1 files changed, 28 insertions, 12 deletions

diff --git a/deps/v8/src/compiler/js-inlining-heuristic.cc b/deps/v8/src/compiler/js-inlining-heuristic.cc
index ec00e9bde4..cd5637b0c4 100644
--- a/deps/v8/src/compiler/js-inlining-heuristic.cc
+++ b/deps/v8/src/compiler/js-inlining-heuristic.cc
@@ -13,7 +13,7 @@ namespace internal {
 namespace compiler {
 
 Reduction JSInliningHeuristic::Reduce(Node* node) {
-  if (node->opcode() != IrOpcode::kJSCallFunction) return NoChange();
+  if (!IrOpcode::IsInlineeOpcode(node->opcode())) return NoChange();
 
   // Check if we already saw that {node} before, and if so, just skip it.
   if (seen_.find(node->id()) != seen_.end()) return NoChange();
@@ -26,7 +26,7 @@ Reduction JSInliningHeuristic::Reduce(Node* node) {
 
   // Functions marked with %SetForceInlineFlag are immediately inlined.
   if (function->shared()->force_inline()) {
-    return inliner_.ReduceJSCallFunction(node, function);
+    return inliner_.ReduceJSCall(node, function);
   }
 
   // Handling of special inlining modes right away:
@@ -36,7 +36,7 @@ Reduction JSInliningHeuristic::Reduce(Node* node) {
     case kRestrictedInlining:
       return NoChange();
     case kStressInlining:
-      return inliner_.ReduceJSCallFunction(node, function);
+      return inliner_.ReduceJSCall(node, function);
     case kGeneralInlining:
       break;
   }
@@ -48,6 +48,9 @@ Reduction JSInliningHeuristic::Reduce(Node* node) {
   // Built-in functions are handled by the JSBuiltinReducer.
   if (function->shared()->HasBuiltinFunctionId()) return NoChange();
 
+  // Don't inline builtins.
+  if (function->shared()->IsBuiltin()) return NoChange();
+
   // Quick check on source code length to avoid parsing large candidate.
   if (function->shared()->SourceSize() > FLAG_max_inlined_source_size) {
     return NoChange();
@@ -64,18 +67,21 @@ Reduction JSInliningHeuristic::Reduce(Node* node) {
 
   // Stop inlinining once the maximum allowed level is reached.
   int level = 0;
-  for (Node* frame_state = NodeProperties::GetFrameStateInput(node, 1);
+  for (Node* frame_state = NodeProperties::GetFrameStateInput(node, 0);
        frame_state->opcode() == IrOpcode::kFrameState;
        frame_state = NodeProperties::GetFrameStateInput(frame_state, 0)) {
     if (++level > FLAG_max_inlining_levels) return NoChange();
   }
 
   // Gather feedback on how often this call site has been hit before.
-  CallFunctionParameters p = CallFunctionParametersOf(node->op());
   int calls = -1;  // Same default as CallICNexus::ExtractCallCount.
-  if (p.feedback().IsValid()) {
-    CallICNexus nexus(p.feedback().vector(), p.feedback().slot());
-    calls = nexus.ExtractCallCount();
+  // TODO(turbofan): We also want call counts for constructor calls.
+  if (node->opcode() == IrOpcode::kJSCallFunction) {
+    CallFunctionParameters p = CallFunctionParametersOf(node->op());
+    if (p.feedback().IsValid()) {
+      CallICNexus nexus(p.feedback().vector(), p.feedback().slot());
+      calls = nexus.ExtractCallCount();
+    }
   }
 
   // ---------------------------------------------------------------------------
@@ -92,13 +98,23 @@ void JSInliningHeuristic::Finalize() {
   if (candidates_.empty()) return;  // Nothing to do without candidates.
   if (FLAG_trace_turbo_inlining) PrintCandidates();
 
+  // We inline at most one candidate in every iteration of the fixpoint.
+  // This is to ensure that we don't consume the full inlining budget
+  // on things that aren't called very often.
+  // TODO(bmeurer): Use std::priority_queue instead of std::set here.
   while (!candidates_.empty()) {
-    if (cumulative_count_ > FLAG_max_inlined_nodes_cumulative) break;
+    if (cumulative_count_ > FLAG_max_inlined_nodes_cumulative) return;
     auto i = candidates_.begin();
-    Candidate const& candidate = *i;
-    inliner_.ReduceJSCallFunction(candidate.node, candidate.function);
-    cumulative_count_ += candidate.function->shared()->ast_node_count();
+    Candidate candidate = *i;
     candidates_.erase(i);
+    // Make sure we don't try to inline dead candidate nodes.
+    if (!candidate.node->IsDead()) {
+      Reduction r = inliner_.ReduceJSCall(candidate.node, candidate.function);
+      if (r.Changed()) {
+        cumulative_count_ += candidate.function->shared()->ast_node_count();
+        return;
+      }
+    }
   }
 }