[turbofan] Disable bogus lowering of builtin tail-calls.

[turbofan] Disable bogus lowering of builtin tail-calls.

The TurboFan backends currently don't support tail-calls to CPP builtins
because the semantics of kJavaScriptCallArgCountRegister has different
semantics for stub call descriptors versus JavaScript call descriptors.
This is actually a short-coming of the backends and follow-up work will
make the backends more robust in that regard to fail hard on unsupported
constructs like that. This just disables the lowering creating such a
tail-call.

R=bmeurer@chromium.org
BUG=chromium:658691
TEST=mjsunit/regress/regress-crbug-658691

Committed: https://crrev.com/2ab2ec224324d0a9e59e100d53a55394dc57ea12
Cr-Commit-Position: refs/heads/master@{#40590}

[Michael Starzinger, 2016-10-26 11:16:17]

Description was changed from

==========
[turbofan] Disable bogus lowering of builtin tail-calls.

The TurboFan backends currently don't support tail-calls to CPP builtins
because the semantics of kJavaScriptCallArgCountRegister has different
semantics for stub call descriptors versus JavaScipt call descriptors.
This is actually a short-coming of the backends and follow-up work will
make the backends more robust in that regard to fail hard on unsupported
constructs like that. This just disables the lowering creating such a
tail-call.

R=bmeurer@chromium.org
BUG=chromium:658691
TEST=mjsunit/regress/regress-crbug-658691
==========

to

==========
[turbofan] Disable bogus lowering of builtin tail-calls.

The TurboFan backends currently don't support tail-calls to CPP builtins
because the semantics of kJavaScriptCallArgCountRegister has different
semantics for stub call descriptors versus JavaScript call descriptors.
This is actually a short-coming of the backends and follow-up work will
make the backends more robust in that regard to fail hard on unsupported
constructs like that. This just disables the lowering creating such a
tail-call.

R=bmeurer@chromium.org
BUG=chromium:658691
TEST=mjsunit/regress/regress-crbug-658691
==========

[Michael Starzinger, 2016-10-26 11:17:43]

mstarzinger@chromium.org changed reviewers:
+ jgruber@chromium.org

[Michael Starzinger, 2016-10-26 11:17:43]

Benedikt: PTAL.
Jakob: FYI.

[Michael Starzinger, 2016-10-26 11:17:54]

The CQ bit was checked by mstarzinger@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2016-10-26 11:18:05]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[jgruber, 2016-10-26 11:22:59]

lgtm

https://codereview.chromium.org/2447383002/diff/1/src/compiler/js-typed-lower...
File src/compiler/js-typed-lowering.cc (right):

https://codereview.chromium.org/2447383002/diff/1/src/compiler/js-typed-lower...
src/compiler/js-typed-lowering.cc:1881: } else if (is_builtin &&
Builtins::HasCppImplementation(builtin_index) &&
ReduceBuiltin is also called from ReduceJSCallConstruct, should the same check
be added there?

[Michael Starzinger, 2016-10-26 11:35:54]

https://codereview.chromium.org/2447383002/diff/1/src/compiler/js-typed-lower...
File src/compiler/js-typed-lowering.cc (right):

https://codereview.chromium.org/2447383002/diff/1/src/compiler/js-typed-lower...
src/compiler/js-typed-lowering.cc:1752: CallDescriptor::Flags flags =
CallDescriptor::kNeedsFrameState;
Flags are set unconditionally to not do tail calls here.

https://codereview.chromium.org/2447383002/diff/1/src/compiler/js-typed-lower...
src/compiler/js-typed-lowering.cc:1881: } else if (is_builtin &&
Builtins::HasCppImplementation(builtin_index) &&
On 2016/10/26 11:22:59, jgruber wrote:
> ReduceBuiltin is also called from ReduceJSCallConstruct, should the same check
> be added there?

Acknowledged. Constructor calls cannot be in tail-call position (even when they
syntactically appear as "return new f()" in the code) because the constructor
call chooses the actual return value based on an instance check. This work is
done by the construct stub (which has it's own frame) after the function
returns. This is one of the reasons why constructor calls are not considered
tail-calls by the ECMAScript spec:

http://www.ecma-international.org/ecma-262/6.0/#sec-tail-position-calls

[commit-bot: I haz the power, 2016-10-26 11:42:44]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-10-26 11:42:45]

Dry run: This issue passed the CQ dry run.

[Benedikt Meurer, 2016-10-26 12:01:51]

lgtm

[Michael Starzinger, 2016-10-26 12:46:58]

The CQ bit was checked by mstarzinger@chromium.org

[commit-bot: I haz the power, 2016-10-26 12:47:06]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-10-26 12:48:46]

Description was changed from

==========
[turbofan] Disable bogus lowering of builtin tail-calls.

The TurboFan backends currently don't support tail-calls to CPP builtins
because the semantics of kJavaScriptCallArgCountRegister has different
semantics for stub call descriptors versus JavaScript call descriptors.
This is actually a short-coming of the backends and follow-up work will
make the backends more robust in that regard to fail hard on unsupported
constructs like that. This just disables the lowering creating such a
tail-call.

R=bmeurer@chromium.org
BUG=chromium:658691
TEST=mjsunit/regress/regress-crbug-658691
==========

to

==========
[turbofan] Disable bogus lowering of builtin tail-calls.

The TurboFan backends currently don't support tail-calls to CPP builtins
because the semantics of kJavaScriptCallArgCountRegister has different
semantics for stub call descriptors versus JavaScript call descriptors.
This is actually a short-coming of the backends and follow-up work will
make the backends more robust in that regard to fail hard on unsupported
constructs like that. This just disables the lowering creating such a
tail-call.

R=bmeurer@chromium.org
BUG=chromium:658691
TEST=mjsunit/regress/regress-crbug-658691
==========

[commit-bot: I haz the power, 2016-10-26 12:48:46]

Committed patchset #1 (id:1)

[commit-bot: I haz the power, 2016-11-17 22:13:58]

Description was changed from

==========
[turbofan] Disable bogus lowering of builtin tail-calls.

The TurboFan backends currently don't support tail-calls to CPP builtins
because the semantics of kJavaScriptCallArgCountRegister has different
semantics for stub call descriptors versus JavaScript call descriptors.
This is actually a short-coming of the backends and follow-up work will
make the backends more robust in that regard to fail hard on unsupported
constructs like that. This just disables the lowering creating such a
tail-call.

R=bmeurer@chromium.org
BUG=chromium:658691
TEST=mjsunit/regress/regress-crbug-658691
==========

to

==========
[turbofan] Disable bogus lowering of builtin tail-calls.

The TurboFan backends currently don't support tail-calls to CPP builtins
because the semantics of kJavaScriptCallArgCountRegister has different
semantics for stub call descriptors versus JavaScript call descriptors.
This is actually a short-coming of the backends and follow-up work will
make the backends more robust in that regard to fail hard on unsupported
constructs like that. This just disables the lowering creating such a
tail-call.

R=bmeurer@chromium.org
BUG=chromium:658691
TEST=mjsunit/regress/regress-crbug-658691

Committed: https://crrev.com/2ab2ec224324d0a9e59e100d53a55394dc57ea12
Cr-Commit-Position: refs/heads/master@{#40590}
==========

[commit-bot: I haz the power, 2016-11-17 22:13:59]

Patchset 1 (id:??) landed as
https://crrev.com/2ab2ec224324d0a9e59e100d53a55394dc57ea12
Cr-Commit-Position: refs/heads/master@{#40590}