[nci] Don't lower feedback-collecting operators

Feedback collection is currently implemented only for JS operators in
generic lowering. Missing feedback collection results in soft-deopts
immediately after tiering up to TF from NCI code.

In this CL we disable two large classes of such problematic lowerings
for NCI code, type hint lowering and typed lowering.

Cq-Include-Trybots: luci.v8.try:v8_linux64_fyi_rel_ng
Bug: v8:8888
Change-Id: Ia8452775616074b7ad6dfe930f305449db3f5682
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2410180
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69910}

src/compiler/js-heap-broker.h

@@ -10,6 +10,7 @@
 #include "src/common/globals.h"
 #include "src/compiler/access-info.h"
 #include "src/compiler/feedback-source.h"
+#include "src/compiler/globals.h"
 #include "src/compiler/processed-feedback.h"
 #include "src/compiler/refs-map.h"
 #include "src/compiler/serializer-hints.h"
@@ -103,6 +104,12 @@ class V8_EXPORT_PRIVATE JSHeapBroker {
   bool is_native_context_independent() const {
     return is_native_context_independent_;
   }
+  bool generate_full_feedback_collection() const {
+    // NCI code currently collects full feedback.
+    DCHECK_IMPLIES(is_native_context_independent(),
+                   CollectFeedbackInGenericLowering());
+    return is_native_context_independent();
+  }
 
   enum BrokerMode { kDisabled, kSerializing, kSerialized, kRetired };
   BrokerMode mode() const { return mode_; }

src/compiler/js-typed-lowering.cc

@@ -2406,7 +2406,16 @@ Reduction JSTypedLowering::ReduceJSResolvePromise(Node* node) {
 Reduction JSTypedLowering::Reduce(Node* node) {
   DisallowHeapAccess no_heap_access;
 
-  switch (node->opcode()) {
+  const IrOpcode::Value opcode = node->opcode();
+  if (broker()->generate_full_feedback_collection() &&
+      IrOpcode::IsFeedbackCollectingOpcode(opcode)) {
+    // In NCI code, it is not valid to reduce feedback-collecting JS opcodes
+    // into non-feedback-collecting lower-level opcodes; missed feedback would
+    // result in soft deopts.
+    return NoChange();
+  }
+
+  switch (opcode) {
     case IrOpcode::kJSEqual:
       return ReduceJSEqual(node);
     case IrOpcode::kJSStrictEqual:

src/compiler/opcodes.h

@@ -1070,6 +1070,55 @@ class V8_EXPORT_PRIVATE IrOpcode {
   static bool IsContextChainExtendingOpcode(Value value) {
     return kJSCreateFunctionContext <= value && value <= kJSCreateBlockContext;
   }
+
+  // These opcode take the feedback vector as an input, and implement
+  // feedback-collecting logic in generic lowering.
+  static bool IsFeedbackCollectingOpcode(Value value) {
+#define CASE(Name, ...) \
+  case k##Name:         \
+    return true;
+    switch (value) {
+      JS_ARITH_BINOP_LIST(CASE)
+      JS_ARITH_UNOP_LIST(CASE)
+      JS_BITWISE_BINOP_LIST(CASE)
+      JS_BITWISE_UNOP_LIST(CASE)
+      JS_COMPARE_BINOP_LIST(CASE)
+      case kJSCall:
+      case kJSCallWithArrayLike:
+      case kJSCallWithSpread:
+      case kJSCloneObject:
+      case kJSConstruct:
+      case kJSConstructWithArrayLike:
+      case kJSConstructWithSpread:
+      case kJSCreateEmptyLiteralArray:
+      case kJSCreateLiteralArray:
+      case kJSCreateLiteralObject:
+      case kJSCreateLiteralRegExp:
+      case kJSGetIterator:
+      case kJSGetTemplateObject:
+      case kJSHasProperty:
+      case kJSInstanceOf:
+      case kJSLoadGlobal:
+      case kJSLoadNamed:
+      case kJSLoadProperty:
+      case kJSStoreDataPropertyInLiteral:
+      case kJSStoreGlobal:
+      case kJSStoreInArrayLiteral:
+      case kJSStoreNamed:
+      case kJSStoreNamedOwn:
+      case kJSStoreProperty:
+        return true;
+      default:
+        return false;
+    }
+#undef CASE
+    UNREACHABLE();
+  }
+
+  static bool IsFeedbackCollectingOpcode(int16_t value) {
+    DCHECK(0 <= value && value <= kLast);
+    return IsFeedbackCollectingOpcode(static_cast<IrOpcode::Value>(value));
+  }
 };
 
 V8_EXPORT_PRIVATE std::ostream& operator<<(std::ostream&, IrOpcode::Value);