[ic] Introduce --max-polymorphic-map-count flag.

This turns the previous compile time constant IC::kMaxPolymorphicMapCount
into a runtime flag --max-polymorphic-map-count (defaults to 4 still),
which makes it easier to play with different number of maps in POLYMORPHIC
state.

Bug: v8:8765
Change-Id: I86c04d9b2d8be21a3bc6b31f70b0bbc359067467
Reviewed-on: https://chromium-review.googlesource.com/c/1456097Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59398}

src/feedback-vector.cc

@@ -784,8 +784,8 @@ void FeedbackNexus::ConfigureCloneObject(Handle<Map> source_map,
       }
       break;
     case POLYMORPHIC: {
-      static constexpr int kMaxElements =
-          IC::kMaxPolymorphicMapCount * kCloneObjectPolymorphicEntrySize;
+      const int kMaxElements =
+          FLAG_max_polymorphic_map_count * kCloneObjectPolymorphicEntrySize;
       Handle<WeakFixedArray> array = Handle<WeakFixedArray>::cast(feedback);
       int i = 0;
       for (; i < array->length(); i += kCloneObjectPolymorphicEntrySize) {

src/flag-definitions.h

@@ -997,6 +997,8 @@ DEFINE_BOOL_READONLY(track_constant_fields, false,
 DEFINE_BOOL_READONLY(modify_map_inplace, false, "enable in-place map updates")
 DEFINE_BOOL_READONLY(fast_map_update, false,
                      "enable fast map update by caching the migration target")
+DEFINE_INT(max_polymorphic_map_count, 4,
+           "maximum number of maps to track in POLYMORPHIC state")
 
 // macro-assembler-ia32.cc
 DEFINE_BOOL(native_code_counters, false,

src/ic/ic.cc

@@ -586,7 +586,7 @@ bool IC::UpdatePolymorphicIC(Handle<Name> name,
   int number_of_valid_maps =
       number_of_maps - deprecated_maps - (handler_to_overwrite != -1);
 
-  if (number_of_valid_maps >= kMaxPolymorphicMapCount) return false;
+  if (number_of_valid_maps >= FLAG_max_polymorphic_map_count) return false;
   if (number_of_maps == 0 && state() != MONOMORPHIC && state() != POLYMORPHIC) {
     return false;
   }

src/ic/ic.h

@@ -31,10 +31,6 @@ class IC {
 
   static constexpr int kMaxKeyedPolymorphism = 4;
 
-  // A polymorphic IC can handle at most 4 distinct maps before transitioning
-  // to megamorphic state.
-  static constexpr int kMaxPolymorphicMapCount = 4;
-
   // Construct the IC structure with the given number of extra
   // JavaScript frames on the stack.
   IC(Isolate* isolate, Handle<FeedbackVector> vector, FeedbackSlot slot,