[interpreter] Support on-stack replacement in profiler.

This adds preliminary support for on-stack replacement from Ignition to
optimized code generated by TurboFan to the runtime profiler. Involved
heuristics (e.g. code size allowance) have been taken from existing code
without any re-evaluation in the new setting.

R=rmcilroy@chromium.org
BUG=v8:4764

Review-Url: https://codereview.chromium.org/2182183005
Cr-Commit-Position: refs/heads/master@{#38159}

src/interpreter/interpreter.cc

@@ -129,8 +129,6 @@ void Interpreter::IterateDispatchTable(ObjectVisitor* v) {
 
 // static
 int Interpreter::InterruptBudget() {
-  // TODO(ignition): Tune code size multiplier.
-  const int kCodeSizeMultiplier = 32;
   return FLAG_interrupt_budget * kCodeSizeMultiplier;
 }
 

src/interpreter/interpreter.h

@@ -65,6 +65,9 @@ class Interpreter {
     return reinterpret_cast<Address>(bytecode_dispatch_counters_table_.get());
   }
 
+  // TODO(ignition): Tune code size multiplier.
+  static const int kCodeSizeMultiplier = 32;
+
  private:
 // Bytecode handler generator functions.
 #define DECLARE_BYTECODE_HANDLER_GENERATOR(Name, ...) \

src/runtime-profiler.cc

@@ -14,6 +14,7 @@
 #include "src/frames-inl.h"
 #include "src/full-codegen/full-codegen.h"
 #include "src/global-handles.h"
+#include "src/interpreter/interpreter.h"
 
 namespace v8 {
 namespace internal {
@@ -41,9 +42,13 @@ STATIC_ASSERT(kTicksWhenNotEnoughTypeInfo < 256);
 // Maximum size in bytes of generate code for a function to allow OSR.
 static const int kOSRCodeSizeAllowanceBase =
     100 * FullCodeGenerator::kCodeSizeMultiplier;
+static const int kOSRCodeSizeAllowanceBaseIgnition =
+    100 * interpreter::Interpreter::kCodeSizeMultiplier;
 
 static const int kOSRCodeSizeAllowancePerTick =
     4 * FullCodeGenerator::kCodeSizeMultiplier;
+static const int kOSRCodeSizeAllowancePerTickIgnition =
+    4 * interpreter::Interpreter::kCodeSizeMultiplier;
 
 // Maximum size in bytes of generated code for a function to be optimized
 // the very first time it is seen on the stack.
@@ -269,10 +274,22 @@ void RuntimeProfiler::MaybeBaselineIgnition(JSFunction* function) {
   // TODO(rmcilroy): Also ensure we only OSR top-level code if it is smaller
   // than kMaxToplevelSourceSize.
 
-  if (function->IsMarkedForBaseline() || function->IsMarkedForOptimization() ||
-      function->IsMarkedForConcurrentOptimization() ||
-      function->IsOptimized()) {
-    // TODO(rmcilroy): Support OSR in these cases.
+  if (FLAG_ignition_osr && FLAG_always_osr) {
+    AttemptOnStackReplacement(function, AbstractCode::kMaxLoopNestingMarker);
+    // Fall through and do a normal baseline compile as well.
+  } else if (function->IsMarkedForBaseline() ||
+             function->IsMarkedForOptimization() ||
+             function->IsMarkedForConcurrentOptimization() ||
+             function->IsOptimized()) {
+    // Attempt OSR if we are still running interpreted code even though the
+    // the function has long been marked or even already been optimized.
+    int64_t allowance =
+        kOSRCodeSizeAllowanceBaseIgnition +
+        static_cast<int64_t>(ticks) * kOSRCodeSizeAllowancePerTickIgnition;
+    if (FLAG_ignition_osr && shared->HasBytecodeArray() &&
+        shared->bytecode_array()->Size() <= allowance) {
+      AttemptOnStackReplacement(function);
+    }
     return;
   }
 
@@ -296,10 +313,23 @@ void RuntimeProfiler::MaybeOptimizeIgnition(JSFunction* function) {
 
   // TODO(rmcilroy): Also ensure we only OSR top-level code if it is smaller
   // than kMaxToplevelSourceSize.
-  if (function->IsMarkedForBaseline() || function->IsMarkedForOptimization() ||
-      function->IsMarkedForConcurrentOptimization() ||
-      function->IsOptimized()) {
-    // TODO(rmcilroy): Support OSR in these cases.
+
+  if (FLAG_ignition_osr && FLAG_always_osr) {
+    AttemptOnStackReplacement(function, AbstractCode::kMaxLoopNestingMarker);
+    // Fall through and do a normal optimized compile as well.
+  } else if (function->IsMarkedForBaseline() ||
+             function->IsMarkedForOptimization() ||
+             function->IsMarkedForConcurrentOptimization() ||
+             function->IsOptimized()) {
+    // Attempt OSR if we are still running interpreted code even though the
+    // the function has long been marked or even already been optimized.
+    int64_t allowance =
+        kOSRCodeSizeAllowanceBaseIgnition +
+        static_cast<int64_t>(ticks) * kOSRCodeSizeAllowancePerTickIgnition;
+    if (FLAG_ignition_osr && shared->HasBytecodeArray() &&
+        shared->bytecode_array()->Size() <= allowance) {
+      AttemptOnStackReplacement(function);
+    }
     return;
   }
 

test/mjsunit/array-literal-transitions.js

@@ -26,6 +26,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 // Flags: --allow-natives-syntax --expose-gc
+// Flags: --ignition-osr --turbo-from-bytecode
 
 // IC and Crankshaft support for smi-only elements in dynamic array literals.
 function get(foo) { return foo; }  // Used to generate dynamic values.

test/mjsunit/mjsunit.status

@@ -220,10 +220,6 @@
   'array-literal-feedback': [PASS, NO_IGNITION],
   'regress/regress-4121': [PASS, NO_IGNITION],
 
-  # TODO(mythria, 4764): lack of osr support. The tests waits in a loop
-  # till it is optimized. So test timeouts.
-  'array-literal-transitions': [PASS, NO_IGNITION],
-
   # TODO(4680): Test doesn't know about three tier compiler pipeline.
   'assert-opt-and-deopt': [PASS, NO_IGNITION],
 
@@ -706,10 +702,6 @@
   'array-feedback': [FAIL],
   'allocation-site-info': [FAIL],
 
-  # TODO(mythria, 4764): lack of osr support. The tests waits in a loop
-  # till it is optimized. So test timeouts.
-  'array-literal-transitions': [SKIP],
-
   'wasm/asm-wasm-f32': [PASS, ['arch in [arm64]', SKIP]],
   'wasm/asm-wasm-f64': [PASS, ['arch in [arm64]', SKIP]],