[turbofan] Handle insufficient feedback in ComputeElementAccessInfos

Bug: chromium:961986, v8:7790
Change-Id: I4c5fbd8eafb96ffe7e54be28eb5c5462b49ed015
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1607648Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61439}

src/compiler/access-info.cc

@@ -281,11 +281,16 @@ base::Optional<ElementAccessInfo> AccessInfoFactory::ComputeElementAccessInfo(
 bool AccessInfoFactory::ComputeElementAccessInfos(
     FeedbackNexus nexus, MapHandles const& maps, AccessMode access_mode,
     ZoneVector<ElementAccessInfo>* access_infos) const {
-  ElementAccessFeedback const* processed =
+  DCHECK(access_infos->empty());
+  ProcessedFeedback const* processed =
       FLAG_concurrent_inlining
-          ? broker()->GetElementAccessFeedback(FeedbackSource(nexus))
+          ? broker()->GetFeedback(FeedbackSource(nexus))
           : broker()->ProcessFeedbackMapsForElementAccess(maps);
   if (processed == nullptr) return false;
+  if (processed->kind() == ProcessedFeedback::kInsufficient) return true;
+  CHECK_EQ(processed->kind(), ProcessedFeedback::kElementAccess);
+  ElementAccessFeedback const* feedback =
+      static_cast<ElementAccessFeedback const*>(processed);
 
   if (access_mode == AccessMode::kLoad || access_mode == AccessMode::kHas) {
     // For polymorphic loads of similar elements kinds (i.e. all tagged or all
@@ -293,21 +298,21 @@ bool AccessInfoFactory::ComputeElementAccessInfos(
     // much faster than transitioning the elements to the worst case, trading a
     // TransitionElementsKind for a CheckMaps, avoiding mutation of the array.
     base::Optional<ElementAccessInfo> access_info =
-        ConsolidateElementLoad(*processed);
+        ConsolidateElementLoad(*feedback);
     if (access_info.has_value()) {
       access_infos->push_back(*access_info);
       return true;
     }
   }
 
-  for (Handle<Map> receiver_map : processed->receiver_maps) {
+  for (Handle<Map> receiver_map : feedback->receiver_maps) {
     // Compute the element access information.
     base::Optional<ElementAccessInfo> access_info =
         ComputeElementAccessInfo(receiver_map, access_mode);
     if (!access_info.has_value()) return false;
 
     // Collect the possible transitions for the {receiver_map}.
-    for (auto transition : processed->transitions) {
+    for (auto transition : feedback->transitions) {
       if (transition.second.equals(receiver_map)) {
         access_info->AddTransitionSource(transition.first);
       }

src/compiler/js-native-context-specialization.cc

@@ -1517,10 +1517,7 @@ Reduction JSNativeContextSpecialization::ReduceElementAccess(
   if (!access_info_factory.ComputeElementAccessInfos(
           nexus, receiver_maps, access_mode, &access_infos)) {
     return NoChange();
-  }
-
-  // Nothing to do if we have no non-deprecated maps.
-  if (access_infos.empty()) {
+  } else if (access_infos.empty()) {
     return ReduceSoftDeoptimize(
         node, DeoptimizeReason::kInsufficientTypeFeedbackForGenericKeyedAccess);
   }

test/mjsunit/compiler/regress-961986.js

+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo() {
+  const proto = [];
+  const obj = Object.create(proto);
+  obj[1] = "";
+  proto[1];
+  proto.bla = 42;
+}
+
+foo();
+%OptimizeFunctionOnNextCall(foo);
+foo();