[turbofan] Bailout from polymorphic inlining if target becomes monomorphic.

Bug: chromium:958717
Change-Id: Ib0f12cc7ec9cca12c7859bf838e536fb330c5e9e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627537
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61818}

src/compiler/js-inlining-heuristic.cc

@@ -343,7 +343,6 @@ Node* JSInliningHeuristic::DuplicateFrameStateAndRename(Node* frame_state,
 }
 
 bool JSInliningHeuristic::TryReuseDispatch(Node* node, Node* callee,
-                                           Candidate const& candidate,
                                            Node** if_successes, Node** calls,
                                            Node** inputs, int input_count) {
   // We will try to reuse the control flow branch created for computing
@@ -351,11 +350,6 @@ bool JSInliningHeuristic::TryReuseDispatch(Node* node, Node* callee,
   // is no side-effect between the call and the branch, and if the callee is
   // only used as the target (and possibly also in the related frame states).
 
-  int const num_calls = candidate.num_functions;
-
-  DCHECK_EQ(IrOpcode::kPhi, callee->opcode());
-  DCHECK_EQ(num_calls, callee->op()->ValueInputCount());
-
   // We are trying to match the following pattern:
   //
   //         C1     C2
@@ -438,6 +432,11 @@ bool JSInliningHeuristic::TryReuseDispatch(Node* node, Node* callee,
   //                              |
   //                             ...
 
+  // Bailout if the call is not polymorphic anymore (other reducers might
+  // have replaced the callee phi with a constant).
+  if (callee->opcode() != IrOpcode::kPhi) return false;
+  int const num_calls = callee->op()->ValueInputCount();
+
   // If there is a control node between the callee computation
   // and the call, bail out.
   Node* merge = NodeProperties::GetControlInput(callee);
@@ -584,7 +583,7 @@ void JSInliningHeuristic::CreateOrReuseDispatch(Node* node, Node* callee,
                                                 int input_count) {
   SourcePositionTable::Scope position(
       source_positions_, source_positions_->GetSourcePosition(node));
-  if (TryReuseDispatch(node, callee, candidate, if_successes, calls, inputs,
+  if (TryReuseDispatch(node, callee, if_successes, calls, inputs,
                        input_count)) {
     return;
   }

src/compiler/js-inlining-heuristic.h

@@ -73,9 +73,8 @@ class JSInliningHeuristic final : public AdvancedReducer {
   void CreateOrReuseDispatch(Node* node, Node* callee,
                              Candidate const& candidate, Node** if_successes,
                              Node** calls, Node** inputs, int input_count);
-  bool TryReuseDispatch(Node* node, Node* callee, Candidate const& candidate,
-                        Node** if_successes, Node** calls, Node** inputs,
-                        int input_count);
+  bool TryReuseDispatch(Node* node, Node* callee, Node** if_successes,
+                        Node** calls, Node** inputs, int input_count);
   enum StateCloneMode { kCloneState, kChangeInPlace };
   Node* DuplicateFrameStateAndRename(Node* frame_state, Node* from, Node* to,
                                      StateCloneMode mode);