[turboprop] Loop over polymorphic array in builtin

Instead of just comparing the first 4 elements, load and loop
over the entire array so that we don't miss out on deprecate
maps.

Bug: v8:10582
Change-Id: I67542e2ab24367a11a4bb84b6745a4fa80c42772
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2524441
Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71141}

src/builtins/base.tq

@@ -1712,8 +1712,7 @@ macro ConstantIterator<T: type>(value: T): ConstantIterator<T> {
   return ConstantIterator{value};
 }
 
-extern macro FeedbackIteratorSizeFor(constexpr int32): intptr;
-extern macro FeedbackIteratorMapIndexForEntry(constexpr int32): intptr;
-extern macro FeedbackIteratorHandlerIndexForEntry(constexpr int32): intptr;
+extern macro FeedbackIteratorEntrySize(): intptr;
+extern macro FeedbackIteratorHandlerOffset(): intptr;
 extern operator '[]' macro LoadWeakFixedArrayElement(
     WeakFixedArray, intptr): MaybeObject;

src/builtins/ic-dynamic-map-checks.tq

@@ -13,74 +13,36 @@ const kDeopt: constexpr int32
 extern runtime TryMigrateInstance(implicit context: Context)(Object): Object;
 extern macro LoadFeedbackVectorForStub(): FeedbackVector;
 
-macro PerformMapAndHandlerCheck(
-    entry: constexpr int32, polymorphicArray: WeakFixedArray,
-    weakActualMap: WeakHeapObject,
-    actualHandler: Smi|DataHandler): void labels Next,
-    Deopt {
-  const mapIndex = FeedbackIteratorMapIndexForEntry(entry);
-  assert(mapIndex < polymorphicArray.length_intptr);
-
-  const maybeCachedMap = UnsafeCast<WeakHeapObject>(polymorphicArray[mapIndex]);
-  if (maybeCachedMap != weakActualMap) {
-    goto Next;
-  }
-
-  const handlerIndex = FeedbackIteratorHandlerIndexForEntry(entry);
-  assert(handlerIndex < polymorphicArray.length_intptr);
-  const maybeHandler =
-      Cast<Object>(polymorphicArray[handlerIndex]) otherwise unreachable;
-  if (TaggedNotEqual(maybeHandler, actualHandler)) {
-    goto Deopt;
-  }
-}
-
 macro PerformPolymorphicCheck(
     expectedPolymorphicArray: HeapObject, actualMap: Map,
     actualHandler: Smi|DataHandler): int32 {
   if (!Is<WeakFixedArray>(expectedPolymorphicArray)) {
     return kDeopt;
   }
-  try {
-    const polymorphicArray =
-        UnsafeCast<WeakFixedArray>(expectedPolymorphicArray);
-    const weakActualMap = MakeWeak(actualMap);
-    const length = polymorphicArray.length_intptr;
-    assert(length > 0);
 
-    try {
-      if (length >= FeedbackIteratorSizeFor(4)) goto Len4;
-      if (length == FeedbackIteratorSizeFor(3)) goto Len3;
-      if (length == FeedbackIteratorSizeFor(2)) goto Len2;
-      if (length == FeedbackIteratorSizeFor(1)) goto Len1;
+  const polymorphicArray = UnsafeCast<WeakFixedArray>(expectedPolymorphicArray);
+  const weakActualMap = MakeWeak(actualMap);
+  const length = polymorphicArray.length_intptr;
+  assert(length > 0);
 
-      unreachable;
-    } label Len4 {
-      PerformMapAndHandlerCheck(
-          3, polymorphicArray, weakActualMap, actualHandler) otherwise Len3,
-          Deopt;
-      return kSuccess;
-    } label Len3 {
-      PerformMapAndHandlerCheck(
-          2, polymorphicArray, weakActualMap, actualHandler) otherwise Len2,
-          Deopt;
-      return kSuccess;
-    } label Len2 {
-      PerformMapAndHandlerCheck(
-          1, polymorphicArray, weakActualMap, actualHandler) otherwise Len1,
-          Deopt;
-      return kSuccess;
-    } label Len1 {
-      PerformMapAndHandlerCheck(
-          0, polymorphicArray, weakActualMap, actualHandler)
-          otherwise Bailout, Deopt;
-      return kSuccess;
+  for (let mapIndex: intptr = 0; mapIndex < length;
+       mapIndex += FeedbackIteratorEntrySize()) {
+    const maybeCachedMap =
+        UnsafeCast<WeakHeapObject>(polymorphicArray[mapIndex]);
+    if (maybeCachedMap == weakActualMap) {
+      const handlerIndex = mapIndex + FeedbackIteratorHandlerOffset();
+      assert(handlerIndex < length);
+      const maybeHandler =
+          Cast<Object>(polymorphicArray[handlerIndex]) otherwise unreachable;
+      if (TaggedEqual(maybeHandler, actualHandler)) {
+        return kSuccess;
+      } else {
+        return kDeopt;
+      }
     }
-  } label Bailout {
-    return kBailout;
-  } label Deopt {
-    return kDeopt;
   }
+
+  return kBailout;
 }
 
 macro PerformMonomorphicCheck(

src/codegen/code-stub-assembler.h

@@ -3631,16 +3631,12 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
       TNode<JSFinalizationRegistry> finalization_registry,
       TNode<WeakCell> weak_cell);
 
-  TNode<IntPtrT> FeedbackIteratorSizeFor(int number_of_entries) {
-    return IntPtrConstant(FeedbackIterator::SizeFor(number_of_entries));
+  TNode<IntPtrT> FeedbackIteratorEntrySize() {
+    return IntPtrConstant(FeedbackIterator::kEntrySize);
   }
 
-  TNode<IntPtrT> FeedbackIteratorMapIndexForEntry(int entry) {
-    return IntPtrConstant(FeedbackIterator::MapIndexForEntry(entry));
-  }
-
-  TNode<IntPtrT> FeedbackIteratorHandlerIndexForEntry(int entry) {
-    return IntPtrConstant(FeedbackIterator::HandlerIndexForEntry(entry));
+  TNode<IntPtrT> FeedbackIteratorHandlerOffset() {
+    return IntPtrConstant(FeedbackIterator::kHandlerOffset);
   }
 
  private:

src/objects/feedback-vector.h

@@ -875,12 +875,13 @@ class V8_EXPORT_PRIVATE FeedbackIterator final {
     return (entry * kEntrySize) + kHandlerOffset;
   }
 
+  static constexpr int kEntrySize = 2;
+  static constexpr int kHandlerOffset = 1;
+
  private:
   void AdvancePolymorphic();
   enum State { kMonomorphic, kPolymorphic, kOther };
 
-  static constexpr int kEntrySize = 2;
-  static constexpr int kHandlerOffset = 1;
   Handle<WeakFixedArray> polymorphic_feedback_;
   Map map_;
   MaybeObject handler_;