[Turboprop] Add tests for dynamic check maps operator

This cl also
1. Fixes a bug in effect-control-linearizer where we should have
converted fixed array length from Smi to integer
2. Also prints deopt location for the new "bailout" deopt type on
--trace-deopt.

Bug: v8:10582, v8:9684
Change-Id: Iafc5e8abbca5252a8783a5a1184a1667a7f708a4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2297460
Commit-Queue: Mythri Alle <mythria@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69115}

src/compiler/effect-control-linearizer.cc

@@ -1911,8 +1911,8 @@ void EffectControlLinearizer::LowerDynamicCheckMaps(Node* node,
                        FeedbackSource(), is_weak_fixed_array_check, frame_state,
                        IsSafetyCheck::kCriticalSafetyCheck);
 
-    Node* length =
-        __ LoadField(AccessBuilder::ForWeakFixedArrayLength(), feedback_slot);
+    Node* length = ChangeSmiToInt32(
+        __ LoadField(AccessBuilder::ForWeakFixedArrayLength(), feedback_slot));
     auto loop = __ MakeLoopLabel(MachineRepresentation::kWord32);
     __ Goto(&loop, __ Int32Constant(0));
     __ Bind(&loop);

src/deoptimizer/deoptimizer.cc

@@ -786,8 +786,7 @@ void Deoptimizer::DoComputeOutputFrames() {
            "]\n",
            input_data.OptimizationId().value(), bailout_id_, fp_to_sp_delta_,
            caller_frame_top_);
-    if (deopt_kind_ == DeoptimizeKind::kEager ||
-        deopt_kind_ == DeoptimizeKind::kSoft) {
+    if (deopt_kind_ != DeoptimizeKind::kLazy) {
       compiled_code_.PrintDeoptLocation(
           trace_scope_->file(), "            ;;; deoptimize at ", from_);
     }

test/mjsunit/compiler/test-dynamic-map-checks-poly-mono.js

+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turboprop --dynamic-map-checks --opt
+// Flags: --no-always-opt
+
+function load(obj){
+  return obj.x;
+}
+
+var o = {x:20, y:30};
+var o1 = {x:20, y:30, z:40};
+
+%PrepareFunctionForOptimization(load);
+load(o);
+load(o1);
+
+%OptimizeFunctionOnNextCall(load);
+load(o);
+load(o1);
+assertOptimized(load);
+
+// deprecate maps in IC
+o.x = 21.32;
+o1.x = 21.32;
+
+// transition poly -> mono
+var o2 = {y:20, x:20};
+// This bails out to interpreter and updates the IC state
+load(o2);
+// Optimized code sees monomorphic and should deopt.
+load(o2);
+// should deptimize since we wouldn't generate checks for monomorphic when
+// starting off with polymorphic
+assertUnoptimized(load);

test/mjsunit/compiler/test-dynamic-map-checks-wrong-handler.js

+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turboprop --dynamic-map-checks --opt
+// Flags: --no-always-opt
+
+function load(obj){
+  return obj.x;
+}
+
+%PrepareFunctionForOptimization(load);
+obj = {};
+obj.x = 1;
+
+//get mono feedback
+load(obj);
+
+// optimize as mono
+%OptimizeFunctionOnNextCall(load);
+load(obj);
+assertOptimized(load);
+load(obj);
+
+// change the object's representation.
+obj.x = 2.3;
+load(obj);
+// deoptimizes on a wrong map but retains the code
+assertOptimized(load);
+
+// deoptimizes on the wrong handler.
+load(obj);
+assertUnoptimized(load);

test/mjsunit/compiler/test-dynamic-map-checks-wrong-handler1.js

+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turboprop --dynamic-map-checks --opt
+// Flags: --no-always-opt
+
+function load(obj){
+  return obj.x;
+}
+
+var o = {x: 10, y:20};
+var o1 = {x:10, y:20, z:30};
+
+%PrepareFunctionForOptimization(load);
+// polymorphic with same handler
+load(o);
+load(o1);
+
+%OptimizeFunctionOnNextCall(load);
+load(o);
+load(o1);
+assertOptimized(load);
+
+var o2 = {y: 10, x:20};
+// deopts but stays optimized
+load(o2);
+assertOptimized(load);
+
+// deopts and discard code on wrong handler
+load(o2);
+assertUnoptimized(load);

test/mjsunit/compiler/test-dynamic-map-checks.js

+// Copyright 2020 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turboprop --dynamic-map-checks --opt
+// Flags: --no-always-opt
+
+function load(obj){
+  return obj.x;
+}
+
+%PrepareFunctionForOptimization(load);
+obj = {};
+obj.x = 1;
+
+//get mono feedback
+load(obj);
+load(obj);
+
+// optimize as mono
+%OptimizeFunctionOnNextCall(load);
+load(obj);
+assertOptimized(load);
+load(obj);
+
+// transition to poly - should retain optimized code
+obj.y = 2;
+load(obj);
+assertOptimized(load);
+load(obj);
+
+// transition to more polymorphic
+obj.z = 3;
+load(obj);
+obj.q =4;
+load(obj);
+
+// transition to megamorphic
+assertOptimized(load);
+obj.r = 5;
+load(obj);
+obj.s = 6;
+load(obj);
+assertUnoptimized(load);
+load(obj);