[parser] Prevent feedback slot merging for dynamic globals

This is a short-term fix to prevent any merging of feedback slots for
dynamic globals, while we work on a longer term solution to make it
consistent between eager and lazy compilation.

Bug: chromium:1008414, v8:8510
Change-Id: I4a5977046f53454d6f8a6ea2f41046abdf73418f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1829270
Commit-Queue: Dan Elphick <delphick@chromium.org>
Auto-Submit: Dan Elphick <delphick@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64041}

src/interpreter/bytecode-generator.cc

@@ -3030,7 +3030,9 @@ void BytecodeGenerator::BuildVariableLoad(Variable* variable,
         case VariableMode::kDynamicGlobal: {
           int depth =
               current_scope()->ContextChainLengthUntilOutermostSloppyEval();
-          FeedbackSlot slot = GetCachedLoadGlobalICSlot(typeof_mode, variable);
+          // TODO(1008414): Add back caching here when bug is fixed properly.
+          FeedbackSlot slot = feedback_spec()->AddLoadGlobalICSlot(typeof_mode);
+
           builder()->LoadLookupGlobalSlot(variable->raw_name(), typeof_mode,
                                           feedback_index(slot), depth);
           break;

test/mjsunit/regress/regress-1008414.js

+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --throws
+
+(function bar() {
+  (function foo(
+      x = new class B extends A(eval) { }
+    ) {
+        eval();
+    })();
+  eval();
+})()