Support fast case for-in in Crankshaft.

Support fast case for-in in Crankshaft.

Only JSObject enumerables with enum cache (fast case properties, no interceptors, no enumerable properties on the prototype) are supported.

HLoadKeyedGeneric with keys produced by for-in enumeration are recognized and rewritten into direct property load by index. For this enum-cache was extended to store property indices in a separate array (see handles.cc).

New hydrogen instructions: 

- HForInPrepareMap: checks for-in fast case preconditions and returns map that contains enum-cache;
- HForInCacheArray: extracts enum-cache array from the map;
- HCheckMapValue: map check with HValue map instead of immediate;
- HLoadFieldByIndex: load fast property by it's index, positive indexes denote in-object properties, negative - out of object properties;

Changed hydrogen instructions:

- HLoadKeyedFastElement: added hole check suppression for loads from internal FixedArrays that are knows to have no holes inside.


R=fschneider@chromium.org
BUG=
TEST=

Committed: https://code.google.com/p/v8/source/detail?r=10794

[fschneider, 2012-02-20 14:56:06]

https://chromiumcodereview.appspot.com/9425045/diff/1/src/handles.cc
File src/handles.cc (right):

https://chromiumcodereview.appspot.com/9425045/diff/1/src/handles.cc#newcode750
src/handles.cc:750: if (!indexes.is_null()) {
s/indexes/indices/g

https://chromiumcodereview.appspot.com/9425045/diff/1/src/hydrogen.cc
File src/hydrogen.cc (right):

https://chromiumcodereview.appspot.com/9425045/diff/1/src/hydrogen.cc#newcode...
src/hydrogen.cc:3259: HInstruction* start_index = AddInstruction(new(zone())
HConstant(
You could use PushAndAdd here in these cases.

https://chromiumcodereview.appspot.com/9425045/diff/1/src/hydrogen.cc#newcode...
src/hydrogen.cc:3261: 
Remove \n.

https://chromiumcodereview.appspot.com/9425045/diff/1/src/hydrogen.cc#newcode...
src/hydrogen.cc:3319: HValue* next_index = AddInstruction(
You could use PushAndAdd here.

https://chromiumcodereview.appspot.com/9425045/diff/1/src/ia32/lithium-codege...
File src/ia32/lithium-codegen-ia32.cc (right):

https://chromiumcodereview.appspot.com/9425045/diff/1/src/ia32/lithium-codege...
src/ia32/lithium-codegen-ia32.cc:4798: JSObject::kHeaderSize - kHeapObjectTag));
Maybe use FieldOperand instead to avoid having to subtract the kHeapObjectTag.

https://chromiumcodereview.appspot.com/9425045/diff/1/src/ia32/lithium-codege...
src/ia32/lithium-codegen-ia32.cc:4807: kPointerSize - kHeapObjectTag));
Shouldn't this be FixedArray::kHeaderSize - kHeapObjectTag?

https://chromiumcodereview.appspot.com/9425045/diff/1/src/ia32/lithium-ia32.cc
File src/ia32/lithium-ia32.cc (right):

https://chromiumcodereview.appspot.com/9425045/diff/1/src/ia32/lithium-ia32.c...
src/ia32/lithium-ia32.cc:2430: return
AssignEnvironment(DefineAsRegister(new(zone()) LCheckMapValue(value, map)));
Long line.

https://chromiumcodereview.appspot.com/9425045/diff/1/src/ia32/lithium-ia32.c...
src/ia32/lithium-ia32.cc:2430: return
AssignEnvironment(DefineAsRegister(new(zone()) LCheckMapValue(value, map)));
Since the result of the HCheckMapValue instruction is not used, you don't need
to assign an output register here.

[Vyacheslav Egorov (Chromium), 2012-02-21 17:05:42]

PTAL!

[fschneider, 2012-02-22 10:16:45]

LGTM!

https://chromiumcodereview.appspot.com/9425045/diff/4001/src/arm/lithium-arm.h
File src/arm/lithium-arm.h (right):

https://chromiumcodereview.appspot.com/9425045/diff/4001/src/arm/lithium-arm....
src/arm/lithium-arm.h:2100: class LCheckMapValue: public LTemplateInstruction<1,
2, 0> {
Since there is no output operand: <0, 2, 0>

https://chromiumcodereview.appspot.com/9425045/diff/4001/src/ia32/lithium-ia32.h
File src/ia32/lithium-ia32.h (right):

https://chromiumcodereview.appspot.com/9425045/diff/4001/src/ia32/lithium-ia3...
src/ia32/lithium-ia32.h:2205: class LCheckMapValue: public
LTemplateInstruction<1, 2, 0> {
No output: <0, 2, 0>

https://chromiumcodereview.appspot.com/9425045/diff/4001/src/x64/lithium-x64.h
File src/x64/lithium-x64.h (right):

https://chromiumcodereview.appspot.com/9425045/diff/4001/src/x64/lithium-x64....
src/x64/lithium-x64.h:2075: class LCheckMapValue: public LTemplateInstruction<1,
2, 0> {
Also here: <0, 2, 0>

https://chromiumcodereview.appspot.com/9425045/diff/4001/test/mjsunit/compile...
File test/mjsunit/compiler/optimized-for-in.js (right):

https://chromiumcodereview.appspot.com/9425045/diff/4001/test/mjsunit/compile...
test/mjsunit/compiler/optimized-for-in.js:101: delete t[i];
maybe use deopt.deopt to deoptimize?

https://chromiumcodereview.appspot.com/9425045/diff/4001/test/mjsunit/compile...
test/mjsunit/compiler/optimized-for-in.js:187: function mkTable(opt) { return {
a: "1", b: "2", c: "3", d: "4" }; }
Why pass in the opt parameter? it seems not used.