[osr] For early OSR, install through the install target

.. instead of through urgency. Whenever we target a specific JumpLoop,
the install target should be used instead of the generic urgency
mechanism.

Bug: v8:12161
Change-Id: I2e5cb604ce237bcc788dfc4288150881510bf6af
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3578800Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Jakob Linke <jgruber@chromium.org>
Auto-Submit: Jakob Linke <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79981}

src/execution/tiering-manager.cc

@@ -139,8 +139,7 @@ void TraceManualRecompile(JSFunction function, CodeKind code_kind,
   }
 }
 
-void TieringManager::Optimize(JSFunction function, CodeKind code_kind,
-                              OptimizationDecision d) {
+void TieringManager::Optimize(JSFunction function, OptimizationDecision d) {
   DCHECK(d.should_optimize());
   TraceRecompile(isolate_, function, d);
   function.MarkForOptimization(isolate_, d.code_kind, d.concurrency_mode);
@@ -149,7 +148,7 @@ void TieringManager::Optimize(JSFunction function, CodeKind code_kind,
 namespace {
 
 bool HaveCachedOSRCodeForCurrentBytecodeOffset(UnoptimizedFrame* frame,
-                                               int* osr_urgency_out) {
+                                               BytecodeOffset* osr_offset_out) {
   JSFunction function = frame->function();
   const int current_offset = frame->GetBytecodeOffset();
   OSROptimizedCodeCache cache = function.native_context().osr_code_cache();
@@ -160,9 +159,7 @@ bool HaveCachedOSRCodeForCurrentBytecodeOffset(UnoptimizedFrame* frame,
     iterator.SetOffset(osr_offset.ToInt());
     if (base::IsInRange(current_offset, iterator.GetJumpTargetOffset(),
                         osr_offset.ToInt())) {
-      int loop_depth = iterator.GetImmediateOperand(1);
-      // `+ 1` because osr_urgency is an exclusive upper limit on the depth.
-      *osr_urgency_out = loop_depth + 1;
+      *osr_offset_out = osr_offset;
       return true;
     }
   }
@@ -246,13 +243,23 @@ void TryRequestOsrAtNextOpportunity(Isolate* isolate, JSFunction function) {
   TrySetOsrUrgency(isolate, function, BytecodeArray::kMaxOsrUrgency);
 }
 
-void TryRequestOsrForCachedOsrCode(Isolate* isolate, JSFunction function,
-                                   int osr_urgency_for_cached_osr_code) {
-  DCHECK_LE(osr_urgency_for_cached_osr_code, BytecodeArray::kMaxOsrUrgency);
-  int old_urgency = function.shared().GetBytecodeArray(isolate).osr_urgency();
-  // Make sure not to decrease the existing urgency.
-  int new_urgency = std::max(old_urgency, osr_urgency_for_cached_osr_code);
-  TrySetOsrUrgency(isolate, function, new_urgency);
+void TrySetOsrInstallTarget(Isolate* isolate, JSFunction function,
+                            BytecodeOffset osr_offset) {
+  DCHECK(!osr_offset.IsNone());
+  SharedFunctionInfo shared = function.shared();
+
+  if (V8_UNLIKELY(!FLAG_use_osr)) return;
+  if (V8_UNLIKELY(!shared.IsUserJavaScript())) return;
+  if (V8_UNLIKELY(shared.optimization_disabled())) return;
+
+  BytecodeArray bytecode = shared.GetBytecodeArray(isolate);
+  if (V8_UNLIKELY(FLAG_trace_osr)) {
+    PrintF(CodeTracer::Scope{isolate->GetCodeTracer()}.file(),
+           "[OSR - requesting install. function: %s, osr offset: %d]\n",
+           function.DebugNameCStr().get(), osr_offset.ToInt());
+  }
+
+  bytecode.set_osr_install_target(osr_offset);
 }
 
 bool ShouldOptimizeAsSmallFunction(int bytecode_size, bool any_ic_changed) {
@@ -297,11 +304,10 @@ void TieringManager::MaybeOptimizeFrame(JSFunction function,
   }
 
   // If we have matching cached OSR'd code, request OSR at the next opportunity.
-  int osr_urgency_for_cached_osr_code;
+  BytecodeOffset osr_offset_for_cached_osr_code = BytecodeOffset::None();
   if (HaveCachedOSRCodeForCurrentBytecodeOffset(
-          frame, &osr_urgency_for_cached_osr_code)) {
-    TryRequestOsrForCachedOsrCode(isolate_, function,
-                                  osr_urgency_for_cached_osr_code);
+          frame, &osr_offset_for_cached_osr_code)) {
+    TrySetOsrInstallTarget(isolate_, function, osr_offset_for_cached_osr_code);
   }
 
   const bool is_marked_for_any_optimization =
@@ -321,7 +327,7 @@ void TieringManager::MaybeOptimizeFrame(JSFunction function,
   DCHECK(!is_marked_for_any_optimization &&
          !function.HasAvailableOptimizedCode());
   OptimizationDecision d = ShouldOptimize(function, code_kind, frame);
-  if (d.should_optimize()) Optimize(function, code_kind, d);
+  if (d.should_optimize()) Optimize(function, d);
 }
 
 OptimizationDecision TieringManager::ShouldOptimize(JSFunction function,

src/execution/tiering-manager.h

@@ -49,8 +49,7 @@ class TieringManager {
 
   OptimizationDecision ShouldOptimize(JSFunction function, CodeKind code_kind,
                                       JavaScriptFrame* frame);
-  void Optimize(JSFunction function, CodeKind code_kind,
-                OptimizationDecision decision);
+  void Optimize(JSFunction function, OptimizationDecision decision);
   void Baseline(JSFunction function, OptimizationReason reason);
 
   class V8_NODISCARD OnInterruptTickScope final {