[compiler] Fix {UseTurboFan} for disabled optimization.

This fixes a corner-case in the above predicate that was introduced to
allow fully disabling optimization using %NeverOptimizeFunction. This
property of a function is a transient property (i.e. changes over time),
whereas {UseTurboFan} is designed to be a static property (i.e. gives
same answer over time). Violating this led to cases where functions got
optimization disabled for other reasons would suddenly be baselined.
The correct place to check transient properties is when optimization is
requested.

R=jarin@chromium.org
TEST=mjsunit/never-baseline

Change-Id: I37eb0c70d2b39704be29fd4bda76975bfbede66b
Reviewed-on: https://chromium-review.googlesource.com/447937Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43514}

src/compiler.cc

@@ -328,10 +328,6 @@ void EnsureFeedbackMetadata(CompilationInfo* info) {
 }
 
 bool UseTurboFan(Handle<SharedFunctionInfo> shared) {
-  if (shared->optimization_disabled()) {
-    return false;
-  }
-
   bool must_use_ignition_turbo = shared->must_use_ignition_turbo();
 
   // Check the enabling conditions for Turbofan.
@@ -867,6 +863,13 @@ MaybeHandle<Code> GetOptimizedCode(Handle<JSFunction> function,
     return MaybeHandle<Code>();
   }
 
+  // Do not use Crankshaft/TurboFan when %NeverOptimizeFunction was applied.
+  if (shared->optimization_disabled() &&
+      shared->disable_optimization_reason() == kOptimizationDisabledForTest) {
+    info->AbortOptimization(kOptimizationDisabledForTest);
+    return MaybeHandle<Code>();
+  }
+
   // Limit the number of times we try to optimize functions.
   const int kMaxOptCount =
       FLAG_deopt_every_n_times == 0 ? FLAG_max_opt_count : 1000;

test/mjsunit/never-baseline.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --ignition --turbo
+
+function f(a, b) {
+  %DeoptimizeNow();
+  return a + b;
+}
+
+// Go through enough optimization and deoptimization cycles in order for the
+// function {f} to be marked as optimization disabled.
+for (var i = 0; i < 16; ++i) {
+  %OptimizeFunctionOnNextCall(f);
+  f(1, 2);
+}
+
+// Make the runtime profiler perceive {f} as hot again and then verify that we
+// didn't trigger an unintentional baseline compilation.
+for (var i = 0; i < 100000; ++i) {
+  f(1, 2);
+}
+assertTrue(isInterpreted(f));