[turbofan] Fix lazy deopt for JSToNumber conversions in binary operations.

[turbofan] Fix lazy deopt for JSToNumber conversions in binary operations.

This slightly hacky change provides lazy deopt points for to-number conversions in binops: When we deopt from a to-number conversion, we create a frame state with the already-converted value(s) so that we do not repeat the side effect of the conversion.

Embenchen numbers are below. It is not quite clear what happened to fasta - the hot code looks nearly identical.

Current: EmbenchenBox2d(RunTime): 12746 ms.
d8-master: EmbenchenBox2d(RunTime): 13861 ms.
----------- bullet.js
Current: EmbenchenBullet(RunTime): 17680 ms.
d8-master: EmbenchenBullet(RunTime): 19170 ms.
----------- copy.js
Current: EmbenchenCopy(RunTime): 4939 ms.
d8-master: EmbenchenCopy(RunTime): 4943 ms.
----------- corrections.js
Current: EmbenchenCorrections(RunTime): 6639 ms.
d8-master: EmbenchenCorrections(RunTime): 6728 ms.
----------- fannkuch.js
Current: EmbenchenFannkuch(RunTime): 4630 ms.
d8-master: EmbenchenFannkuch(RunTime): 4872 ms.
----------- fasta.js
Current: EmbenchenFasta(RunTime): 10209 ms.
d8-master: EmbenchenFasta(RunTime): 9673 ms.
----------- lua_binarytrees.js
Current: EmbenchenLuaBinaryTrees(RunTime): 12936 ms.
d8-master: EmbenchenLuaBinaryTrees(RunTime): 15529 ms.
----------- memops.js
Current: EmbenchenMemOps(RunTime): 7357 ms.
d8-master: EmbenchenMemOps(RunTime): 7340 ms.
----------- primes.js
Current: EmbenchenPrimes(RunTime): 7530 ms.
d8-master: EmbenchenPrimes(RunTime): 7457 ms.
----------- skinning.js
Current: EmbenchenSkinning(RunTime): 15832 ms.
d8-master: EmbenchenSkinning(RunTime): 15630 ms.
----------- zlib.js
Current: EmbenchenZLib(RunTime): 11176 ms.
d8-master: EmbenchenZLib(RunTime): 11324 ms.

BUG=

Committed: https://crrev.com/6f559b7ec32ac5d40a78dcadad297c8be4a979cf
Cr-Commit-Position: refs/heads/master@{#27071}

[Jarin, 2015-03-06 16:28:25]

jarin@chromium.org changed reviewers:
+ bmeurer@chromium.org

[Jarin, 2015-03-09 09:36:48]

Could you take a look, please?

[Benedikt Meurer, 2015-03-09 09:57:30]

https://codereview.chromium.org/985713003/diff/20001/src/compiler/js-typed-lo...
File src/compiler/js-typed-lowering.cc (right):

https://codereview.chromium.org/985713003/diff/20001/src/compiler/js-typed-lo...
src/compiler/js-typed-lowering.cc:231: return graph()->NewNode(op,
frame_state->InputAt(0),
As discussed offline, please add something like NodeProperties::Clone(Node*)
here with set_op() on the clone.

https://codereview.chromium.org/985713003/diff/20001/src/compiler/js-typed-lo...
src/compiler/js-typed-lowering.cc:270: return graph()->NewNode(op,
frame_state->InputAt(0),
As discussed offline, please add something like NodeProperties::Clone(Node*)
here with set_op() and ReplaceInput() on the clone.

[Jarin, 2015-03-09 11:43:35]

On 2015/03/09 09:57:30, Benedikt Meurer wrote:
>
https://codereview.chromium.org/985713003/diff/20001/src/compiler/js-typed-lo...
> File src/compiler/js-typed-lowering.cc (right):
> 
>
https://codereview.chromium.org/985713003/diff/20001/src/compiler/js-typed-lo...
> src/compiler/js-typed-lowering.cc:231: return graph()->NewNode(op,
> frame_state->InputAt(0),
> As discussed offline, please add something like NodeProperties::Clone(Node*)
> here with set_op() on the clone.
> 
>
https://codereview.chromium.org/985713003/diff/20001/src/compiler/js-typed-lo...
> src/compiler/js-typed-lowering.cc:270: return graph()->NewNode(op,
> frame_state->InputAt(0),
> As discussed offline, please add something like NodeProperties::Clone(Node*)
> here with set_op() and ReplaceInput() on the clone.

Unfortunately, I need a graph to create new nodes. As NodeProperties does not
know anything about the graph, maybe we should keep the code as is.

[Benedikt Meurer, 2015-03-09 11:43:45]

lgtm

[Jarin, 2015-03-09 13:03:25]

The CQ bit was checked by jarin@chromium.org

[commit-bot: I haz the power, 2015-03-09 13:04:01]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/985713003/20001

[commit-bot: I haz the power, 2015-03-09 13:24:34]

Committed patchset #2 (id:20001)

[commit-bot: I haz the power, 2015-03-09 13:24:49]

Patchset 2 (id:??) landed as
https://crrev.com/6f559b7ec32ac5d40a78dcadad297c8be4a979cf
Cr-Commit-Position: refs/heads/master@{#27071}