[turboprop] Handle MinimorphicPropertyAccess in ShouldUseMegamorphic

It is possible that we fallback to GenericLowering for minimorphic
property accesses. So handle MinimorphicPropertyAccess in
ShouldUseMegamorphicLoadBuiltin.

Bug: chromium:1223733
Change-Id: Ia1ba8c8786be91dda841d4138cffe81185c066b0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2997104
Commit-Queue: Mythri Alle <mythria@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75505}

src/compiler/js-generic-lowering.cc

@@ -255,6 +255,11 @@ bool ShouldUseMegamorphicLoadBuiltin(FeedbackSource const& source,
     return feedback.AsNamedAccess().maps().empty();
   } else if (feedback.kind() == ProcessedFeedback::kInsufficient) {
     return false;
+  } else if (feedback.kind() == ProcessedFeedback::kMinimorphicPropertyAccess) {
+    // MinimorphicPropertyAccess is used for dynamic map checks and the IC state
+    // is either monomorphic or polymorphic. So it will still benefit from
+    // collecting feedback, so don't use megamorphic builtin.
+    return false;
   }
   UNREACHABLE();
 }

test/mjsunit/regress/regress-1223733.js

+// Copyright 2021 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turboprop --turbo-dynamic-map-checks
+
+function main() {
+  // Store something onto a function prototype so we will bailout of the
+  // function.prototype load optimization in NativeContextSpecialization.
+  isNaN.prototype = 14;
+  const v14 = isNaN.prototype;
+}
+%PrepareFunctionForOptimization(main);
+main();
+%OptimizeFunctionOnNextCall(main);
+main();