[ic] Iterate polymorphic feedback backwards

Reduce register pressure (and therefore spills) across the loop
iterating over the LoadIC polymorphic feedback array by starting at
length - 1 and iterating down to 0.

Might give a tiny recency boost too.

Change-Id: I1295a8136212c339b9d3974e2d49b3ecfe1ce543
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1687545Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62528}

src/ic/accessor-assembler.cc

@@ -107,12 +107,12 @@ void AccessorAssembler::HandlePolymorphicCase(
 
   // Load the {feedback} array length.
   TNode<IntPtrT> length = LoadAndUntagWeakFixedArrayLength(feedback);
-  CSA_ASSERT(this, IntPtrLessThanOrEqual(IntPtrConstant(1), length));
+  CSA_ASSERT(this, IntPtrLessThanOrEqual(IntPtrConstant(kEntrySize), length));
 
-  // This is a hand-crafted loop that only compares against the {length}
-  // in the end, since we already know that we will have at least a single
-  // entry in the {feedback} array anyways.
-  TVARIABLE(IntPtrT, var_index, IntPtrConstant(0));
+  // This is a hand-crafted loop that iterates backwards and only compares
+  // against zero at the end, since we already know that we will have at least a
+  // single entry in the {feedback} array anyways.
+  TVARIABLE(IntPtrT, var_index, IntPtrSub(length, IntPtrConstant(kEntrySize)));
   Label loop(this, &var_index), loop_next(this);
   Goto(&loop);
   BIND(&loop);
@@ -131,8 +131,9 @@ void AccessorAssembler::HandlePolymorphicCase(
 
     BIND(&loop_next);
     var_index =
-        Signed(IntPtrAdd(var_index.value(), IntPtrConstant(kEntrySize)));
-    Branch(IntPtrLessThan(var_index.value(), length), &loop, if_miss);
+        Signed(IntPtrSub(var_index.value(), IntPtrConstant(kEntrySize)));
+    Branch(IntPtrGreaterThanOrEqual(var_index.value(), IntPtrConstant(0)),
+           &loop, if_miss);
   }
 }