[turboprop] Enable DynamicMapChecks for TurboProp

Bug: v8:10582, v8:9684
Change-Id: Ib29e9b56d4c722cb572e86def7eeb3f588dc9c2d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2316079Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69128}

src/flags/flag-definitions.h

@@ -508,6 +508,7 @@ DEFINE_NEG_IMPLICATION(turboprop, turbo_inlining)
 DEFINE_IMPLICATION(turboprop, concurrent_inlining)
 DEFINE_VALUE_IMPLICATION(turboprop, interrupt_budget, 15 * KB)
 DEFINE_VALUE_IMPLICATION(turboprop, reuse_opt_code_count, 2)
+DEFINE_IMPLICATION(turboprop, dynamic_map_checks)
 
 // Flags for concurrent recompilation.
 DEFINE_BOOL(concurrent_recompilation, true,

src/runtime/runtime-test.cc

@@ -250,6 +250,12 @@ RUNTIME_FUNCTION(Runtime_IsConcurrentRecompilationSupported) {
       isolate->concurrent_recompilation_enabled());
 }
 
+RUNTIME_FUNCTION(Runtime_DynamicMapChecksEnabled) {
+  SealHandleScope shs(isolate);
+  DCHECK_EQ(0, args.length());
+  return isolate->heap()->ToBoolean(FLAG_dynamic_map_checks);
+}
+
 RUNTIME_FUNCTION(Runtime_OptimizeFunctionOnNextCall) {
   HandleScope scope(isolate);
 

src/runtime/runtime.h

@@ -470,6 +470,7 @@ namespace internal {
   F(DisallowCodegenFromStrings, 1, 1)         \
   F(DisallowWasmCodegen, 1, 1)                \
   F(DisassembleFunction, 1, 1)                \
+  F(DynamicMapChecksEnabled, 0, 1)            \
   F(EnableCodeLoggingForTesting, 0, 1)        \
   F(EnsureFeedbackVectorForFunction, 1, 1)    \
   F(FreezeWasmLazyCompilation, 1, 1)          \

test/mjsunit/mjsunit.status

@@ -1205,6 +1205,18 @@
 
   # const field tracking is disabled in turboprop
   'const-field-tracking': [SKIP],
+
+  # Dynamic map checks doesn't use information from maps so we don't inline
+  # array builtins or track field representation.
+  'compiler/deopt-inlined-from-call': [SKIP],
+  'compiler/field-representation-tracking': [SKIP],
+  'field-type-tracking': [SKIP],
+
+  # We don't migrate deprecated maps with dynamic map checks. This will be
+  # fixed in a later cl.
+  # TODO(mythria): Reenable this when the cl that migrates deprecated maps
+  # lands
+  'regress/regress-932953': [FAIL],
 }],  # variant == turboprop
 
 ##############################################################################

test/mjsunit/regress/regress-385565.js

@@ -50,6 +50,10 @@ callsFReceiver(o1);
 var r2 = callsFReceiver(o1);
 assertOptimized(callsFReceiver);
 callsFReceiver(o2);
+if (%DynamicMapChecksEnabled()) {
+  // Call it again to ensure a deopt when dynamic map checks is enabled.
+  callsFReceiver(o2);
+}
 assertUnoptimized(callsFReceiver);
 
 %PrepareFunctionForOptimization(callsFReceiver);
@@ -72,4 +76,9 @@ assertEquals(1, r1);
 assertTrue(r1 === r2);
 assertTrue(r2 === r3);
 
-assertEquals(10, calls);
+
+if (%DynamicMapChecksEnabled()) {
+  assertEquals(11, calls);
+} else {
+  assertEquals(10, calls);
+}

test/mjsunit/regress/regress-unlink-closures-on-deopt.js

@@ -27,6 +27,10 @@ g1({ f : 1});
 %OptimizeFunctionOnNextCall(g2);
 g2({ f : 2});
 g1({});
+if (%DynamicMapChecksEnabled()) {
+  // One more call to ensure a deopt even if dynamic map checks is enabled.
+  g1({});
+}
 
 assertUnoptimized(g1);