[maglev] Fix Sparkplug tiering in presence of Maglev

We should only tier to Sparkplug from Ignition. Previously, the
'!ActiveTierIsSparkplug' condition was correct since only Ignition (and
Sparkplug itself) entered the TieringManager. But now that Maglev is
also present, the condition must be clarified to 'ActiveTierIsIgnition'.

Bug: v8:7700
Change-Id: Ic7ea898facf9ce65407d09cead35e0181e49db31
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3835562
Commit-Queue: Jakob Linke <jgruber@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82519}

src/execution/tiering-manager.cc

@@ -375,7 +375,7 @@ void TieringManager::OnInterruptTick(Handle<JSFunction> function) {
   // compile request and fulfillment, which doesn't work with strictly linear
   // tiering.
   if (CanCompileWithBaseline(isolate_, function->shared()) &&
-      !function->ActiveTierIsBaseline()) {
+      function->ActiveTierIsIgnition()) {
     if (FLAG_baseline_batch_compilation) {
       isolate_->baseline_batch_compiler()->EnqueueFunction(function);
     } else {

src/objects/js-function.cc

@@ -625,9 +625,10 @@ void JSFunction::InitializeFeedbackCell(
     EnsureClosureFeedbackCellArray(function,
                                    reset_budget_for_feedback_allocation);
   }
+  // TODO(jgruber): Unduplicate these conditions from tiering-manager.cc.
   if (function->shared().sparkplug_compiled() &&
       CanCompileWithBaseline(isolate, function->shared()) &&
-      !function->ActiveTierIsBaseline()) {
+      function->ActiveTierIsIgnition()) {
     if (FLAG_baseline_batch_compilation) {
       isolate->baseline_batch_compiler()->EnqueueFunction(function);
     } else {

test/mjsunit/maglev/tier-to-ml-to-tf.js

@@ -3,6 +3,7 @@
 // found in the LICENSE file.
 //
 // Flags: --allow-natives-syntax --maglev --no-stress-opt
+// Flags: --no-baseline-batch-compilation
 
 function f(x) {
   var y = 0;
@@ -20,8 +21,6 @@ function g() {
 
   f(10);
 
-  // TODO(v8:7700): Enable.
-  /*
   if (%IsSparkplugEnabled()) {
     while (!%ActiveTierIsSparkplug(f) && --keep_going) f(10);
     assertTrue(%ActiveTierIsSparkplug(f));
@@ -31,7 +30,6 @@ function g() {
     while (!%ActiveTierIsMaglev(f) && --keep_going) f(10);
     assertTrue(%ActiveTierIsMaglev(f));
   }
-  */
 
   if (%IsTurbofanEnabled()) {
     while (!%ActiveTierIsTurbofan(f) && --keep_going) f(10);