This is a reland of commit 88496ba1c3
Fixes on top of the original change:
* Closure layout is changed to avoid gap between fixed fields and
variable-length elements on compressed pointers architecture.
This gap was causing crashes in the GC when scanning closure
objects.
* pkg/vm_snapshot_analysis/test/instruction_sizes_test is fixed
on arm64 by decreasing threshold for detecting size changes.
Original change's description:
> [vm,dart2bytecode,modular_aot] Variable-length closure objects
>
> Extend closure objects with variable number of elements to capture.
> This is needed to support capturing multiple independent contexts
> after capturing is computed in the front-end.
>
> The following fixed Closure fields are moved into variable-length
> elements:
> - delayed type arguments;
> - instantiator type arguments;
> - function type arguments;
> - context.
>
> Number of elements and presence/indices of various type arguments
> are encoded into the new length_and_flags field in the Closure.
>
> Most closure objects don't need any of the type arguments so this
> change will reduce average Closure object size.
TEST=ci
Issue: https://github.com/dart-lang/sdk/issues/61572
Issue: https://github.com/dart-lang/sdk/issues/61635
Change-Id: I8685e632e2d0832766ecdc470f3cf9a6b880de48
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/494243
Commit-Queue: Alexander Markov <alexmarkov@google.com>
Reviewed-by: Tess Strickland <sstrickl@google.com>
Reviewed-by: Slava Egorov <vegorov@google.com>
Extend closure objects with variable number of elements to capture.
This is needed to support capturing multiple independent contexts
after capturing is computed in the front-end.
The following fixed Closure fields are moved into variable-length
elements:
- delayed type arguments;
- instantiator type arguments;
- function type arguments;
- context.
Number of elements and presence/indices of various type arguments
are encoded into the new length_and_flags field in the Closure.
Most closure objects don't need any of the type arguments so this
change will reduce average Closure object size.
TEST=ci
Issue: https://github.com/dart-lang/sdk/issues/61572
Issue: https://github.com/dart-lang/sdk/issues/61635
Change-Id: I7ca5cec0fd8725c432a01d51781fb14e803997dd
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/489482
Commit-Queue: Alexander Markov <alexmarkov@google.com>
Reviewed-by: Ryan Macnak <rmacnak@google.com>
Reviewed-by: Slava Egorov <vegorov@google.com>
Reviewed-by: Tess Strickland <sstrickl@google.com>
ComputeElementAddress takes a base untagged address, an index, an index
scale, and an offset and returns base + (index * scale) + offset as an
untagged address.
This removes the last conversions between untagged and unboxed integers
for untagged GC-movable pointers. The only remaining conversions are
the following cases, which all involve non-GC-movable pointers:
1. Calls to the FFI resolver (on IA32 only).
2. Returning nullptr when a pointer to memory is expected in
exceptional returns from FFI callbacks.
3. Converting user-provided integers to FFI pointer objects and back.
In addition, we no longer add the data field to materializations of
typed data views, but instead recompute the data field in
DeferredObject::Fill(). This removes the last source of unsafe untagged
pointers that may have arbitrary lifetimes in the flow graph.
Thus, we can now verify in the FlowGraphChecker that there are no
GC-triggering instructions between the creation of an untagged
GC-movable pointer and its use (including the use itself). To do this,
this CL adds a predicate MayCreateUnsafeUntaggedPointer to definitions,
which by default returns true for kUntagged results, false otherwise,
and should only be overwritten in cases where the result can be proven
to not be a untagged GC-movable pointer.
TEST=vm/dart/regress_54710_il_test
vm/cc/AllocationSinking_NoViewDataMaterialization
Fixes: https://github.com/dart-lang/sdk/issues/54710
Cq-Include-Trybots: luci.dart.try:vm-aot-android-release-arm64c-try,vm-aot-linux-debug-x64-try,vm-aot-linux-debug-x64c-try,vm-aot-mac-release-arm64-try,vm-aot-mac-release-x64-try,vm-aot-obfuscate-linux-release-x64-try,vm-aot-optimization-level-linux-release-x64-try,vm-appjit-linux-debug-x64-try,vm-asan-linux-release-x64-try,vm-checked-mac-release-arm64-try,vm-eager-optimization-linux-release-ia32-try,vm-eager-optimization-linux-release-x64-try,vm-ffi-android-debug-arm-try,vm-ffi-android-debug-arm64c-try,vm-ffi-qemu-linux-release-arm-try,vm-ffi-qemu-linux-release-riscv64-try,vm-fuchsia-release-x64-try,vm-linux-debug-ia32-try,vm-linux-debug-x64c-try,vm-mac-debug-arm64-try,vm-mac-debug-x64-try,vm-msan-linux-release-x64-try,vm-reload-linux-debug-x64-try,vm-reload-rollback-linux-debug-x64-try,vm-ubsan-linux-release-x64-try,vm-win-release-ia32-try
Change-Id: Ie172a8bd0330a728a4f151478664a530f8d9b38a
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/354862
Commit-Queue: Tess Strickland <sstrickl@google.com>
Reviewed-by: Alexander Markov <alexmarkov@google.com>
`Pointer`s were not handled in deferred materialization of objects
on deoptimizations. This lead to the address field being written as a
tagged value, causing the actual address to be smitagged.
Subsequent uses of those addresses would lead to segfaults.
This CL handles the `Pointer`s manually to deal with the untagged
address.
`--trace-deoptimization-verbose` before this CL:
```
Deoptimizing [...]
_typedDataBase@8050071 <- Pointer: address=0x7ffff7488081
null Field @ offset(8) <- 140736616678128
null Field @ offset(16) <- TypeArguments: (H39d2e3b4) [Type: Never]
```
after this CL:
```
Deoptimizing [...]
_typedDataBase@8050071 <- Pointer: address=0x7fa2c0a88081
pointer@data <- 0x7fa29c16c0e0
pointer@type_args <- TypeArguments: (H39d2e3b4) [Type: Never]
```
TEST=runtime/tests/vm/dart/regress_54871_test.dart
TEST=tests/ffi/structs_test.dart with --hot-reload-rollback-test-mode
and --optimization-counter-threshold=50
Closes: https://github.com/dart-lang/sdk/issues/54871
Change-Id: I13b6404c8b098643b8ac0f59ee8e9bc635f33b8d
Cq-Include-Trybots: luci.dart.try:vm-reload-rollback-linux-debug-x64-try,vm-reload-rollback-linux-release-x64-try
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/352300
Reviewed-by: Martin Kustermann <kustermann@google.com>
Commit-Queue: Daco Harkes <dacoharkes@google.com>
The representation of record shape in record instances and record
types is changed from a pair
int num_fields
Array field_names
to a single integer - packed bitfield
int num_fields(16)
int field_names_index(kSmiBits-16)
where field names index is an index in the array available from
ObjectStore.
With the new representation of record shapes:
1) Size of record instances is reduced.
2) Number of comparisons for a shape test reduced from 2 to 1
(shape test is used during type checks).
3) A few operations removed from Record.hashCode.
4) Type testing stubs (TTS) are now supported for record types with
named fields. Previously it was not possible to check shape of records
with named fields in TTS as TTS cannot access object pool and cannot
load field names array).
TEST=existing
Issue: https://github.com/dart-lang/sdk/issues/49719
Change-Id: I7cdcbb53938aba5d561cd24dc99530395dbbea7e
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/276201
Reviewed-by: Ryan Macnak <rmacnak@google.com>
Commit-Queue: Alexander Markov <alexmarkov@google.com>
When materializing objects during deoptimization, their fields were
set using Instance::SetField. However, Instance::SetField updates
field guards and it is strict about not taking 'sentinel' value.
That caused assertion to fail when trying to materialize an instances
with late fields which were not initialized yet and have 'sentinel'
value.
Changed materialization to use a more low-level SetFieldAtOffset
in case of sentinel value.
TEST=runtime/tests/vm/dart/regress_45691_test.dart
Fixes https://github.com/dart-lang/sdk/issues/45691
Change-Id: If39a1e4f2fc0d0fe7f988a80c7a0073cafff28b0
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/195490
Commit-Queue: Alexander Markov <alexmarkov@google.com>
Reviewed-by: Vyacheslav Egorov <vegorov@google.com>
Before value is stored into Float32List, it is converted to 32-bit
float using DoubleToFloat instruction. If allocation sinking
eliminated the allocation of Float32List but we need to deoptimize,
the list is materialized and elements are filled. In such case,
we shouldn't perform double->float conversion as it already happened.
This change also updates the assertion in DoubleToFloatInstr::Canonicalize
which verifies that DoubleToFloat instruction can be used only
in certain cases.
TEST=tests/language/vm/allocation_sinking_arrays_test.dart
Fixes https://github.com/dart-lang/sdk/issues/45547
Change-Id: I9a1bd28a9fc09bccad6aa3c91a7880abd002f7c9
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/193831
Reviewed-by: Ryan Macnak <rmacnak@google.com>
Commit-Queue: Alexander Markov <alexmarkov@google.com>
This CL removes asserts that prevented background compiler from doing class finalization.
It adds program_lock synchronization for when object properties are updated during class finalization.
It also encloses code instructions installation into safepoint scopes to ensure that no code is executed during installation.
Issue https://github.com/dart-lang/sdk/issues/36097
TEST=existing test suite
Change-Id: If297e44f51b187242eca2cdcfff066c8f6386d97
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/178163
Commit-Queue: Alexander Aprelev <aam@google.com>
Reviewed-by: Ryan Macnak <rmacnak@google.com>
Currently we have things called XPtr which are not what you get from ptr().
Old world:
handle->raw() returns RawObject* (tagged)
raw_obj->ptr() returns RawObject* (untagged)
After 6fe15f6df9:
handle->raw() returns ObjectPtr
obj_ptr->ptr() returns ObjectLayout*
New world:
handle->ptr() returns ObjectPtr
obj_ptr->untag() returns UntaggedObject*
TEST=ci
Change-Id: I6c7f34014cf20737607caaf84979838300d12df2
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/149367
Commit-Queue: Ryan Macnak <rmacnak@google.com>
Reviewed-by: Martin Kustermann <kustermann@google.com>
Reviewed-by: Siva Annamalai <asiva@google.com>
Reviewed-by: Vyacheslav Egorov <vegorov@google.com>
As part of making the compiler and other subsystems independent
of `Isolate` we have to move various state from `Isolate` to
`IsolateGroup`.
The class_table and object_store were already moved to `IsolateGroup`.
This CL only replaces usages of `Isolate::{object_store,class_table}`
with the equivalent in `IsolateGroup`.
Issue https://github.com/dart-lang/sdk/issues/36097
TEST=Pure refactoring - relying on existing test coverage.
Change-Id: I34a0682d715b054d6c5faff077a513980f59a348
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/177126
Commit-Queue: Martin Kustermann <kustermann@google.com>
Reviewed-by: Alexander Aprelev <aam@google.com>
Reviewed-by: Ryan Macnak <rmacnak@google.com>
This reverts commit 9eb531bde4.
Reason for revert: Bots are red. Some tests are failing.
https://ci.chromium.org/p/dart/builders/ci.sandbox/vm-kernel-precomp-obfuscate-linux-release-x64/6039https://ci.chromium.org/p/dart/builders/ci.sandbox/vm-kernel-precomp-android-release-arm_x64/957
Original change's description:
> [vm] Add support for real unboxed floating point fields in AOT
>
> Non-nullable floating point fields (double, Float32x4, Float64x2)
> are fully unboxed in their classes.
>
> A bitmap for each class was added to the shared class table in order to keep
> track of the pointers of the classes. Since all classes in Flutter Gallery
> have less than 64 fields, the bitmap is represented by a 64 bit integer and
> fields whose offset is more than 64 words are not unboxed.
>
> The instance sizes and field offsets might change between target and host
> in cross-compilation, since the number of words used to store unboxed fields
> may differ.
>
> dart-aot Xeon
>
> SplayLatency -4.62%
> SplayHarderLatency -4.17%
> NavierStokes -2.20%
> Tracer 8.72%
> ParticleSystemPaint 2.90%
> NBodySIMD 8.35%
> NBody 25.59%
>
> With hack TFA to make doubles in Rect/Offset/Size classes in flutter non-nullable:
>
> flutter arm-v8:
>
> gallery total size: -1%
>
> matrix_utils_transform_rect_perspective -16.70% (less is better)
> matrix_utils_transform_rect_affine -31.82% (less is better)
> matrix_utils_transform_point_perspective -24.90% (less is better)
> matrix_utils_transform_point_affine) -27.26% (less is better)
> rrect_contains_bench -4.719% (less is better)
>
> Change-Id: I9ae09c9c3167d99f9efd071a92937aa51093fd1d
> Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/131824
> Commit-Queue: Victor Agnez Lima <victoragnez@google.com>
> Reviewed-by: Martin Kustermann <kustermann@google.com>
> Reviewed-by: Ryan Macnak <rmacnak@google.com>
> Reviewed-by: Samir Jindel <sjindel@google.com>
TBR=kustermann@google.com,rmacnak@google.com,sjindel@google.com,victoragnez@google.com
Change-Id: Ic73858f6adb7f55c4129d4f46ff4731b378cb634
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/134020
Reviewed-by: Zichang Guo <zichangguo@google.com>
Commit-Queue: Zichang Guo <zichangguo@google.com>
Non-nullable floating point fields (double, Float32x4, Float64x2)
are fully unboxed in their classes.
A bitmap for each class was added to the shared class table in order to keep
track of the pointers of the classes. Since all classes in Flutter Gallery
have less than 64 fields, the bitmap is represented by a 64 bit integer and
fields whose offset is more than 64 words are not unboxed.
The instance sizes and field offsets might change between target and host
in cross-compilation, since the number of words used to store unboxed fields
may differ.
dart-aot Xeon
SplayLatency -4.62%
SplayHarderLatency -4.17%
NavierStokes -2.20%
Tracer 8.72%
ParticleSystemPaint 2.90%
NBodySIMD 8.35%
NBody 25.59%
With hack TFA to make doubles in Rect/Offset/Size classes in flutter non-nullable:
flutter arm-v8:
gallery total size: -1%
matrix_utils_transform_rect_perspective -16.70% (less is better)
matrix_utils_transform_rect_affine -31.82% (less is better)
matrix_utils_transform_point_perspective -24.90% (less is better)
matrix_utils_transform_point_affine) -27.26% (less is better)
rrect_contains_bench -4.719% (less is better)
Change-Id: I9ae09c9c3167d99f9efd071a92937aa51093fd1d
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/131824
Commit-Queue: Victor Agnez Lima <victoragnez@google.com>
Reviewed-by: Martin Kustermann <kustermann@google.com>
Reviewed-by: Ryan Macnak <rmacnak@google.com>
Reviewed-by: Samir Jindel <sjindel@google.com>
dart-bytecode, arm64: +4.742% geomean
dart-bytecode-jit-unopt, arm64: +12.73% geomean
dart2js-compile, x64: +3.635% geomean
In the polymorphic and unlinked cases, call to a stub the does a linear scan against an ICData.
In the monomorphic case, call to a prologue of the expected target function that checks the expected receiver class. There is additional indirection in the JIT version compared to the AOT version to also tick a usage counter so the inliner can make good decisions.
In the megamorphic case, call to a stub that does a hash table lookup against a MegamorphicCache.
Megamorphic call sites face a loss of precision in usage counts. The call site count is not recorded and the usage counter of the target function is used as an approximation.
Monomorphic and megamorphic calls sites are reset to the polymorphic/unlinked state on hot reload.
Monomorphic and megamorphic calls sites do not check the stepping state, so they are reset to the polymorphic/unlinked state when stepping begins and disabled.
Back-edges now increment the usage counter in addition to checking it. This ensures function with loops containing monomorphic calls will eventually cross the optimization threshold.
Fixed backwards use of kMonomorphicEntryOffset and kPolymorphicEntryOffset.
Fixed C stack overflow when bouncing between the KBC interpreter and a simulator.
Bug: https://github.com/dart-lang/sdk/issues/26780
Bug: https://github.com/dart-lang/sdk/issues/36409
Bug: https://github.com/dart-lang/sdk/issues/36731
Change-Id: I78a49cccd962703a459288e71ce246ed845df474
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/102820
Commit-Queue: Ryan Macnak <rmacnak@google.com>
Reviewed-by: Alexander Markov <alexmarkov@google.com>
This reverts commit fde6a5917e.
Reason for revert: This commit looks to be causing new test failures on dart2js. While there are some odd results on some builders that look like infra failures, some builders (for example, dart2js-minified-strong-linux-x64-d8) show the new failing tests clearly.
Original change's description:
> [vm, compiler] Unoptimized megamorphic calls.
>
> When an instance call in unoptimized code creates more than FLAG_max_polymorphic_checks cases, switch the call to use a MegamorphicCache instead of ICData. The prevents unbounded collection of type feedback, and gives improvements on microbenchmarks in the 3-8% range for unoptimized code.
>
> It also leads to a loss of target frequency information for the optimizer, leading to different ordering for range checks in polymorphic inlining. This leads to changes on megamorphic microbenchmarks from -31% to +60%, weighted toward the negative end.
>
> In practice the frequency information seems unimportant, as dart2js has 4.01% geomean improvement.
>
> This is a step toward direct monomorphic calls in unoptimized code, which will also make use of the patching and type feedback extraction added here.
>
> Bug: https://github.com/dart-lang/sdk/issues/26780
> Bug: https://github.com/dart-lang/sdk/issues/36409
> Bug: https://github.com/dart-lang/sdk/issues/36731
> Change-Id: I29f53f23b6794c5f5f0db8b8184788cee16fd9c5
> Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/99270
> Reviewed-by: Alexander Markov <alexmarkov@google.com>
TBR=rmacnak@google.com,alexmarkov@google.com,ajcbik@google.com
Change-Id: Icad46b93cdf8541a00563f49da6b4ac0a4df1ba1
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: https://github.com/dart-lang/sdk/issues/26780, https://github.com/dart-lang/sdk/issues/36409, https://github.com/dart-lang/sdk/issues/36731
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/103440
Reviewed-by: Teagan Strickland <sstrickl@google.com>
Commit-Queue: Teagan Strickland <sstrickl@google.com>
When an instance call in unoptimized code creates more than FLAG_max_polymorphic_checks cases, switch the call to use a MegamorphicCache instead of ICData. The prevents unbounded collection of type feedback, and gives improvements on microbenchmarks in the 3-8% range for unoptimized code.
It also leads to a loss of target frequency information for the optimizer, leading to different ordering for range checks in polymorphic inlining. This leads to changes on megamorphic microbenchmarks from -31% to +60%, weighted toward the negative end.
In practice the frequency information seems unimportant, as dart2js has 4.01% geomean improvement.
This is a step toward direct monomorphic calls in unoptimized code, which will also make use of the patching and type feedback extraction added here.
Bug: https://github.com/dart-lang/sdk/issues/26780
Bug: https://github.com/dart-lang/sdk/issues/36409
Bug: https://github.com/dart-lang/sdk/issues/36731
Change-Id: I29f53f23b6794c5f5f0db8b8184788cee16fd9c5
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/99270
Reviewed-by: Alexander Markov <alexmarkov@google.com>
This removes the 3 fields from the classes in Dart and instead describes
the layout in C++ via a RawTypedDataView class (as already do with
normal RawTypedData). The existing "semi" TypedDataView handle class is
changed to be a real handle class.
This decreases performance of some microbenchmarks due to field guards
not being used anymore (before the JIT could add a field guard to view classes
guarding that only normal typed data is used as backing store (and not e.g. external
typed data)
Issue https://github.com/dart-lang/sdk/issues/35154
Issue https://github.com/dart-lang/sdk/issues/31954
Change-Id: I7a0022b843a4c0fa69f53dedcc4c7bd2117cdc37
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/96806
Commit-Queue: Martin Kustermann <kustermann@google.com>
Reviewed-by: Ryan Macnak <rmacnak@google.com>
For some reason this code used deopt_id from the environment attached
to the AssertAssignable instruction, rather than deopt_id from the
instruction itself.
Under certain conditions this deopt_id is -1 which usually does
not cause any problems because no other code uses it.
Compiler is now changed in a way that only sets Environment::deopt_id_
for outer environments and innermost environment always has deopt_id_ set
to DeoptId::kNone.
This bug manifested itself as a very rare crash on lib_2/convert/chunked_conversion_utf8_test.dart
test on optcounter bot.
This change also converts an assertion that verifies that deoptimization target
always exists into a FATAL to make such crashes more informative.
TEST=runtime/tests/vm/dart/licm_and_assert_strengthening_test.dart
Change-Id: Ib58237b0f4ae279dcf9d88cac031156e88bf4828
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/96657
Auto-Submit: Vyacheslav Egorov <vegorov@google.com>
Reviewed-by: Martin Kustermann <kustermann@google.com>
Commit-Queue: Vyacheslav Egorov <vegorov@google.com>
Also move deopt id computation logic into a separate class and add a comment
explaining while deopt ids are incremented by 2.
Change-Id: Ife489be7d10c7198a8e7adf9e97e0c516d78ea55
Reviewed-on: https://dart-review.googlesource.com/72685
Commit-Queue: Vyacheslav Egorov <vegorov@google.com>
Reviewed-by: Martin Kustermann <kustermann@google.com>
Coverage uses the value of an execution counter to detect executed functions. However non-positive execution counter does not necessary mean that a function was never executed because we sometimes reset the counter.
Introduce additional bit on a function that is set whenever we reset positive execution counter and use this bit when generating coverage data.
Bug: https://github.com/dart-lang/sdk/issues/31326
Change-Id: I5357109603defad7e7c9415c433203f16bcf88f4
Reviewed-on: https://dart-review.googlesource.com/19760
Commit-Queue: Ryan Macnak <rmacnak@google.com>
Reviewed-by: Vyacheslav Egorov <vegorov@google.com>
New folder structure (nested under vm/):
- compiler/
- jit/ - JIT specific code
- aot/ - AOT specific code
- backend/ - all middle-end and back-end code (IL, flow graph)
- assembler/ - assemblers and disassemblers
- frontend/ - front ends (AST -> IL, Kernel -> IL)
compiler/README.md would be the documentation root for the compiler
pipeline
Bug: https://github.com/dart-lang/sdk/issues/30575
Change-Id: I2dfd9688793bff737f7632ddc77fca766875ce36
Reviewed-on: https://dart-review.googlesource.com/2940
Reviewed-by: Vyacheslav Egorov <vegorov@google.com>
Commit-Queue: Vyacheslav Egorov <vegorov@google.com>
Simplify handling of closures as deferred objects.
The name "type_arguments_" is confusing, because class Closure is not generic.
Class Closure was forcefully made (kinda) generic by setting its
type_arguments_field_offset_in_words_ field to a valid value, so that the
type_arguments_ field in closure instances could be accessed similarly as in
generic instances. With generic functions, closures will potentially have more
than one instantiator and the name type_arguments_ becomes nonsensical.
R=johnmccutchan@google.com
Review-Url: https://codereview.chromium.org/2719603002 .
They were used as the class of closure instances and as the type class of
function types.
All closure instances now have class _Closure and function types are represented
by a new class FunctionType extending AbstractType.
Fix issue 24567 and add regression test.
R=asiva@google.com, rmacnak@google.com
Review URL: https://codereview.chromium.org/1584223006 .
Instead of calling code object directly, call indirectly and
pass the code object in a register. The object pool is then loaded from
the code object. This is another preparation step for making generated code
relocatable.
All non-ia32 platforms:
No entry patching.
ARM:
PC marker (now code object) moves to the same place as on x64 (below saved PP, above saved FP).
R9 is now used as PP, R10 as CODE_REG.
BUG=
R=rmacnak@google.com
Review URL: https://codereview.chromium.org//1192103004 .
Alexander Markov