Revert "[super] Optimize super property access in JSNativeContextSpecialization"

This reverts commit 30ca51ec.

Reason for revert: TSAN failures https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20TSAN/34104

Original change's description:
> [super] Optimize super property access in JSNativeContextSpecialization
>
> This is a reland of https://chromium-review.googlesource.com/c/v8/v8/+/2487122
>
> Generalize the existing property lookup machinery
> (JSNCS::ReduceNamedAccess) to handle the case where the
> lookup_start_object and the receiver are different objects.
>
> Design doc: https://docs.google.com/document/d/1b_wgtExmJDLb8206jpJol-g4vJAxPs1XjEx95hwRboI/edit#heading=h.xqthbgih7l2l
>
> Bug: v8:9237
> Change-Id: Ia8e79b00f7720f4e3e90801e49a0106e03b4767d
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2523197
> Commit-Queue: Marja Hölttä <marja@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#71052}

TBR=marja@chromium.org,neis@chromium.org

Change-Id: I2b10963a9a99f7b482f1014472a6a281fcf9b8c1
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:9237
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2527184Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71058}

src/compiler/access-info.cc

@@ -70,13 +70,12 @@ std::ostream& operator<<(std::ostream& os, AccessMode access_mode) {
   UNREACHABLE();
 }
 
-ElementAccessInfo::ElementAccessInfo(
-    ZoneVector<Handle<Map>>&& lookup_start_object_maps,
-    ElementsKind elements_kind, Zone* zone)
+ElementAccessInfo::ElementAccessInfo(ZoneVector<Handle<Map>>&& receiver_maps,
+                                     ElementsKind elements_kind, Zone* zone)
     : elements_kind_(elements_kind),
-      lookup_start_object_maps_(lookup_start_object_maps),
+      receiver_maps_(receiver_maps),
       transition_sources_(zone) {
-  CHECK(!lookup_start_object_maps.empty());
+  CHECK(!receiver_maps.empty());
 }
 
 // static
@@ -159,26 +158,27 @@ MinimorphicLoadPropertyAccessInfo MinimorphicLoadPropertyAccessInfo::Invalid() {
 
 PropertyAccessInfo::PropertyAccessInfo(Zone* zone)
     : kind_(kInvalid),
-      lookup_start_object_maps_(zone),
+      receiver_maps_(zone),
       unrecorded_dependencies_(zone),
       field_representation_(Representation::None()),
       field_type_(Type::None()) {}
 
-PropertyAccessInfo::PropertyAccessInfo(
-    Zone* zone, Kind kind, MaybeHandle<JSObject> holder,
-    ZoneVector<Handle<Map>>&& lookup_start_object_maps)
+PropertyAccessInfo::PropertyAccessInfo(Zone* zone, Kind kind,
+                                       MaybeHandle<JSObject> holder,
+                                       ZoneVector<Handle<Map>>&& receiver_maps)
     : kind_(kind),
-      lookup_start_object_maps_(lookup_start_object_maps),
+      receiver_maps_(receiver_maps),
       unrecorded_dependencies_(zone),
       holder_(holder),
       field_representation_(Representation::None()),
       field_type_(Type::None()) {}
 
-PropertyAccessInfo::PropertyAccessInfo(
-    Zone* zone, Kind kind, MaybeHandle<JSObject> holder,
-    Handle<Object> constant, ZoneVector<Handle<Map>>&& lookup_start_object_maps)
+PropertyAccessInfo::PropertyAccessInfo(Zone* zone, Kind kind,
+                                       MaybeHandle<JSObject> holder,
+                                       Handle<Object> constant,
+                                       ZoneVector<Handle<Map>>&& receiver_maps)
     : kind_(kind),
-      lookup_start_object_maps_(lookup_start_object_maps),
+      receiver_maps_(receiver_maps),
       unrecorded_dependencies_(zone),
       constant_(constant),
       holder_(holder),
@@ -189,10 +189,10 @@ PropertyAccessInfo::PropertyAccessInfo(
     Kind kind, MaybeHandle<JSObject> holder, MaybeHandle<Map> transition_map,
     FieldIndex field_index, Representation field_representation,
     Type field_type, Handle<Map> field_owner_map, MaybeHandle<Map> field_map,
-    ZoneVector<Handle<Map>>&& lookup_start_object_maps,
+    ZoneVector<Handle<Map>>&& receiver_maps,
     ZoneVector<CompilationDependency const*>&& unrecorded_dependencies)
     : kind_(kind),
-      lookup_start_object_maps_(lookup_start_object_maps),
+      receiver_maps_(receiver_maps),
       unrecorded_dependencies_(std::move(unrecorded_dependencies)),
       transition_map_(transition_map),
       holder_(holder),
@@ -265,10 +265,9 @@ bool PropertyAccessInfo::Merge(PropertyAccessInfo const* that,
         }
         this->field_type_ =
             Type::Union(this->field_type_, that->field_type_, zone);
-        this->lookup_start_object_maps_.insert(
-            this->lookup_start_object_maps_.end(),
-            that->lookup_start_object_maps_.begin(),
-            that->lookup_start_object_maps_.end());
+        this->receiver_maps_.insert(this->receiver_maps_.end(),
+                                    that->receiver_maps_.begin(),
+                                    that->receiver_maps_.end());
         this->unrecorded_dependencies_.insert(
             this->unrecorded_dependencies_.end(),
             that->unrecorded_dependencies_.begin(),
@@ -283,10 +282,9 @@ bool PropertyAccessInfo::Merge(PropertyAccessInfo const* that,
       if (this->constant_.address() == that->constant_.address()) {
         DCHECK(this->unrecorded_dependencies_.empty());
         DCHECK(that->unrecorded_dependencies_.empty());
-        this->lookup_start_object_maps_.insert(
-            this->lookup_start_object_maps_.end(),
-            that->lookup_start_object_maps_.begin(),
-            that->lookup_start_object_maps_.end());
+        this->receiver_maps_.insert(this->receiver_maps_.end(),
+                                    that->receiver_maps_.begin(),
+                                    that->receiver_maps_.end());
         return true;
       }
       return false;
@@ -296,10 +294,9 @@ bool PropertyAccessInfo::Merge(PropertyAccessInfo const* that,
     case kStringLength: {
       DCHECK(this->unrecorded_dependencies_.empty());
       DCHECK(that->unrecorded_dependencies_.empty());
-      this->lookup_start_object_maps_.insert(
-          this->lookup_start_object_maps_.end(),
-          that->lookup_start_object_maps_.begin(),
-          that->lookup_start_object_maps_.end());
+      this->receiver_maps_.insert(this->receiver_maps_.end(),
+                                  that->receiver_maps_.begin(),
+                                  that->receiver_maps_.end());
       return true;
     }
     case kModuleExport:

src/compiler/access-info.h

@@ -37,25 +37,25 @@ std::ostream& operator<<(std::ostream&, AccessMode);
 // This class encapsulates all information required to access a certain element.
 class ElementAccessInfo final {
  public:
-  ElementAccessInfo(ZoneVector<Handle<Map>>&& lookup_start_object_maps,
+  ElementAccessInfo(ZoneVector<Handle<Map>>&& receiver_maps,
                     ElementsKind elements_kind, Zone* zone);
 
   ElementsKind elements_kind() const { return elements_kind_; }
-  ZoneVector<Handle<Map>> const& lookup_start_object_maps() const {
-    return lookup_start_object_maps_;
+  ZoneVector<Handle<Map>> const& receiver_maps() const {
+    return receiver_maps_;
   }
   ZoneVector<Handle<Map>> const& transition_sources() const {
     return transition_sources_;
   }
 
   void AddTransitionSource(Handle<Map> map) {
-    CHECK_EQ(lookup_start_object_maps_.size(), 1);
+    CHECK_EQ(receiver_maps_.size(), 1);
     transition_sources_.push_back(map);
   }
 
  private:
   ElementsKind elements_kind_;
-  ZoneVector<Handle<Map>> lookup_start_object_maps_;
+  ZoneVector<Handle<Map>> receiver_maps_;
   ZoneVector<Handle<Map>> transition_sources_;
 };
 
@@ -128,26 +128,26 @@ class PropertyAccessInfo final {
   Type field_type() const { return field_type_; }
   Representation field_representation() const { return field_representation_; }
   MaybeHandle<Map> field_map() const { return field_map_; }
-  ZoneVector<Handle<Map>> const& lookup_start_object_maps() const {
-    return lookup_start_object_maps_;
+  ZoneVector<Handle<Map>> const& receiver_maps() const {
+    return receiver_maps_;
   }
 
  private:
   explicit PropertyAccessInfo(Zone* zone);
   PropertyAccessInfo(Zone* zone, Kind kind, MaybeHandle<JSObject> holder,
-                     ZoneVector<Handle<Map>>&& lookup_start_object_maps);
+                     ZoneVector<Handle<Map>>&& receiver_maps);
   PropertyAccessInfo(Zone* zone, Kind kind, MaybeHandle<JSObject> holder,
                      Handle<Object> constant,
-                     ZoneVector<Handle<Map>>&& lookup_start_object_maps);
+                     ZoneVector<Handle<Map>>&& receiver_maps);
   PropertyAccessInfo(Kind kind, MaybeHandle<JSObject> holder,
                      MaybeHandle<Map> transition_map, FieldIndex field_index,
                      Representation field_representation, Type field_type,
                      Handle<Map> field_owner_map, MaybeHandle<Map> field_map,
-                     ZoneVector<Handle<Map>>&& lookup_start_object_maps,
+                     ZoneVector<Handle<Map>>&& receiver_maps,
                      ZoneVector<CompilationDependency const*>&& dependencies);
 
   Kind kind_;
-  ZoneVector<Handle<Map>> lookup_start_object_maps_;
+  ZoneVector<Handle<Map>> receiver_maps_;
   ZoneVector<CompilationDependency const*> unrecorded_dependencies_;
   Handle<Object> constant_;
   MaybeHandle<Map> transition_map_;

src/compiler/bytecode-graph-builder.cc

@@ -264,7 +264,7 @@ class BytecodeGraphBuilder {
       const Operator* op, Node* receiver, FeedbackSlot load_slot,
       FeedbackSlot call_slot);
   JSTypeHintLowering::LoweringResult TryBuildSimplifiedLoadNamed(
-      const Operator* op, FeedbackSlot slot);
+      const Operator* op, Node* receiver, FeedbackSlot slot);
   JSTypeHintLowering::LoweringResult TryBuildSimplifiedLoadKeyed(
       const Operator* op, Node* receiver, Node* key, FeedbackSlot slot);
   JSTypeHintLowering::LoweringResult TryBuildSimplifiedStoreNamed(
@@ -2019,7 +2019,7 @@ void BytecodeGraphBuilder::VisitLdaNamedProperty() {
   const Operator* op = javascript()->LoadNamed(name.object(), feedback);
 
   JSTypeHintLowering::LoweringResult lowering =
-      TryBuildSimplifiedLoadNamed(op, feedback.slot);
+      TryBuildSimplifiedLoadNamed(op, object, feedback.slot);
   if (lowering.IsExit()) return;
 
   Node* node = nullptr;
@@ -2052,24 +2052,10 @@ void BytecodeGraphBuilder::VisitLdaNamedPropertyFromSuper() {
   Node* home_object = environment()->LookupAccumulator();
   NameRef name(broker(),
                bytecode_iterator().GetConstantForIndexOperand(1, isolate()));
+  const Operator* op = javascript()->LoadNamedFromSuper(name.object());
+  // TODO(marja, v8:9237): Use lowering.
 
-  FeedbackSource feedback =
-      CreateFeedbackSource(bytecode_iterator().GetIndexOperand(2));
-  const Operator* op =
-      javascript()->LoadNamedFromSuper(name.object(), feedback);
-
-  JSTypeHintLowering::LoweringResult lowering =
-      TryBuildSimplifiedLoadNamed(op, feedback.slot);
-  if (lowering.IsExit()) return;
-
-  Node* node = nullptr;
-  if (lowering.IsSideEffectFree()) {
-    node = lowering.value();
-  } else {
-    DCHECK(!lowering.Changed());
-    DCHECK(IrOpcode::IsFeedbackCollectingOpcode(op->opcode()));
-    node = NewNode(op, receiver, home_object, feedback_vector_node());
-  }
+  Node* node = NewNode(op, receiver, home_object);
   environment()->BindAccumulator(node, Environment::kAttachFrameState);
 }
 
@@ -4236,12 +4222,14 @@ BytecodeGraphBuilder::TryBuildSimplifiedGetIterator(const Operator* op,
 
 JSTypeHintLowering::LoweringResult
 BytecodeGraphBuilder::TryBuildSimplifiedLoadNamed(const Operator* op,
+                                                  Node* receiver,
                                                   FeedbackSlot slot) {
   if (!CanApplyTypeHintLowering(op)) return NoChange();
   Node* effect = environment()->GetEffectDependency();
   Node* control = environment()->GetControlDependency();
   JSTypeHintLowering::LoweringResult early_reduction =
-      type_hint_lowering().ReduceLoadNamedOperation(op, effect, control, slot);
+      type_hint_lowering().ReduceLoadNamedOperation(op, receiver, effect,
+                                                    control, slot);
   ApplyEarlyReduction(early_reduction);
   return early_reduction;
 }

src/compiler/js-call-reducer.cc

@@ -7648,7 +7648,7 @@ Reduction JSCallReducer::ReduceRegExpPrototypeTest(Node* node) {
 
     // Add proper dependencies on the {regexp}s [[Prototype]]s.
     dependencies()->DependOnStablePrototypeChains(
-        ai_exec.lookup_start_object_maps(), kStartAtPrototype,
+        ai_exec.receiver_maps(), kStartAtPrototype,
         JSObjectRef(broker(), holder));
   } else {
     return inference.NoChange();

src/compiler/js-generic-lowering.cc

@@ -318,10 +318,8 @@ void JSGenericLowering::LowerJSLoadNamed(Node* node) {
 }
 
 void JSGenericLowering::LowerJSLoadNamedFromSuper(Node* node) {
-  // TODO(marja, v8:9237): Call a builtin which collects feedback.
   JSLoadNamedFromSuperNode n(node);
   NamedAccess const& p = n.Parameters();
-  node->RemoveInput(2);  // Feedback vector
   node->InsertInput(zone(), 2, jsgraph()->HeapConstant(p.name()));
   ReplaceWithRuntimeCall(node, Runtime::kLoadFromSuper);
 }

src/compiler/js-heap-copy-reducer.cc

@@ -172,12 +172,10 @@ Reduction JSHeapCopyReducer::Reduce(Node* node) {
       break;
     }
     case IrOpcode::kJSLoadNamedFromSuper: {
+      // TODO(marja, v8:9237): Process feedback once it's added to the byte
+      // code.
       NamedAccess const& p = NamedAccessOf(node->op());
       NameRef name(broker(), p.name());
-      if (p.feedback().IsValid()) {
-        broker()->ProcessFeedbackForPropertyAccess(p.feedback(),
-                                                   AccessMode::kLoad, name);
-      }
       break;
     }
     case IrOpcode::kJSStoreNamed: {

src/compiler/js-native-context-specialization.h

@@ -83,7 +83,6 @@ class V8_EXPORT_PRIVATE JSNativeContextSpecialization final
   Reduction ReduceJSLoadGlobal(Node* node);
   Reduction ReduceJSStoreGlobal(Node* node);
   Reduction ReduceJSLoadNamed(Node* node);
-  Reduction ReduceJSLoadNamedFromSuper(Node* node);
   Reduction ReduceJSGetIterator(Node* node);
   Reduction ReduceJSStoreNamed(Node* node);
   Reduction ReduceJSHasProperty(Node* node);
@@ -95,7 +94,7 @@ class V8_EXPORT_PRIVATE JSNativeContextSpecialization final
   Reduction ReduceJSToObject(Node* node);
 
   Reduction ReduceElementAccess(Node* node, Node* index, Node* value,
-                                ElementAccessFeedback const& feedback);
+                                ElementAccessFeedback const& processed);
   // In the case of non-keyed (named) accesses, pass the name as {static_name}
   // and use {nullptr} for {key} (load/store modes are irrelevant).
   Reduction ReducePropertyAccess(Node* node, Node* key,
@@ -103,21 +102,18 @@ class V8_EXPORT_PRIVATE JSNativeContextSpecialization final
                                  Node* value, FeedbackSource const& source,
                                  AccessMode access_mode);
   Reduction ReduceNamedAccess(Node* node, Node* value,
-                              NamedAccessFeedback const& feedback,
+                              NamedAccessFeedback const& processed,
                               AccessMode access_mode, Node* key = nullptr);
   Reduction ReduceMinimorphicPropertyAccess(
       Node* node, Node* value,
       MinimorphicLoadPropertyAccessFeedback const& feedback,
       FeedbackSource const& source);
-  Reduction ReduceGlobalAccess(Node* node, Node* lookup_start_object,
-                               Node* receiver, Node* value, NameRef const& name,
-                               AccessMode access_mode, Node* key = nullptr,
-                               Node* effect = nullptr);
-  Reduction ReduceGlobalAccess(Node* node, Node* lookup_start_object,
-                               Node* receiver, Node* value, NameRef const& name,
-                               AccessMode access_mode, Node* key,
-                               PropertyCellRef const& property_cell,
-                               Node* effect = nullptr);
+  Reduction ReduceGlobalAccess(Node* node, Node* receiver, Node* value,
+                               NameRef const& name, AccessMode access_mode,
+                               Node* key = nullptr);
+  Reduction ReduceGlobalAccess(Node* node, Node* receiver, Node* value,
+                               NameRef const& name, AccessMode access_mode,
+                               Node* key, PropertyCellRef const& property_cell);
   Reduction ReduceElementLoadFromHeapConstant(Node* node, Node* key,
                                               AccessMode access_mode,
                                               KeyedAccessLoadMode load_mode);
@@ -150,13 +146,14 @@ class V8_EXPORT_PRIVATE JSNativeContextSpecialization final
   };
 
   // Construct the appropriate subgraph for property access.
-  ValueEffectControl BuildPropertyAccess(
-      Node* lookup_start_object, Node* receiver, Node* value, Node* context,
-      Node* frame_state, Node* effect, Node* control, NameRef const& name,
-      ZoneVector<Node*>* if_exceptions, PropertyAccessInfo const& access_info,
-      AccessMode access_mode);
-  ValueEffectControl BuildPropertyLoad(Node* lookup_start_object,
-                                       Node* receiver, Node* context,
+  ValueEffectControl BuildPropertyAccess(Node* receiver, Node* value,
+                                         Node* context, Node* frame_state,
+                                         Node* effect, Node* control,
+                                         NameRef const& name,
+                                         ZoneVector<Node*>* if_exceptions,
+                                         PropertyAccessInfo const& access_info,
+                                         AccessMode access_mode);
+  ValueEffectControl BuildPropertyLoad(Node* receiver, Node* context,
                                        Node* frame_state, Node* effect,
                                        Node* control, NameRef const& name,
                                        ZoneVector<Node*>* if_exceptions,
@@ -215,19 +212,20 @@ class V8_EXPORT_PRIVATE JSNativeContextSpecialization final
   // code dependencies and might use the array protector cell.
   bool CanTreatHoleAsUndefined(ZoneVector<Handle<Map>> const& receiver_maps);
 
-  void RemoveImpossibleMaps(Node* object, ZoneVector<Handle<Map>>* maps) const;
+  void RemoveImpossibleReceiverMaps(
+      Node* receiver, ZoneVector<Handle<Map>>* receiver_maps) const;
 
   ElementAccessFeedback const& TryRefineElementAccessFeedback(
       ElementAccessFeedback const& feedback, Node* receiver,
       Node* effect) const;
 
-  // Try to infer maps for the given {object} at the current {effect}.
-  bool InferMaps(Node* object, Node* effect,
-                 ZoneVector<Handle<Map>>* maps) const;
+  // Try to infer maps for the given {receiver} at the current {effect}.
+  bool InferReceiverMaps(Node* receiver, Node* effect,
+                         ZoneVector<Handle<Map>>* receiver_maps) const;
 
-  // Try to infer a root map for the {object} independent of the current program
-  // location.
-  base::Optional<MapRef> InferRootMap(Node* object) const;
+  // Try to infer a root map for the {receiver} independent of the current
+  // program location.
+  base::Optional<MapRef> InferReceiverRootMap(Node* receiver) const;
 
   // Checks if we know at compile time that the {receiver} either definitely
   // has the {prototype} in it's prototype chain, or the {receiver} definitely
@@ -240,8 +238,6 @@ class V8_EXPORT_PRIVATE JSNativeContextSpecialization final
   InferHasInPrototypeChainResult InferHasInPrototypeChain(
       Node* receiver, Node* effect, HeapObjectRef const& prototype);
 
-  Node* BuildLoadPrototypeFromObject(Node* object, Node* effect, Node* control);
-
   Graph* graph() const;
   JSGraph* jsgraph() const { return jsgraph_; }
 

src/compiler/js-operator.cc

@@ -935,13 +935,12 @@ const Operator* JSOperatorBuilder::LoadNamed(Handle<Name> name,
       access);                                          // parameter
 }
 
-const Operator* JSOperatorBuilder::LoadNamedFromSuper(
-    Handle<Name> name, const FeedbackSource& feedback) {
+const Operator* JSOperatorBuilder::LoadNamedFromSuper(Handle<Name> name) {
   static constexpr int kReceiver = 1;
   static constexpr int kHomeObject = 1;
-  static constexpr int kFeedbackVector = 1;
-  static constexpr int kArity = kReceiver + kHomeObject + kFeedbackVector;
-  NamedAccess access(LanguageMode::kSloppy, name, feedback);
+  static constexpr int kArity = kReceiver + kHomeObject;
+  // TODO(marja, v8:9237): Use real feedback.
+  NamedAccess access(LanguageMode::kSloppy, name, FeedbackSource());
   return zone()->New<Operator1<NamedAccess>>(                    // --
       IrOpcode::kJSLoadNamedFromSuper, Operator::kNoProperties,  // opcode
       "JSLoadNamedFromSuper",                                    // name

src/compiler/js-operator.h

@@ -937,8 +937,7 @@ class V8_EXPORT_PRIVATE JSOperatorBuilder final
 
   const Operator* LoadProperty(FeedbackSource const& feedback);
   const Operator* LoadNamed(Handle<Name> name, FeedbackSource const& feedback);
-  const Operator* LoadNamedFromSuper(Handle<Name> name,
-                                     FeedbackSource const& feedback);
+  const Operator* LoadNamedFromSuper(Handle<Name> name);
 
   const Operator* StoreProperty(LanguageMode language_mode,
                                 FeedbackSource const& feedback);
@@ -1414,13 +1413,9 @@ class JSLoadNamedFromSuperNode final : public JSNodeWrapperBase {
 
   const NamedAccess& Parameters() const { return NamedAccessOf(node()->op()); }
 
-  // TODO(marja, v8:9237): A more intuitive order would be (home_object,
-  // receiver, feedback_vector). The order can be changed once we no longer
-  // delegate to Runtime_LoadFromSuper.
-#define INPUTS(V)                       \
-  V(Receiver, receiver, 0, Object)      \
-  V(HomeObject, home_object, 1, Object) \
-  V(FeedbackVector, feedback_vector, 2, HeapObject)
+#define INPUTS(V)                  \
+  V(Receiver, receiver, 0, Object) \
+  V(Object, home_object, 1, Object)
   INPUTS(DEFINE_INPUT_ACCESSORS)
 #undef INPUTS
 };

src/compiler/js-type-hint-lowering.cc

@@ -513,9 +513,9 @@ JSTypeHintLowering::ReduceGetIteratorOperation(const Operator* op,
 }
 
 JSTypeHintLowering::LoweringResult JSTypeHintLowering::ReduceLoadNamedOperation(
-    const Operator* op, Node* effect, Node* control, FeedbackSlot slot) const {
-  DCHECK(op->opcode() == IrOpcode::kJSLoadNamed ||
-         op->opcode() == IrOpcode::kJSLoadNamedFromSuper);
+    const Operator* op, Node* receiver, Node* effect, Node* control,
+    FeedbackSlot slot) const {
+  DCHECK_EQ(IrOpcode::kJSLoadNamed, op->opcode());
   if (Node* node = TryBuildSoftDeopt(
           slot, effect, control,
           DeoptimizeReason::kInsufficientTypeFeedbackForGenericNamedAccess)) {

src/compiler/js-type-hint-lowering.h

@@ -144,8 +144,8 @@ class JSTypeHintLowering {
                                             FeedbackSlot call_slot) const;
 
   // Potential reduction of property access operations.
-  LoweringResult ReduceLoadNamedOperation(const Operator* op, Node* effect,
-                                          Node* control,
+  LoweringResult ReduceLoadNamedOperation(const Operator* op, Node* obj,
+                                          Node* effect, Node* control,
                                           FeedbackSlot slot) const;
   LoweringResult ReduceLoadKeyedOperation(const Operator* op, Node* obj,
                                           Node* key, Node* effect,

src/compiler/map-inference.cc

@@ -19,12 +19,12 @@ MapInference::MapInference(JSHeapBroker* broker, Node* object, Node* effect)
     : broker_(broker), object_(object) {
   ZoneHandleSet<Map> maps;
   auto result =
-      NodeProperties::InferMapsUnsafe(broker_, object_, effect, &maps);
+      NodeProperties::InferReceiverMapsUnsafe(broker_, object_, effect, &maps);
   maps_.insert(maps_.end(), maps.begin(), maps.end());
-  maps_state_ = (result == NodeProperties::kUnreliableMaps)
+  maps_state_ = (result == NodeProperties::kUnreliableReceiverMaps)
                     ? kUnreliableDontNeedGuard
                     : kReliableOrGuarded;
-  DCHECK_EQ(maps_.empty(), result == NodeProperties::kNoMaps);
+  DCHECK_EQ(maps_.empty(), result == NodeProperties::kNoReceiverMaps);
 }
 
 MapInference::~MapInference() { CHECK(Safe()); }

src/compiler/node-properties.cc

@@ -349,7 +349,7 @@ base::Optional<MapRef> NodeProperties::GetJSCreateMap(JSHeapBroker* broker,
 }
 
 // static
-NodeProperties::InferMapsResult NodeProperties::InferMapsUnsafe(
+NodeProperties::InferReceiverMapsResult NodeProperties::InferReceiverMapsUnsafe(
     JSHeapBroker* broker, Node* receiver, Node* effect,
     ZoneHandleSet<Map>* maps_return) {
   HeapObjectMatcher m(receiver);
@@ -368,11 +368,11 @@ NodeProperties::InferMapsResult NodeProperties::InferMapsUnsafe(
         // The {receiver_map} is only reliable when we install a stability
         // code dependency.
         *maps_return = ZoneHandleSet<Map>(receiver.map().object());
-        return kUnreliableMaps;
+        return kUnreliableReceiverMaps;
       }
     }
   }
-  InferMapsResult result = kReliableMaps;
+  InferReceiverMapsResult result = kReliableReceiverMaps;
   while (true) {
     switch (effect->opcode()) {
       case IrOpcode::kMapGuard: {
@@ -399,9 +399,9 @@ NodeProperties::InferMapsResult NodeProperties::InferMapsUnsafe(
             return result;
           }
           // We reached the allocation of the {receiver}.
-          return kNoMaps;
+          return kNoReceiverMaps;
         }
-        result = kUnreliableMaps;  // JSCreate can have side-effect.
+        result = kUnreliableReceiverMaps;  // JSCreate can have side-effect.
         break;
       }
       case IrOpcode::kJSCreatePromise: {
@@ -430,7 +430,7 @@ NodeProperties::InferMapsResult NodeProperties::InferMapsUnsafe(
           }
           // Without alias analysis we cannot tell whether this
           // StoreField[map] affects {receiver} or not.
-          result = kUnreliableMaps;
+          result = kUnreliableReceiverMaps;
         }
         break;
       }
@@ -453,25 +453,25 @@ NodeProperties::InferMapsResult NodeProperties::InferMapsUnsafe(
         if (control->opcode() != IrOpcode::kLoop) {
           DCHECK(control->opcode() == IrOpcode::kDead ||
                  control->opcode() == IrOpcode::kMerge);
-          return kNoMaps;
+          return kNoReceiverMaps;
         }
 
         // Continue search for receiver map outside the loop. Since operations
         // inside the loop may change the map, the result is unreliable.
         effect = GetEffectInput(effect, 0);
-        result = kUnreliableMaps;
+        result = kUnreliableReceiverMaps;
         continue;
       }
       default: {
         DCHECK_EQ(1, effect->op()->EffectOutputCount());
         if (effect->op()->EffectInputCount() != 1) {
           // Didn't find any appropriate CheckMaps node.
-          return kNoMaps;
+          return kNoReceiverMaps;
         }
         if (!effect->op()->HasProperty(Operator::kNoWrite)) {
           // Without alias/escape analysis we cannot tell whether this
           // {effect} affects {receiver} or not.
-          result = kUnreliableMaps;
+          result = kUnreliableReceiverMaps;
         }
         break;
       }
@@ -479,7 +479,7 @@ NodeProperties::InferMapsResult NodeProperties::InferMapsUnsafe(
 
     // Stop walking the effect chain once we hit the definition of
     // the {receiver} along the {effect}s.
-    if (IsSame(receiver, effect)) return kNoMaps;
+    if (IsSame(receiver, effect)) return kNoReceiverMaps;
 
     // Continue with the next {effect}.
     DCHECK_EQ(1, effect->op()->EffectInputCount());

src/compiler/node-properties.h

@@ -203,15 +203,15 @@ class V8_EXPORT_PRIVATE NodeProperties final {
   // Walks up the {effect} chain to find a witness that provides map
   // information about the {receiver}. Can look through potentially
   // side effecting nodes.
-  enum InferMapsResult {
-    kNoMaps,         // No maps inferred.
-    kReliableMaps,   // Maps can be trusted.
-    kUnreliableMaps  // Maps might have changed (side-effect).
+  enum InferReceiverMapsResult {
+    kNoReceiverMaps,         // No receiver maps inferred.
+    kReliableReceiverMaps,   // Receiver maps can be trusted.
+    kUnreliableReceiverMaps  // Receiver maps might have changed (side-effect).
   };
-  // DO NOT USE InferMapsUnsafe IN NEW CODE. Use MapInference instead.
-  static InferMapsResult InferMapsUnsafe(JSHeapBroker* broker, Node* object,
-                                         Node* effect,
-                                         ZoneHandleSet<Map>* maps);
+  // DO NOT USE InferReceiverMapsUnsafe IN NEW CODE. Use MapInference instead.
+  static InferReceiverMapsResult InferReceiverMapsUnsafe(
+      JSHeapBroker* broker, Node* receiver, Node* effect,
+      ZoneHandleSet<Map>* maps_return);
 
   // Return the initial map of the new-target if the allocation can be inlined.
   static base::Optional<MapRef> GetJSCreateMap(JSHeapBroker* broker,

src/compiler/opcodes.h

@@ -1116,7 +1116,6 @@ class V8_EXPORT_PRIVATE IrOpcode {
       case kJSInstanceOf:
       case kJSLoadGlobal:
       case kJSLoadNamed:
-      case kJSLoadNamedFromSuper:
       case kJSLoadProperty:
       case kJSStoreDataPropertyInLiteral:
       case kJSStoreGlobal:

src/compiler/property-access-builder.cc

@@ -82,30 +82,30 @@ bool PropertyAccessBuilder::TryBuildNumberCheck(
 }
 
 void PropertyAccessBuilder::BuildCheckMaps(
-    Node* object, Node** effect, Node* control,
-    ZoneVector<Handle<Map>> const& maps) {
-  HeapObjectMatcher m(object);
+    Node* receiver, Node** effect, Node* control,
+    ZoneVector<Handle<Map>> const& receiver_maps) {
+  HeapObjectMatcher m(receiver);
   if (m.HasResolvedValue()) {
-    MapRef object_map = m.Ref(broker()).map();
-    if (object_map.is_stable()) {
-      for (Handle<Map> map : maps) {
-        if (MapRef(broker(), map).equals(object_map)) {
-          dependencies()->DependOnStableMap(object_map);
+    MapRef receiver_map = m.Ref(broker()).map();
+    if (receiver_map.is_stable()) {
+      for (Handle<Map> map : receiver_maps) {
+        if (MapRef(broker(), map).equals(receiver_map)) {
+          dependencies()->DependOnStableMap(receiver_map);
           return;
         }
       }
     }
   }
-  ZoneHandleSet<Map> map_set;
+  ZoneHandleSet<Map> maps;
   CheckMapsFlags flags = CheckMapsFlag::kNone;
-  for (Handle<Map> map : maps) {
-    MapRef object_map(broker(), map);
-    map_set.insert(object_map.object(), graph()->zone());
-    if (object_map.is_migration_target()) {
+  for (Handle<Map> map : receiver_maps) {
+    MapRef receiver_map(broker(), map);
+    maps.insert(receiver_map.object(), graph()->zone());
+    if (receiver_map.is_migration_target()) {
       flags |= CheckMapsFlag::kTryMigrateInstance;
     }
   }
-  *effect = graph()->NewNode(simplified()->CheckMaps(flags, map_set), object,
+  *effect = graph()->NewNode(simplified()->CheckMaps(flags, maps), receiver,
                              *effect, control);
 }
 
@@ -124,12 +124,12 @@ Node* PropertyAccessBuilder::BuildCheckValue(Node* receiver, Effect* effect,
 }
 
 Node* PropertyAccessBuilder::ResolveHolder(
-    PropertyAccessInfo const& access_info, Node* lookup_start_object) {
+    PropertyAccessInfo const& access_info, Node* receiver) {
   Handle<JSObject> holder;
   if (access_info.holder().ToHandle(&holder)) {
     return jsgraph()->Constant(ObjectRef(broker(), holder));
   }
-  return lookup_start_object;
+  return receiver;
 }
 
 MachineRepresentation PropertyAccessBuilder::ConvertRepresentation(
@@ -150,27 +150,25 @@ MachineRepresentation PropertyAccessBuilder::ConvertRepresentation(
 
 Node* PropertyAccessBuilder::TryBuildLoadConstantDataField(
     NameRef const& name, PropertyAccessInfo const& access_info,
-    Node* lookup_start_object) {
+    Node* receiver) {
   if (!access_info.IsDataConstant()) return nullptr;
 
   // First, determine if we have a constant holder to load from.
   Handle<JSObject> holder;
   // If {access_info} has a holder, just use it.
   if (!access_info.holder().ToHandle(&holder)) {
-    // Otherwise, try to match the {lookup_start_object} as a constant.
-    HeapObjectMatcher m(lookup_start_object);
+    // Otherwise, try to match the {receiver} as a constant.
+    HeapObjectMatcher m(receiver);
     if (!m.HasResolvedValue() || !m.Ref(broker()).IsJSObject()) return nullptr;
 
-    // Let us make sure the actual map of the constant lookup_start_object is
-    // among the maps in {access_info}.
-    MapRef lookup_start_object_map = m.Ref(broker()).map();
-    if (std::find_if(
-            access_info.lookup_start_object_maps().begin(),
-            access_info.lookup_start_object_maps().end(), [&](Handle<Map> map) {
-              return MapRef(broker(), map).equals(lookup_start_object_map);
-            }) == access_info.lookup_start_object_maps().end()) {
-      // The map of the lookup_start_object is not in the feedback, let us bail
-      // out.
+    // Let us make sure the actual map of the constant receiver is among
+    // the maps in {access_info}.
+    MapRef receiver_map = m.Ref(broker()).map();
+    if (std::find_if(access_info.receiver_maps().begin(),
+                     access_info.receiver_maps().end(), [&](Handle<Map> map) {
+                       return MapRef(broker(), map).equals(receiver_map);
+                     }) == access_info.receiver_maps().end()) {
+      // The map of the receiver is not in the feedback, let us bail out.
       return nullptr;
     }
     holder = m.Ref(broker()).AsJSObject().object();
@@ -255,7 +253,7 @@ Node* PropertyAccessBuilder::BuildLoadDataField(NameRef const& name,
 
 Node* PropertyAccessBuilder::BuildMinimorphicLoadDataField(
     NameRef const& name, MinimorphicLoadPropertyAccessInfo const& access_info,
-    Node* lookup_start_object, Node** effect, Node** control) {
+    Node* receiver, Node** effect, Node** control) {
   DCHECK_NULL(dependencies());
   MachineRepresentation const field_representation =
       ConvertRepresentation(access_info.field_representation());
@@ -270,22 +268,22 @@ Node* PropertyAccessBuilder::BuildMinimorphicLoadDataField(
       kFullWriteBarrier,
       LoadSensitivity::kCritical,
       ConstFieldInfo::None()};
-  return BuildLoadDataField(name, lookup_start_object, field_access,
+  return BuildLoadDataField(name, receiver, field_access,
                             access_info.is_inobject(), effect, control);
 }
 
 Node* PropertyAccessBuilder::BuildLoadDataField(
-    NameRef const& name, PropertyAccessInfo const& access_info,
-    Node* lookup_start_object, Node** effect, Node** control) {
+    NameRef const& name, PropertyAccessInfo const& access_info, Node* receiver,
+    Node** effect, Node** control) {
   DCHECK(access_info.IsDataField() || access_info.IsDataConstant());
-  if (Node* value = TryBuildLoadConstantDataField(name, access_info,
-                                                  lookup_start_object)) {
+  if (Node* value =
+          TryBuildLoadConstantDataField(name, access_info, receiver)) {
     return value;
   }
 
   MachineRepresentation const field_representation =
       ConvertRepresentation(access_info.field_representation());
-  Node* storage = ResolveHolder(access_info, lookup_start_object);
+  Node* storage = ResolveHolder(access_info, receiver);
 
   FieldAccess field_access = {
       kTaggedBase,

src/compiler/property-access-builder.h

@@ -45,13 +45,13 @@ class PropertyAccessBuilder {
 
   // TODO(jgruber): Remove the untyped version once all uses are
   // updated.
-  void BuildCheckMaps(Node* object, Node** effect, Node* control,
-                      ZoneVector<Handle<Map>> const& maps);
-  void BuildCheckMaps(Node* object, Effect* effect, Control control,
-                      ZoneVector<Handle<Map>> const& maps) {
+  void BuildCheckMaps(Node* receiver, Node** effect, Node* control,
+                      ZoneVector<Handle<Map>> const& receiver_maps);
+  void BuildCheckMaps(Node* receiver, Effect* effect, Control control,
+                      ZoneVector<Handle<Map>> const& receiver_maps) {
     Node* e = *effect;
     Node* c = control;
-    BuildCheckMaps(object, &e, c, maps);
+    BuildCheckMaps(receiver, &e, c, receiver_maps);
     *effect = e;
   }
   Node* BuildCheckValue(Node* receiver, Effect* effect, Control control,
@@ -61,14 +61,13 @@ class PropertyAccessBuilder {
   // properties (without heap-object or map checks).
   Node* BuildLoadDataField(NameRef const& name,
                            PropertyAccessInfo const& access_info,
-                           Node* lookup_start_object, Node** effect,
-                           Node** control);
+                           Node* receiver, Node** effect, Node** control);
 
   // Builds the load for data-field access for minimorphic loads that use
   // dynamic map checks. These cannot depend on any information from the maps.
   Node* BuildMinimorphicLoadDataField(
       NameRef const& name, MinimorphicLoadPropertyAccessInfo const& access_info,
-      Node* lookup_start_object, Node** effect, Node** control);
+      Node* receiver, Node** effect, Node** control);
 
   static MachineRepresentation ConvertRepresentation(
       Representation representation);
@@ -84,11 +83,10 @@ class PropertyAccessBuilder {
 
   Node* TryBuildLoadConstantDataField(NameRef const& name,
                                       PropertyAccessInfo const& access_info,
-                                      Node* lookup_start_object);
+                                      Node* receiver);
   // Returns a node with the holder for the property access described by
   // {access_info}.
-  Node* ResolveHolder(PropertyAccessInfo const& access_info,
-                      Node* lookup_start_object);
+  Node* ResolveHolder(PropertyAccessInfo const& access_info, Node* receiver);
 
   Node* BuildLoadDataField(NameRef const& name, Node* holder,
                            FieldAccess& field_access, bool is_inobject,

test/mjsunit/es6/super-ic-opt-dynamic-map-checks.js

-// Copyright 2020 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --allow-natives-syntax --super-ic --opt --runtime-call-stats
-// Flags: --no-always-opt --no-stress-opt --turboprop
-// Flags: --turboprop-dynamic-map-checks
-
-load("test/mjsunit/runtime-callstats-helpers.js");
-
-%GetAndResetRuntimeCallStats();
-
-// This file contains tests which require --dynamic-map-chekcs.
-
-(function TestMinimorphicPropertyAccess() {
-  class A {}
-  A.prototype.bar = "wrong value: A.prototype.bar";
-
-  class B extends A {};
-  B.prototype.bar = "correct value";
-
-  class C extends B {
-    foo(should_bailout) {
-      const r = super.bar;
-      const did_bailout = (
-          %GetOptimizationStatus(C.prototype.foo) &
-          V8OptimizationStatus.kTopmostFrameIsTurboFanned) == 0;
-      assertEquals(should_bailout, did_bailout);
-      return r;
-    }
-  }
-  C.prototype.bar = "wrong value: C.prototype.bar";
-  %PrepareFunctionForOptimization(C.prototype.foo);
-
-  let o = new C();
-  o.bar = "wrong value: o.bar";
-
-  // Fill in the feedback.
-  let r = o.foo(true);
-  assertEquals("correct value", r);
-  %OptimizeFunctionOnNextCall(C.prototype.foo);
-
-  // Test the optimized function.
-  r = o.foo(false);
-  assertEquals("correct value", r);
-})();
-
-// Assert that the tests so far generated real optimized code and not just a
-// bailout to Runtime_LoadFromSuper. TODO(marja, v8:9237): update this to track
-// the builtin we'll use for bailout cases.
-assertEquals(0, getRuntimeFunctionCallCount("LoadFromSuper"));
-
-// Reset runtime stats so that we don't get extra printout.
-%GetAndResetRuntimeCallStats();

test/mjsunit/es6/super-ic-opt-no-turboprop.js

-// Copyright 2020 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --allow-natives-syntax --super-ic --opt --runtime-call-stats
-// Flags: --no-always-opt --no-stress-opt
-
-load("test/mjsunit/runtime-callstats-helpers.js");
-
-%GetAndResetRuntimeCallStats();
-
-// This file contains tests which are disabled for TurboProp. TurboProp deopts
-// differently than TurboFan, so the assertions about when a function is
-// deoptimized won't hold.
-
-(function TestPropertyIsConstant() {
-  // Test for a case where the property is a constant found in the lookup start
-  // object.
-  class A {}
-  A.prototype.bar = "wrong value: A.prototype.bar";
-
-  class B extends A {};
-  B.prototype.bar = "correct value";
-
-  class C extends B {
-    foo() { return super.bar; }
-  }
-  C.prototype.bar = "wrong value: C.prototype.bar";
-  %PrepareFunctionForOptimization(C.prototype.foo);
-
-  let o = new C();
-  o.bar = "wrong value: o.bar";
-
-  // Fill in the feedback.
-  r = o.foo();
-  assertEquals("correct value", r);
-
-  %OptimizeFunctionOnNextCall(C.prototype.foo);
-
-  // Test the optimized function.
-  r = o.foo();
-  assertEquals("correct value", r);
-
-  // Assert that the function was not deoptimized.
-  assertOptimized(C.prototype.foo);
-
-  // Change the property value.
-  B.prototype.bar = "new value";
-  r = o.foo();
-  assertEquals("new value", r);
-
-  // Assert that the function was deoptimized (dependency to the constant
-  // value).
-  assertFalse(isOptimized(C.prototype.foo));
-})();
-
-// Assert that the tests so far generated real optimized code and not just a
-// bailout to Runtime_LoadFromSuper. TODO(marja, v8:9237): update this to track
-// the builtin we'll use for bailout cases.
-assertEquals(0, getRuntimeFunctionCallCount("LoadFromSuper"));
-
-// Reset runtime stats so that we don't get extra printout.
-%GetAndResetRuntimeCallStats();

test/mjsunit/mjsunit.status

@@ -1144,7 +1144,6 @@
   'compiler/number-comparison-truncations': [SKIP],
   'compiler/redundancy-elimination': [SKIP],
   'compiler/regress-9945-*': [SKIP],
-  'es6/super-ic-opt-no-turboprop': [SKIP],
 
   # Static asserts for optimizations don't hold due to removed optimization
   # phases.
@@ -1433,8 +1432,6 @@
   'compiler/serializer-feedback-propagation-1': [SKIP],
   'compiler/serializer-feedback-propagation-2': [SKIP],
   'compiler/serializer-transition-propagation': [SKIP],
-  # crbug.com/v8/11110
-  'es6/super-ic-opt*': [SKIP],
 }],  # variant == nci or variant == nci_as_midtier
 
 ['((arch == mipsel or arch == mips64el or arch == mips or arch == mips64) and not simd_mips) or (arch in [ppc64, s390x])', {

test/mjsunit/regress-1146106.js

-// Copyright 2020 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --allow-natives-syntax --concurrent-inlining --no-use-ic --super-ic
-
-class A {
-  bar() { }
-}
-class B extends A {
-  foo() {
-    return super.bar();
-  }
-}
-%PrepareFunctionForOptimization(B.prototype.foo);
-new B().foo();
-%OptimizeFunctionOnNextCall(B.prototype.foo);
-new B().foo();

test/mjsunit/runtime-callstats-helpers.js

@@ -14,7 +14,7 @@ function getRuntimeFunctionCallCount(function_name) {
     const line = lines[i];
     const m = line.match(/(?<name>\S+)\s+\S+\s+\S+\s+(?<count>\S+)/);
     if (function_name == m.groups.name) {
-      return parseInt(m.groups.count);
+      return m.groups.count;
     }
   }
   return 0;