[maglev] Call Math.pow builtin if both inputs are tagged

JetStream2:ARES:Basic regresses with the Float64Exponentiate.
It seems that calling the builtin directly is cheaper than
unboxing both inputs and calling the C++ stub.

Bug: v8:7700, v8:1393643
Change-Id: Ib2c1523ed57eea048bb269fc16992349687cbb73
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4084764
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84786}

src/maglev/maglev-graph-builder.cc

@@ -3088,6 +3088,13 @@ ValueNode* MaglevGraphBuilder::TryReduceMathPow(compiler::JSFunctionRef target,
   if (args.count() < 2) {
     return GetRootConstant(RootIndex::kNanValue);
   }
+  // If both arguments are tagged, it is cheaper to call Math.Pow builtin,
+  // instead of Float64Exponentiate, since we are still making a call and we
+  // don't need to unbox both inputs. See https://crbug.com/1393643.
+  if (args[0]->properties().is_tagged() && args[1]->properties().is_tagged()) {
+    // The Math.pow call will be created in CallKnownJSFunction reduction.
+    return nullptr;
+  }
   ValueNode* left = GetFloat64(args[0]);
   ValueNode* right = GetFloat64(args[1]);
   return AddNewNode<Float64Exponentiate>({left, right});

src/maglev/maglev-ir.h

@@ -548,6 +548,9 @@ class OpProperties {
   constexpr ValueRepresentation value_representation() const {
     return kValueRepresentationBits::decode(bitfield_);
   }
+  constexpr bool is_tagged() const {
+    return value_representation() == ValueRepresentation::kTagged;
+  }
   constexpr bool is_conversion() const {
     return kIsConversionBit::decode(bitfield_);
   }