Disable one shot optimizations

We used to optimize functions that are expected to executed only
once by not allocating feedback slots for some of the bytecodes. This
would help in reducing the memory and avoiding initializing feedback
that would be never used. With lazy feedback allocation, we don't
allocate feedback vectors for most of such functions anyway.

The generated bytecode for oneshot optimized functions is different and
if we don't properly track this information we might end up generating
different bytecode for the same function. This could causes problems
when there is a mismatch between the feedback slots used by the new
bytecode and the old bytecode. Since we potentially get most of the
benefits of this optimization with lazy feedback vector allocation
we can simplify the code by disabling this optimization.

Bug: chromium:1045824
Change-Id: Ib94605c8c766adc99f54c8333f780d2448caff5e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2030918Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66172}

src/flags/flag-definitions.h

@@ -399,7 +399,7 @@ DEFINE_BOOL_READONLY(internalize_on_the_fly, true,
                      "internalize string keys for generic keyed ICs on the fly")
 
 // Flag for one shot optimiztions.
-DEFINE_BOOL(enable_one_shot_optimization, true,
+DEFINE_BOOL(enable_one_shot_optimization, false,
             "Enable size optimizations for the code that will "
             "only be executed once")
 

test/mjsunit/harmony/weakrefs/finalization-group-keeps-holdings-alive.js

@@ -19,13 +19,18 @@ let cleanup = function(iter) {
 let fg = new FinalizationGroup(cleanup);
 let o1 = {};
 let holdings = {'a': 'this is the holdings object'};
-fg.register(o1, holdings);
+
+// Ignition holds references to objects in temporary registers. These will be
+// released when the function exits. So only access o inside a function to
+// prevent any references to objects in temporary registers when a gc is
+// triggered.
+(() => {fg.register(o1, holdings);})()
 
 gc();
 assertFalse(cleanup_called);
 
 // Drop the last references to o1.
-o1 = null;
+(() => {o1 = null;})()
 
 // Drop the last reference to the holdings. The FinalizationGroup keeps it
 // alive, so the cleanup function will be called as normal.

test/mjsunit/harmony/weakrefs/finalizationgroup-scheduled-for-cleanup-multiple-times.js

@@ -40,11 +40,11 @@ let fg1 = new FinalizationGroup(cleanup1);
 
   // Drop the references to the objects.
   objects = [];
-
-  // Will schedule both fg0 and fg1 for cleanup.
-  gc();
 })();
 
+// Will schedule both fg0 and fg1 for cleanup.
+gc();
+
 // Before the cleanup task has a chance to run, do the same thing again, so both
 // FinalizationGroups are (again) scheduled for cleanup. This has to be a IIFE function
 // (so that we can reliably kill the objects) so we cannot use the same function
@@ -56,9 +56,10 @@ let fg1 = new FinalizationGroup(cleanup1);
   fg0.register(objects[0], "holdings0-1");
   fg1.register(objects[1], "holdings1-1");
   objects = [];
-  gc();
 })();
 
+gc();
+
 let timeout_func = function() {
   assertEquals(1, cleanup0_call_count);
   assertEquals(2, cleanup0_holdings_count);

test/mjsunit/harmony/weakrefs/iterating-in-cleanup.js

@@ -24,15 +24,24 @@ let cleanup = function(iter) {
 let fg = new FinalizationGroup(cleanup);
 let o1 = {};
 let o2 = {};
-fg.register(o1, 1);
-fg.register(o2, 2);
+
+// Ignition holds references to objects in temporary registers. These will be
+// released when the function exits. So only access o inside a function to
+// prevent any references to objects in temporary registers when a gc is
+(function() {
+  fg.register(o1, 1);
+  fg.register(o2, 2);
+})();
 
 gc();
 assertFalse(cleanup_called);
 
 // Drop the last references to o1 and o2.
-o1 = null;
-o2 = null;
+(function() {
+  o1 = null;
+  o2 = null;
+})();
+
 // GC will reclaim the target objects; the cleanup function will be called the
 // next time we enter the event loop.
 gc();

test/mjsunit/harmony/weakrefs/weak-cell-basics.js

@@ -18,13 +18,19 @@ let cleanup = function(iter) {
 let fg = new FinalizationGroup(cleanup);
 let o = {};
 let holdings = {'h': 55};
-fg.register(o, holdings);
+
+// Ignition holds references to objects in temporary registers. These will be
+// released when the function exits. So only access o inside a function to
+// prevent any references to objects in temporary registers when a gc is
+// triggered.
+(() => { fg.register(o, holdings); })()
 
 gc();
 assertFalse(cleanup_called);
 
 // Drop the last reference to o.
-o = null;
+(() => { o = null; })()
+
 // GC will clear the WeakCell; the cleanup function will be called the next time
 // we enter the event loop.
 gc();