[turbofan] Mark builtin stub frames as deoptimized again

For eager deopts within builtin stub frames we skiped marking the
underlying function as deoptimized. This avoided deopt loops where
we would just generate the same optimized code all over again.

Bug: v8:6898
Change-Id: Ie3d7ee4dfcbeb63e6087112d5740a423c4730599
Reviewed-on: https://chromium-review.googlesource.com/822491Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50066}

src/deoptimizer.cc

@@ -383,7 +383,6 @@ Deoptimizer::Deoptimizer(Isolate* isolate, JSFunction* function,
       function_(function),
       bailout_id_(bailout_id),
       bailout_type_(type),
-      preserve_optimized_(false),
       from_(from),
       fp_to_sp_delta_(fp_to_sp_delta),
       deoptimizing_throw_(false),
@@ -1624,13 +1623,6 @@ void Deoptimizer::DoComputeBuiltinContinuation(
     output_frame->SetRegister(context_reg.code(), context_value);
   }
 
-  // TODO(6898): For eager deopts within builtin stub frames we currently skip
-  // marking the underlying function as deoptimized. This is to avoid deopt
-  // loops where we would just generate the same optimized code all over again.
-  if (is_topmost && bailout_type_ != LAZY) {
-    preserve_optimized_ = true;
-  }
-
   // Ensure the frame pointer register points to the callee's frame. The builtin
   // will build its own frame once we continue to it.
   Register fp_reg = JavaScriptFrame::fp_register();

src/deoptimizer.h

@@ -426,7 +426,6 @@ class Deoptimizer : public Malloced {
   Handle<JSFunction> function() const;
   Handle<Code> compiled_code() const;
   BailoutType bailout_type() const { return bailout_type_; }
-  bool preserve_optimized() const { return preserve_optimized_; }
 
   // Number of created JS frames. Not all created frames are necessarily JS.
   int jsframe_count() const { return jsframe_count_; }
@@ -577,7 +576,6 @@ class Deoptimizer : public Malloced {
   Code* compiled_code_;
   unsigned bailout_id_;
   BailoutType bailout_type_;
-  bool preserve_optimized_;
   Address from_;
   int fp_to_sp_delta_;
   bool deoptimizing_throw_;

src/runtime/runtime-compiler.cc

@@ -159,7 +159,6 @@ RUNTIME_FUNCTION(Runtime_NotifyDeoptimized) {
   TRACE_EVENT0("v8", "V8.DeoptimizeCode");
   Handle<JSFunction> function = deoptimizer->function();
   Deoptimizer::BailoutType type = deoptimizer->bailout_type();
-  bool preserve_optimized_code = deoptimizer->preserve_optimized();
 
   // TODO(turbofan): We currently need the native context to materialize
   // the arguments object, but only to get to its map.
@@ -175,7 +174,7 @@ RUNTIME_FUNCTION(Runtime_NotifyDeoptimized) {
   isolate->set_context(Context::cast(top_frame->context()));
 
   // Invalidate the underlying optimized code on non-lazy deopts.
-  if (type != Deoptimizer::LAZY && !preserve_optimized_code) {
+  if (type != Deoptimizer::LAZY) {
     Deoptimizer::DeoptimizeFunction(*function);
   }