[turbofan] Speculatively optimize string character access.

[turbofan] Speculatively optimize string character access.

Add a protector cell for string bounds checks that is being used to
protect speculative bounds for String.prototype.charCodeAt and
String.prototype.charAt in TurboFan (and Crankshaft). This way we don't
have the diamond in optimized code, which stands in the way of other
optimizations for charCodeAt that are currently being worked on by
petermarshall@.

BUG=v8:6391
TBR=mlippautz@chromium.org
R=petermarshall@chromium.org

Review-Url: https://codereview.chromium.org/2905623003
Cr-Commit-Position: refs/heads/master@{#45514}
Committed: https://chromium.googlesource.com/v8/v8/+/9d8bd0551657d60c66b2f96544eecedfba1cba8a

[Benedikt Meurer, 2017-05-24 12:51:22]

The CQ bit was checked by bmeurer@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2017-05-24 12:51:25]

Dry run: CQ is trying da patch.

Follow status at:
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[petermarshall, 2017-05-24 13:19:14]

LGTM! Thanks

[Benedikt Meurer, 2017-05-24 13:19:49]

The CQ bit was unchecked by bmeurer@chromium.org

[Benedikt Meurer, 2017-05-24 13:19:52]

The CQ bit was checked by bmeurer@chromium.org

[commit-bot: I haz the power, 2017-05-24 13:19:58]

CQ is trying da patch.

Follow status at:
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[Michael Lippautz, 2017-05-24 13:42:10]

heap/ LGTM

[commit-bot: I haz the power, 2017-05-24 13:53:28]

CQ is committing da patch.

Bot data: {"patchset_id": 1, "attempt_start_ts": 1495631992359720, "parent_rev":
"a8421ddd506f1cacb6ccddbb80e43c7ed7beac83", "commit_rev":
"482fdfdd31493578571e2b6a59e83cfedf5d7df6"}

[commit-bot: I haz the power, 2017-05-24 13:53:42]

CQ is committing da patch.

Bot data: {"patchset_id": 1, "attempt_start_ts": 1495631992359720, "parent_rev":
"bce2a50de69a3982972643ddfaec633ceb5ed32b", "commit_rev":
"9d8bd0551657d60c66b2f96544eecedfba1cba8a"}

[commit-bot: I haz the power, 2017-05-24 13:53:48]

Description was changed from

==========
[turbofan] Speculatively optimize string character access.

Add a protector cell for string bounds checks that is being used to
protect speculative bounds for String.prototype.charCodeAt and
String.prototype.charAt in TurboFan (and Crankshaft). This way we don't
have the diamond in optimized code, which stands in the way of other
optimizations for charCodeAt that are currently being worked on by
petermarshall@.

BUG=v8:6391
TBR=mlippautz@chromium.org
R=petermarshall@chromium.org
==========

to

==========
[turbofan] Speculatively optimize string character access.

Add a protector cell for string bounds checks that is being used to
protect speculative bounds for String.prototype.charCodeAt and
String.prototype.charAt in TurboFan (and Crankshaft). This way we don't
have the diamond in optimized code, which stands in the way of other
optimizations for charCodeAt that are currently being worked on by
petermarshall@.

BUG=v8:6391
TBR=mlippautz@chromium.org
R=petermarshall@chromium.org

Review-Url: https://codereview.chromium.org/2905623003
Cr-Commit-Position: refs/heads/master@{#45514}
Committed:
https://chromium.googlesource.com/v8/v8/+/9d8bd0551657d60c66b2f96544eecedfba1...
==========

[commit-bot: I haz the power, 2017-05-24 13:53:49]

Committed patchset #1 (id:1) as
https://chromium.googlesource.com/v8/v8/+/9d8bd0551657d60c66b2f96544eecedfba1...

[Michael Achenbach, 2017-05-24 17:04:25]

A revert of this CL (patchset #1 id:1) has been created in
https://codereview.chromium.org/2900333002/ by machenbach@chromium.org.

The reason for reverting is: Changes layout tests:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/bui...

See:
https://github.com/v8/v8/wiki/Blink-layout-tests.

[Michael Achenbach, 2017-05-24 20:14:19]

machenbach@chromium.org changed reviewers:
+ machenbach@chromium.org

[Michael Achenbach, 2017-05-24 20:14:19]

Alexey, could you have a look why so many inspector and debugger tests are
flakily failing on Linux:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064?num...

It looks as if it started with this CL, but the revert didn't bring much. The
tests that fail are also varying. Maybe it is caused by some expectations being
removed on the chromium-side or some rebaseline gone wrong?

[kozy, 2017-05-24 20:27:04]

On 2017/05/24 20:14:19, machenbach (OOO) wrote:
> Alexey, could you have a look why so many inspector and debugger tests are
> flakily failing on Linux:
>
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064?num...
> 
> It looks as if it started with this CL, but the revert didn't bring much. The
> tests that fail are also varying. Maybe it is caused by some expectations
being
> removed on the chromium-side or some rebaseline gone wrong?

Stack trace from one of try bots:
crash log for renderer (pid <unknown>):
STDOUT: #CRASHED - renderer
STDERR: Backtrace:
STDERR: 	v8::internal::Heap::MergeAllocationSitePretenuringFeedback
[0x02404AFA+58]
STDERR: 	v8::internal::MarkCompactCollector::Evacuator::Finalize
[0x02437904+164]
STDERR: 	v8::internal::MarkCompactCollector::EvacuatePagesInParallel
[0x024374D8+584]
STDERR: 	v8::internal::MarkCompactCollector::EvacuateNewSpaceAndCandidates
[0x0243703F+367]
STDERR: 	v8::internal::MarkCompactCollector::CollectGarbage [0x0243670D+29]
STDERR: 	v8::internal::Heap::MarkCompact [0x0240472B+107]
STDERR: 	v8::internal::Heap::PerformGarbageCollection [0x024052EF+719]
STDERR: 	v8::internal::Heap::CollectGarbage [0x023FBA44+596]
STDERR: 	v8::internal::Heap::CollectAllGarbage [0x023FB7DC+92]
STDERR: 	v8::internal::HeapObjectsMap::UpdateHeapObjectsMap [0x02507F47+55]
STDERR: 	v8::internal::HeapObjectsMap::PushHeapObjectsStats [0x02505E53+19]
STDERR: 	blink::V8HeapProfilerAgentImpl::requestHeapStatsUpdate [0x02250330+48]
STDERR: 	blink::InspectorHeapProfilerAgent::HeapStatsUpdateTask::onTimer
[0x00CE9917+7]
STDERR: 	blink::Timer<blink::`anonymous namespace'::WebLeakDetectorImpl>::fired
[0x00CCD98B+11]
STDERR: 	blink::TimerBase::runInternal [0x02199CBD+317]
STDERR: 	blink::TimerBase::CancellableTimerTask::run [0x02199B69+25]
STDERR: 	scheduler::WebTaskRunnerImpl::runTask [0x0223BB6B+11]
STDERR:
	base::internal::Invoker<base::IndexSequence<0>,base::internal::BindState<base::internal::RunnableAdapter<bool
(__cdecl*)(std::unique_ptr<std::vector<std::pair<int,int>,std::allocator<std::pair<int,int>
> >,std::default_delete<std::vector<std::pair<int,int [0x027403AF+95]
STDERR: 	base::debug::TaskAnnotator::RunTask [0x001AED67+247]
STDERR: 	scheduler::TaskQueueManager::ProcessTaskFromWorkQueue [0x0273883A+826]
STDERR: 	scheduler::TaskQueueManager::DoWork [0x02738053+387]
STDERR:
	base::internal::Invoker<base::IndexSequence<0,1,2>,base::internal::BindState<base::internal::RunnableAdapter<void
(__thiscall scheduler::TaskQueueManager::*)(base::TimeTicks,bool)>,void
__cdecl(scheduler::TaskQueueManager *,base::TimeTicks,bool),base::Wea
[0x02738C7F+79]
STDERR: 	base::debug::TaskAnnotator::RunTask [0x001AED67+247]
..

[kozy, 2017-05-24 20:29:55]

crash on another bot looks completely unrelated, maybe it's a reason why revert
doesn't help/

crash log for renderer (pid <unknown>):
STDOUT: #CRASHED - renderer
STDERR: [3472:5036:1110/195544:11242867:ERROR:entry.cc(168)] Entry::Deserialize:
dictionary has no interface_provider_specs key
STDERR: [5888:2088:1110/195545:11243928:FATAL:render_widget.h(163)] Check
failed: routing_id_ != MSG_ROUTING_NONE. 
STDERR: Backtrace:
STDERR: 	base::debug::StackTrace::StackTrace [0x0168E0F7+23]
STDERR: 	logging::LogMessage::~LogMessage [0x016DFE0B+59]
STDERR: 	content::RenderWidget::routing_id [0x104644A6+166]
STDERR: 	content::RenderViewImpl::GetRoutingID [0x12637001+49]
STDERR: 	content::RenderViewObserver::RenderViewObserver [0x10462FB5+133]
STDERR: 	content::BlinkTestRunner::BlinkTestRunner [0x008157E6+22]
STDERR: 	gin::Handle<content::InterfaceRegistryJsWrapper>::ToV8 [0x007D07A7+167]
STDERR: 	base::internal::FunctorTraits<void (__cdecl*)(content::RenderView
*,test_runner::WebViewTestProxyBase *),void>::Invoke<content::RenderView
*,test_runner::WebViewTestProxyBase *> [0x007CCE24+36]
STDERR: 	base::internal::InvokeHelper<0,void>::MakeItSo<void (__cdecl*const
&)(content::RenderView *,test_runner::WebViewTestProxyBase
*),content::RenderView *,test_runner::WebViewTestProxyBase *> [0x007CCF61+49]
STDERR:
	??$RunImpl@ABQ6AXPAVRenderView@content@@PAVWebViewTestProxyBase@test_runner@@@ZABV?$tuple@$$V@std@@$S@?$Invoker@U?$BindState@P6AXPAVRenderView@content@@PAVWebViewTestProxyBase@test_runner@@@Z$$V@internal@base@@$$A6AXPAVRenderView@content@@PAVWebViewTestPr
[0x007CD01F+47]
STDERR:
	?Run@?$Invoker@U?$BindState@P6AXPAVRenderView@content@@PAVWebViewTestProxyBase@test_runner@@@Z$$V@internal@base@@$$A6AXPAVRenderView@content@@PAVWebViewTestProxyBase@test_runner@@@Z@internal@base@@SAXPAVBindStateBase@23@$$QAPAVRenderView@content@@$$QAPAVW
[0x007D043E+62]
STDERR: 	base::internal::RunMixin<base::Callback<void
__cdecl(content::RenderView *,test_runner::WebViewTestProxyBase *),1,1> >::Run
[0x00971F89+89]
STDERR: 	content::LayoutTestDependenciesImpl::CreateDisplayOutputSurface
[0x00965ABA+794]
STDERR: 	content::RenderViewImpl::Create [0x12635554+196]
STDERR: 	content::RenderThreadImpl::CreateView [0x1260F0FF+63]
STDERR: 	content::mojom::RendererStubDispatch::Accept [0x109E7AE1+513]
STDERR:
	content::mojom::RendererStub<mojo::RawPtrImplRefTraits<content::mojom::Renderer>
>::Accept [0x1260AC11+65]
STDERR: 	mojo::InterfaceEndpointClient::HandleValidatedMessage [0x01B29F2D+1101]
STDERR: 	mojo::InterfaceEndpointClient::HandleIncomingMessageThunk::Accept
[0x01B28A96+22]
STDERR: 	mojo::FilterChain::Accept [0x01B20551+337]
STDERR: 	mojo::InterfaceEndpointClient::HandleIncomingMessage [0x01B29A98+200]
STDERR: 	mojo::SyncHandleWatcher::`scalar deleting destructor' [0x01479408+2504]
STDERR: 	base::internal::FunctorTraits<void (__thiscall IPC::`anonymous
namespace'::ChannelAssociatedGroupController::*)(mojo::Message),void>::Invoke<scoped_refptr<IPC::`anonymous
namespace'::ChannelAssociatedGroupController> const &,mojo::Message>
[0x0146FEED+45]
STDERR: 	base::internal::InvokeHelper<0,void>::MakeItSo<void (__thiscall
IPC::`anonymous namespace'::ChannelAssociatedGroupController::*const
&)(mojo::Message),scoped_refptr<IPC::`anonymous
namespace'::ChannelAssociatedGroupController> const &,mojo::Message>
[0x01470235+53]
STDERR: 	base::internal::Invoker<base::internal::BindState<void (__thiscall
IPC::`anonymous
namespace'::ChannelAssociatedGroupController::*)(mojo::Message),scoped_refptr<IPC::`anonymous
namespace'::ChannelAssociatedGroupController>,base::internal::PassedWrapper<mo
[0x0147063A+90]
STDERR: 	base::internal::Invoker<base::internal::BindState<void (__thiscall
IPC::`anonymous
namespace'::ChannelAssociatedGroupController::*)(mojo::Message),scoped_refptr<IPC::`anonymous
namespace'::ChannelAssociatedGroupController>,base::internal::PassedWrapper<mo
[0x0147D6F4+36]
STDERR: 	base::internal::RunMixin<base::Callback<void __cdecl(void),0,0> >::Run
[0x01693E94+68]
STDERR: 	base::debug::TaskAnnotator::RunTask [0x0169402F+367]
STDERR: 	blink::scheduler::TaskQueueManager::ProcessTaskFromWorkQueue
[0x0B6580D4+1508]
STDERR: 	blink::scheduler::TaskQueueManager::DoWork [0x0B656661+737]
STDERR: 	base::internal::FunctorTraits<void (__thiscall
blink::scheduler::TaskQueueManager::*)(base::TimeTicks,bool),void>::Invoke<base::WeakPtr<blink::scheduler::TaskQueueManager>
const &,base::TimeTicks const &,bool const &> [0x0B64C0CD+61]
STDERR: 	base::internal::InvokeHelper<1,void>::MakeItSo<void (__thiscall
blink::scheduler::TaskQueueManager::*const
&)(base::TimeTicks,bool),base::WeakPtr<blink::scheduler::TaskQueueManager> const
&,base::TimeTicks const &,bool const &> [0x0B64C1E3+83]
STDERR: 	base::internal::Invoker<base::internal::BindState<void (__thiscall
blink::scheduler::TaskQueueManager::*)(base::TimeTicks,bool),base::WeakPtr<blink::scheduler::TaskQueueManager>,base::TimeTicks,bool>,void
__cdecl(void)>::RunImpl<void (__thiscall blink::sc [0x0B64C2D2+114]
STDERR: 	base::internal::Invoker<base::internal::BindState<void (__thiscall
blink::scheduler::TaskQueueManager::*)(base::TimeTicks,bool),base::WeakPtr<blink::scheduler::TaskQueueManager>,base::TimeTicks,bool>,void
__cdecl(void)>::Run [0x0B658B64+36]
STDERR: 	base::internal::RunMixin<base::Callback<void __cdecl(void),0,0> >::Run
[0x01693E94+68]
STDERR: 	base::debug::TaskAnnotator::RunTask [0x0169402F+367]
STDERR: 	base::MessageLoop::RunTask [0x01710964+660]
STDERR: 	base::MessageLoop::DeferOrRunPendingTask [0x0170E75C+44]
STDERR: 	base::MessageLoop::DoWork [0x0170ED42+242]
STDERR: 	base::MessagePumpDefault::Run [0x01716B8E+190]
STDERR: 	base::MessageLoop::RunHandler [0x0171065C+444]
..
STDERR: 
STDERR: Backtrace:
STDERR: 	base::debug::BreakDebugger [0x0168C5F7+23]
STDERR: 	logging::LogMessage::~LogMessage [0x016E008D+701]
STDERR: 	content::RenderWidget::routing_id [0x104644A6+166]
STDERR: 	content::RenderViewImpl::GetRoutingID [0x12637001+49]
STDERR: 	content::RenderViewObserver::RenderViewObserver [0x10462FB5+133]
STDERR: 	content::BlinkTestRunner::BlinkTestRunner [0x008157E6+22]
STDERR: 	gin::Handle<content::InterfaceRegistryJsWrapper>::ToV8 [0x007D07A7+167]
STDERR: 	base::internal::FunctorTraits<void (__cdecl*)(content::RenderView
*,test_runner::WebViewTestProxyBase *),void>::Invoke<content::RenderView
*,test_runner::WebViewTestProxyBase *> [0x007CCE24+36]
STDERR: 	base::internal::InvokeHelper<0,void>::MakeItSo<void (__cdecl*const
&)(content::RenderView *,test_runner::WebViewTestProxyBase
*),content::RenderView *,test_runner::WebViewTestProxyBase *> [0x007CCF61+49]
STDERR:
	??$RunImpl@ABQ6AXPAVRenderView@content@@PAVWebViewTestProxyBase@test_runner@@@ZABV?$tuple@$$V@std@@$S@?$Invoker@U?$BindState@P6AXPAVRenderView@content@@PAVWebViewTestProxyBase@test_runner@@@Z$$V@internal@base@@$$A6AXPAVRenderView@content@@PAVWebViewTestPr
[0x007CD01F+47]
STDERR:
	?Run@?$Invoker@U?$BindState@P6AXPAVRenderView@content@@PAVWebViewTestProxyBase@test_runner@@@Z$$V@internal@base@@$$A6AXPAVRenderView@content@@PAVWebViewTestProxyBase@test_runner@@@Z@internal@base@@SAXPAVBindStateBase@23@$$QAPAVRenderView@content@@$$QAPAVW
[0x007D043E+62]
STDERR: 	base::internal::RunMixin<base::Callback<void
__cdecl(content::RenderView *,test_runner::WebViewTestProxyBase *),1,1> >::Run
[0x00971F89+89]
STDERR: 	content::LayoutTestDependenciesImpl::CreateDisplayOutputSurface
[0x00965ABA+794]
STDERR: 	content::RenderViewImpl::Create [0x12635554+196]
STDERR: 	content::RenderThreadImpl::CreateView [0x1260F0FF+63]
STDERR: 	content::mojom::RendererStubDispatch::Accept [0x109E7AE1+513]
STDERR:
	content::mojom::RendererStub<mojo::RawPtrImplRefTraits<content::mojom::Renderer>
>::Accept [0x1260AC11+65]
STDERR: 	mojo::InterfaceEndpointClient::HandleValidatedMessage [0x01B29F2D+1101]
STDERR: 	mojo::InterfaceEndpointClient::HandleIncomingMessageThunk::Accept
[0x01B28A96+22]
STDERR: 	mojo::FilterChain::Accept [0x01B20551+337]
STDERR: 	mojo::InterfaceEndpointClient::HandleIncomingMessage [0x01B29A98+200]
STDERR: 	mojo::SyncHandleWatcher::`scalar deleting destructor' [0x01479408+2504]
STDERR: 	base::internal::FunctorTraits<void (__thiscall IPC::`anonymous
namespace'::ChannelAssociatedGroupController::*)(mojo::Message),void>::Invoke<scoped_refptr<IPC::`anonymous
namespace'::ChannelAssociatedGroupController> const &,mojo::Message>
[0x0146FEED+45]
STDERR: 	base::internal::InvokeHelper<0,void>::MakeItSo<void (__thiscall
IPC::`anonymous namespace'::ChannelAssociatedGroupController::*const
&)(mojo::Message),scoped_refptr<IPC::`anonymous
namespace'::ChannelAssociatedGroupController> const &,mojo::Message>
[0x01470235+53]
STDERR: 	base::internal::Invoker<base::internal::BindState<void (__thiscall
IPC::`anonymous
namespace'::ChannelAssociatedGroupController::*)(mojo::Message),scoped_refptr<IPC::`anonymous
namespace'::ChannelAssociatedGroupController>,base::internal::PassedWrapper<mo
[0x0147063A+90]
STDERR: 	base::internal::Invoker<base::internal::BindState<void (__thiscall
IPC::`anonymous
namespace'::ChannelAssociatedGroupController::*)(mojo::Message),scoped_refptr<IPC::`anonymous
namespace'::ChannelAssociatedGroupController>,base::internal::PassedWrapper<mo
[0x0147D6F4+36]
STDERR: 	base::internal::RunMixin<base::Callback<void __cdecl(void),0,0> >::Run
[0x01693E94+68]
STDERR: 	base::debug::TaskAnnotator::RunTask [0x0169402F+367]
STDERR: 	blink::scheduler::TaskQueueManager::ProcessTaskFromWorkQueue
[0x0B6580D4+1508]
STDERR: 	blink::scheduler::TaskQueueManager::DoWork [0x0B656661+737]
STDERR: 	base::internal::FunctorTraits<void (__thiscall
blink::scheduler::TaskQueueManager::*)

[Michael Achenbach, 2017-05-25 15:02:38]

On 2017/05/24 20:29:55, kozy wrote:
> crash on another bot looks completely unrelated, maybe it's a reason why
revert
> doesn't help/

Not sure if unrelated. Maybe another V8 change that causes this. The bots only
show V8 side failures as they retry with the pinned version. E.g. chromium
upstream doesn't have these errors and our roll is probably going to be blocked
as soon as we roll again after the branch. Which means we have to revert
something V8-side or skip the tests temporarily.