Enable double alignment for constructed arrays.

Enable double alignment for constructed arrays.

2nd (of 3) CL's to ensure complete alignment of FixedDoubleArrays.

TEST=
BUG=

Committed: http://code.google.com/p/v8/source/detail?r=17809

[dusmil, 2013-10-22 16:36:20]

PTAL, this and 2 related CLs provide complete alignment of FixedDoubleArrays
which then allows a big MIPS performance improvement via
https://codereview.chromium.org/35463002.

[Hannes Payer (out of office), 2013-10-23 09:49:33]

https://codereview.chromium.org/35133002/diff/1/src/hydrogen.cc
File src/hydrogen.cc (right):

https://codereview.chromium.org/35133002/diff/1/src/hydrogen.cc#newcode2129
src/hydrogen.cc:2129: HType::JSArray(), NOT_TENURED, instance_type);
This is not correct. JS_ARRAY refers to the array object and FIXED_DOUBLE_ARRAY
to its elements. This change may result in a memory corruption since potential
mementos behind JS_ARRAY do not get cleared.
What about calling MakeDoubleAligned() instead?

[dusmil, 2013-10-23 13:27:35]

https://codereview.chromium.org/35133002/diff/1/src/hydrogen.cc
File src/hydrogen.cc (right):

https://codereview.chromium.org/35133002/diff/1/src/hydrogen.cc#newcode2129
src/hydrogen.cc:2129: HType::JSArray(), NOT_TENURED, instance_type);
On 2013/10/23 09:49:34, Hannes Payer wrote:
> This is not correct. JS_ARRAY refers to the array object and
FIXED_DOUBLE_ARRAY
> to its elements. This change may result in a memory corruption since potential
> mementos behind JS_ARRAY do not get cleared.
> What about calling MakeDoubleAligned() instead?

Yes, the problem there is that allocation of array object and its array of
elements is manually folded into one. I am sure it safe, but it is semantically
incorrect to change instance_type. Good point, it is better to call
MakeDoubleAligned. The new patch set will be uploaded soon, after testing is
done.

[dusmil, 2013-10-23 13:55:20]

https://codereview.chromium.org/35133002/diff/1/src/hydrogen.cc
File src/hydrogen.cc (right):

https://codereview.chromium.org/35133002/diff/1/src/hydrogen.cc#newcode2129
src/hydrogen.cc:2129: HType::JSArray(), NOT_TENURED, instance_type);
On 2013/10/23 09:49:34, Hannes Payer wrote:
> This is not correct. JS_ARRAY refers to the array object and
FIXED_DOUBLE_ARRAY
> to its elements. This change may result in a memory corruption since potential
> mementos behind JS_ARRAY do not get cleared.
> What about calling MakeDoubleAligned() instead?

Done.

[Hannes Payer (out of office), 2013-10-24 08:36:45]

LGTM, and it wouldn't be safe because of AllocationMementos which just get
cleared for JS_ARRAY_TYPE.

[dusmil, 2013-10-24 10:15:56]

On 2013/10/24 08:36:45, Hannes Payer wrote:
> LGTM, and it wouldn't be safe because of AllocationMementos which just get
> cleared for JS_ARRAY_TYPE.

Yes, I didn't see that AllocationSite::CanTrack depends on instance_type.
Thank you very much for pointing this out.

[Paul Lind, 2013-10-24 19:02:56]

Committed as r17382.