[crankshaft] Fix deoptimization loop w/ non-monomorphic arguments access.

[crankshaft] Fix deoptimization loop w/ non-monomorphic arguments access.

In Crankshaft we unconditionally assume that accesses to arguments[i] will
be in-bounds and don't take into account IC feedback that would eventually
teach us about out-of-bounds accesses that have happened in the past, so
there's no real guard to protect the bounds check in optimized code.

TEST=mjsunit/compiler/deopt-arguments-oob
R=jarin@chromium.org
BUG=v8:5606
Committed: https://crrev.com/d6ff45afadf1931ebd88d23f7e8f418ada1ba02e
Cr-Commit-Position: refs/heads/master@{#40787}

[Benedikt Meurer, 2016-11-06 19:50:02]

The CQ bit was checked by bmeurer@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2016-11-06 19:50:12]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[Benedikt Meurer, 2016-11-06 19:50:48]

Hey Jaro,

Here's a fix for the obvious deoptimization loop around arguments[i] in
Crankshaft. Please take a look.

Thanks,
Benedikt

[Benedikt Meurer, 2016-11-06 19:58:38]

Description was changed from

==========
[crankshaft] Fix deoptimization loop w/ non-monomorphic arguments access.

In Crankshaft we unconditionally assume that accesses to arguments[i] will
be in-bounds and don't take into account IC feedback that would eventually
teach us about out-of-bounds accesses that have happened in the past, so
there's no real guard to protect the bounds check in optimized code.

TEST=mjsunit/compiler/deopt-arguments-oob
R=jarin@chromium.org
==========

to

==========
[crankshaft] Fix deoptimization loop w/ non-monomorphic arguments access.

In Crankshaft we unconditionally assume that accesses to arguments[i] will
be in-bounds and don't take into account IC feedback that would eventually
teach us about out-of-bounds accesses that have happened in the past, so
there's no real guard to protect the bounds check in optimized code.

TEST=mjsunit/compiler/deopt-arguments-oob
R=jarin@chromium.org
BUG=v8:5606
==========

[commit-bot: I haz the power, 2016-11-06 20:36:49]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-11-06 20:36:49]

Dry run: This issue passed the CQ dry run.

[Jarin, 2016-11-07 06:29:47]

lgtm

[Benedikt Meurer, 2016-11-07 06:36:47]

The CQ bit was checked by bmeurer@chromium.org

[commit-bot: I haz the power, 2016-11-07 06:36:57]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-11-07 06:38:57]

Description was changed from

==========
[crankshaft] Fix deoptimization loop w/ non-monomorphic arguments access.

In Crankshaft we unconditionally assume that accesses to arguments[i] will
be in-bounds and don't take into account IC feedback that would eventually
teach us about out-of-bounds accesses that have happened in the past, so
there's no real guard to protect the bounds check in optimized code.

TEST=mjsunit/compiler/deopt-arguments-oob
R=jarin@chromium.org
BUG=v8:5606
==========

to

==========
[crankshaft] Fix deoptimization loop w/ non-monomorphic arguments access.

In Crankshaft we unconditionally assume that accesses to arguments[i] will
be in-bounds and don't take into account IC feedback that would eventually
teach us about out-of-bounds accesses that have happened in the past, so
there's no real guard to protect the bounds check in optimized code.

TEST=mjsunit/compiler/deopt-arguments-oob
R=jarin@chromium.org
BUG=v8:5606
==========

[commit-bot: I haz the power, 2016-11-07 06:38:58]

Committed patchset #1 (id:1)

[commit-bot: I haz the power, 2016-11-17 22:23:58]

Description was changed from

==========
[crankshaft] Fix deoptimization loop w/ non-monomorphic arguments access.

In Crankshaft we unconditionally assume that accesses to arguments[i] will
be in-bounds and don't take into account IC feedback that would eventually
teach us about out-of-bounds accesses that have happened in the past, so
there's no real guard to protect the bounds check in optimized code.

TEST=mjsunit/compiler/deopt-arguments-oob
R=jarin@chromium.org
BUG=v8:5606
==========

to

==========
[crankshaft] Fix deoptimization loop w/ non-monomorphic arguments access.

In Crankshaft we unconditionally assume that accesses to arguments[i] will
be in-bounds and don't take into account IC feedback that would eventually
teach us about out-of-bounds accesses that have happened in the past, so
there's no real guard to protect the bounds check in optimized code.

TEST=mjsunit/compiler/deopt-arguments-oob
R=jarin@chromium.org
BUG=v8:5606

Committed: https://crrev.com/d6ff45afadf1931ebd88d23f7e8f418ada1ba02e
Cr-Commit-Position: refs/heads/master@{#40787}
==========

[commit-bot: I haz the power, 2016-11-17 22:23:59]

Patchset 1 (id:??) landed as
https://crrev.com/d6ff45afadf1931ebd88d23f7e8f418ada1ba02e
Cr-Commit-Position: refs/heads/master@{#40787}