[turbofan] Remove eager frame state from JSMultiply.

[turbofan] Remove eager frame state from JSMultiply.

This removes the frame state input representing the before-state from
nodes having the {JSMultiply} operator. Lowering that inserts number
conversions of the inputs has to be disabled when deoptimization is
enabled, because the frame state layout is no longer known.

R=jarin@chromium.org
BUG=v8:5021
Committed: https://crrev.com/277fac44ffe9e5824964c4a252138ff25c2d8e82
Cr-Commit-Position: refs/heads/master@{#37517}

[Jarin, 2016-06-30 16:32:48]

lgtm. Great to see this being removed!

https://codereview.chromium.org/2111193002/diff/20001/src/compiler/js-typed-l...
File src/compiler/js-typed-lowering.cc (right):

https://codereview.chromium.org/2111193002/diff/20001/src/compiler/js-typed-l...
src/compiler/js-typed-lowering.cc:536: // conversions of either input to number.
We rely on type feedback instead.
Nit: Maybe you can just say "If deoptimization is enabled we rely on type
feedback." Hopefully, in several months no one will remember the crazy frame
state massage. In that world, the comment will make little sense.

[Michael Starzinger, 2016-07-01 09:36:08]

Thanks! Comments addressed. I think I'll wait with landing this until early next
week when our auto-roller is on again and we have a somewhat stable Canary
again.

https://codereview.chromium.org/2111193002/diff/20001/src/compiler/js-typed-l...
File src/compiler/js-typed-lowering.cc (right):

https://codereview.chromium.org/2111193002/diff/20001/src/compiler/js-typed-l...
src/compiler/js-typed-lowering.cc:536: // conversions of either input to number.
We rely on type feedback instead.
On 2016/06/30 16:32:48, Jarin wrote:
> Nit: Maybe you can just say "If deoptimization is enabled we rely on type
> feedback." Hopefully, in several months no one will remember the crazy frame
> state massage. In that world, the comment will make little sense.

Done.

[Michael Starzinger, 2016-07-05 08:38:53]

The CQ bit was checked by mstarzinger@chromium.org

[Michael Starzinger, 2016-07-05 08:38:54]

The patchset sent to the CQ was uploaded after l-g-t-m from jarin@chromium.org
Link to the patchset: https://codereview.chromium.org/2111193002/#ps40001
(title: "Addressed comment.")

[commit-bot: I haz the power, 2016-07-05 08:39:02]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-07-05 09:04:00]

Committed patchset #3 (id:40001)

[commit-bot: I haz the power, 2016-07-05 09:05:40]

Description was changed from

==========
[turbofan] Remove eager frame state from JSMultiply.

This removes the frame state input representing the before-state from
nodes having the {JSMultiply} operator. Lowering that inserts number
conversions of the inputs has to be disabled when deoptimization is
enabled, because the frame state layout is no longer known.

R=jarin@chromium.org
BUG=v8:5021
==========

to

==========
[turbofan] Remove eager frame state from JSMultiply.

This removes the frame state input representing the before-state from
nodes having the {JSMultiply} operator. Lowering that inserts number
conversions of the inputs has to be disabled when deoptimization is
enabled, because the frame state layout is no longer known.

R=jarin@chromium.org
BUG=v8:5021

Committed: https://crrev.com/277fac44ffe9e5824964c4a252138ff25c2d8e82
Cr-Commit-Position: refs/heads/master@{#37517}
==========

[commit-bot: I haz the power, 2016-07-05 09:05:41]

Patchset 3 (id:??) landed as
https://crrev.com/277fac44ffe9e5824964c4a252138ff25c2d8e82
Cr-Commit-Position: refs/heads/master@{#37517}