[turbofan] Add initial support for growing stores.

[turbofan] Add initial support for growing stores.

Introduce a dedicated MaybeGrowFastElements simplified operator, which
tries to grow a fast elements backing store for a given element that
should be added to an array/object. Use that to lower a growing keyed
store to a sequence of

 1) check index is a valid array index,
 2) check stored value,
 3) maybe grow elements backing store (and deoptimize if it would
    normalize), and
 4) store the actual element.

The actual growing is done by two dedicated GrowFastDoubleElements
and GrowFastSmiOrObjectElements builtins, which are very similar to
the GrowArrayElementsStub that is used by Crankshaft.

Drive-by-fix: Turn CopyFixedArray into CopyFastSmiOrObjectElements
builtin, similar to the new growing builtins, so we don't need to
inline the store+write barrier for the elements into all optimized
code objects anymore.

Also fix a bug in the OperationTyper for NumberSilenceNaN, which was
triggered by this change.

BUG=v8:5272
Committed: https://crrev.com/e6822a8338c70ab476e545da95d958c23ac366f9
Cr-Commit-Position: refs/heads/master@{#38418}

[Benedikt Meurer, 2016-08-08 05:12:37]

The CQ bit was checked by bmeurer@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2016-08-08 05:12:47]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[Benedikt Meurer, 2016-08-08 05:18:37]

bmeurer@chromium.org changed reviewers:
+ jarin@chromium.org

[Benedikt Meurer, 2016-08-08 05:18:38]

Hey Jaro,

Here's the last missing store mode support.
Please take a look.

Thanks,
Benedikt

[commit-bot: I haz the power, 2016-08-08 05:45:46]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-08-08 05:45:48]

Dry run: This issue passed the CQ dry run.

[Benedikt Meurer, 2016-08-08 07:59:30]

The CQ bit was checked by bmeurer@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2016-08-08 07:59:35]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[Jarin, 2016-08-08 08:03:48]

lgtm.

https://codereview.chromium.org/2227493002/diff/1/src/compiler/load-eliminati...
File src/compiler/load-elimination.cc (right):

https://codereview.chromium.org/2227493002/diff/1/src/compiler/load-eliminati...
src/compiler/load-elimination.cc:618: state = state->KillField(object, 2,
zone());
Should not the magic numbers (like 2 here and 3 below) have some human readable
names? (Especially when there are no nearby comments explaining this .)

https://codereview.chromium.org/2227493002/diff/1/src/compiler/operation-type...
File src/compiler/operation-typer.cc (right):

https://codereview.chromium.org/2227493002/diff/1/src/compiler/operation-type...
src/compiler/operation-typer.cc:487: // TODO(turbofan): We should have a
dedicated type for the signaling NaN.
Please add a comment that signposts a horrible hack.

https://codereview.chromium.org/2227493002/diff/1/src/compiler/simplified-low...
File src/compiler/simplified-lowering.cc (right):

https://codereview.chromium.org/2227493002/diff/1/src/compiler/simplified-low...
src/compiler/simplified-lowering.cc:2396: ProcessInput(node, 3,
UseInfo::TruncatingWord32());
Again, the magic indices are not helping readability here. Could we have at
least a one-word comment at the end of each line above? (Such as // length
etc.).

[Benedikt Meurer, 2016-08-08 08:12:56]

https://codereview.chromium.org/2227493002/diff/1/src/compiler/load-eliminati...
File src/compiler/load-elimination.cc (right):

https://codereview.chromium.org/2227493002/diff/1/src/compiler/load-eliminati...
src/compiler/load-elimination.cc:618: state = state->KillField(object, 2,
zone());
Acknowledged. On the TODO list.

https://codereview.chromium.org/2227493002/diff/1/src/compiler/operation-type...
File src/compiler/operation-typer.cc (right):

https://codereview.chromium.org/2227493002/diff/1/src/compiler/operation-type...
src/compiler/operation-typer.cc:487: // TODO(turbofan): We should have a
dedicated type for the signaling NaN.
On 2016/08/08 08:03:47, Jarin wrote:
> Please add a comment that signposts a horrible hack.

Done.

https://codereview.chromium.org/2227493002/diff/1/src/compiler/simplified-low...
File src/compiler/simplified-lowering.cc (right):

https://codereview.chromium.org/2227493002/diff/1/src/compiler/simplified-low...
src/compiler/simplified-lowering.cc:2396: ProcessInput(node, 3,
UseInfo::TruncatingWord32());
On 2016/08/08 08:03:47, Jarin wrote:
> Again, the magic indices are not helping readability here. Could we have at
> least a one-word comment at the end of each line above? (Such as // length
> etc.).

Done.

[Benedikt Meurer, 2016-08-08 08:17:42]

The CQ bit was checked by bmeurer@chromium.org

[Benedikt Meurer, 2016-08-08 08:17:42]

The patchset sent to the CQ was uploaded after l-g-t-m from jarin@chromium.org
Link to the patchset: https://codereview.chromium.org/2227493002/#ps60001
(title: "Add comments.")

[commit-bot: I haz the power, 2016-08-08 08:17:45]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-08-08 08:43:57]

Committed patchset #4 (id:60001)

[commit-bot: I haz the power, 2016-08-08 08:44:34]

Description was changed from

==========
[turbofan] Add initial support for growing stores.

Introduce a dedicated MaybeGrowFastElements simplified operator, which
tries to grow a fast elements backing store for a given element that
should be added to an array/object. Use that to lower a growing keyed
store to a sequence of

 1) check index is a valid array index,
 2) check stored value,
 3) maybe grow elements backing store (and deoptimize if it would
    normalize), and
 4) store the actual element.

The actual growing is done by two dedicated GrowFastDoubleElements
and GrowFastSmiOrObjectElements builtins, which are very similar to
the GrowArrayElementsStub that is used by Crankshaft.

Drive-by-fix: Turn CopyFixedArray into CopyFastSmiOrObjectElements
builtin, similar to the new growing builtins, so we don't need to
inline the store+write barrier for the elements into all optimized
code objects anymore.

Also fix a bug in the OperationTyper for NumberSilenceNaN, which was
triggered by this change.

BUG=v8:5272
==========

to

==========
[turbofan] Add initial support for growing stores.

Introduce a dedicated MaybeGrowFastElements simplified operator, which
tries to grow a fast elements backing store for a given element that
should be added to an array/object. Use that to lower a growing keyed
store to a sequence of

 1) check index is a valid array index,
 2) check stored value,
 3) maybe grow elements backing store (and deoptimize if it would
    normalize), and
 4) store the actual element.

The actual growing is done by two dedicated GrowFastDoubleElements
and GrowFastSmiOrObjectElements builtins, which are very similar to
the GrowArrayElementsStub that is used by Crankshaft.

Drive-by-fix: Turn CopyFixedArray into CopyFastSmiOrObjectElements
builtin, similar to the new growing builtins, so we don't need to
inline the store+write barrier for the elements into all optimized
code objects anymore.

Also fix a bug in the OperationTyper for NumberSilenceNaN, which was
triggered by this change.

BUG=v8:5272

Committed: https://crrev.com/e6822a8338c70ab476e545da95d958c23ac366f9
Cr-Commit-Position: refs/heads/master@{#38418}
==========

[commit-bot: I haz the power, 2016-08-08 08:44:35]

Patchset 4 (id:??) landed as
https://crrev.com/e6822a8338c70ab476e545da95d958c23ac366f9
Cr-Commit-Position: refs/heads/master@{#38418}