commit e56f265f6d41fadbcea2be65d9b573bad8b4709d
author bmeurer <bmeurer@chromium.org> Mon Sep 21 16:05:27 2015
committer Commit bot <commit-bot@chromium.org> Mon Sep 21 16:05:43 2015
tree b3c7bcefe05f58bd7f4c380a9988f9f0fb594d21
parent c7a6790050023ff22515233f820fe5c8dc104a11

[ic] Also collect known map for relational comparison.

Previously we only collected the known map for equality comparisons. But
if we also collect it for relational comparisons, we can inline a fast
path of ToPrimitive on the objects, which is especially interesting
since both sides have the same map.

For now we only inline a very limited subset of ToPrimitive in
Crankshaft, which is when the receiver map (and its prototype chain)
doesn't have @@toPrimitive, and both valueOf and toString are the
default versions on the %ObjectPrototype%. In this case the relational
comparison would reduce to a string comparison of "[object CLASS]" with
itself and so we can reduce that to a boolean constant plus map checks
on both left and right hand side, plus code dependencies on the
prototype chain. This repairs the regression on box2d.

R=jkummerow@chromium.org
BUG=chromium:534200
LOG=n

Review URL: https://codereview.chromium.org/1355113002

Cr-Commit-Position: refs/heads/master@{#30852}