[turbofan] Kill serialization environment on Throw bytecodes

Kill the environment when encountering Throw, Rethrow or Abort, because
the following code may be dead.

Also add support for the SwitchOnSmi bytecode.

Bug: v8:7790
Change-Id: Ia925aec854fea031be1df88a6a924e4b0d0406e9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1631602
Auto-Submit: Georg Neis <neis@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61904}

src/compiler/serializer-for-background-compilation.cc

@@ -447,21 +447,6 @@ void SerializerForBackgroundCompilation::TraverseBytecode() {
   }
 }
 
-void SerializerForBackgroundCompilation::VisitIllegal(
-    BytecodeArrayIterator* iterator) {
-  UNREACHABLE();
-}
-
-void SerializerForBackgroundCompilation::VisitWide(
-    BytecodeArrayIterator* iterator) {
-  UNREACHABLE();
-}
-
-void SerializerForBackgroundCompilation::VisitExtraWide(
-    BytecodeArrayIterator* iterator) {
-  UNREACHABLE();
-}
-
 void SerializerForBackgroundCompilation::VisitGetSuperConstructor(
     BytecodeArrayIterator* iterator) {
   interpreter::Register dst = iterator->GetRegisterOperand(0);
@@ -813,6 +798,17 @@ void SerializerForBackgroundCompilation::VisitReturn(
   environment()->ClearEphemeralHints();
 }
 
+void SerializerForBackgroundCompilation::VisitSwitchOnSmiNoFeedback(
+    interpreter::BytecodeArrayIterator* iterator) {
+  interpreter::JumpTableTargetOffsets targets =
+      iterator->GetJumpTableTargetOffsets();
+  for (const auto& target : targets) {
+    // TODO(neis): Here and in ProcessJump, don't overwrite stashed environment.
+    stashed_environments_[target.target_offset] =
+        new (zone()) Environment(*environment());
+  }
+}
+
 void SerializerForBackgroundCompilation::Environment::ExportRegisterHints(
     interpreter::Register first, size_t count, HintsVector& dst) {
   dst.resize(dst.size() + count, Hints(zone()));
@@ -1176,6 +1172,22 @@ UNCONDITIONAL_JUMPS_LIST(DEFINE_UNCONDITIONAL_JUMP)
 IGNORED_BYTECODE_LIST(DEFINE_IGNORE)
 #undef DEFINE_IGNORE
 
+#define DEFINE_UNREACHABLE(name, ...)                   \
+  void SerializerForBackgroundCompilation::Visit##name( \
+      BytecodeArrayIterator* iterator) {                \
+    UNREACHABLE();                                      \
+  }
+UNREACHABLE_BYTECODE_LIST(DEFINE_UNREACHABLE)
+#undef DEFINE_UNREACHABLE
+
+#define DEFINE_KILL(name, ...)                          \
+  void SerializerForBackgroundCompilation::Visit##name( \
+      BytecodeArrayIterator* iterator) {                \
+    environment()->Kill();                              \
+  }
+KILL_ENVIRONMENT_LIST(DEFINE_KILL)
+#undef DEFINE_KILL
+
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8

src/compiler/serializer-for-background-compilation.h

@@ -31,7 +31,6 @@ class Zone;
 namespace compiler {
 
 #define CLEAR_ENVIRONMENT_LIST(V) \
-  V(Abort)                        \
   V(CallRuntime)                  \
   V(CallRuntimeForPair)           \
   V(CreateBlockContext)           \
@@ -41,11 +40,14 @@ namespace compiler {
   V(PopContext)                   \
   V(PushContext)                  \
   V(ResumeGenerator)              \
-  V(ReThrow)                      \
   V(StaContextSlot)               \
   V(StaCurrentContextSlot)        \
   V(SuspendGenerator)             \
-  V(SwitchOnGeneratorState)       \
+  V(SwitchOnGeneratorState)
+
+#define KILL_ENVIRONMENT_LIST(V) \
+  V(Abort)                       \
+  V(ReThrow)                     \
   V(Throw)
 
 #define CLEAR_ACCUMULATOR_LIST(V)   \
@@ -152,6 +154,11 @@ namespace compiler {
   V(ThrowSuperAlreadyCalledIfNotHole) \
   V(ThrowSuperNotCalledIfHole)
 
+#define UNREACHABLE_BYTECODE_LIST(V) \
+  V(ExtraWide)                       \
+  V(Illegal)                         \
+  V(Wide)
+
 #define SUPPORTED_BYTECODE_LIST(V)   \
   V(CallAnyReceiver)                 \
   V(CallProperty)                    \
@@ -166,9 +173,7 @@ namespace compiler {
   V(Construct)                       \
   V(ConstructWithSpread)             \
   V(CreateClosure)                   \
-  V(ExtraWide)                       \
   V(GetSuperConstructor)             \
-  V(Illegal)                         \
   V(LdaConstant)                     \
   V(LdaFalse)                        \
   V(LdaGlobal)                       \
@@ -192,13 +197,15 @@ namespace compiler {
   V(StaNamedOwnProperty)             \
   V(StaNamedProperty)                \
   V(Star)                            \
+  V(SwitchOnSmiNoFeedback)           \
   V(TestIn)                          \
-  V(Wide)                            \
-  CLEAR_ENVIRONMENT_LIST(V)          \
   CLEAR_ACCUMULATOR_LIST(V)          \
+  CLEAR_ENVIRONMENT_LIST(V)          \
   CONDITIONAL_JUMPS_LIST(V)          \
+  IGNORED_BYTECODE_LIST(V)           \
+  KILL_ENVIRONMENT_LIST(V)           \
   UNCONDITIONAL_JUMPS_LIST(V)        \
-  IGNORED_BYTECODE_LIST(V)
+  UNREACHABLE_BYTECODE_LIST(V)
 
 class JSHeapBroker;