[ic] Various cleanups to the IC class.

This includes a bunch of individual changes:

 - Refactor IC::OnFeedbackChanged() and remove the now unused
   GetHostFunction().
 - Remove constant_pool, pc and fp from the IC, since it was
   only used for --trace-ic by now, and here we can now use the
   JavaScriptFrameIterator instead.
 - Use FLAG_max_polymorphic_map_count consistently instead of having a
   separate kMaxKeyedPolymorphism constant in some cases.
 - Remove dead IC::TraceHandlerCacheHitStats() method.
 - Remove the unused maybe_handler_ field.

Bug: v8:9183
Change-Id: I29680519ab84b2790c73f50fca966a66918a7e31
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1649567
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Auto-Submit: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62083}

src/ic/ic-inl.h

@@ -16,23 +16,6 @@
 namespace v8 {
 namespace internal {
 
-Address IC::constant_pool() const {
-  if (FLAG_enable_embedded_constant_pool) {
-    return raw_constant_pool();
-  } else {
-    return kNullAddress;
-  }
-}
-
-
-Address IC::raw_constant_pool() const {
-  if (FLAG_enable_embedded_constant_pool) {
-    return *constant_pool_address_;
-  } else {
-    return kNullAddress;
-  }
-}
-
 void IC::update_receiver_map(Handle<Object> receiver) {
   if (receiver->IsSmi()) {
     receiver_map_ = isolate_->factory()->heap_number_map();
@@ -50,13 +33,6 @@ bool IC::IsHandler(MaybeObject object) {
           (heap_object.IsDataHandler() || heap_object.IsCode()));
 }
 
-bool IC::HostIsDeoptimizedCode() const {
-  Code host =
-      isolate()->inner_pointer_to_code_cache()->GetCacheEntry(pc())->code;
-  return (host.kind() == Code::OPTIMIZED_FUNCTION &&
-          host.marked_for_deoptimization());
-}
-
 bool IC::vector_needs_update() {
   if (state() == NO_FEEDBACK) return false;
   return (!vector_set_ &&

src/ic/ic.h

@@ -29,8 +29,6 @@ class IC {
   // Alias the inline cache state type to make the IC code more readable.
   using State = InlineCacheState;
 
-  static constexpr int kMaxKeyedPolymorphism = 4;
-
   // Construct the IC structure with the given number of extra
   // JavaScript frames on the stack.
   IC(Isolate* isolate, Handle<FeedbackVector> vector, FeedbackSlot slot,
@@ -62,25 +60,15 @@ class IC {
 
   // Nofity the IC system that a feedback has changed.
   static void OnFeedbackChanged(Isolate* isolate, FeedbackVector vector,
-                                FeedbackSlot slot, JSFunction host_function,
-                                const char* reason);
+                                FeedbackSlot slot, const char* reason);
 
-  static void OnFeedbackChanged(Isolate* isolate, FeedbackNexus* nexus,
-                                JSFunction host_function, const char* reason);
+  void OnFeedbackChanged(const char* reason);
 
  protected:
-  Address fp() const { return fp_; }
-  Address pc() const { return *pc_address_; }
-
   void set_slow_stub_reason(const char* reason) { slow_stub_reason_ = reason; }
 
   Isolate* isolate() const { return isolate_; }
 
-  // Get the caller function object.
-  JSFunction GetHostFunction() const;
-
-  inline bool HostIsDeoptimizedCode() const;
-
   bool is_vector_set() { return vector_set_; }
   inline bool vector_needs_update();
 
@@ -106,8 +94,6 @@ class IC {
                                 Handle<Object> key);
   MaybeHandle<Object> ReferenceError(Handle<Name> name);
 
-  void TraceHandlerCacheHitStats(LookupIterator* lookup);
-
   void UpdateMonomorphicIC(const MaybeObjectHandle& handler, Handle<Name> name);
   bool UpdatePolymorphicIC(Handle<Name> name, const MaybeObjectHandle& handler);
   void UpdateMegamorphicCache(Handle<Map> map, Handle<Name> name,
@@ -158,28 +144,12 @@ class IC {
   FeedbackNexus* nexus() { return &nexus_; }
 
  private:
-  inline Address constant_pool() const;
-  inline Address raw_constant_pool() const;
-
   void FindTargetMaps() {
     if (target_maps_set_) return;
     target_maps_set_ = true;
     nexus()->ExtractMaps(&target_maps_);
   }
 
-  // Frame pointer for the frame that uses (calls) the IC.
-  Address fp_;
-
-  // All access to the program counter and constant pool of an IC structure is
-  // indirect to make the code GC safe. This feature is crucial since
-  // GetProperty and SetProperty are called and they in turn might
-  // invoke the garbage collector.
-  Address* pc_address_;
-
-  // The constant pool of the code which originally called the IC (which might
-  // be for the breakpointed copy of the original code).
-  Address* constant_pool_address_;
-
   Isolate* isolate_;
 
   bool vector_set_;
@@ -187,7 +157,6 @@ class IC {
   State state_;
   FeedbackSlotKind kind_;
   Handle<Map> receiver_map_;
-  MaybeObjectHandle maybe_handler_;
 
   MapHandles target_maps_;
   bool target_maps_set_;

src/objects/js-objects.cc

@@ -5530,7 +5530,7 @@ void JSFunction::ClearTypeFeedbackInfo() {
     FeedbackVector vector = feedback_vector();
     Isolate* isolate = GetIsolate();
     if (vector.ClearSlots(isolate)) {
-      IC::OnFeedbackChanged(isolate, vector, FeedbackSlot::Invalid(), *this,
+      IC::OnFeedbackChanged(isolate, vector, FeedbackSlot::Invalid(),
                             "ClearTypeFeedbackInfo");
     }
   }