[turbofan] Reland^3 "Polymorphic inlining - try merge map check dispatch with...

[turbofan] Reland^3 "Polymorphic inlining - try merge map check dispatch with function call dispatch."

This reverts commit ae28e0cf.

Bug: chromium:758096
Change-Id: I6541bd1ba46cd5dfb942ed3f3d382e047fb1f3e6
Reviewed-on: https://chromium-review.googlesource.com/657401Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47934}

src/compiler/js-inlining-heuristic.h

@@ -64,6 +64,17 @@ class JSInliningHeuristic final : public AdvancedReducer {
   // Dumps candidates to console.
   void PrintCandidates();
   Reduction InlineCandidate(Candidate const& candidate, bool force_inline);
+  void CreateOrReuseDispatch(Node* node, Node* callee,
+                             Candidate const& candidate, Node** if_successes,
+                             Node** calls, Node** inputs, int input_count);
+  bool TryReuseDispatch(Node* node, Node* callee, Candidate const& candidate,
+                        Node** if_successes, Node** calls, Node** inputs,
+                        int input_count);
+  enum StateCloneMode { kCloneState, kChangeInPlace };
+  Node* DuplicateFrameStateAndRename(Node* frame_state, Node* from, Node* to,
+                                     StateCloneMode mode);
+  Node* DuplicateStateValuesAndRename(Node* state_values, Node* from, Node* to,
+                                      StateCloneMode mode);
 
   CommonOperatorBuilder* common() const;
   Graph* graph() const;

test/mjsunit/compiler/regress-758096.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function() {
+  var x = 1;
+  x.__proto__.f = function() { return 1; }
+
+  function g() {}
+  g.prototype.f =  function() { return 3; };
+  var y = new g();
+
+  function f(obj) {
+    return obj.f();
+  }
+
+  f(x);
+  f(y);
+  f(x);
+  f(y);
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals(1, f(x));
+  assertEquals(3, f(y));
+})();
+
+(function() {
+  function f() { return 1; }
+  function g() { return 2; }
+
+  var global;
+
+  function h(s) {
+    var fg;
+    var a = 0;
+    if (s) {
+      global = 0;
+      a = 1;
+      fg = f;
+    } else {
+      global = 1
+      fg = g;
+    }
+    return fg() + a;
+  }
+
+  h(0);
+  h(0);
+  h(1);
+  h(1);
+  %OptimizeFunctionOnNextCall(h);
+  assertEquals(2, h(0));
+})();