[maglev] Add marker for maglev frames

Doesn't do much at the moment beyond not being a baseline frame. Fixes a
DCHECK in tiering that checks the frame type, by removing the frame
lookup there (which wasn't necessary anymore).

Bug: v8:7700
Change-Id: Icecfe27771923d380a7d1dc1c29aa9c5c9dfbf0f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3644618
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80512}

src/execution/frames-inl.h

@@ -219,6 +219,9 @@ inline InterpretedFrame::InterpretedFrame(StackFrameIteratorBase* iterator)
 inline BaselineFrame::BaselineFrame(StackFrameIteratorBase* iterator)
     : UnoptimizedFrame(iterator) {}
 
+inline MaglevFrame::MaglevFrame(StackFrameIteratorBase* iterator)
+    : JavaScriptFrame(iterator) {}
+
 inline BuiltinFrame::BuiltinFrame(StackFrameIteratorBase* iterator)
     : TypedFrameWithJSLinkage(iterator) {}
 

src/execution/frames.cc

@@ -1132,6 +1132,7 @@ void CommonFrame::IterateCompiledFrame(RootVisitor* v) const {
       case OPTIMIZED:
       case INTERPRETED:
       case BASELINE:
+      case MAGLEV:
       case BUILTIN:
         // These frame types have a context, but they are actually stored
         // in the place on the stack that one finds the frame type.

src/execution/frames.h

@@ -109,6 +109,7 @@ class StackHandler {
   IF_WASM(V, WASM_COMPILE_LAZY, WasmCompileLazyFrame)                     \
   V(INTERPRETED, InterpretedFrame)                                        \
   V(BASELINE, BaselineFrame)                                              \
+  V(MAGLEV, MaglevFrame)                                                  \
   V(OPTIMIZED, OptimizedFrame)                                            \
   V(STUB, StubFrame)                                                      \
   V(BUILTIN_CONTINUATION, BuiltinContinuationFrame)                       \
@@ -220,6 +221,7 @@ class StackFrame {
   }
   bool is_interpreted() const { return type() == INTERPRETED; }
   bool is_baseline() const { return type() == BASELINE; }
+  bool is_maglev() const { return type() == MAGLEV; }
 #if V8_ENABLE_WEBASSEMBLY
   bool is_wasm() const { return this->type() == WASM; }
   bool is_c_wasm_entry() const { return type() == C_WASM_ENTRY; }
@@ -244,7 +246,8 @@ class StackFrame {
 
   static bool IsJavaScript(Type t) {
     STATIC_ASSERT(INTERPRETED + 1 == BASELINE);
-    STATIC_ASSERT(BASELINE + 1 == OPTIMIZED);
+    STATIC_ASSERT(BASELINE + 1 == MAGLEV);
+    STATIC_ASSERT(MAGLEV + 1 == OPTIMIZED);
     return t >= INTERPRETED && t <= OPTIMIZED;
   }
   bool is_java_script() const { return IsJavaScript(type()); }
@@ -932,6 +935,22 @@ class BaselineFrame : public UnoptimizedFrame {
   friend class StackFrameIteratorBase;
 };
 
+class MaglevFrame : public JavaScriptFrame {
+ public:
+  Type type() const override { return MAGLEV; }
+
+  static MaglevFrame* cast(StackFrame* frame) {
+    DCHECK(frame->is_maglev());
+    return static_cast<MaglevFrame*>(frame);
+  }
+
+ protected:
+  inline explicit MaglevFrame(StackFrameIteratorBase* iterator);
+
+ private:
+  friend class StackFrameIteratorBase;
+};
+
 // Builtin frames are built for builtins with JavaScript linkage, such as
 // various standard library functions (i.e. Math.asin, Math.floor, etc.).
 class BuiltinFrame final : public TypedFrameWithJSLinkage {

src/execution/tiering-manager.cc

@@ -234,7 +234,6 @@ void TieringManager::RequestOsrAtNextOpportunity(JSFunction function) {
 }
 
 void TieringManager::MaybeOptimizeFrame(JSFunction function,
-                                        UnoptimizedFrame* frame,
                                         CodeKind code_kind) {
   const TieringState tiering_state = function.feedback_vector().tiering_state();
   const TieringState osr_tiering_state =
@@ -278,13 +277,12 @@ void TieringManager::MaybeOptimizeFrame(JSFunction function,
 
   DCHECK(!is_marked_for_any_optimization &&
          !function.HasAvailableOptimizedCode());
-  OptimizationDecision d = ShouldOptimize(function, code_kind, frame);
+  OptimizationDecision d = ShouldOptimize(function, code_kind);
   if (d.should_optimize()) Optimize(function, d);
 }
 
 OptimizationDecision TieringManager::ShouldOptimize(JSFunction function,
-                                                    CodeKind code_kind,
-                                                    JavaScriptFrame* frame) {
+                                                    CodeKind code_kind) {
   DCHECK_EQ(code_kind, function.GetActiveTier().value());
 
   if (TiersUpToMaglev(code_kind) &&
@@ -395,12 +393,8 @@ void TieringManager::OnInterruptTick(Handle<JSFunction> function) {
 
   function_obj.feedback_vector().SaturatingIncrementProfilerTicks();
 
-  // TODO(v8:7700): When tiering up from ML we no longer have an
-  // UnoptimizedFrame. Add logic to handle this case as well.
-  JavaScriptFrameIterator it(isolate_);
-  UnoptimizedFrame* frame = UnoptimizedFrame::cast(it.frame());
   const CodeKind code_kind = function_obj.GetActiveTier().value();
-  MaybeOptimizeFrame(function_obj, frame, code_kind);
+  MaybeOptimizeFrame(function_obj, code_kind);
 }
 
 }  // namespace internal

src/execution/tiering-manager.h

@@ -44,11 +44,9 @@ class TieringManager {
   // Make the decision whether to optimize the given function, and mark it for
   // optimization if the decision was 'yes'.
   // This function is also responsible for bumping the OSR urgency.
-  void MaybeOptimizeFrame(JSFunction function, UnoptimizedFrame* frame,
-                          CodeKind code_kind);
+  void MaybeOptimizeFrame(JSFunction function, CodeKind code_kind);
 
-  OptimizationDecision ShouldOptimize(JSFunction function, CodeKind code_kind,
-                                      JavaScriptFrame* frame);
+  OptimizationDecision ShouldOptimize(JSFunction function, CodeKind code_kind);
   void Optimize(JSFunction function, OptimizationDecision decision);
   void Baseline(JSFunction function, OptimizationReason reason);
 

src/maglev/maglev-code-generator.cc

@@ -56,7 +56,7 @@ class MaglevCodeGeneratingNodeProcessor {
 
     __ BailoutIfDeoptimized(rbx);
 
-    __ EnterFrame(StackFrame::BASELINE);
+    __ EnterFrame(StackFrame::MAGLEV);
 
     // Save arguments in frame.
     // TODO(leszeks): Consider eliding this frame if we don't make any calls

tools/v8heapconst.py

@@ -584,6 +584,7 @@ FRAME_MARKERS = (
   "WASM_COMPILE_LAZY",
   "INTERPRETED",
   "BASELINE",
+  "MAGLEV",
   "OPTIMIZED",
   "STUB",
   "BUILTIN_CONTINUATION",