[turbofan] Use unreliable LOAD_IC feedback for Array.prototype.push.

src/compiler/node-properties.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/node-properties.h"
 #include "src/compiler/common-operator.h"
 #include "src/compiler/graph.h"
 #include "src/compiler/js-operator.h"
 #include "src/compiler/linkage.h"
 #include "src/compiler/node-matchers.h"
@@ skipping 315 matching lines @@
     }
     if (b->opcode() == IrOpcode::kCheckHeapObject) {
       b = GetValueInput(b, 0);
       continue;
     }
     return a == b;
   }
 }
 
 // static
-bool NodeProperties::InferReceiverMaps(Node* receiver, Node* effect,
-                                       ZoneHandleSet<Map>* maps_return) {
+NodeProperties::InferReceiverMapsResult NodeProperties::InferReceiverMaps(
+    Node* receiver, Node* effect, ZoneHandleSet<Map>* maps_return) {
   HeapObjectMatcher m(receiver);
   if (m.HasValue()) {
     Handle<Map> receiver_map(m.Value()->map());
     if (receiver_map->is_stable()) {
+      // The {receiver_map} is only reliable when we install a stability
+      // code dependency.
       *maps_return = ZoneHandleSet<Map>(receiver_map);
-      return true;
+      return kUnreliableReceiverMaps;
     }
   }
+  InferReceiverMapsResult result = kReliableReceiverMaps;
   while (true) {
     switch (effect->opcode()) {
       case IrOpcode::kCheckMaps: {
         Node* const object = GetValueInput(effect, 0);
         if (IsSame(receiver, object)) {
           *maps_return = CheckMapsParametersOf(effect->op()).maps();
-          return true;
+          return result;
         }
         break;
       }
       case IrOpcode::kJSCreate: {
         if (IsSame(receiver, effect)) {
           HeapObjectMatcher mtarget(GetValueInput(effect, 0));
           HeapObjectMatcher mnewtarget(GetValueInput(effect, 1));
           if (mtarget.HasValue() && mnewtarget.HasValue()) {
             Handle<JSFunction> original_constructor =
                 Handle<JSFunction>::cast(mnewtarget.Value());
             if (original_constructor->has_initial_map()) {
               Handle<Map> initial_map(original_constructor->initial_map());
               if (initial_map->constructor_or_backpointer() ==
                   *mtarget.Value()) {
                 *maps_return = ZoneHandleSet<Map>(initial_map);
-                return true;
+                return result;
               }
             }
           }
           // We reached the allocation of the {receiver}.
-          return false;
+          return kNoReceiverMaps;
         }
         break;
       }
       case IrOpcode::kStoreField: {
         // We only care about StoreField of maps.
         Node* const object = GetValueInput(effect, 0);
         FieldAccess const& access = FieldAccessOf(effect->op());
         if (access.base_is_tagged == kTaggedBase &&
             access.offset == HeapObject::kMapOffset) {
           if (IsSame(receiver, object)) {
             Node* const value = GetValueInput(effect, 1);
             HeapObjectMatcher m(value);
             if (m.HasValue()) {
               *maps_return = ZoneHandleSet<Map>(Handle<Map>::cast(m.Value()));
-              return true;
+              return result;
             }
           }
           // Without alias analysis we cannot tell whether this
           // StoreField[map] affects {receiver} or not.
-          return false;
+          result = kUnreliableReceiverMaps;
         }
         break;
       }
       case IrOpcode::kJSStoreMessage:
       case IrOpcode::kJSStoreModule:
       case IrOpcode::kStoreElement:
       case IrOpcode::kStoreTypedElement: {
         // These never change the map of objects.
         break;
       }
       default: {
         DCHECK_EQ(1, effect->op()->EffectOutputCount());
-        if (effect->op()->EffectInputCount() != 1 ||
-            !effect->op()->HasProperty(Operator::kNoWrite)) {
+        if (effect->op()->EffectInputCount() != 1) {
           // Didn't find any appropriate CheckMaps node.
-          return false;
+          return kNoReceiverMaps;
+        }
+        if (!effect->op()->HasProperty(Operator::kNoWrite)) {
+          // Without alias/escape analysis we cannot tell whether this
+          // {effect} affects {receiver} or not.
+          result = kUnreliableReceiverMaps;
         }
         break;
       }
     }
     DCHECK_EQ(1, effect->op()->EffectInputCount());
     effect = NodeProperties::GetEffectInput(effect);
   }
 }
 
 // static
@@ skipping 51 matching lines @@
 // static
 bool NodeProperties::IsInputRange(Edge edge, int first, int num) {
   if (num == 0) return false;
   int const index = edge.index();
   return first <= index && index < first + num;
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8