Reland "[sparkplug] Trigger compilation when a FBV exists"

This is a reland of 3296de2f
It includes pthier@'s fix of overzealous OSR

Original change's description:
> [sparkplug] Trigger compilation when a FBV exists
>
> We were gating baseline compilation on FBV allocation, but in some
> cases, the feedback vector may be allocated eagerly (notably, if we are
> logging function events). Instead, unconditionally try baseline
> compilation after ensuring the feedback vector exists.
>
> Bug: v8:11420
> Change-Id: I1264a1d541a74d4eccb5caf65c360ac23836a1a8
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2953161
> Auto-Submit: Leszek Swirski <leszeks@chromium.org>
> Commit-Queue: Patrick Thier <pthier@chromium.org>
> Reviewed-by: Patrick Thier <pthier@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#75242}

Bug: v8:11420
Change-Id: Ia6864856926d6760bbe6c89ee010fa62cf23b6ca
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2976660
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Patrick Thier <pthier@chromium.org>
Reviewed-by: Patrick Thier <pthier@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75319}

src/runtime/runtime-compiler.cc

@@ -240,6 +240,8 @@ RUNTIME_FUNCTION(Runtime_VerifyType) {
 
 static bool IsSuitableForOnStackReplacement(Isolate* isolate,
                                             Handle<JSFunction> function) {
+  // Don't OSR during serialization.
+  if (isolate->serializer_enabled()) return false;
   // Keep track of whether we've succeeded in optimizing.
   if (function->shared().optimization_disabled()) return false;
   // TODO(chromium:1031479): Currently, OSR triggering mechanism is tied to the

src/runtime/runtime-internal.cc

@@ -334,6 +334,7 @@ RUNTIME_FUNCTION(Runtime_BytecodeBudgetInterruptFromBytecode) {
   DCHECK_EQ(1, args.length());
   CONVERT_ARG_HANDLE_CHECKED(JSFunction, function, 0);
   function->SetInterruptBudget();
+  bool should_mark_for_optimization = function->has_feedback_vector();
   if (!function->has_feedback_vector()) {
     IsCompiledScope is_compiled_scope(
         function->shared().is_compiled_scope(isolate));
@@ -343,28 +344,26 @@ RUNTIME_FUNCTION(Runtime_BytecodeBudgetInterruptFromBytecode) {
     // OSR. When we OSR functions with lazy feedback allocation we want to have
     // a non zero invocation count so we can inline functions.
     function->feedback_vector().set_invocation_count(1);
-    if (FLAG_sparkplug) {
-      CompilationMode compilation_mode =
-          FLAG_baseline_batch_compilation ? kCompileBatch : kCompileImmediate;
-      if (V8_LIKELY(FLAG_use_osr)) {
-        JavaScriptFrameIterator it(isolate);
-        DCHECK(it.frame()->is_unoptimized());
-        UnoptimizedFrame* frame = UnoptimizedFrame::cast(it.frame());
-        OSRInterpreterFrameToBaseline(isolate, function, frame,
-                                      compilation_mode);
-      } else {
-        OSRInterpreterFrameToBaseline(isolate, function, nullptr,
-                                      compilation_mode);
-      }
+  }
+  if (FLAG_sparkplug && !function->ActiveTierIsBaseline()) {
+    CompilationMode compilation_mode =
+        FLAG_baseline_batch_compilation ? kCompileBatch : kCompileImmediate;
+    if (V8_LIKELY(FLAG_use_osr)) {
+      JavaScriptFrameIterator it(isolate);
+      DCHECK(it.frame()->is_unoptimized());
+      UnoptimizedFrame* frame = UnoptimizedFrame::cast(it.frame());
+      OSRInterpreterFrameToBaseline(isolate, function, frame, compilation_mode);
+    } else {
+      OSRInterpreterFrameToBaseline(isolate, function, nullptr,
+                                    compilation_mode);
     }
-    return ReadOnlyRoots(isolate).undefined_value();
   }
-  {
+  if (should_mark_for_optimization) {
     SealHandleScope shs(isolate);
     isolate->counters()->runtime_profiler_ticks()->Increment();
     isolate->runtime_profiler()->MarkCandidatesForOptimizationFromBytecode();
-    return ReadOnlyRoots(isolate).undefined_value();
   }
+  return ReadOnlyRoots(isolate).undefined_value();
 }
 
 RUNTIME_FUNCTION(Runtime_BytecodeBudgetInterruptFromCode) {

test/mjsunit/baseline/batch-compilation.js

@@ -2,9 +2,10 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --sparkplug --no-always-sparkplug --sparkplug-filter="-"
+// Flags: --sparkplug --no-always-sparkplug --sparkplug-filter="test*"
 // Flags: --allow-natives-syntax --expose-gc --no-always-opt
 // Flags: --baseline-batch-compilation --baseline-batch-compilation-threshold=200
+// Flags: --scale-factor-for-feedback-allocation=4
 
 // Flags to drive Fuzzers into the right direction
 // TODO(v8:11853): Remove these flags once fuzzers handle flag implications
@@ -25,7 +26,7 @@
 
   %NeverOptimizeFunction(test1);
   // Trigger bytecode budget interrupt for test1.
-  for (let i=1; i<10000; ++i) {
+  for (let i=0; i<5; ++i) {
     test1(i,4711);
   }
   // Shouldn't be compiled because of batch compilation.
@@ -33,7 +34,7 @@
 
   %NeverOptimizeFunction(test2);
   // Trigger bytecode budget interrupt for test2.
-  for (let i=1; i<10000; ++i) {
+  for (let i=0; i<5; ++i) {
     test2(i,4711);
   }
 
@@ -55,7 +56,8 @@
     return (a + b + 11) * 42 / a % b;
   }
 
-  for (let i=1; i<100000; ++i) {
+  %NeverOptimizeFunction(test_weak);
+  for (let i=0; i<5; ++i) {
     test_weak(i,4711);
   }
 
@@ -63,7 +65,7 @@
 
   %NeverOptimizeFunction(test2);
   // Trigger bytecode budget interrupt for test2.
-  for (let i=1; i<1000; ++i) {
+  for (let i=0; i<5; ++i) {
     test2(i,4711);
   }