Inline Array.prototype.forEach in TurboFan

src/builtins/builtins-definitions.h

Index: src/builtins/builtins-definitions.h
diff --git a/src/builtins/builtins-definitions.h b/src/builtins/builtins-definitions.h
index bce8eebb0f05cf8cab7c3299532aa56503cc7f46..41c0bc570af7c24737a390f299726d9b4f6fb8eb 100644
--- a/src/builtins/builtins-definitions.h
+++ b/src/builtins/builtins-definitions.h
@@ -157,6 +157,30 @@ namespace internal {
   ASM(NotifyLazyDeoptimized)                                                   \
   ASM(NotifyStubFailure)                                                       \
   ASM(NotifyStubFailureSaveDoubles)                                            \
+  ASM(NotifyBuiltinContinuation)                                               \
+                                                                               \
+  /* Trampolines called when returning from a deoptimization that expects   */ \
+  /* to continue in a JavaScript builtin to finish the functionality of a   */ \
+  /* an TF-inlined version of builtin that has side-effects.                */ \
+  /* Each restores input register values that the builtin expects from a    */ \
+  /* BuiltinContinuationFrame, tear down that frame, and then jump to the   */ \
+  /* stashed-away builtin's address. After the trampoline completes,        */ \
+  /* it appears to the called JavaScript builtin that it had been directly  */ \
+  /* invoked by the frame above it. When the builtin returns, execution     */ \
+  /* resumes normally in the calling frame, processing any return result    */ \
+  /* from the JavaScript builtin, again as if it had called the builtin     */ \
+  /* directly.                                                              */ \

[Jarin, 2017/05/24 06:41:22]

Nit: This would read better if it was written as a sequence of steps.

Something like:
  1. Trampoline restores input register values that 
     the builtin expects from a BuiltinContinuationFrame.
  2. Trampoline tears down BuiltinContinuationFrame.
  3. Trampoline jumps to the builtin's address.
  4. Builtin executes as if invoked by the frame above it.
  5. When the builtin returns, execution resumes normally 
     in the calling frame, processing any return result from 
     the JavaScript builtin as if it had called the builtin
     directly.

The trampolines below implement steps 1-3.

[Michael Starzinger, 2017/05/24 13:54:59]

+1

[danno, 2017/06/06 12:04:51]

Done.

[danno, 2017/06/06 12:04:51]

Done.

+  /* There are two variants of the stub that differ in their handling of a  */ \
+  /* value returned by the next frame deeper on the stack. For LAZY deopts, */ \
+  /* the return value (e.g. rax on x64) is explicitly passed as an extra    */ \
+  /* stack parameter to the JavaScript builtin by the "WithResult"          */ \
+  /* trampoline variant. The plain variant is used in EAGER deopt contexts  */ \
+  /* and has no such special handling. */                                      \
+  ASM(ContinueToCodeStubBuiltin)                                               \
+  ASM(ContinueToCodeStubBuiltinWithResult)                                     \
+  ASM(ContinueToJavaScriptBuiltin)                                             \
+  ASM(ContinueToJavaScriptBuiltinWithResult)                                   \
+                                                                               \
   ASM(OnStackReplacement)                                                      \
                                                                                \
   /* API callback handling */                                                  \
@@ -268,6 +292,10 @@ namespace internal {
   /* ES6 #sec-array.prototype.foreach */                                       \
   TFS(ArrayForEachLoopContinuation, kReceiver, kCallbackFn, kThisArg, kArray,  \
       kObject, kInitialK, kLength, kTo)                                        \
+  TFJ(ArrayForEachLoopEagerDeoptContinuation, 4, kCallbackFn, kThisArg,        \
+      kInitialK, kLength)                                                      \
+  TFJ(ArrayForEachLoopLazyDeoptContinuation, 5, kCallbackFn, kThisArg,         \
+      kInitialK, kLength, kResult)                                             \
   TFJ(ArrayForEach, SharedFunctionInfo::kDontAdaptArgumentsSentinel)           \
   /* ES6 #sec-array.prototype.every */                                         \
   TFS(ArrayEveryLoopContinuation, kReceiver, kCallbackFn, kThisArg, kArray,    \
@@ -1058,6 +1086,14 @@ namespace internal {
   BUILTIN_LIST(IGNORE_BUILTIN, IGNORE_BUILTIN, IGNORE_BUILTIN, IGNORE_BUILTIN, \
                V, IGNORE_BUILTIN, IGNORE_BUILTIN, IGNORE_BUILTIN)
 
+#define BUILTIN_LIST_TFJ(V)                                       \
+  BUILTIN_LIST(IGNORE_BUILTIN, IGNORE_BUILTIN, V, IGNORE_BUILTIN, \
+               IGNORE_BUILTIN, IGNORE_BUILTIN, IGNORE_BUILTIN, IGNORE_BUILTIN)
+
+#define BUILTIN_LIST_TFC(V)                                       \
+  BUILTIN_LIST(IGNORE_BUILTIN, IGNORE_BUILTIN, IGNORE_BUILTIN, V, \
+               IGNORE_BUILTIN, IGNORE_BUILTIN, IGNORE_BUILTIN, IGNORE_BUILTIN)
+
 #define BUILTINS_WITH_UNTAGGED_PARAMS(V) V(WasmCompileLazy)
 
 }  // namespace internal