[compiler] Properly guard the speculative optimizations for instanceof.

[compiler] Properly guard the speculative optimizations for instanceof.

Add a general feedback slot for instanceof similar to what we already have
for for-in, which basically has a fast (indicated by the uninitialized
sentinel) and a slow (indicated by the megamorphic sentinel) mode. Now
we can only take the fast path when the feedback slot says it hasn't
seen any funky inputs and nothing funky appeared in the prototype chain.
In the TurboFan code we also deoptimize whenever we see a funky object
(i.e. a proxy or an object that requires access checks) in the prototype
chain (similar to what Crankshaft already did).

Drive-by-fix: Also make Crankshaft respect the mode and therefore
address the deopt loop in Crankshaft around instanceof.

We might want to introduce an InstanceOfIC mechanism at some point and
track the map of the right-hand side.

BUG=v8:5267
R=mvstanton@chromium.org

Committed: https://crrev.com/a0484bc6116ebc2b855de87d862945e2ae07169b
Cr-Commit-Position: refs/heads/master@{#39718}

[Benedikt Meurer, 2016-09-26 08:07:27]

The CQ bit was checked by bmeurer@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2016-09-26 08:07:28]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[Benedikt Meurer, 2016-09-26 08:08:29]

Hey Michael,

Here's a fix for instanceof deopt loops, which also allows TurboFan to optimize
instanceof in a better way.
Please take a look.

Thanks,
Benedikt

[commit-bot: I haz the power, 2016-09-26 08:11:58]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-09-26 08:11:58]

Dry run: Try jobs failed on following builders:
  v8_linux_mips64el_compile_rel on master.tryserver.v8 (JOB_FAILED,
http://build.chromium.org/p/tryserver.v8/builders/v8_linux_mips64el_compile_r...)

[Benedikt Meurer, 2016-09-26 08:14:20]

The CQ bit was checked by bmeurer@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2016-09-26 08:14:30]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-09-26 08:38:34]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-09-26 08:38:35]

Dry run: Try jobs failed on following builders:
  v8_linux_arm_rel_ng on master.tryserver.v8 (JOB_FAILED,
http://build.chromium.org/p/tryserver.v8/builders/v8_linux_arm_rel_ng/builds/...)
  v8_linux_arm_rel_ng_triggered on master.tryserver.v8 (JOB_FAILED,
http://build.chromium.org/p/tryserver.v8/builders/v8_linux_arm_rel_ng_trigger...)

[Benedikt Meurer, 2016-09-26 10:44:36]

The CQ bit was checked by bmeurer@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2016-09-26 10:44:44]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-09-26 11:11:33]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-09-26 11:11:34]

Dry run: This issue passed the CQ dry run.

[mvstanton, 2016-09-26 12:14:16]

LGTM.

[Benedikt Meurer, 2016-09-26 12:16:10]

The CQ bit was checked by bmeurer@chromium.org

[commit-bot: I haz the power, 2016-09-26 12:16:16]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-09-26 12:32:28]

Committed patchset #3 (id:40001)

[commit-bot: I haz the power, 2016-09-26 12:32:41]

Description was changed from

==========
[compiler] Properly guard the speculative optimizations for instanceof.

Add a general feedback slot for instanceof similar to what we already have
for for-in, which basically has a fast (indicated by the uninitialized
sentinel) and a slow (indicated by the megamorphic sentinel) mode. Now
we can only take the fast path when the feedback slot says it hasn't
seen any funky inputs and nothing funky appeared in the prototype chain.
In the TurboFan code we also deoptimize whenever we see a funky object
(i.e. a proxy or an object that requires access checks) in the prototype
chain (similar to what Crankshaft already did).

Drive-by-fix: Also make Crankshaft respect the mode and therefore
address the deopt loop in Crankshaft around instanceof.

We might want to introduce an InstanceOfIC mechanism at some point and
track the map of the right-hand side.

BUG=v8:5267
R=mvstanton@chromium.org
==========

to

==========
[compiler] Properly guard the speculative optimizations for instanceof.

Add a general feedback slot for instanceof similar to what we already have
for for-in, which basically has a fast (indicated by the uninitialized
sentinel) and a slow (indicated by the megamorphic sentinel) mode. Now
we can only take the fast path when the feedback slot says it hasn't
seen any funky inputs and nothing funky appeared in the prototype chain.
In the TurboFan code we also deoptimize whenever we see a funky object
(i.e. a proxy or an object that requires access checks) in the prototype
chain (similar to what Crankshaft already did).

Drive-by-fix: Also make Crankshaft respect the mode and therefore
address the deopt loop in Crankshaft around instanceof.

We might want to introduce an InstanceOfIC mechanism at some point and
track the map of the right-hand side.

BUG=v8:5267
R=mvstanton@chromium.org

Committed: https://crrev.com/a0484bc6116ebc2b855de87d862945e2ae07169b
Cr-Commit-Position: refs/heads/master@{#39718}
==========

[commit-bot: I haz the power, 2016-09-26 12:32:42]

Patchset 3 (id:??) landed as
https://crrev.com/a0484bc6116ebc2b855de87d862945e2ae07169b
Cr-Commit-Position: refs/heads/master@{#39718}

[Benedikt Meurer, 2016-09-26 17:39:56]

A revert of this CL (patchset #3 id:40001) has been created in
https://codereview.chromium.org/2365223003/ by bmeurer@chromium.org.

The reason for reverting is: Tanks EarleyBoyer..