Re-enable the ArraySet fast path with Baker read barriers.

Benchmarks (ARM64) score variations on Nexus 5X with CPU
cores clamped at 960000 Hz (aosp_bullhead-userdebug build):
- Ritzperf - average (lower is better):       -0.95% (virtually unchanged)
- CaffeineMark - average (higher is better):  +2.50% (slightly better)
- DeltaBlue (lower is better):                -0.55% (virtually unchanged)
- Richards - average (lower is better):       +0.67% (virtually unchanged)
- SciMark2 - average (higher is better):      -0.10% (virtually unchanged)

Details about Ritzperf benchmarks with meaningful variations
(lower is better):
- GenericCalcActions.MemAllocTest:            -5.05% (better)

Details about CaffeineMark benchmarks with meaningful variations
(higher is better):
- Method:                                    +16.88% (better)

Details about Richards benchmarks with meaningful variations
(lower is better):
- deutsch_acc_interface:                      +9.86% (worse)

Boot image code size variation on Nexus 5X
(aosp_bullhead-userdebug build):
- total ARM64 framework Oat files size change:
  105933472 bytes -> 106027680 bytes (+0.09%)
- total ARM framework Oat files size change:
  89157936 bytes -> 89239856 bytes (+0.09%)

Test: ART host and target (ARM, ARM64) tests.
Bug: 29516974
Bug: 29506760
Bug: 12687968
Change-Id: Ib9e9709712295e17804b8888ac10e3d518ff2e70
diff --git a/compiler/optimizing/code_generator_arm64.cc b/compiler/optimizing/code_generator_arm64.cc
index cc8985d..578c7e7 100644
--- a/compiler/optimizing/code_generator_arm64.cc
+++ b/compiler/optimizing/code_generator_arm64.cc
@@ -591,6 +591,7 @@
     DCHECK(instruction_->IsInstanceFieldGet() ||
            instruction_->IsStaticFieldGet() ||
            instruction_->IsArrayGet() ||
+           instruction_->IsArraySet() ||
            instruction_->IsLoadClass() ||
            instruction_->IsLoadString() ||
            instruction_->IsInstanceOf() ||
@@ -2176,6 +2177,11 @@
   } else {
     locations->SetInAt(2, Location::RequiresRegister());
   }
+  if (object_array_set_with_read_barrier && kUseBakerReadBarrier) {
+    // Additional temporary registers for a Baker read barrier.
+    locations->AddTemp(Location::RequiresRegister());
+    locations->AddTemp(Location::RequiresRegister());
+  }
 }
 
 void InstructionCodeGeneratorARM64::VisitArraySet(HArraySet* instruction) {
@@ -2225,7 +2231,6 @@
     codegen_->Store(value_type, value, destination);
     codegen_->MaybeRecordImplicitNullCheck(instruction);
   } else {
-    DCHECK(needs_write_barrier);
     DCHECK(!instruction->GetArray()->IsIntermediateAddress());
     vixl::aarch64::Label done;
     SlowPathCodeARM64* slow_path = nullptr;
@@ -2264,33 +2269,112 @@
         }
 
         if (kEmitCompilerReadBarrier) {
-          // When read barriers are enabled, the type checking
-          // instrumentation requires two read barriers:
-          //
-          //   __ Mov(temp2, temp);
-          //   // /* HeapReference<Class> */ temp = temp->component_type_
-          //   __ Ldr(temp, HeapOperand(temp, component_offset));
-          //   codegen_->GenerateReadBarrierSlow(
-          //       instruction, temp_loc, temp_loc, temp2_loc, component_offset);
-          //
-          //   // /* HeapReference<Class> */ temp2 = value->klass_
-          //   __ Ldr(temp2, HeapOperand(Register(value), class_offset));
-          //   codegen_->GenerateReadBarrierSlow(
-          //       instruction, temp2_loc, temp2_loc, value_loc, class_offset, temp_loc);
-          //
-          //   __ Cmp(temp, temp2);
-          //
-          // However, the second read barrier may trash `temp`, as it
-          // is a temporary register, and as such would not be saved
-          // along with live registers before calling the runtime (nor
-          // restored afterwards).  So in this case, we bail out and
-          // delegate the work to the array set slow path.
-          //
-          // TODO: Extend the register allocator to support a new
-          // "(locally) live temp" location so as to avoid always
-          // going into the slow path when read barriers are enabled.
-          __ B(slow_path->GetEntryLabel());
+          if (!kUseBakerReadBarrier) {
+            // When (non-Baker) read barriers are enabled, the type
+            // checking instrumentation requires two read barriers
+            // generated by CodeGeneratorARM64::GenerateReadBarrierSlow:
+            //
+            //   __ Mov(temp2, temp);
+            //   // /* HeapReference<Class> */ temp = temp->component_type_
+            //   __ Ldr(temp, HeapOperand(temp, component_offset));
+            //   codegen_->GenerateReadBarrierSlow(
+            //       instruction, temp_loc, temp_loc, temp2_loc, component_offset);
+            //
+            //   // /* HeapReference<Class> */ temp2 = value->klass_
+            //   __ Ldr(temp2, HeapOperand(Register(value), class_offset));
+            //   codegen_->GenerateReadBarrierSlow(
+            //       instruction, temp2_loc, temp2_loc, value_loc, class_offset, temp_loc);
+            //
+            //   __ Cmp(temp, temp2);
+            //
+            // However, the second read barrier may trash `temp`, as it
+            // is a temporary register, and as such would not be saved
+            // along with live registers before calling the runtime (nor
+            // restored afterwards).  So in this case, we bail out and
+            // delegate the work to the array set slow path.
+            //
+            // TODO: Extend the register allocator to support a new
+            // "(locally) live temp" location so as to avoid always
+            // going into the slow path when read barriers are enabled?
+            //
+            // There is no such problem with Baker read barriers (see below).
+            __ B(slow_path->GetEntryLabel());
+          } else {
+            // Note that we cannot use `temps` (instance of VIXL's
+            // UseScratchRegisterScope) to allocate `temp2` because
+            // the Baker read barriers generated by
+            // GenerateFieldLoadWithBakerReadBarrier below also use
+            // that facility to allocate a temporary register, thus
+            // making VIXL's scratch register pool empty.
+            Location temp2_loc = locations->GetTemp(0);
+            Register temp2 = WRegisterFrom(temp2_loc);
+
+            // Note: Because it is acquired from VIXL's scratch register
+            // pool, `temp` might be IP0, and thus cannot be used as
+            // `ref` argument of GenerateFieldLoadWithBakerReadBarrier
+            // calls below (see ReadBarrierMarkSlowPathARM64 for more
+            // details).
+
+            // /* HeapReference<Class> */ temp2 = array->klass_
+            codegen_->GenerateFieldLoadWithBakerReadBarrier(instruction,
+                                                            temp2_loc,
+                                                            array,
+                                                            class_offset,
+                                                            temp,
+                                                            /* needs_null_check */ true,
+                                                            /* use_load_acquire */ false);
+
+            // /* HeapReference<Class> */ temp2 = temp2->component_type_
+            codegen_->GenerateFieldLoadWithBakerReadBarrier(instruction,
+                                                            temp2_loc,
+                                                            temp2,
+                                                            component_offset,
+                                                            temp,
+                                                            /* needs_null_check */ false,
+                                                            /* use_load_acquire */ false);
+            // For the same reason that we request `temp2` from the
+            // register allocator above, we cannot get `temp3` from
+            // VIXL's scratch register pool.
+            Location temp3_loc = locations->GetTemp(1);
+            Register temp3 = WRegisterFrom(temp3_loc);
+            // Register `temp2` is not trashed by the read barrier
+            // emitted by GenerateFieldLoadWithBakerReadBarrier below,
+            // as that method produces a call to a ReadBarrierMarkRegX
+            // entry point, which saves all potentially live registers,
+            // including temporaries such a `temp2`.
+            // /* HeapReference<Class> */ temp3 = register_value->klass_
+            codegen_->GenerateFieldLoadWithBakerReadBarrier(instruction,
+                                                            temp3_loc,
+                                                            value.W(),
+                                                            class_offset,
+                                                            temp,
+                                                            /* needs_null_check */ false,
+                                                            /* use_load_acquire */ false);
+            // If heap poisoning is enabled, `temp2` and `temp3` have
+            // been unpoisoned by the the previous calls to
+            // CodeGeneratorARM64::GenerateFieldLoadWithBakerReadBarrier.
+            __ Cmp(temp2, temp3);
+
+            if (instruction->StaticTypeOfArrayIsObjectArray()) {
+              vixl::aarch64::Label do_put;
+              __ B(eq, &do_put);
+              // We do not need to emit a read barrier for the
+              // following heap reference load, as `temp2` is only used
+              // in a comparison with null below, and this reference
+              // is not kept afterwards.
+              // /* HeapReference<Class> */ temp = temp2->super_class_
+              __ Ldr(temp, HeapOperand(temp2, super_offset));
+              // If heap poisoning is enabled, no need to unpoison
+              // `temp`, as we are comparing against null below.
+              __ Cbnz(temp, slow_path->GetEntryLabel());
+              __ Bind(&do_put);
+            } else {
+              __ B(ne, slow_path->GetEntryLabel());
+            }
+          }
         } else {
+          // Non read barrier code.
+
           Register temp2 = temps.AcquireSameSizeAs(array);
           // /* HeapReference<Class> */ temp = array->klass_
           __ Ldr(temp, HeapOperand(array, class_offset));
@@ -2304,6 +2388,7 @@
           // If heap poisoning is enabled, no need to unpoison `temp`
           // nor `temp2`, as we are comparing two poisoned references.
           __ Cmp(temp, temp2);
+          temps.Release(temp2);
 
           if (instruction->StaticTypeOfArrayIsObjectArray()) {
             vixl::aarch64::Label do_put;
@@ -2321,7 +2406,6 @@
           } else {
             __ B(ne, slow_path->GetEntryLabel());
           }
-          temps.Release(temp2);
         }
       }