[turbofan] Mark {JSCreate} as potentially throwing.

[turbofan] Mark {JSCreate} as potentially throwing.

This correctly marks the {JSCreate} operator as potentially throwing,
since it might trigger a property access of the 'prototype' property
during instantiation. This is observable, can throw (not kNoThrow),
might have side-effects (not kNoWrite), or even trigger a lazy deopt
event (not kNoDeopt). The inlining logic has been adapted to wire up
control projections accordingly.

Note that this does not yet take care of the "after" frame-state which
is associated with the {JSCreate} node introduced by the inliner. We
still might re-evaluate the property access upon lazy deoptimization.

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-5638
BUG=v8:5638
Review-Url: https://codereview.chromium.org/2671203003
Cr-Commit-Position: refs/heads/master@{#42981}
Committed: https://chromium.googlesource.com/v8/v8/+/e34f53662055c57f15f03b375cb59ea8772596fe

[Michael Starzinger, 2017-02-06 15:58:25]

The CQ bit was checked by mstarzinger@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2017-02-06 15:58:35]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[Michael Starzinger, 2017-02-06 15:58:43]

Description was changed from

==========
[turbofan] Mark {JSCreate} as potentially thowing.

This correctly marks the {JSCreate} operator as potentially throwing,
since it might trigger a property access of the 'prototype' property
during instantiation. This is observable, can throw (not kNoThrow),
might have side-effects (not kNoWrite), or even trigger a lazy deopt
event (not kNoDeopt). The inlining logic has been adapted to wire up
control prpjections accordingly.

Note that this does not yet take care of the "after" frame-state which
is associated with the {JSCreate} node introduced by the inliner. We
still might re-evaluate the property access upon lazy deoptimization.

R=
TEST=mjsunit/regress/regress-5638
BUG=v8:5638
==========

to

==========
[turbofan] Mark {JSCreate} as potentially throwing.

This correctly marks the {JSCreate} operator as potentially throwing,
since it might trigger a property access of the 'prototype' property
during instantiation. This is observable, can throw (not kNoThrow),
might have side-effects (not kNoWrite), or even trigger a lazy deopt
event (not kNoDeopt). The inlining logic has been adapted to wire up
control prpjections accordingly.

Note that this does not yet take care of the "after" frame-state which
is associated with the {JSCreate} node introduced by the inliner. We
still might re-evaluate the property access upon lazy deoptimization.

R=
TEST=mjsunit/regress/regress-5638
BUG=v8:5638
==========

[commit-bot: I haz the power, 2017-02-06 16:20:41]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2017-02-06 16:20:42]

Dry run: This issue passed the CQ dry run.

[Michael Starzinger, 2017-02-06 16:34:32]

Description was changed from

==========
[turbofan] Mark {JSCreate} as potentially throwing.

This correctly marks the {JSCreate} operator as potentially throwing,
since it might trigger a property access of the 'prototype' property
during instantiation. This is observable, can throw (not kNoThrow),
might have side-effects (not kNoWrite), or even trigger a lazy deopt
event (not kNoDeopt). The inlining logic has been adapted to wire up
control prpjections accordingly.

Note that this does not yet take care of the "after" frame-state which
is associated with the {JSCreate} node introduced by the inliner. We
still might re-evaluate the property access upon lazy deoptimization.

R=
TEST=mjsunit/regress/regress-5638
BUG=v8:5638
==========

to

==========
[turbofan] Mark {JSCreate} as potentially throwing.

This correctly marks the {JSCreate} operator as potentially throwing,
since it might trigger a property access of the 'prototype' property
during instantiation. This is observable, can throw (not kNoThrow),
might have side-effects (not kNoWrite), or even trigger a lazy deopt
event (not kNoDeopt). The inlining logic has been adapted to wire up
control prpjections accordingly.

Note that this does not yet take care of the "after" frame-state which
is associated with the {JSCreate} node introduced by the inliner. We
still might re-evaluate the property access upon lazy deoptimization.

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-5638
BUG=v8:5638
==========

[Michael Starzinger, 2017-02-06 16:34:32]

mstarzinger@chromium.org changed reviewers:
+ bmeurer@chromium.org

[Michael Starzinger, 2017-02-06 16:35:14]

Description was changed from

==========
[turbofan] Mark {JSCreate} as potentially throwing.

This correctly marks the {JSCreate} operator as potentially throwing,
since it might trigger a property access of the 'prototype' property
during instantiation. This is observable, can throw (not kNoThrow),
might have side-effects (not kNoWrite), or even trigger a lazy deopt
event (not kNoDeopt). The inlining logic has been adapted to wire up
control prpjections accordingly.

Note that this does not yet take care of the "after" frame-state which
is associated with the {JSCreate} node introduced by the inliner. We
still might re-evaluate the property access upon lazy deoptimization.

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-5638
BUG=v8:5638
==========

to

==========
[turbofan] Mark {JSCreate} as potentially throwing.

This correctly marks the {JSCreate} operator as potentially throwing,
since it might trigger a property access of the 'prototype' property
during instantiation. This is observable, can throw (not kNoThrow),
might have side-effects (not kNoWrite), or even trigger a lazy deopt
event (not kNoDeopt). The inlining logic has been adapted to wire up
control projections accordingly.

Note that this does not yet take care of the "after" frame-state which
is associated with the {JSCreate} node introduced by the inliner. We
still might re-evaluate the property access upon lazy deoptimization.

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-5638
BUG=v8:5638
==========

[Benedikt Meurer, 2017-02-06 17:56:10]

Thanks, LGTM!

[Michael Starzinger, 2017-02-07 08:58:50]

The CQ bit was checked by mstarzinger@chromium.org

[commit-bot: I haz the power, 2017-02-07 08:59:01]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2017-02-07 09:00:18]

CQ is committing da patch.

Bot data: {"patchset_id": 1, "attempt_start_ts": 1486457930974560, "parent_rev":
"b87d99495e972ee76254cbe912626707da0785c4", "commit_rev":
"e34f53662055c57f15f03b375cb59ea8772596fe"}

[commit-bot: I haz the power, 2017-02-07 09:00:22]

Description was changed from

==========
[turbofan] Mark {JSCreate} as potentially throwing.

This correctly marks the {JSCreate} operator as potentially throwing,
since it might trigger a property access of the 'prototype' property
during instantiation. This is observable, can throw (not kNoThrow),
might have side-effects (not kNoWrite), or even trigger a lazy deopt
event (not kNoDeopt). The inlining logic has been adapted to wire up
control projections accordingly.

Note that this does not yet take care of the "after" frame-state which
is associated with the {JSCreate} node introduced by the inliner. We
still might re-evaluate the property access upon lazy deoptimization.

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-5638
BUG=v8:5638
==========

to

==========
[turbofan] Mark {JSCreate} as potentially throwing.

This correctly marks the {JSCreate} operator as potentially throwing,
since it might trigger a property access of the 'prototype' property
during instantiation. This is observable, can throw (not kNoThrow),
might have side-effects (not kNoWrite), or even trigger a lazy deopt
event (not kNoDeopt). The inlining logic has been adapted to wire up
control projections accordingly.

Note that this does not yet take care of the "after" frame-state which
is associated with the {JSCreate} node introduced by the inliner. We
still might re-evaluate the property access upon lazy deoptimization.

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-5638
BUG=v8:5638

Review-Url: https://codereview.chromium.org/2671203003
Cr-Commit-Position: refs/heads/master@{#42981}
Committed:
https://chromium.googlesource.com/v8/v8/+/e34f53662055c57f15f03b375cb59ea8772...
==========

[commit-bot: I haz the power, 2017-02-07 09:00:23]

Committed patchset #1 (id:1) as
https://chromium.googlesource.com/v8/v8/+/e34f53662055c57f15f03b375cb59ea8772...