[ic] Support smi receivers in megamorphic loads

Smis are represented in feedback by the heap number map. Turns out the
megamorphic load IC always just missed instead of using the map. Fixing this
improves a microbenchmark by ~6x.

Change-Id: I4c6d0ec1abb88ae34b212cfc69cc6b020060753b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3683318Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80923}

src/ic/accessor-assembler.cc

@@ -1152,6 +1152,7 @@ void AccessorAssembler::EmitAccessCheck(TNode<Context> expected_native_context,
   TNode<NativeContext> native_context = LoadNativeContext(context);
   GotoIf(TaggedEqual(expected_native_context, native_context), can_access);
   // If the receiver is not a JSGlobalProxy then we miss.
+  GotoIf(TaggedIsSmi(receiver), miss);
   GotoIfNot(IsJSGlobalProxy(CAST(receiver)), miss);
   // For JSGlobalProxy receiver try to compare security tokens of current
   // and expected native contexts.
@@ -2958,10 +2959,26 @@ void AccessorAssembler::TryProbeStubCache(StubCache* stub_cache,
   Counters* counters = isolate()->counters();
   IncrementCounter(counters->megamorphic_stub_cache_probes(), 1);
 
-  // Check that the {lookup_start_object} isn't a smi.
-  GotoIf(TaggedIsSmi(lookup_start_object), &miss);
+  Label smi(this), non_smi(this), do_lookup(this);
+  TVARIABLE(Map, map_var);
+  Branch(TaggedIsSmi(lookup_start_object), &smi, &non_smi);
 
-  TNode<Map> lookup_start_object_map = LoadMap(CAST(lookup_start_object));
+  BIND(&smi);
+  {
+    // Also for smis the HeapNumberMap is used to identify number feedback.
+    map_var = HeapNumberMapConstant();
+    Goto(&do_lookup);
+  }
+
+  BIND(&non_smi);
+  {
+    map_var = LoadMap(CAST(lookup_start_object));
+    Goto(&do_lookup);
+  }
+
+  BIND(&do_lookup);
+
+  TNode<Map> lookup_start_object_map = map_var.value();
 
   // Probe the primary table.
   TNode<IntPtrT> primary_offset =