[turbofan] Initial support for polymorphic inlining.

For call sites where the target is not a known constant, but potentially
a list of known constants (i.e. a Phi with all HeapConstant inputs), we
still record the call site as a potential candidate for inlining.
In case the heuristic picks that candidate for inlining, we
expand the call site to a dispatched call site and invoke the
actual inlining logic for all the nested call sites.

Like Crankshaft, we currently allow up to 4 targets for polymorphic inlining,
although we might want to refine that later.

This approach is different from what Crankshaft does in
that we don't duplicate the evaluation of the parameters per polymorphic
case. Instead we first perform the load of the target (which usually
dispatches based on the receiver map), then we evaluate all the
parameters, and then we dispatch again based on the known targets. This
might generate better or worse code compared to what Crankshaft does,
and for the cases where we generate worse code (i.e. because we have
only trivial parameters or no parameters at all), we might want to
investigate optimizing away the double dispatch in the
future.

R=mvstanton@chromium.org
BUG=v8:5267,v8:5365

Review-Url: https://codereview.chromium.org/2325943002
Cr-Commit-Position: refs/heads/master@{#39302}

src/compilation-info.cc

@@ -51,7 +51,6 @@ CompilationInfo::CompilationInfo(ParseInfo* parse_info,
   if (isolate_->serializer_enabled()) EnableDeoptimizationSupport();
 
   if (FLAG_function_context_specialization) MarkAsFunctionContextSpecializing();
-  if (FLAG_turbo_inlining) MarkAsInliningEnabled();
   if (FLAG_turbo_source_positions) MarkAsSourcePositionsEnabled();
   if (FLAG_turbo_splitting) MarkAsSplittingEnabled();
 }

src/compiler/js-inlining-heuristic.h

@@ -21,7 +21,7 @@ class JSInliningHeuristic final : public AdvancedReducer {
         inliner_(editor, local_zone, info, jsgraph),
         candidates_(local_zone),
         seen_(local_zone),
-        info_(info) {}
+        jsgraph_(jsgraph) {}
 
   Reduction Reduce(Node* node) final;
 
@@ -30,10 +30,15 @@ class JSInliningHeuristic final : public AdvancedReducer {
   void Finalize() final;
 
  private:
+  // This limit currently matches what Crankshaft does. We may want to
+  // re-evaluate and come up with a proper limit for TurboFan.
+  static const int kMaxCallPolymorphism = 4;
+
   struct Candidate {
-    Handle<JSFunction> function;  // The call target being inlined.
-    Node* node;                   // The call site at which to inline.
-    int calls;                    // Number of times the call site was hit.
+    Handle<JSFunction> functions[kMaxCallPolymorphism];
+    int num_functions;
+    Node* node = nullptr;  // The call site at which to inline.
+    int calls = -1;        // Number of times the call site was hit.
   };
 
   // Comparator for candidates.
@@ -46,12 +51,18 @@ class JSInliningHeuristic final : public AdvancedReducer {
 
   // Dumps candidates to console.
   void PrintCandidates();
+  Reduction InlineCandidate(Candidate const& candidate);
+
+  CommonOperatorBuilder* common() const;
+  Graph* graph() const;
+  JSGraph* jsgraph() const { return jsgraph_; }
+  SimplifiedOperatorBuilder* simplified() const;
 
   Mode const mode_;
   JSInliner inliner_;
   Candidates candidates_;
   ZoneSet<NodeId> seen_;
-  CompilationInfo* info_;
+  JSGraph* const jsgraph_;
   int cumulative_count_ = 0;
 };
 

src/compiler/pipeline.cc

@@ -605,6 +605,9 @@ PipelineCompilationJob::Status PipelineCompilationJob::PrepareJobImpl() {
     if (FLAG_native_context_specialization) {
       info()->MarkAsNativeContextSpecializing();
     }
+    if (FLAG_turbo_inlining) {
+      info()->MarkAsInliningEnabled();
+    }
   }
   if (!info()->shared_info()->asm_function() || FLAG_turbo_asm_deoptimization) {
     info()->MarkAsDeoptimizationEnabled();