[JSC] Add support for typed arrays to the Array profiling

[JSC] Add support for typed arrays to the Array profiling
https://bugs.webkit.org/show_bug.cgi?id=143913

Patch by Benjamin Poulain <bpoulain@apple.com> on 2015-04-27
Reviewed by Filip Pizlo.

Source/JavaScriptCore:

This patch adds ArrayModes for every typed arrays. Having that information
let us generate better GetByVal and PutByVal when the type speculation
are not good enough.

A typical case where this is useful is any basic block for which the type
of the object is always more restrictive than the speculation (for example,
a basic block gated by a branch only taken for on type).

* bytecode/ArrayProfile.cpp:
(JSC::dumpArrayModes):
* bytecode/ArrayProfile.h:
(JSC::arrayModeFromStructure):
* dfg/DFGArrayMode.cpp:
(JSC::DFG::ArrayMode::fromObserved):
(JSC::DFG::ArrayMode::refine):
Maintain the refine() semantic. We do not support OutOfBounds access
for GetByVal on typed array.

* runtime/IndexingType.h:
* tests/stress/typed-array-get-by-val-profiling.js: Added.
(testArray.testCode):
(testArray):
* tests/stress/typed-array-put-by-val-profiling.js: Added.
(testArray.testCode):
(testArray):

LayoutTests:

* js/regress/script-tests/typed-array-get-set-by-val-profiling.js: Added.
* js/regress/typed-array-get-set-by-val-profiling.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@183450 268f45cc-cd09-0410-ab3c-d52691b4dbfc