Optimize Function.prototype.call

Optimize Function.prototype.call

BUG=
R=verwaest@chromium.org, jarin@chromium.org, jkummerow@chromium.org

Committed: https://code.google.com/p/v8/source/detail?r=24631

[p.antonov, 2014-09-19 14:11:13]

As per https://codereview.chromium.org/350913002/, added deoptimization tests
for paths where simulates are used

[p.antonov, 2014-09-24 08:29:52]

PTAL

[p.antonov, 2014-09-30 07:43:56]

PTAL

[verwaest1, 2014-10-01 08:26:55]

verwaest@google.com changed reviewers:
+ verwaest@google.com

[verwaest1, 2014-10-01 08:26:55]

I'm OOO for at least another week. Unless someone else can take a look, this'll
have to wait a bit.

[Toon Verwaest, 2014-10-15 11:16:49]

lgtm

[Toon Verwaest, 2014-10-15 12:36:05]

Committed patchset #1 (id:1) manually as 24631 (presubmit successful).

[Toon Verwaest, 2015-04-24 18:51:07]

https://codereview.chromium.org/588573002/diff/1/src/hydrogen.cc
File src/hydrogen.cc (right):

https://codereview.chromium.org/588573002/diff/1/src/hydrogen.cc#newcode8153
src/hydrogen.cc:8153: HConstant::cast(receiver)->handle(isolate()))->map());
This caused a major issue since no map-check is added for the map that's
introduced here. Array.prototype.push will happily push doubles on non-double
arrays.