[compiler] Load elimination now traverses CheckTaggedPointer.

[compiler] Load elimination now traverses CheckTaggedPointer.

It also dereferences the inputs of StoreField, if those were
CheckTaggedPointers. Tested manually.

BUG=

Committed: https://crrev.com/f416886358c0aeaa5b4d1e83d9c7d6bb8b0e7f2f
Cr-Commit-Position: refs/heads/master@{#37330}

[bgeron, 2016-06-28 12:03:35]

bgeron@google.com changed reviewers:
+ bmeurer@chromium.org

[bgeron, 2016-06-28 12:03:35]

PTAL.

[bgeron, 2016-06-28 12:05:45]

Oops, this yields segfaults. Debugging now.

[Benedikt Meurer, 2016-06-28 12:17:36]

Nice, thanks. LGTM.

[bgeron, 2016-06-28 12:56:34]

The CQ bit was checked by bgeron@google.com

[commit-bot: I haz the power, 2016-06-28 12:56:38]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[bgeron, 2016-06-28 12:58:11]

Jaro suspects that my CL triggered a latent bug that you already fixed,
Benedikt. I'm landing this CL.

Command line: gdb --args out/Debug/d8 --test --trace-turbo --turbo
--enable-slow-asserts --debug-code --verify-heap --allow-natives-syntax
test/mjsunit/mjsunit.js test/mjsunit/es6/math-fround.js

Backtrace:
#0  v8::internal::compiler::Node::id (this=0x0) at ../../src/compiler/node.h:58
#1  0x000000000067aa61 in
v8::internal::compiler::RepresentationSelector::GetInfo (this=0x7fffffffc6b0,
node=0x0)
    at ../../src/compiler/simplified-lowering.cc:2137
#2  0x0000000000687ee4 in
v8::internal::compiler::RepresentationSelector::ConvertInput
(this=0x7fffffffc6b0, 
    node=0x1926110, index=0, use=...) at
../../src/compiler/simplified-lowering.cc:698
#3  0x00000000006850aa in
v8::internal::compiler::RepresentationSelector::ProcessInput
(this=0x7fffffffc6b0, 
    node=0x1926110, index=0, use=...) at
../../src/compiler/simplified-lowering.cc:720
#4  0x000000000068702b in
v8::internal::compiler::RepresentationSelector::VisitUnop (this=0x7fffffffc6b0, 
    node=0x1926110, input_use=...,
output=v8::internal::MachineRepresentation::kWord32)
    at ../../src/compiler/simplified-lowering.cc:776
#5  0x000000000067e92f in
v8::internal::compiler::RepresentationSelector::VisitNode (this=0x7fffffffc6b0, 
    node=0x1926110, truncation=..., lowering=0x7fffffffc938) at
../../src/compiler/simplified-lowering.cc:1685
#6  0x000000000067126f in v8::internal::compiler::RepresentationSelector::Run
(this=0x7fffffffc6b0, 
    lowering=0x7fffffffc938) at ../../src/compiler/simplified-lowering.cc:592
#7  0x0000000000670e65 in
v8::internal::compiler::SimplifiedLowering::LowerAllNodes (this=0x7fffffffc938)
    at ../../src/compiler/simplified-lowering.cc:2158
#8  0x00000000005e7f83 in
v8::internal::compiler::RepresentationSelectionPhase::Run (this=0x7fffffffc9b8, 
    data=0x1909558, temp_zone=0x1909a90) at ../../src/compiler/pipeline.cc:963
#9  0x00000000005da114 in
v8::internal::compiler::PipelineImpl::Run<v8::internal::compiler::RepresentationSelectionPhase>
(this=0x1909658) at ../../src/compiler/pipeline.cc:692
#10 0x00000000005d89d8 in v8::internal::compiler::PipelineImpl::CreateGraph
(this=0x1909658)
    at ../../src/compiler/pipeline.cc:1429
#11 0x00000000005d83b9 in
v8::internal::compiler::PipelineCompilationJob::CreateGraphImpl (this=0x1909280)
    at ../../src/compiler/pipeline.cc:610
#12 0x00000000006cf27f in v8::internal::CompilationJob::CreateGraph
(this=0x1909280) at ../../src/compiler.cc:254
#13 0x00000000006dbbe3 in v8::internal::(anonymous
namespace)::GetOptimizedCodeNow (job=0x1909280)
    at ../../src/compiler.cc:663
#14 0x00000000006d2fb4 in v8::internal::(anonymous namespace)::GetOptimizedCode
(function=..., 
    mode=v8::internal::Compiler::NOT_CONCURRENT, osr_ast_id=..., osr_frame=0x0)
at ../../src/compiler.cc:804
#15 0x00000000006d25cd in v8::internal::Compiler::CompileOptimized
(function=..., 
    mode=v8::internal::Compiler::NOT_CONCURRENT) at ../../src/compiler.cc:1215
#16 0x0000000000f8c60e in
v8::internal::__RT_impl_Runtime_CompileOptimized_NotConcurrent (args=...,
isolate=0x18b4320)
    at ../../src/runtime/runtime-compiler.cc:75
#17 0x0000000000f8c345 in v8::internal::Runtime_CompileOptimized_NotConcurrent
(args_length=1, 
    args_object=0x7fffffffd6b0, isolate=0x18b4320) at
../../src/runtime/runtime-compiler.cc:69

[bgeron, 2016-06-28 12:59:33]

I got that segfault when applying my patch onto this commit:

commit 99eb5686e9833b95e10d084e6baf294c9e99cf1d
Author: bmeurer <bmeurer@chromium.org>
Date:   Mon Jun 20 03:46:12 2016 -0700

    [turbofan] Introduce CheckTaggedSigned and CheckTaggedPointer operators.

[commit-bot: I haz the power, 2016-06-28 13:20:01]

Committed patchset #1 (id:1)

[commit-bot: I haz the power, 2016-06-28 13:21:10]

Description was changed from

==========
[compiler] Load elimination now traverses CheckTaggedPointer.

It also dereferences the inputs of StoreField, if those were
CheckTaggedPointers. Tested manually.

BUG=
==========

to

==========
[compiler] Load elimination now traverses CheckTaggedPointer.

It also dereferences the inputs of StoreField, if those were
CheckTaggedPointers. Tested manually.

BUG=

Committed: https://crrev.com/f416886358c0aeaa5b4d1e83d9c7d6bb8b0e7f2f
Cr-Commit-Position: refs/heads/master@{#37330}
==========

[commit-bot: I haz the power, 2016-06-28 13:21:11]

Patchset 1 (id:??) landed as
https://crrev.com/f416886358c0aeaa5b4d1e83d9c7d6bb8b0e7f2f
Cr-Commit-Position: refs/heads/master@{#37330}

[Jarin, 2016-06-30 11:46:37]

A revert of this CL (patchset #1 id:1) has been created in
https://codereview.chromium.org/2113623002/ by jarin@chromium.org.

The reason for reverting is: Clusterfuzz breakage
(https://bugs.chromium.org/p/chromium/issues/detail?id=624756).