[turboprop] Refactor minimorphic-polymorphic dynamic map checks

For minimorphic-polymorphic checks, instead of loading the feedback
vector in an inlined unrolled loop, just inline the maps present in
the feedback vector at compile time and call out to the builtin if
these map checks fail.

Change-Id: I4672bc2c774027935aa245382625b9aa64be1d10
Bug: v8:10582
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2460812Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70981}

src/compiler/js-heap-broker.cc

@@ -4637,11 +4637,11 @@ bool ElementAccessFeedback::HasOnlyStringMaps(JSHeapBroker* broker) const {
 
 MinimorphicLoadPropertyAccessFeedback::MinimorphicLoadPropertyAccessFeedback(
     NameRef const& name, FeedbackSlotKind slot_kind, Handle<Object> handler,
-    MaybeHandle<Map> maybe_map, bool has_migration_target_maps)
+    ZoneVector<Handle<Map>> const& maps, bool has_migration_target_maps)
     : ProcessedFeedback(kMinimorphicPropertyAccess, slot_kind),
       name_(name),
       handler_(handler),
-      maybe_map_(maybe_map),
+      maps_(maps),
       has_migration_target_maps_(has_migration_target_maps) {
   DCHECK(IsLoadICKind(slot_kind));
 }
@@ -4795,13 +4795,10 @@ ProcessedFeedback const& JSHeapBroker::ReadFeedbackForPropertyAccess(
       maps_and_handlers, kind, target_native_context().object(),
       is_turboprop());
   if (!handler.is_null()) {
-    MaybeHandle<Map> maybe_map;
-    if (nexus.ic_state() == MONOMORPHIC) {
-      DCHECK_EQ(maps.size(), 1);
-      maybe_map = maps[0];
-    }
     return *zone()->New<MinimorphicLoadPropertyAccessFeedback>(
-        *name, kind, handler.object(), maybe_map, HasMigrationTargets(maps));
+        *name, kind, handler.object(),
+        ZoneVector<Handle<Map>>(maps.begin(), maps.end(), zone()),
+        HasMigrationTargets(maps));
   }
 
   FilterRelevantReceiverMaps(isolate(), &maps);

src/compiler/js-native-context-specialization.cc

@@ -1081,10 +1081,15 @@ Reduction JSNativeContextSpecialization::ReduceMinimorphicPropertyAccess(
   if (feedback.has_migration_target_maps()) {
     flags |= CheckMapsFlag::kTryMigrateInstance;
   }
-  effect =
-      graph()->NewNode(simplified()->DynamicCheckMaps(flags, feedback.handler(),
-                                                      feedback.map(), source),
-                       receiver, effect, control);
+
+  ZoneHandleSet<Map> maps;
+  for (Handle<Map> map : feedback.maps()) {
+    maps.insert(map, graph()->zone());
+  }
+
+  effect = graph()->NewNode(
+      simplified()->DynamicCheckMaps(flags, feedback.handler(), maps, source),
+      receiver, effect, control);
   value = access_builder.BuildMinimorphicLoadDataField(
       feedback.name(), access_info, receiver, &effect, &control);
 

src/compiler/processed-feedback.h

@@ -178,19 +178,19 @@ class MinimorphicLoadPropertyAccessFeedback : public ProcessedFeedback {
   MinimorphicLoadPropertyAccessFeedback(NameRef const& name,
                                         FeedbackSlotKind slot_kind,
                                         Handle<Object> handler,
-                                        MaybeHandle<Map> maybe_map,
+                                        ZoneVector<Handle<Map>> const& maps,
                                         bool has_migration_target_maps);
 
   NameRef const& name() const { return name_; }
-  bool is_monomorphic() const { return !maybe_map_.is_null(); }
+  bool is_monomorphic() const { return maps_.size() == 1; }
   Handle<Object> handler() const { return handler_; }
-  MaybeHandle<Map> map() const { return maybe_map_; }
+  ZoneVector<Handle<Map>> const& maps() const { return maps_; }
   bool has_migration_target_maps() const { return has_migration_target_maps_; }
 
  private:
   NameRef const name_;
   Handle<Object> const handler_;
-  MaybeHandle<Map> const maybe_map_;
+  ZoneVector<Handle<Map>> const maps_;
   bool const has_migration_target_maps_;
 };
 

src/compiler/simplified-operator.cc

@@ -294,7 +294,7 @@ bool operator==(DynamicCheckMapsParameters const& lhs,
   DCHECK_IMPLIES(lhs.feedback() == rhs.feedback(),
                  lhs.flags() == rhs.flags() && lhs.state() == rhs.state() &&
                      lhs.handler().address() == rhs.handler().address() &&
-                     lhs.map().address() == rhs.map().address());
+                     lhs.maps() == rhs.maps());
   return lhs.feedback() == rhs.feedback();
 }
 
@@ -308,7 +308,7 @@ size_t hash_value(DynamicCheckMapsParameters const& p) {
 std::ostream& operator<<(std::ostream& os,
                          DynamicCheckMapsParameters const& p) {
   return os << p.handler() << ", " << p.feedback() << "," << p.state() << ","
-            << p.flags() << "," << p.map().address();
+            << p.flags() << "," << p.maps();
 }
 
 DynamicCheckMapsParameters const& DynamicCheckMapsParametersOf(
@@ -1487,10 +1487,9 @@ const Operator* SimplifiedOperatorBuilder::CheckMaps(
 }
 
 const Operator* SimplifiedOperatorBuilder::DynamicCheckMaps(
-    CheckMapsFlags flags, Handle<Object> handler, MaybeHandle<Map> maybe_map,
-    const FeedbackSource& feedback) {
-  DynamicCheckMapsParameters const parameters(flags, handler, maybe_map,
-                                              feedback);
+    CheckMapsFlags flags, Handle<Object> handler,
+    ZoneHandleSet<Map> const& maps, const FeedbackSource& feedback) {
+  DynamicCheckMapsParameters const parameters(flags, handler, maps, feedback);
   return zone()->New<Operator1<DynamicCheckMapsParameters>>(  // --
       IrOpcode::kDynamicCheckMaps,                            // opcode
       Operator::kNoThrow | Operator::kNoWrite,                // flags

src/compiler/simplified-operator.h

@@ -445,25 +445,22 @@ class DynamicCheckMapsParameters final {
   enum ICState { kMonomorphic, kPolymorphic };
 
   DynamicCheckMapsParameters(CheckMapsFlags flags, Handle<Object> handler,
-                             MaybeHandle<Map> maybe_map,
+                             ZoneHandleSet<Map> const& maps,
                              const FeedbackSource& feedback)
-      : flags_(flags),
-        handler_(handler),
-        maybe_map_(maybe_map),
-        feedback_(feedback) {}
+      : flags_(flags), handler_(handler), maps_(maps), feedback_(feedback) {}
 
   CheckMapsFlags flags() const { return flags_; }
   Handle<Object> handler() const { return handler_; }
-  MaybeHandle<Map> map() const { return maybe_map_; }
+  ZoneHandleSet<Map> const& maps() const { return maps_; }
   FeedbackSource const& feedback() const { return feedback_; }
   ICState state() const {
-    return maybe_map_.is_null() ? ICState::kPolymorphic : ICState::kMonomorphic;
+    return maps_.size() == 1 ? ICState::kMonomorphic : ICState::kPolymorphic;
   }
 
  private:
   CheckMapsFlags const flags_;
   Handle<Object> const handler_;
-  MaybeHandle<Map> const maybe_map_;
+  ZoneHandleSet<Map> const maps_;
   FeedbackSource const feedback_;
 };
 
@@ -901,7 +898,7 @@ class V8_EXPORT_PRIVATE SimplifiedOperatorBuilder final
   const Operator* CheckMaps(CheckMapsFlags, ZoneHandleSet<Map>,
                             const FeedbackSource& = FeedbackSource());
   const Operator* DynamicCheckMaps(CheckMapsFlags flags, Handle<Object> handler,
-                                   MaybeHandle<Map> map,
+                                   ZoneHandleSet<Map> const& maps,
                                    const FeedbackSource& feedback);
   const Operator* CheckNotTaggedHole();
   const Operator* CheckNumber(const FeedbackSource& feedback);