[turbofan] Add inlined Array.prototype.push support.

[turbofan] Add inlined Array.prototype.push support.

This adds a very first version of inlined Array.prototype.push into
TurboFan optimized code. The current inlined version has a potential
deopt loop, but it's unlikely that we hit it currently (Crankshaft
suffers from an even worse problem). Once we have a way to learn from
deopts we can fix this deopt loops.

It's also probably overly defensive in when it's safe to inline
the call to Array.prototype.push, but we can always extend that
later once we have sufficient trust in the implementation and see
an actual need to extend it.

BUG=v8:2229, v8:3952, v8:5267
R=jarin@chromium.org

Committed: https://crrev.com/50f223e47eafdf4fccc0108b03affca9e3d892b1
Cr-Commit-Position: refs/heads/master@{#38603}

[Benedikt Meurer, 2016-08-12 08:33:34]

The CQ bit was checked by bmeurer@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2016-08-12 08:33:36]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[Jarin, 2016-08-12 08:48:34]

lgtm

[commit-bot: I haz the power, 2016-08-12 08:55:06]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-08-12 08:55:06]

Dry run: This issue passed the CQ dry run.

[Benedikt Meurer, 2016-08-12 08:57:21]

The CQ bit was checked by bmeurer@chromium.org

[commit-bot: I haz the power, 2016-08-12 08:57:26]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-08-12 08:59:24]

Committed patchset #1 (id:1)

[commit-bot: I haz the power, 2016-08-12 08:59:34]

Description was changed from

==========
[turbofan] Add inlined Array.prototype.push support.

This adds a very first version of inlined Array.prototype.push into
TurboFan optimized code. The current inlined version has a potential
deopt loop, but it's unlikely that we hit it currently (Crankshaft
suffers from an even worse problem). Once we have a way to learn from
deopts we can fix this deopt loops.

It's also probably overly defensive in when it's safe to inline
the call to Array.prototype.push, but we can always extend that
later once we have sufficient trust in the implementation and see
an actual need to extend it.

BUG=v8:2229,v8:3952,v8:5267
R=jarin@chromium.org
==========

to

==========
[turbofan] Add inlined Array.prototype.push support.

This adds a very first version of inlined Array.prototype.push into
TurboFan optimized code. The current inlined version has a potential
deopt loop, but it's unlikely that we hit it currently (Crankshaft
suffers from an even worse problem). Once we have a way to learn from
deopts we can fix this deopt loops.

It's also probably overly defensive in when it's safe to inline
the call to Array.prototype.push, but we can always extend that
later once we have sufficient trust in the implementation and see
an actual need to extend it.

BUG=v8:2229,v8:3952,v8:5267
R=jarin@chromium.org

Committed: https://crrev.com/50f223e47eafdf4fccc0108b03affca9e3d892b1
Cr-Commit-Position: refs/heads/master@{#38603}
==========

[commit-bot: I haz the power, 2016-08-12 08:59:35]

Patchset 1 (id:??) landed as
https://crrev.com/50f223e47eafdf4fccc0108b03affca9e3d892b1
Cr-Commit-Position: refs/heads/master@{#38603}