[maglev] Allow property cell caching to fail

This can happen in concurrent compilation, we should fall back to
generic LoadGlobal when it's the case.

Drive-by refactor the property cell load builder to return false on
failure.

Bug: v8:7700
Change-Id: Iad3fc4bc794e4ec8c4061f2dce1561c15593e215
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3706616Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81183}

src/maglev/maglev-graph-builder.cc

@@ -598,19 +598,23 @@ MAGLEV_UNIMPLEMENTED_BYTECODE(TestNull)
 MAGLEV_UNIMPLEMENTED_BYTECODE(TestUndefined)
 MAGLEV_UNIMPLEMENTED_BYTECODE(TestTypeOf)
 
-void MaglevGraphBuilder::BuildPropertyCellAccess(
-    const compiler::PropertyCellRef& property_cell) {
+bool MaglevGraphBuilder::TryBuildPropertyCellAccess(
+    const compiler::GlobalAccessFeedback& global_access_feedback) {
   // TODO(leszeks): A bunch of this is copied from
   // js-native-context-specialization.cc -- I wonder if we can unify it
   // somehow.
-  bool was_cached = property_cell.Cache();
-  CHECK(was_cached);
+
+  if (!global_access_feedback.IsPropertyCell()) return false;
+  compiler::PropertyCellRef property_cell =
+      global_access_feedback.property_cell();
+
+  if (!property_cell.Cache()) return false;
 
   compiler::ObjectRef property_cell_value = property_cell.value();
   if (property_cell_value.IsTheHole()) {
     // The property cell is no longer valid.
     EmitUnconditionalDeopt();
-    return;
+    return true;
   }
 
   PropertyDetails property_details = property_cell.property_details();
@@ -619,7 +623,7 @@ void MaglevGraphBuilder::BuildPropertyCellAccess(
 
   if (!property_details.IsConfigurable() && property_details.IsReadOnly()) {
     SetAccumulator(GetConstant(property_cell_value));
-    return;
+    return true;
   }
 
   // Record a code dependency on the cell if we can benefit from the
@@ -634,13 +638,14 @@ void MaglevGraphBuilder::BuildPropertyCellAccess(
   if (property_cell_type == PropertyCellType::kConstant ||
       property_cell_type == PropertyCellType::kUndefined) {
     SetAccumulator(GetConstant(property_cell_value));
-    return;
+    return true;
   }
 
   ValueNode* property_cell_node =
       AddNewNode<Constant>({}, property_cell.AsHeapObject());
   SetAccumulator(AddNewNode<LoadTaggedField>({property_cell_node},
                                              PropertyCell::kValueOffset));
+  return true;
 }
 
 void MaglevGraphBuilder::VisitLdaGlobal() {
@@ -664,14 +669,12 @@ void MaglevGraphBuilder::VisitLdaGlobal() {
   const compiler::GlobalAccessFeedback& global_access_feedback =
       access_feedback.AsGlobalAccess();
 
-  if (global_access_feedback.IsPropertyCell()) {
-    BuildPropertyCellAccess(global_access_feedback.property_cell());
-  } else {
-    // TODO(leszeks): Handle the IsScriptContextSlot case.
+  if (TryBuildPropertyCellAccess(global_access_feedback)) return;
 
-    ValueNode* context = GetContext();
-    SetAccumulator(AddNewNode<LoadGlobal>({context}, name, feedback_source));
-  }
+  // TODO(leszeks): Handle the IsScriptContextSlot case.
+
+  ValueNode* context = GetContext();
+  SetAccumulator(AddNewNode<LoadGlobal>({context}, name, feedback_source));
 }
 MAGLEV_UNIMPLEMENTED_BYTECODE(LdaGlobalInsideTypeof)
 MAGLEV_UNIMPLEMENTED_BYTECODE(StaGlobal)

src/maglev/maglev-graph-builder.h

@@ -561,7 +561,8 @@ class MaglevGraphBuilder {
   void BuildCallFromRegisters(int argc_count,
                               ConvertReceiverMode receiver_mode);
 
-  void BuildPropertyCellAccess(const compiler::PropertyCellRef& property_cell);
+  bool TryBuildPropertyCellAccess(
+      const compiler::GlobalAccessFeedback& global_access_feedback);
 
   bool TryBuildMonomorphicLoad(ValueNode* object, const compiler::MapRef& map,
                                MaybeObjectHandle handler);