Revert of Provide call counts for constructor calls, surface them as a vector IC.

src/compiler/js-call-reducer.cc

Index: src/compiler/js-call-reducer.cc
diff --git a/src/compiler/js-call-reducer.cc b/src/compiler/js-call-reducer.cc
index 102191551b8980308998e0c260e22c9b2878dae6..d46ade2f8410d5fcc85bf2ea5963db4a97df52a7 100644
--- a/src/compiler/js-call-reducer.cc
+++ b/src/compiler/js-call-reducer.cc
@@ -252,7 +252,7 @@
   // Extract feedback from the {node} using the CallICNexus.
   if (!p.feedback().IsValid()) return NoChange();
   CallICNexus nexus(p.feedback().vector(), p.feedback().slot());
-  Handle<Object> feedback = nexus.GetCallFeedback();
+  Handle<Object> feedback(nexus.GetFeedback(), isolate());
   if (feedback->IsAllocationSite()) {
     // Retrieve the Array function from the {node}.
     Node* array_function;
@@ -287,30 +287,34 @@
     NodeProperties::ReplaceEffectInput(node, effect);
     NodeProperties::ReplaceControlInput(node, control);
     return ReduceArrayConstructor(node);
-  } else if (feedback->IsJSFunction()) {
-    Node* target_function = jsgraph()->Constant(feedback);
-
-    // Check that the {target} is still the {target_function}.
-    Node* check = effect =
-        graph()->NewNode(javascript()->StrictEqual(), target, target_function,
-                         context, effect, control);
-    Node* branch =
-        graph()->NewNode(common()->Branch(BranchHint::kTrue), check, control);
-    Node* if_false = graph()->NewNode(common()->IfFalse(), branch);
-    Node* deoptimize =
-        graph()->NewNode(common()->Deoptimize(), frame_state, effect, if_false);
-    // TODO(bmeurer): This should be on the AdvancedReducer somehow.
-    NodeProperties::MergeControlToEnd(graph(), common(), deoptimize);
-    control = graph()->NewNode(common()->IfTrue(), branch);
-
-    // Specialize the JSCallFunction node to the {target_function}.
-    NodeProperties::ReplaceValueInput(node, target_function, 0);
-    NodeProperties::ReplaceEffectInput(node, effect);
-    NodeProperties::ReplaceControlInput(node, control);
-
-    // Try to further reduce the JSCallFunction {node}.
-    Reduction const reduction = ReduceJSCallFunction(node);
-    return reduction.Changed() ? reduction : Changed(node);
+  } else if (feedback->IsWeakCell()) {
+    Handle<WeakCell> cell = Handle<WeakCell>::cast(feedback);
+    if (cell->value()->IsJSFunction()) {
+      Node* target_function =
+          jsgraph()->Constant(handle(cell->value(), isolate()));
+
+      // Check that the {target} is still the {target_function}.
+      Node* check = effect =
+          graph()->NewNode(javascript()->StrictEqual(), target, target_function,
+                           context, effect, control);
+      Node* branch =
+          graph()->NewNode(common()->Branch(BranchHint::kTrue), check, control);
+      Node* if_false = graph()->NewNode(common()->IfFalse(), branch);
+      Node* deoptimize = graph()->NewNode(common()->Deoptimize(), frame_state,
+                                          effect, if_false);
+      // TODO(bmeurer): This should be on the AdvancedReducer somehow.
+      NodeProperties::MergeControlToEnd(graph(), common(), deoptimize);
+      control = graph()->NewNode(common()->IfTrue(), branch);
+
+      // Specialize the JSCallFunction node to the {target_function}.
+      NodeProperties::ReplaceValueInput(node, target_function, 0);
+      NodeProperties::ReplaceEffectInput(node, effect);
+      NodeProperties::ReplaceControlInput(node, control);
+
+      // Try to further reduce the JSCallFunction {node}.
+      Reduction const reduction = ReduceJSCallFunction(node);
+      return reduction.Changed() ? reduction : Changed(node);
+    }
   }
   return NoChange();
 }
@@ -381,9 +385,9 @@
   if (!(flags() & kDeoptimizationEnabled)) return NoChange();
 
   // TODO(mvstanton): Use ConstructICNexus here, once available.
+  Handle<Object> feedback;
   if (!p.feedback().IsValid()) return NoChange();
-  ConstructICNexus nexus(p.feedback().vector(), p.feedback().slot());
-  Handle<Object> feedback = nexus.GetCallFeedback();
+  feedback = handle(p.feedback().vector()->Get(p.feedback().slot()), isolate());
   if (feedback->IsAllocationSite()) {
     // The feedback is an AllocationSite, which means we have called the
     // Array function and collected transition (and pretenuring) feedback
@@ -430,33 +434,37 @@
     NodeProperties::ReplaceValueInput(node, new_target, 1);
     NodeProperties::ChangeOp(node, javascript()->CreateArray(arity, site));
     return Changed(node);
-  } else if (feedback->IsJSFunction()) {
-    Node* target_function = jsgraph()->Constant(feedback);
-
-    // Check that the {target} is still the {target_function}.
-    Node* check = effect =
-        graph()->NewNode(javascript()->StrictEqual(), target, target_function,
-                         context, effect, control);
-    Node* branch =
-        graph()->NewNode(common()->Branch(BranchHint::kTrue), check, control);
-    Node* if_false = graph()->NewNode(common()->IfFalse(), branch);
-    Node* deoptimize =
-        graph()->NewNode(common()->Deoptimize(), frame_state, effect, if_false);
-    // TODO(bmeurer): This should be on the AdvancedReducer somehow.
-    NodeProperties::MergeControlToEnd(graph(), common(), deoptimize);
-    control = graph()->NewNode(common()->IfTrue(), branch);
-
-    // Specialize the JSCallConstruct node to the {target_function}.
-    NodeProperties::ReplaceValueInput(node, target_function, 0);
-    NodeProperties::ReplaceEffectInput(node, effect);
-    NodeProperties::ReplaceControlInput(node, control);
-    if (target == new_target) {
-      NodeProperties::ReplaceValueInput(node, target_function, arity + 1);
-    }
-
-    // Try to further reduce the JSCallConstruct {node}.
-    Reduction const reduction = ReduceJSCallConstruct(node);
-    return reduction.Changed() ? reduction : Changed(node);
+  } else if (feedback->IsWeakCell()) {
+    Handle<WeakCell> cell = Handle<WeakCell>::cast(feedback);
+    if (cell->value()->IsJSFunction()) {
+      Node* target_function =
+          jsgraph()->Constant(handle(cell->value(), isolate()));
+
+      // Check that the {target} is still the {target_function}.
+      Node* check = effect =
+          graph()->NewNode(javascript()->StrictEqual(), target, target_function,
+                           context, effect, control);
+      Node* branch =
+          graph()->NewNode(common()->Branch(BranchHint::kTrue), check, control);
+      Node* if_false = graph()->NewNode(common()->IfFalse(), branch);
+      Node* deoptimize = graph()->NewNode(common()->Deoptimize(), frame_state,
+                                          effect, if_false);
+      // TODO(bmeurer): This should be on the AdvancedReducer somehow.
+      NodeProperties::MergeControlToEnd(graph(), common(), deoptimize);
+      control = graph()->NewNode(common()->IfTrue(), branch);
+
+      // Specialize the JSCallConstruct node to the {target_function}.
+      NodeProperties::ReplaceValueInput(node, target_function, 0);
+      NodeProperties::ReplaceEffectInput(node, effect);
+      NodeProperties::ReplaceControlInput(node, control);
+      if (target == new_target) {
+        NodeProperties::ReplaceValueInput(node, target_function, arity + 1);
+      }
+
+      // Try to further reduce the JSCallConstruct {node}.
+      Reduction const reduction = ReduceJSCallConstruct(node);
+      return reduction.Changed() ? reduction : Changed(node);
+    }
   }
 
   return NoChange();