[compiler] limit load elimination to avoid quadratic complexity

Bug: v8:13247
Change-Id: I8fd1fe179accc0ca37d32b737a5cfac2a736e1a2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3865553
Auto-Submit: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82898}

src/compiler/load-elimination.cc

@@ -383,8 +383,12 @@ LoadElimination::AbstractMaps const* LoadElimination::AbstractMaps::Merge(
 
 LoadElimination::AbstractMaps const* LoadElimination::AbstractMaps::Extend(
     Node* object, ZoneHandleSet<Map> maps, Zone* zone) const {
-  AbstractMaps* that = zone->New<AbstractMaps>(zone);
-  that->info_for_node_ = this->info_for_node_;
+  AbstractMaps* that = zone->New<AbstractMaps>(*this);
+  if (that->info_for_node_.size() >= kMaxTrackedObjects) {
+    // We are tracking too many objects, which leads to bad performance.
+    // Delete one to avoid the map from becoming bigger.
+    that->info_for_node_.erase(that->info_for_node_.begin());
+  }
   object = ResolveRenames(object);
   that->info_for_node_[object] = maps;
   return that;

src/compiler/load-elimination.h

@@ -136,8 +136,12 @@ class V8_EXPORT_PRIVATE LoadElimination final
 
     AbstractField const* Extend(Node* object, FieldInfo info,
                                 Zone* zone) const {
-      AbstractField* that = zone->New<AbstractField>(zone);
-      that->info_for_node_ = this->info_for_node_;
+      AbstractField* that = zone->New<AbstractField>(*this);
+      if (that->info_for_node_.size() >= kMaxTrackedObjects) {
+        // We are tracking too many objects, which leads to bad performance.
+        // Delete one to avoid the map from becoming bigger.
+        that->info_for_node_.erase(that->info_for_node_.begin());
+      }
       that->info_for_node_[object] = info;
       return that;
     }
@@ -171,6 +175,7 @@ class V8_EXPORT_PRIVATE LoadElimination final
   };
 
   static size_t const kMaxTrackedFields = 32;
+  static size_t const kMaxTrackedObjects = 100;
 
   // Abstract state to approximate the current map of an object along the
   // effect paths through the graph.