https://crrev.com/1ef737026565ea2becc84f30cfd432e581d50c6b
Cr-Commit-Position: refs/heads/master@{#36782}
==========

[commit-bot: I haz the power, 2016-06-07 09:58:10]

Patchset 3 (id:??) landed as
https://crrev.com/1ef737026565ea2becc84f30cfd432e581d50c6b
Cr-Commit-Position: refs/heads/master@{#36782}

[Michael Achenbach, 2016-06-07 11:27:12]

A revert of this CL (patchset #3 id:40001) has been created in
https://codereview.chromium.org/2039093005/ by machenbach@chromium.org.

The reason for reverting is: Blink:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/bui....