[turboprop] Store minimorphic access info indexed on FeedbackSource

We used to store MinimorphicPropertyAccessInfo indexed on the feedback
slot id. This works fine when there is no inlining but returns the
wrong access information when functions are inlined. Index it
based on FeedbackSource to avoid these problems.

Bug: v8:10582,chromium:1125871
Change-Id: Id01010f3153f7e21495d73899a8604a64417ae95
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2401426
Commit-Queue: Mythri Alle <mythria@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69845}

src/compiler/js-heap-broker.cc

@@ -5217,12 +5217,13 @@ PropertyAccessInfo JSHeapBroker::GetPropertyAccessInfo(
 MinimorphicLoadPropertyAccessInfo JSHeapBroker::GetPropertyAccessInfo(
     MinimorphicLoadPropertyAccessFeedback const& feedback,
     FeedbackSource const& source, SerializationPolicy policy) {
-  auto it = minimorphic_property_access_infos_.find(source.index());
+  auto it = minimorphic_property_access_infos_.find(source);
   if (it != minimorphic_property_access_infos_.end()) return it->second;
 
   if (policy == SerializationPolicy::kAssumeSerialized) {
-    TRACE_BROKER_MISSING(
-        this, "MinimorphicLoadPropertyAccessInfo for slot " << source.index());
+    TRACE_BROKER_MISSING(this, "MinimorphicLoadPropertyAccessInfo for slot "
+                                   << source.index() << "  "
+                                   << ObjectRef(this, source.vector));
     return MinimorphicLoadPropertyAccessInfo::Invalid();
   }
 
@@ -5230,9 +5231,10 @@ MinimorphicLoadPropertyAccessInfo JSHeapBroker::GetPropertyAccessInfo(
   MinimorphicLoadPropertyAccessInfo access_info =
       factory.ComputePropertyAccessInfo(feedback);
   if (is_concurrent_inlining_) {
-    TRACE(this,
-          "Storing MinimorphicLoadPropertyAccessInfo for " << source.index());
-    minimorphic_property_access_infos_.insert({source.index(), access_info});
+    TRACE(this, "Storing MinimorphicLoadPropertyAccessInfo for "
+                    << source.index() << "  "
+                    << ObjectRef(this, source.vector));
+    minimorphic_property_access_infos_.insert({source, access_info});
   }
   return access_info;
 }

src/compiler/js-heap-broker.h

@@ -363,7 +363,8 @@ class V8_EXPORT_PRIVATE JSHeapBroker {
   ZoneUnorderedMap<PropertyAccessTarget, PropertyAccessInfo,
                    PropertyAccessTarget::Hash, PropertyAccessTarget::Equal>
       property_access_infos_;
-  ZoneUnorderedMap<int, MinimorphicLoadPropertyAccessInfo>
+  ZoneUnorderedMap<FeedbackSource, MinimorphicLoadPropertyAccessInfo,
+                   FeedbackSource::Hash, FeedbackSource::Equal>
       minimorphic_property_access_infos_;
 
   ZoneVector<ObjectData*> typed_array_string_tags_;

test/mjsunit/regress/regress-1125871.js

+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --dynamic-map-checks --opt --no-always-opt
+
+function bar(obj) {
+  // Add two dummy loads to make sure obj.b is in the same slot index as obj.a
+  // in foo.
+  obj.y;
+  obj.x;
+  return obj.b
+}
+
+function foo(obj) {
+  bar(obj);
+  return obj.a;
+}
+
+var obj = { a: 10, b: 20};
+%PrepareFunctionForOptimization(foo);
+%EnsureFeedbackVectorForFunction(bar);
+foo(obj);
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(10, foo(obj));