[tiering] Tentative tiering state fix

Bug: chromium:1444835
Change-Id: I0b3e069384a94d74c7666638b0081961378364e8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4547387
Commit-Queue: Toon Verwaest <[email protected]>
Commit-Queue: Igor Sheludko <[email protected]>
Reviewed-by: Igor Sheludko <[email protected]>
Auto-Submit: Toon Verwaest <[email protected]>
Cr-Commit-Position: refs/heads/main@{#87778}

src/objects/feedback-vector.cc

@@ -348,19 +348,25 @@ void FeedbackVector::AddToVectorsForProfilingTools(
 
 void FeedbackVector::SetOptimizedCode(Code code) {
   DCHECK(CodeKindIsOptimizedJSFunction(code.kind()));
+  int32_t state = flags();
   // Skip setting optimized code if it would cause us to tier down.
-  if (has_optimized_code() && !optimized_code().marked_for_deoptimization() &&
-      (!CodeKindCanTierUp(optimized_code().kind()) ||
-       optimized_code().kind() > code.kind())) {
-    if (!v8_flags.stress_concurrent_inlining_attach_code) return;
+  if (has_optimized_code() && (!CodeKindCanTierUp(optimized_code().kind()) ||
+                               optimized_code().kind() > code.kind())) {
+    if (!v8_flags.stress_concurrent_inlining_attach_code &&
+        !optimized_code().marked_for_deoptimization()) {
+      return;
+    }
+    // If we fall through, we may be tiering down. This is fine since we only do
+    // that when the current code is marked for deoptimization, or because we're
+    // stress testing.
+    state = MaybeHasTurbofanCodeBit::update(state, false);
   }
   // TODO(mythria): We could see a CompileOptimized state here either from
   // tests that use %OptimizeFunctionOnNextCall, --always-turbofan or because we
   // re-mark the function for non-concurrent optimization after an OSR. We
   // should avoid these cases and also check that marker isn't
   // TieringState::kRequestTurbofan*.
   set_maybe_optimized_code(HeapObjectReference::Weak(code));
-  int32_t state = flags();
   // TODO(leszeks): Reconsider whether this could clear the tiering state vs.
   // the callers doing so.
   state = TieringStateBits::update(state, TieringState::kNone);