[turbofan] Add support for copy-on-write element stores.

[turbofan] Add support for copy-on-write element stores.

This extends JSNativeContextSpecialization with support for stores to
fast object/smi element backing stores that are marked as copy-on-write.
In this case we first call the CopyFixedArray builtin to take a copy of
the elements backing store, and then store the new elements back to the
object, and finally perform the actual element store.

R=epertoso@chromium.org
BUG=v8:4470
Committed: https://crrev.com/ac98ad22f049a59c48387f1bab1590f135d219c6
Committed: https://crrev.com/b659a0ac2306303f0b7799fc884d57ca0c4dbf92
Cr-Original-Commit-Position: refs/heads/master@{#38370}
Cr-Commit-Position: refs/heads/master@{#38392}

[Benedikt Meurer, 2016-08-05 09:56:48]

The CQ bit was checked by bmeurer@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2016-08-05 09:56:59]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[epertoso, 2016-08-05 10:21:41]

https://codereview.chromium.org/2218703003/diff/1/src/builtins/builtins-inter...
File src/builtins/builtins-internal.cc (right):

https://codereview.chromium.org/2218703003/diff/1/src/builtins/builtins-inter...
src/builtins/builtins-internal.cc:94:
var_index.Bind(assembler->IntPtrConstant(0));
nit: if you bind this to FixedArray::kHeaderSize - kHeapObjectTag, you can
simplify the code below (compare with source_size and just incrementing by
kPointerSize).

[Benedikt Meurer, 2016-08-05 10:30:26]

https://codereview.chromium.org/2218703003/diff/1/src/builtins/builtins-inter...
File src/builtins/builtins-internal.cc (right):

https://codereview.chromium.org/2218703003/diff/1/src/builtins/builtins-inter...
src/builtins/builtins-internal.cc:94:
var_index.Bind(assembler->IntPtrConstant(0));
Nice idea! Done.

[Benedikt Meurer, 2016-08-05 10:31:03]

The CQ bit was checked by bmeurer@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2016-08-05 10:31:14]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[epertoso, 2016-08-05 10:36:00]

lgtm

[Benedikt Meurer, 2016-08-05 10:42:39]

The CQ bit was unchecked by bmeurer@chromium.org

[Benedikt Meurer, 2016-08-05 10:42:43]

The CQ bit was checked by bmeurer@chromium.org

[commit-bot: I haz the power, 2016-08-05 10:42:52]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-08-05 10:57:15]

Committed patchset #2 (id:20001)

[commit-bot: I haz the power, 2016-08-05 10:58:45]

Description was changed from

==========
[turbofan] Add support for copy-on-write element stores.

This extends JSNativeContextSpecialization with support for stores to
fast object/smi element backing stores that are marked as copy-on-write.
In this case we first call the CopyFixedArray builtin to take a copy of
the elements backing store, and then store the new elements back to the
object, and finally perform the actual element store.

R=epertoso@chromium.org
BUG=v8:4470
==========

to

==========
[turbofan] Add support for copy-on-write element stores.

This extends JSNativeContextSpecialization with support for stores to
fast object/smi element backing stores that are marked as copy-on-write.
In this case we first call the CopyFixedArray builtin to take a copy of
the elements backing store, and then store the new elements back to the
object, and finally perform the actual element store.

R=epertoso@chromium.org
BUG=v8:4470

Committed: https://crrev.com/ac98ad22f049a59c48387f1bab1590f135d219c6
Cr-Commit-Position: refs/heads/master@{#38370}
==========

[commit-bot: I haz the power, 2016-08-05 10:58:46]

Patchset 2 (id:??) landed as
https://crrev.com/ac98ad22f049a59c48387f1bab1590f135d219c6
Cr-Commit-Position: refs/heads/master@{#38370}

[Benedikt Meurer, 2016-08-05 12:01:49]

A revert of this CL (patchset #2 id:20001) has been created in
https://codereview.chromium.org/2220513002/ by bmeurer@chromium.org.

The reason for reverting is: Breaks tree?.

[Michael Achenbach, 2016-08-05 12:07:17]

Makes kraken crashy:
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20-%20debug%20-%...

Tested locally that it comes from this CL.

[Benedikt Meurer, 2016-08-05 12:59:49]

Description was changed from

==========
[turbofan] Add support for copy-on-write element stores.

This extends JSNativeContextSpecialization with support for stores to
fast object/smi element backing stores that are marked as copy-on-write.
In this case we first call the CopyFixedArray builtin to take a copy of
the elements backing store, and then store the new elements back to the
object, and finally perform the actual element store.

R=epertoso@chromium.org
BUG=v8:4470

Committed: https://crrev.com/ac98ad22f049a59c48387f1bab1590f135d219c6
Cr-Commit-Position: refs/heads/master@{#38370}
==========

to

==========
[turbofan] Add support for copy-on-write element stores.

This extends JSNativeContextSpecialization with support for stores to
fast object/smi element backing stores that are marked as copy-on-write.
In this case we first call the CopyFixedArray builtin to take a copy of
the elements backing store, and then store the new elements back to the
object, and finally perform the actual element store.

R=epertoso@chromium.org
BUG=v8:4470

Committed: https://crrev.com/ac98ad22f049a59c48387f1bab1590f135d219c6
Cr-Commit-Position: refs/heads/master@{#38370}
==========

[Benedikt Meurer, 2016-08-05 13:02:59]

The CQ bit was checked by bmeurer@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2016-08-05 13:03:07]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[Benedikt Meurer, 2016-08-05 13:10:19]

The CQ bit was unchecked by bmeurer@chromium.org

[Benedikt Meurer, 2016-08-05 13:17:54]

The CQ bit was checked by bmeurer@chromium.org

[Benedikt Meurer, 2016-08-05 13:17:54]

The patchset sent to the CQ was uploaded after l-g-t-m from
epertoso@chromium.org
Link to the patchset: https://codereview.chromium.org/2218703003/#ps40001
(title: "Fix off-by-one loop iteration count.")

[commit-bot: I haz the power, 2016-08-05 13:17:58]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-08-05 15:03:44]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-08-05 15:03:46]

Try jobs failed on following builders:
  v8_linux_arm64_rel_ng on master.tryserver.v8 (JOB_TIMED_OUT, no build URL)

[Benedikt Meurer (Google), 2016-08-05 15:04:46]

The CQ bit was checked by bmeurer@google.com

[commit-bot: I haz the power, 2016-08-05 15:04:55]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-08-05 15:29:02]

Description was changed from

==========
[turbofan] Add support for copy-on-write element stores.

This extends JSNativeContextSpecialization with support for stores to
fast object/smi element backing stores that are marked as copy-on-write.
In this case we first call the CopyFixedArray builtin to take a copy of
the elements backing store, and then store the new elements back to the
object, and finally perform the actual element store.

R=epertoso@chromium.org
BUG=v8:4470

Committed: https://crrev.com/ac98ad22f049a59c48387f1bab1590f135d219c6
Cr-Commit-Position: refs/heads/master@{#38370}
==========

to

==========
[turbofan] Add support for copy-on-write element stores.

This extends JSNativeContextSpecialization with support for stores to
fast object/smi element backing stores that are marked as copy-on-write.
In this case we first call the CopyFixedArray builtin to take a copy of
the elements backing store, and then store the new elements back to the
object, and finally perform the actual element store.

R=epertoso@chromium.org
BUG=v8:4470

Committed: https://crrev.com/ac98ad22f049a59c48387f1bab1590f135d219c6
Cr-Commit-Position: refs/heads/master@{#38370}
==========

[commit-bot: I haz the power, 2016-08-05 15:29:03]

Committed patchset #3 (id:40001)

[commit-bot: I haz the power, 2016-08-05 15:32:22]

Description was changed from

==========
[turbofan] Add support for copy-on-write element stores.

This extends JSNativeContextSpecialization with support for stores to
fast object/smi element backing stores that are marked as copy-on-write.
In this case we first call the CopyFixedArray builtin to take a copy of
the elements backing store, and then store the new elements back to the
object, and finally perform the actual element store.

R=epertoso@chromium.org
BUG=v8:4470

Committed: https://crrev.com/ac98ad22f049a59c48387f1bab1590f135d219c6
Cr-Commit-Position: refs/heads/master@{#38370}
==========

to

==========
[turbofan] Add support for copy-on-write element stores.

This extends JSNativeContextSpecialization with support for stores to
fast object/smi element backing stores that are marked as copy-on-write.
In this case we first call the CopyFixedArray builtin to take a copy of
the elements backing store, and then store the new elements back to the
object, and finally perform the actual element store.

R=epertoso@chromium.org
BUG=v8:4470

Committed: https://crrev.com/ac98ad22f049a59c48387f1bab1590f135d219c6
Committed: https://crrev.com/b659a0ac2306303f0b7799fc884d57ca0c4dbf92
Cr-Original-Commit-Position: refs/heads/master@{#38370}
Cr-Commit-Position: refs/heads/master@{#38392}
==========

[commit-bot: I haz the power, 2016-08-05 15:32:23]

Patchset 3 (id:??) landed as
https://crrev.com/b659a0ac2306303f0b7799fc884d57ca0c4dbf92
Cr-Commit-Position: refs/heads/master@{#38392}