[crankshaft] Don't bailout on uninitialized access to arguments object.

[crankshaft] Don't bailout on uninitialized access to arguments object.

When Crankshaft compiles a keyed load to arguments, it disabled
optimization unless the KEYED_LOAD_IC for the access was monomorphic.
But that's too restrictive, since it will also disable optimization
for this function when the access is on a path that was never executed
so far.

This was spotted in the Node.js core function EventEmitter.prototype.emit,
which was no longer optimizable with Crankshaft using latest V8.

R=jarin@chromium.org
BUG=v8:5790
Review-Url: https://codereview.chromium.org/2607303002
Cr-Commit-Position: refs/heads/master@{#42005}
Committed: https://chromium.googlesource.com/v8/v8/+/380a0207dbf01ddd2954b31f58844f6f5f0def9e

[Benedikt Meurer, 2017-01-02 05:53:06]

The CQ bit was checked by bmeurer@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2017-01-02 05:53:11]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[Benedikt Meurer, 2017-01-02 05:53:47]

Hey Jaro,

Here's a fix for the overly aggressive deopt loop protection on arguments[n]
accesses.
Please take a look.

Thanks,
Benedikt

[commit-bot: I haz the power, 2017-01-02 06:18:16]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2017-01-02 06:18:18]

Dry run: This issue passed the CQ dry run.

[Jarin, 2017-01-02 06:49:40]

lgtm

[Benedikt Meurer, 2017-01-02 06:49:55]

The CQ bit was checked by bmeurer@chromium.org

[commit-bot: I haz the power, 2017-01-02 06:50:08]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2017-01-02 06:52:05]

CQ is committing da patch.

Bot data: {"patchset_id": 1, "attempt_start_ts": 1483339795871470, "parent_rev":
"b00fc8be8a2ff527d8462bb9c0fff163bfce850f", "commit_rev":
"380a0207dbf01ddd2954b31f58844f6f5f0def9e"}

[commit-bot: I haz the power, 2017-01-02 06:52:11]

Description was changed from

==========
[crankshaft] Don't bailout on uninitialized access to arguments object.

When Crankshaft compiles a keyed load to arguments, it disabled
optimization unless the KEYED_LOAD_IC for the access was monomorphic.
But that's too restrictive, since it will also disable optimization
for this function when the access is on a path that was never executed
so far.

This was spotted in the Node.js core function EventEmitter.prototype.emit,
which was no longer optimizable with Crankshaft using latest V8.

R=jarin@chromium.org
BUG=v8:5790
==========

to

==========
[crankshaft] Don't bailout on uninitialized access to arguments object.

When Crankshaft compiles a keyed load to arguments, it disabled
optimization unless the KEYED_LOAD_IC for the access was monomorphic.
But that's too restrictive, since it will also disable optimization
for this function when the access is on a path that was never executed
so far.

This was spotted in the Node.js core function EventEmitter.prototype.emit,
which was no longer optimizable with Crankshaft using latest V8.

R=jarin@chromium.org
BUG=v8:5790

Review-Url: https://codereview.chromium.org/2607303002
Cr-Commit-Position: refs/heads/master@{#42005}
Committed:
https://chromium.googlesource.com/v8/v8/+/380a0207dbf01ddd2954b31f58844f6f5f0...
==========

[commit-bot: I haz the power, 2017-01-02 06:52:12]

Committed patchset #1 (id:1) as
https://chromium.googlesource.com/v8/v8/+/380a0207dbf01ddd2954b31f58844f6f5f0...