Revert "[turbofan] Handle mixed packed/unpacked multimaps in Array.prototype.push"

This reverts commit ae14edca.

Reason for revert: Test fails with gc stress:
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20GC%20Stress%20-%20custom%20snapshot/builds/17067

Original change's description:
> [turbofan] Handle mixed packed/unpacked multimaps in Array.prototype.push
> 
> Bug: v8:7127, v8:7204, v8:7205
> Change-Id: I4eb009492222b208ff8875b4b7940174dfb132ff
> Reviewed-on: https://chromium-review.googlesource.com/847576
> Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
> Reviewed-by: Michael Stanton <mvstanton@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#50451}

TBR=mvstanton@chromium.org,sigurds@chromium.org

Change-Id: Ic1dac13e59565d2f0f2a4265c24f6532973f630a
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7127, v8:7204, v8:7205
Reviewed-on: https://chromium-review.googlesource.com/857636Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50455}

src/compiler/js-call-reducer.cc

@@ -3612,12 +3612,11 @@ Reduction JSCallReducer::ReduceArrayPrototypePush(Node* node) {
   if (result == NodeProperties::kNoReceiverMaps) return NoChange();
   DCHECK_NE(0, receiver_maps.size());
 
-  ElementsKind kind = receiver_maps[0]->elements_kind();
+  const ElementsKind kind = receiver_maps[0]->elements_kind();
 
   for (Handle<Map> receiver_map : receiver_maps) {
     if (!CanInlineArrayResizeOperation(receiver_map)) return NoChange();
-    if (!UnionElementsKindUptoPackedness(&kind, receiver_map->elements_kind()))
-      return NoChange();
+    if (receiver_map->elements_kind() != kind) return NoChange();
   }
 
   // Install code dependencies on the {receiver} global array protector cell.

src/elements-kind.h

@@ -191,43 +191,6 @@ inline ElementsKind GetHoleyElementsKind(ElementsKind packed_kind) {
   return packed_kind;
 }
 
-inline bool UnionElementsKindUptoPackedness(ElementsKind* a_out,
-                                            ElementsKind b) {
-  // Assert that the union of two ElementKinds can be computed via std::max.
-  static_assert(PACKED_SMI_ELEMENTS < HOLEY_SMI_ELEMENTS,
-                "ElementsKind union not computable via std::max.");
-  static_assert(PACKED_ELEMENTS < HOLEY_ELEMENTS,
-                "ElementsKind union not computable via std::max.");
-  static_assert(PACKED_DOUBLE_ELEMENTS < HOLEY_DOUBLE_ELEMENTS,
-                "ElementsKind union not computable via std::max.");
-  ElementsKind a = *a_out;
-  switch (a) {
-    case HOLEY_SMI_ELEMENTS:
-    case PACKED_SMI_ELEMENTS:
-      if (b == PACKED_SMI_ELEMENTS || b == HOLEY_SMI_ELEMENTS) {
-        *a_out = std::max(a, b);
-        return true;
-      }
-      break;
-    case PACKED_ELEMENTS:
-    case HOLEY_ELEMENTS:
-      if (b == PACKED_ELEMENTS || b == HOLEY_ELEMENTS) {
-        *a_out = std::max(a, b);
-        return true;
-      }
-      break;
-    case PACKED_DOUBLE_ELEMENTS:
-    case HOLEY_DOUBLE_ELEMENTS:
-      if (b == PACKED_DOUBLE_ELEMENTS || b == HOLEY_DOUBLE_ELEMENTS) {
-        *a_out = std::max(a, b);
-        return true;
-      }
-      break;
-    default:
-      break;
-  }
-  return false;
-}
 
 inline ElementsKind FastSmiToObjectElementsKind(ElementsKind from_kind) {
   DCHECK(IsSmiElementsKind(from_kind));

test/mjsunit/compiler/array-push-multiple-receiver-maps.js

@@ -2,108 +2,98 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --opt --no-always-opt
+// Flags: --allow-natives-syntax --opt
 
-function runTest(f, message, mkICTraining, deoptArg) {
-  function test(f, message, ictraining, deoptArg) {
-    // Train the call ic to the maps.
-    let t = ictraining;
-    for (let a of t()) {
-      f(a.arr, () => a.el);
-    }
-    for (let a of t()) {
-      f(a.arr, () => a.el);
+(function singleUnreliableReceiverMap() {
+  function f(a, g) {
+    a.push(2, g());
   }
+
+  f([1], () => 3);
+  f([1], () => 3);
   %OptimizeFunctionOnNextCall(f);
-    message += " trained with" + JSON.stringify(t());
-    if (deoptArg == undefined) {
-      // Make sure the optimized function can handle
-      // all trained maps without deopt.
-      for (let a of t()) {
-        f(a.arr, () => a.el);
-        message += " for args " + JSON.stringify(a);
-        assertOptimized(f, undefined, message);
+  f([1], () => 3);
+  assertOptimized(f);
+})();
+
+(function singleUnreliableReceiverMapDeopt() {
+  function f(a, g) {
+    a.push(2, g());
   }
-    } else {
-      // Trigger deopt, causing no-speculation bit to be set.
-      let a1 = deoptArg, a2 = deoptArg;
-      message += " for args " + JSON.stringify(a1);
-      f(a1.arr, () => a1.el);
-      assertUnoptimized(f, undefined, message + " should have been unoptimized");
+
+  f([1], () => 3);
+  f([1], () => 3);
   %OptimizeFunctionOnNextCall(f);
-      // No speculation should protect against further deopts.
-      f(a2.arr, () => a2.el);
-      assertOptimized(f, undefined,  message + " should have been optimized");
-    }
-  }
+  f([1], () => true);
+  %OptimizeFunctionOnNextCall(f);
+  f([1], () => true);
+  assertOptimized(f);
+})();
 
-  // Get function as a string.
-  var testString = test.toString();
-  // Remove the function header..
-  testString = testString.replace(new RegExp("[^\n]*"), "let f = " + f.toString() + ";");
-  // ..and trailing '}'.
-  testString = testString.replace(new RegExp("[^\n]*$"), "");
-  // Substitute parameters.
-  testString = testString.replace(new RegExp("ictraining", 'g'), mkICTraining.toString());
-  testString = testString.replace(new RegExp("deoptArg", 'g'),
-    deoptArg ? JSON.stringify(deoptArg) : "undefined");
+(function multipleUnreliableReceiverMaps(){
+  function f(a, g) {
+    a.push(2, g());
+  }
+  let b = [1]
+  b.x = 3;
 
-  var modTest = new Function("message", testString);
-  //print(modTest);
-  modTest(message);
-}
+  f([1], () => 3);
+  f(b, () => 3);
+  f([1], () => 3);
+  f(b, () => 3);
+  %OptimizeFunctionOnNextCall(f);
+  f([1], () => 3);
+  assertOptimized(f);
+})();
 
-let checks = {
-  smiReceiver:
-    { mkTrainingArguments : () => [{arr:[1], el:3}],
-      deoptingArguments   : [{arr:[1], el:true}, {arr:[0.1], el:1}, {arr:[{}], el:1}]
-    },
-  objectReceiver:
-    { mkTrainingArguments : () => [{arr:[{}], el:0.1}],
-      deoptingArguments : []
-    },
-  multipleSmiReceivers:
-    { mkTrainingArguments : () => { let b = [1]; b.x=3; return [{arr:[1], el:3}, {arr:b, el:3}] },
-      deoptingArguments : [{arr:[1], el:true}, {arr:[0.1], el:1}, {arr:[{}], el:1}]
-    },
-  multipleSmiReceiversPackedUnpacked:
-    { mkTrainingArguments : () => { let b = [1]; b[100] = 3; return [{arr:[1], el:3}, {arr:b, el:3}] },
-      deoptingArguments : [ {arr:[1], el:true} ]
-    },
-  multipleDoubleReceivers:
-    { mkTrainingArguments : () => { let b = [0.1]; b.x=0.3; return [{arr:[0.1], el:0.3}, {arr:b, el:0.3}] },
-      deoptingArguments : [{arr:[{}], el:true}, {arr:[0.1], el:true}]
-    },
-  multipleDoubleReceiversPackedUnpacked:
-    { mkTrainingArguments : () => { let b = [0.1]; b[100] = 0.3; return [{arr:[0.1], el:0.3}, {arr:b, el:0.3}] },
-      deoptingArguments : [{arr:[{}], el:true}, {arr:[0.1], el:true}]
-    },
-  multipleMixedReceivers:
-    { mkTrainingArguments : () => { let b = [0.1]; b.x=0.3; return [{arr:[1], el:0.3}, {arr:[{}], el:true}, {arr:b, el:0.3}] },
-      deoptingArguments : []
-    },
-  multipleMixedReceiversPackedUnpacked:
-    { mkTrainingArguments : () => { let b = [0.1]; b[100] = 0.3; return [{arr:[1], el:0.3}, {arr:[{}], el:true}, {arr:b, el:0.3}] },
-      deoptingArguments : []
-    },
-};
+(function multipleUnreliableReceiverMapsDeopt(){
+  function f(a, g) {
+    a.push(2, g());
+  }
+  let b = [1]
+  b.x = 3;
 
+  f([1], () => 3);
+  f(b, () => 3);
+  f([1], () => 3);
+  f(b, () => 3);
+  %OptimizeFunctionOnNextCall(f);
+  f([0.1], () => 3);
+  %OptimizeFunctionOnNextCall(f);
+  f([0.1], () => 3);
+  assertOptimized(f);
+})();
 
-const functions = {
-  push_reliable: (a,g) => { let b = g(); return a.push(2, b); },
-  push_unreliable: (a,g) => { return a.push(2, g()); },
-}
+(function multipleReliableReceiverMaps(){
+  function f(a) {
+    a.push(2);
+  }
+  let b = [1]
+  b.x = 3;
 
-Object.keys(checks).forEach(
-  key => {
-    let check = checks[key];
+  f([1]);
+  f(b);
+  f([1]);
+  f(b);
+  %OptimizeFunctionOnNextCall(f);
+  f([1]);
+  assertOptimized(f);
+})();
 
-    for (fnc in functions) {
-      runTest(functions[fnc], "test-reliable-" + key, check.mkTrainingArguments);
-      // Test each deopting arg separately.
-      for (let deoptArg of check.deoptingArguments) {
-        runTest(functions[fnc], "testDeopt-reliable-" + key, check.mkTrainingArguments, deoptArg);
-      }
+(function multipleReliableReceiverMapsDeopt(){
+  function f(a) {
+    a.push(2);
   }
-  }
-);
+  let b = [1]
+  b.x = 3;
+
+  f([1]);
+  f(b);
+  f([1]);
+  f(b);
+  %OptimizeFunctionOnNextCall(f);
+  f([0.1]);
+  %OptimizeFunctionOnNextCall(f);
+  f([0.1]);
+  assertOptimized(f);
+})();