Set bytecode budget to interrupt_budget when allocating feedback vector

We use the same interrupt to both allocate feedback vectors and
for updating the profiler ticks. If there is a feedback vector already
available, we just increment the profiler ticks that we use to mark
for optimizing function. Calling JSFunction::EnsureFeedbackVector
allocates a feedback vector, but doesn't reset the budget, so we
optimize much earlier than expected. This is currently only a problem
with %PrepareFunctionForOptimize that doesn't reset the budget. Other
code paths do also reset the interrupt budget.

Bug: chromium:10243
Change-Id: I611a9202e5e71077bf897def5959bcfe11b8fdf4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2064980
Commit-Queue: Mythri Alle <mythria@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66426}

src/heap/factory.cc

@@ -1343,7 +1343,7 @@ Handle<FeedbackCell> Factory::NewNoClosuresCell(Handle<HeapObject> value) {
                                  AllocationType::kOld, *no_closures_cell_map());
   Handle<FeedbackCell> cell(FeedbackCell::cast(result), isolate());
   cell->set_value(*value);
-  cell->set_interrupt_budget(FeedbackCell::GetInitialInterruptBudget());
+  cell->SetInitialInterruptBudget();
   cell->clear_padding();
   return cell;
 }
@@ -1354,7 +1354,7 @@ Handle<FeedbackCell> Factory::NewOneClosureCell(Handle<HeapObject> value) {
                                  AllocationType::kOld, *one_closure_cell_map());
   Handle<FeedbackCell> cell(FeedbackCell::cast(result), isolate());
   cell->set_value(*value);
-  cell->set_interrupt_budget(FeedbackCell::GetInitialInterruptBudget());
+  cell->SetInitialInterruptBudget();
   cell->clear_padding();
   return cell;
 }
@@ -1365,7 +1365,7 @@ Handle<FeedbackCell> Factory::NewManyClosuresCell(Handle<HeapObject> value) {
                                                  *many_closures_cell_map());
   Handle<FeedbackCell> cell(FeedbackCell::cast(result), isolate());
   cell->set_value(*value);
-  cell->set_interrupt_budget(FeedbackCell::GetInitialInterruptBudget());
+  cell->SetInitialInterruptBudget();
   cell->clear_padding();
   return cell;
 }

src/interpreter/interpreter.cc

@@ -104,10 +104,6 @@ size_t Interpreter::GetDispatchTableIndex(Bytecode bytecode,
                      kEntriesPerOperandScale;
 }
 
-int Interpreter::InterruptBudget() {
-  return FLAG_interrupt_budget;
-}
-
 namespace {
 
 void MaybePrintAst(ParseInfo* parse_info,

src/interpreter/interpreter.h

@@ -38,9 +38,6 @@ class Interpreter {
   explicit Interpreter(Isolate* isolate);
   virtual ~Interpreter() = default;
 
-  // Returns the interrupt budget which should be used for the profiler counter.
-  V8_EXPORT_PRIVATE static int InterruptBudget();
-
   // Creates a compilation job which will generate bytecode for |literal|.
   // Additionally, if |eager_inner_literals| is not null, adds any eagerly
   // compilable inner FunctionLiterals to this list.

src/objects/feedback-cell-inl.h

@@ -30,7 +30,7 @@ void FeedbackCell::reset_feedback_vector(
     base::Optional<std::function<void(HeapObject object, ObjectSlot slot,
                                       HeapObject target)>>
         gc_notify_updated_slot) {
-  set_interrupt_budget(FeedbackCell::GetInitialInterruptBudget());
+  SetInitialInterruptBudget();
   if (value().IsUndefined() || value().IsClosureFeedbackCellArray()) return;
 
   CHECK(value().IsFeedbackVector());
@@ -43,6 +43,18 @@ void FeedbackCell::reset_feedback_vector(
   }
 }
 
+void FeedbackCell::SetInitialInterruptBudget() {
+  if (FLAG_lazy_feedback_allocation) {
+    set_interrupt_budget(FLAG_budget_for_feedback_vector_allocation);
+  } else {
+    set_interrupt_budget(FLAG_interrupt_budget);
+  }
+}
+
+void FeedbackCell::SetInterruptBudget() {
+  set_interrupt_budget(FLAG_interrupt_budget);
+}
+
 }  // namespace internal
 }  // namespace v8
 

src/objects/feedback-cell.h

@@ -20,13 +20,6 @@ namespace internal {
 // a native context.
 class FeedbackCell : public TorqueGeneratedFeedbackCell<FeedbackCell, Struct> {
  public:
-  static int GetInitialInterruptBudget() {
-    if (FLAG_lazy_feedback_allocation) {
-      return FLAG_budget_for_feedback_vector_allocation;
-    }
-    return FLAG_interrupt_budget;
-  }
-
   // Dispatched behavior.
   DECL_PRINTER(FeedbackCell)
 
@@ -38,6 +31,8 @@ class FeedbackCell : public TorqueGeneratedFeedbackCell<FeedbackCell, Struct> {
       base::Optional<std::function<void(HeapObject object, ObjectSlot slot,
                                         HeapObject target)>>
           gc_notify_updated_slot = base::nullopt);
+  inline void SetInitialInterruptBudget();
+  inline void SetInterruptBudget();
 
   using BodyDescriptor =
       FixedBodyDescriptor<kValueOffset, kInterruptBudgetOffset, kAlignedSize>;

src/objects/js-objects.cc

@@ -5039,6 +5039,7 @@ void JSFunction::EnsureFeedbackVector(Handle<JSFunction> function) {
   DCHECK(function->raw_feedback_cell() !=
          isolate->heap()->many_closures_cell());
   function->raw_feedback_cell().set_value(*feedback_vector);
+  function->raw_feedback_cell().SetInterruptBudget();
 }
 
 // static

src/snapshot/partial-serializer.cc

@@ -103,8 +103,7 @@ void PartialSerializer::SerializeObject(HeapObject obj) {
 
   // Clear InterruptBudget when serializing FeedbackCell.
   if (obj.IsFeedbackCell()) {
-    FeedbackCell::cast(obj).set_interrupt_budget(
-        FeedbackCell::GetInitialInterruptBudget());
+    FeedbackCell::cast(obj).SetInitialInterruptBudget();
   }
 
   if (SerializeJSObjectWithEmbedderFields(obj)) {

test/mjsunit/mjsunit.status

@@ -1134,6 +1134,9 @@
   'compiler/opt-higher-order-functions': [SKIP],
   'regress/regress-1049982-1': [SKIP],
   'regress/regress-1049982-2': [SKIP],
+
+  # interrupt_budget overrides don't work with TurboProp.
+  'interrupt-budget-override': [SKIP],
 }],  # variant == turboprop
 
 ##############################################################################