Revert "[cleanup] Remove the now-unused deopt_count from feedback vector."

This reverts commit ad1fcd4343.

Reason for revert: Breaks waterfall.

Original change's description:
> [cleanup] Remove the now-unused deopt_count from feedback vector.
> 
> Bug: v8:9183
> Change-Id: Iceeccc8ab1e4e77b428e7e2feec39bff3317f241
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1617675
> Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#61665}

TBR=mstarzinger@chromium.org,jarin@chromium.org

Change-Id: Iea0e6a329f55a3a941f0b976925b2abdf7eece38
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:9183
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1619867
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61666}

src/builtins/base.tq

@@ -1257,6 +1257,7 @@ extern class FeedbackVector extends HeapObject {
   length: int32;
   invocation_count: int32;
   profiler_ticks: int32;
+  deopt_count: int32;
 }
 
 extern class FeedbackCell extends Struct {

src/deoptimizer/deoptimizer.cc

@@ -429,6 +429,7 @@ void Deoptimizer::DeoptimizeFunction(JSFunction function, Code code) {
     function->feedback_vector()->EvictOptimizedCodeMarkedForDeoptimization(
         function->shared(), "unlinking code marked for deopt");
     if (!code->deopt_already_counted()) {
+      function->feedback_vector()->increment_deopt_count();
       code->set_deopt_already_counted(true);
     }
     DeoptimizeMarkedCodeForContext(function->context()->native_context());
@@ -492,10 +493,19 @@ Deoptimizer::Deoptimizer(Isolate* isolate, JSFunction function,
   DCHECK(AllowHeapAllocation::IsAllowed());
   disallow_heap_allocation_ = new DisallowHeapAllocation();
 #endif  // DEBUG
-  if ((compiled_code_->kind() != Code::OPTIMIZED_FUNCTION ||
-       !compiled_code_->deopt_already_counted()) &&
-      deopt_kind_ == DeoptimizeKind::kSoft) {
-    isolate->counters()->soft_deopts_executed()->Increment();
+  if (compiled_code_->kind() != Code::OPTIMIZED_FUNCTION ||
+      !compiled_code_->deopt_already_counted()) {
+    // If the function is optimized, and we haven't counted that deopt yet, then
+    // increment the function's deopt count so that we can avoid optimising
+    // functions that deopt too often.
+
+    if (deopt_kind_ == DeoptimizeKind::kSoft) {
+      // Soft deopts shouldn't count against the overall deoptimization count
+      // that can eventually lead to disabling optimization for a function.
+      isolate->counters()->soft_deopts_executed()->Increment();
+    } else if (!function.is_null()) {
+      function->feedback_vector()->increment_deopt_count();
+    }
   }
   if (compiled_code_->kind() == Code::OPTIMIZED_FUNCTION) {
     compiled_code_->set_deopt_already_counted(true);

src/feedback-vector-inl.h

@@ -108,6 +108,7 @@ ACCESSORS(FeedbackVector, closure_feedback_cell_array, ClosureFeedbackCellArray,
 INT32_ACCESSORS(FeedbackVector, length, kLengthOffset)
 INT32_ACCESSORS(FeedbackVector, invocation_count, kInvocationCountOffset)
 INT32_ACCESSORS(FeedbackVector, profiler_ticks, kProfilerTicksOffset)
+INT32_ACCESSORS(FeedbackVector, deopt_count, kDeoptCountOffset)
 
 bool FeedbackVector::is_empty() const { return length() == 0; }
 
@@ -117,6 +118,13 @@ FeedbackMetadata FeedbackVector::metadata() const {
 
 void FeedbackVector::clear_invocation_count() { set_invocation_count(0); }
 
+void FeedbackVector::increment_deopt_count() {
+  int count = deopt_count();
+  if (count < std::numeric_limits<int32_t>::max()) {
+    set_deopt_count(count + 1);
+  }
+}
+
 Code FeedbackVector::optimized_code() const {
   MaybeObject slot = optimized_code_weak_or_smi();
   DCHECK(slot->IsSmi() || slot->IsWeakOrCleared());

src/feedback-vector.cc

@@ -246,6 +246,7 @@ Handle<FeedbackVector> FeedbackVector::New(
                                    : OptimizationMarker::kNone)));
   DCHECK_EQ(vector->invocation_count(), 0);
   DCHECK_EQ(vector->profiler_ticks(), 0);
+  DCHECK_EQ(vector->deopt_count(), 0);
 
   // Ensure we can skip the write barrier
   Handle<Object> uninitialized_sentinel = UninitializedSentinel(isolate);
@@ -367,6 +368,7 @@ void FeedbackVector::EvictOptimizedCodeMarkedForDeoptimization(
       PrintF("]\n");
     }
     if (!code->deopt_already_counted()) {
+      increment_deopt_count();
       code->set_deopt_already_counted(true);
     }
     ClearOptimizedCode();

src/feedback-vector.h

@@ -208,7 +208,11 @@ class FeedbackVector : public HeapObject {
   // runtime profiler.
   DECL_INT32_ACCESSORS(profiler_ticks)
 
+  // [deopt_count]: The number of times this function has deoptimized.
+  DECL_INT32_ACCESSORS(deopt_count)
+
   inline void clear_invocation_count();
+  inline void increment_deopt_count();
 
   inline Code optimized_code() const;
   inline OptimizationMarker optimization_marker() const;

src/heap/factory.cc

@@ -525,6 +525,7 @@ Handle<FeedbackVector> Factory::NewFeedbackVector(
   vector->set_length(length);
   vector->set_invocation_count(0);
   vector->set_profiler_ticks(0);
+  vector->set_deopt_count(0);
   vector->set_closure_feedback_cell_array(*closure_feedback_cell_array);
 
   // TODO(leszeks): Initialize based on the feedback metadata.

src/runtime/runtime-test.cc

@@ -572,6 +572,15 @@ RUNTIME_FUNCTION(Runtime_UnblockConcurrentRecompilation) {
   return ReadOnlyRoots(isolate).undefined_value();
 }
 
+RUNTIME_FUNCTION(Runtime_GetDeoptCount) {
+  HandleScope scope(isolate);
+  DCHECK_EQ(1, args.length());
+  CONVERT_ARG_HANDLE_CHECKED(JSFunction, function, 0);
+  // Functions without a feedback vector have never deoptimized.
+  if (!function->has_feedback_vector()) return Smi::kZero;
+  return Smi::FromInt(function->feedback_vector()->deopt_count());
+}
+
 static void ReturnThis(const v8::FunctionCallbackInfo<v8::Value>& args) {
   args.GetReturnValue().Set(args.This());
 }

src/runtime/runtime.h

@@ -444,6 +444,7 @@ namespace internal {
   F(DisassembleFunction, 1, 1)                \
   F(FreezeWasmLazyCompilation, 1, 1)          \
   F(GetCallable, 0, 1)                        \
+  F(GetDeoptCount, 1, 1)                      \
   F(GetInitializerFunction, 1, 1)             \
   F(GetOptimizationStatus, -1, 1)             \
   F(GetUndetectable, 0, 1)                    \

test/mjsunit/compiler/native-context-specialization-hole-check.js

@@ -48,4 +48,4 @@ g();
 g();
 %OptimizeFunctionOnNextCall(g);
 g();
-assertUnoptimized(g);
+assertTrue(%GetDeoptCount(g) > 0);

test/mjsunit/deopt-recursive-eager-once.js

@@ -16,6 +16,8 @@ function foo(i, deopt = false) {
 }
 %PrepareFunctionForOptimization(foo);
 
+assertEquals(0, %GetDeoptCount(foo));
+
 %PrepareFunctionForOptimization(foo);
 foo(10);
 foo(10);
@@ -23,7 +25,9 @@ foo(10);
 foo(10);
 
 assertOptimized(foo);
+assertEquals(0, %GetDeoptCount(foo));
 
 foo(10, true);
 
 assertUnoptimized(foo);
+assertEquals(1, %GetDeoptCount(foo));

test/mjsunit/deopt-recursive-lazy-once.js

@@ -17,13 +17,16 @@ function foo(i, deopt = false) {
 %PrepareFunctionForOptimization(foo);
 
 %PrepareFunctionForOptimization(foo);
+assertEquals(0, %GetDeoptCount(foo));
 foo(10);
 foo(10);
 %OptimizeFunctionOnNextCall(foo);
 foo(10);
 
 assertOptimized(foo);
+assertEquals(0, %GetDeoptCount(foo));
 
 foo(10, true);
 
 assertUnoptimized(foo);
+assertEquals(1, %GetDeoptCount(foo));

test/mjsunit/deopt-recursive-soft-once.js

@@ -16,6 +16,8 @@ function foo(i, deopt = false, deoptobj = null) {
     }
 }
 
+assertEquals(0, %GetDeoptCount(foo));
+
 %PrepareFunctionForOptimization(foo);
 foo(10);
 foo(10);
@@ -23,7 +25,10 @@ foo(10);
 foo(10);
 
 assertOptimized(foo);
+assertEquals(0, %GetDeoptCount(foo));
 
 foo(10, true, { bar: function(){} });
 
 assertUnoptimized(foo);
+// Soft deopts don't count to the deopt count.
+assertEquals(0, %GetDeoptCount(foo));

test/mjsunit/deopt-unlinked.js

@@ -9,18 +9,23 @@
 
 function foo() {}
 
+assertEquals(0, %GetDeoptCount(foo));
+
 foo();
 foo();
 %OptimizeFunctionOnNextCall(foo);
 foo();
 
 assertOptimized(foo);
+assertEquals(0, %GetDeoptCount(foo));
 
 // Unlink the function.
 %DeoptimizeFunction(foo);
 
 assertUnoptimized(foo);
+assertEquals(1, %GetDeoptCount(foo));
 
 foo();
 
 assertUnoptimized(foo);
+assertEquals(1, %GetDeoptCount(foo));

test/mjsunit/regress/regress-crbug-937734.js

@@ -2,16 +2,15 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --opt
+// Flags: --allow-natives-syntax
 
 function foo()
 {
     return 1 in [0];
 }
 
-%PrepareFunctionForOptimization(foo);
 foo();
 foo();
 %OptimizeFunctionOnNextCall(foo);
 foo();
-assertOptimized(foo);
+assertEquals(0, %GetDeoptCount(foo));