[turbofan] Remove unnecessary prototype checks for element access.

[turbofan] Remove unnecessary prototype checks for element access.

We don't need to add stability dependencies on JSObject prototypes when
storing to an element, because we do the map check (and thereby guard
the elements kind) and we also properly deoptimize on holes if the array
protector is not usable.

R=verwaest@chromium.org
BUG=chromium:616709
Committed: https://crrev.com/cad5b29610a1684adecafe25544a6d6dddf2113b
Cr-Commit-Position: refs/heads/master@{#38355}

[Benedikt Meurer, 2016-08-01 11:33:48]

The CQ bit was checked by bmeurer@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2016-08-01 11:33:54]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-08-01 11:48:45]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-08-01 11:48:46]

Dry run: Try jobs failed on following builders:
  v8_mac_rel_ng on master.tryserver.v8 (JOB_FAILED,
http://build.chromium.org/p/tryserver.v8/builders/v8_mac_rel_ng/builds/6014)
  v8_mac_rel_ng_triggered on master.tryserver.v8 (JOB_FAILED,
http://build.chromium.org/p/tryserver.v8/builders/v8_mac_rel_ng_triggered/bui...)

[Benedikt Meurer, 2016-08-04 04:21:11]

The CQ bit was checked by bmeurer@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2016-08-04 04:21:16]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-08-04 04:41:16]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-08-04 04:41:16]

Dry run: This issue passed the CQ dry run.

[Toon Verwaest, 2016-08-04 12:36:46]

nice! lgtm

[Benedikt Meurer (Google), 2016-08-04 13:23:51]

The CQ bit was checked by bmeurer@google.com

[commit-bot: I haz the power, 2016-08-04 13:23:53]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-08-04 13:27:02]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-08-04 13:27:04]

Try jobs failed on following builders:
  v8_presubmit on master.tryserver.v8 (JOB_FAILED,
http://build.chromium.org/p/tryserver.v8/builders/v8_presubmit/builds/21017)

[Benedikt Meurer, 2016-08-05 04:13:20]

The CQ bit was checked by bmeurer@chromium.org

[Benedikt Meurer, 2016-08-05 04:13:21]

The patchset sent to the CQ was uploaded after l-g-t-m from
verwaest@chromium.org
Link to the patchset: https://codereview.chromium.org/2198833002/#ps40001
(title: "REBASE")

[commit-bot: I haz the power, 2016-08-05 04:13:27]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-08-05 04:53:57]

Committed patchset #3 (id:40001)

[commit-bot: I haz the power, 2016-08-05 04:55:13]

Description was changed from

==========
[turbofan] Remove unnecessary prototype checks for element access.

We don't need to add stability dependencies on JSObject prototypes when
storing to an element, because we do the map check (and thereby guard
the elements kind) and we also properly deoptimize on holes if the array
protector is not usable.

R=verwaest@chromium.org
BUG=chromium:616709
==========

to

==========
[turbofan] Remove unnecessary prototype checks for element access.

We don't need to add stability dependencies on JSObject prototypes when
storing to an element, because we do the map check (and thereby guard
the elements kind) and we also properly deoptimize on holes if the array
protector is not usable.

R=verwaest@chromium.org
BUG=chromium:616709

Committed: https://crrev.com/cad5b29610a1684adecafe25544a6d6dddf2113b
Cr-Commit-Position: refs/heads/master@{#38355}
==========

[commit-bot: I haz the power, 2016-08-05 04:55:14]

Patchset 3 (id:??) landed as
https://crrev.com/cad5b29610a1684adecafe25544a6d6dddf2113b
Cr-Commit-Position: refs/heads/master@{#38355}

[adamk, 2016-08-08 22:02:00]

https://codereview.chromium.org/2198833002/diff/40001/src/compiler/js-native-...
File src/compiler/js-native-context-specialization.cc (right):

https://codereview.chromium.org/2198833002/diff/40001/src/compiler/js-native-...
src/compiler/js-native-context-specialization.cc:1257:
dependencies()->AssumePrototypeMapsStable(map, initial_object_prototype);
Are you missing a call for initial_array_prototype here? See
https://bugs.chromium.org/p/v8/issues/detail?id=5275