[osr] Remove the --function-context-specialization flag

This flag was a leftover from very early Turbofan days and serves no
purpose. Non-OSR TF code automatically uses function context
specialization (FCS) when appropriate without looking at the flag
value. OSR TF code should never use FCS since it is cached by the
SharedFunctionInfo (not by the JSFunction).

Bug: v8:12161
Change-Id: Ifb5a10918dbdf34a7164f7e665a230698b793e9e
Fixed: chromium:1313419
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3571895
Auto-Submit: Jakob Linke <jgruber@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Jakob Linke <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79802}

src/codegen/compiler.cc

@@ -943,6 +943,7 @@ class OptimizedCodeCache : public AllStatic {
 
     if (IsOSR(osr_offset)) {
       DCHECK(CodeKindCanOSR(kind));
+      DCHECK(!compilation_info->function_context_specializing());
       Handle<SharedFunctionInfo> shared(function->shared(), isolate);
       Handle<NativeContext> native_context(function->native_context(), isolate);
       OSROptimizedCodeCache::Insert(isolate, native_context, shared, code,

src/codegen/optimized-compilation-info.cc

@@ -73,9 +73,6 @@ void OptimizedCompilationInfo::ConfigureFlags() {
       if (FLAG_analyze_environment_liveness) {
         set_analyze_environment_liveness();
       }
-      if (FLAG_function_context_specialization) {
-        set_function_context_specializing();
-      }
       if (FLAG_turbo_splitting) set_splitting();
       break;
     case CodeKind::BYTECODE_HANDLER:

src/flags/flag-definitions.h

@@ -849,8 +849,6 @@ DEFINE_BOOL(turbo_stats_nvp, false,
 DEFINE_BOOL(turbo_stats_wasm, false,
             "print TurboFan statistics of wasm compilations")
 DEFINE_BOOL(turbo_splitting, true, "split nodes during scheduling in TurboFan")
-DEFINE_BOOL(function_context_specialization, false,
-            "enable function context specialization in TurboFan")
 DEFINE_BOOL(turbo_inlining, true, "enable inlining in TurboFan")
 DEFINE_INT(max_inlined_bytecode_size, 460,
            "maximum size of bytecode for a single inlining")

src/runtime/runtime-compiler.cc

@@ -251,11 +251,12 @@ RUNTIME_FUNCTION(Runtime_CompileOptimizedOSR) {
           ? ConcurrencyMode::kConcurrent
           : ConcurrencyMode::kSynchronous;
 
+  Handle<JSFunction> function(frame->function(), isolate);
+  if (IsConcurrent(mode)) {
     // The synchronous fallback mechanism triggers if we've already got OSR'd
     // code for the current function but at a different OSR offset - that may
     // indicate we're having trouble hitting the correct JumpLoop for code
     // installation. In this case, fall back to synchronous OSR.
-  Handle<JSFunction> function(frame->function(), isolate);
     base::Optional<BytecodeOffset> cached_osr_offset =
         function->native_context().osr_code_cache().FirstOsrOffsetFor(
             function->shared());
@@ -263,7 +264,8 @@ RUNTIME_FUNCTION(Runtime_CompileOptimizedOSR) {
         cached_osr_offset.value() != osr_offset) {
       if (V8_UNLIKELY(FLAG_trace_osr)) {
         CodeTracer::Scope scope(isolate->GetCodeTracer());
-      PrintF(scope.file(),
+        PrintF(
+            scope.file(),
             "[OSR - falling back to synchronous compilation due to mismatched "
             "cached entry. function: %s, requested: %d, cached: %d]\n",
             function->DebugNameCStr().get(), osr_offset.ToInt(),
@@ -271,6 +273,7 @@ RUNTIME_FUNCTION(Runtime_CompileOptimizedOSR) {
       }
       mode = ConcurrencyMode::kSynchronous;
     }
+  }
 
   Handle<CodeT> result;
   if (!Compiler::CompileOptimizedOSR(isolate, function, osr_offset, frame, mode)

test/mjsunit/regress/regress-1313419.js

+// Copyright 2022 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --interrupt-budget=100 --function-context-specialization
+
+function __f_0() {
+  return function __f_1() {
+    __v_0.p = 42;
+    for (let __v_2 = 0; __v_2 < 100; __v_2++) {
+      try { this.p(); } catch (e) {}
+    }
+    this.p = __v_0;
+  };
+}
+var __v_0 = __f_0();
+var __v_1 = __f_0();
+__v_1.prototype = {
+  p() {
+    this.q = new __v_0();
+    for (let __v_3 = 0; __v_3 < 200; __v_3++);
+  }
+};
+__v_0.prototype = {
+  p() {}
+};
+new __v_1();