Revert "[maglev] Check for strings in polymorphic loads"

This reverts commit 7f4a04671a.

Reason for revert: Speculative revert for https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64%20TSAN%20-%20no-concurrent-marking/13086/overview

Original change's description:
> [maglev] Check for strings in polymorphic loads
>
> Bug: v8:7700
> Change-Id: Id3d523446f5061a78a46d1c52cf8f8339566356d
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4212402
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Commit-Queue: Leszek Swirski <leszeks@chromium.org>
> Auto-Submit: Victor Gomes <victorgomes@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#85626}

Bug: v8:7700
Change-Id: I87473a0cef092d457391d84c051becf06014703b
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4219091
Owners-Override: Nico Hartmann <nicohartmann@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Auto-Submit: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85627}

src/maglev/arm64/maglev-assembler-arm64-inl.h

@@ -519,20 +519,6 @@ inline void MaglevAssembler::CompareObjectTypeRange(Register heap_object,
   CompareInstanceTypeRange(scratch, scratch, lower_limit, higher_limit);
 }
 
-inline void MaglevAssembler::CompareInstanceTypeRange(
-    Register map, InstanceType lower_limit, InstanceType higher_limit) {
-  ScratchRegisterScope temps(this);
-  Register scratch = temps.Acquire();
-  CompareInstanceTypeRange(map, scratch, lower_limit, higher_limit);
-}
-
-inline void MaglevAssembler::CompareInstanceTypeRange(
-    Register map, Register instance_type_out, InstanceType lower_limit,
-    InstanceType higher_limit) {
-  MacroAssembler::CompareInstanceTypeRange(map, instance_type_out, lower_limit,
-                                           higher_limit);
-}
-
 inline void MaglevAssembler::CompareTagged(Register reg,
                                            Handle<HeapObject> obj) {
   ScratchRegisterScope temps(this);

src/maglev/maglev-assembler.h

@@ -201,12 +201,6 @@ class MaglevAssembler : public MacroAssembler {
                                      InstanceType lower_limit,
                                      InstanceType higher_limit);
 
-  inline void CompareInstanceTypeRange(Register map, InstanceType lower_limit,
-                                       InstanceType higher_limit);
-  inline void CompareInstanceTypeRange(Register map, Register instance_type_out,
-                                       InstanceType lower_limit,
-                                       InstanceType higher_limit);
-
   inline void CompareTagged(Register reg, Handle<HeapObject> obj);
 
   inline void CompareInt32(Register reg, int32_t imm);

src/maglev/maglev-graph-builder.cc

@@ -2005,6 +2005,23 @@ bool MaglevGraphBuilder::TryBuildPropertyAccess(
   }
 }
 
+namespace {
+bool HasOnlyStringMaps(base::Vector<const compiler::MapRef> maps) {
+  for (compiler::MapRef map : maps) {
+    if (!map.IsStringMap()) return false;
+  }
+  return true;
+}
+
+bool HasOnlyNumberMaps(base::Vector<const compiler::MapRef> maps) {
+  for (compiler::MapRef map : maps) {
+    if (map.instance_type() != HEAP_NUMBER_TYPE) return false;
+  }
+  return true;
+}
+
+}  // namespace
+
 bool MaglevGraphBuilder::TryBuildNamedAccess(
     ValueNode* receiver, ValueNode* lookup_start_object,
     compiler::NamedAccessFeedback const& feedback,

src/maglev/maglev-ir.cc

@@ -988,25 +988,26 @@ void EmitPolymorphicAccesses(MaglevAssembler* masm, NodeT* node,
   for (const PolymorphicAccessInfo& access_info : node->access_infos()) {
     Label next;
     Label map_found;
-    auto& maps = access_info.maps();
+    bool has_heap_number_map = false;
 
-    if (HasOnlyNumberMaps(base::VectorOf(maps))) {
+    for (auto it = access_info.maps().begin(); it != access_info.maps().end();
-      DCHECK(!is_number.is_bound());
+         ++it) {
-      __ bind(&is_number);
+      if (it->IsHeapNumberMap()) {
-    } else if (HasOnlyStringMaps(base::VectorOf(maps))) {
+        has_heap_number_map = true;
-      __ CompareInstanceTypeRange(object, FIRST_STRING_TYPE, LAST_STRING_TYPE);
+      }
-      __ JumpIf(kUnsignedGreaterThan, &next);
-      // Fallthrough... to map_found.
-    } else {
-      for (auto it = maps.begin(); it != maps.end(); ++it) {
       __ CompareTagged(object_map, it->object());
-        if (it == maps.end() - 1) {
+      if (it == access_info.maps().end() - 1) {
         __ JumpIf(kNotEqual, &next);
         // Fallthrough... to map_found.
       } else {
         __ JumpIf(kEqual, &map_found);
       }
     }
+
+    // Bind number case here if one of the maps is HeapNumber.
+    if (has_heap_number_map) {
+      DCHECK(!is_number.is_bound());
+      __ bind(&is_number);
     }
 
     __ bind(&map_found);

src/maglev/maglev-ir.h

@@ -463,20 +463,6 @@ inline std::ostream& operator<<(std::ostream& os,
   return os;
 }
 
-inline bool HasOnlyStringMaps(base::Vector<const compiler::MapRef> maps) {
-  for (compiler::MapRef map : maps) {
-    if (!map.IsStringMap()) return false;
-  }
-  return true;
-}
-
-inline bool HasOnlyNumberMaps(base::Vector<const compiler::MapRef> maps) {
-  for (compiler::MapRef map : maps) {
-    if (map.instance_type() != HEAP_NUMBER_TYPE) return false;
-  }
-  return true;
-}
-
 #define DEF_FORWARD_DECLARATION(type, ...) class type;
 NODE_BASE_LIST(DEF_FORWARD_DECLARATION)
 #undef DEF_FORWARD_DECLARATION

src/maglev/x64/maglev-assembler-x64-inl.h

@@ -405,17 +405,6 @@ inline void MaglevAssembler::CompareObjectTypeRange(Register heap_object,
                        higher_limit);
 }
 
-inline void MaglevAssembler::CompareInstanceTypeRange(
-    Register map, InstanceType lower_limit, InstanceType higher_limit) {
-  CompareInstanceTypeRange(map, kScratchRegister, lower_limit, higher_limit);
-}
-
-inline void MaglevAssembler::CompareInstanceTypeRange(
-    Register map, Register instance_type_out, InstanceType lower_limit,
-    InstanceType higher_limit) {
-  CmpInstanceTypeRange(map, instance_type_out, lower_limit, higher_limit);
-}
-
 inline void MaglevAssembler::CompareTagged(Register reg,
                                            Handle<HeapObject> obj) {
   Cmp(reg, obj);