[Turbofan] Make JSCallReducer::ReducePromiseConstructor concurrent

The only piece missing at this point was to serialize the code
objects for the resolve and reject handlers.

Bug: v8:7790
Change-Id: If636f9d74dfc9606cf5f45c4f02dd118fb5d8f00
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1662295
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62215}

src/compiler/js-call-reducer.cc

@@ -5579,6 +5579,7 @@ Node* JSCallReducer::CreateArtificialFrameState(
 
 Reduction JSCallReducer::ReducePromiseConstructor(Node* node) {
   DCHECK_EQ(IrOpcode::kJSConstruct, node->opcode());
+  DisallowHeapAccessIf no_heap_acess(FLAG_concurrent_inlining);
   ConstructParameters const& p = ConstructParametersOf(node->op());
   int arity = static_cast<int>(p.arity() - 2);
   // We only inline when we have the executor.
@@ -5605,6 +5606,13 @@ Reduction JSCallReducer::ReducePromiseConstructor(Node* node) {
     return NoChange();
   }
 
+  // Check if we've captured the resolve and reject promise code objects.
+  if (!native_context().GetPromiseCapabilityDefaultResolveCode().has_value() ||
+      !native_context().GetPromiseCapabilityDefaultRejectCode().has_value()) {
+    TRACE_BROKER_MISSING(broker(), "data for native context promise functions");
+    return NoChange();
+  }
+
   SharedFunctionInfoRef promise_shared =
       native_context().promise_function().shared();
 
@@ -5667,19 +5675,22 @@ Reduction JSCallReducer::ReducePromiseConstructor(Node* node) {
   // Allocate the closure for the resolve case.
   SharedFunctionInfoRef resolve_shared =
       native_context().promise_capability_default_resolve_shared_fun();
-  Node* resolve = effect = graph()->NewNode(
-      javascript()->CreateClosure(
-          resolve_shared.object(), factory()->many_closures_cell(),
-          handle(resolve_shared.object()->GetCode(), isolate())),
-      promise_context, effect, control);
+  Handle<Code> resolve_code =
+      native_context().GetPromiseCapabilityDefaultResolveCode()->object();
+  Node* resolve = effect =
+      graph()->NewNode(javascript()->CreateClosure(
+                           resolve_shared.object(),
+                           factory()->many_closures_cell(), resolve_code),
+                       promise_context, effect, control);
 
   // Allocate the closure for the reject case.
   SharedFunctionInfoRef reject_shared =
       native_context().promise_capability_default_reject_shared_fun();
+  Handle<Code> reject_code =
+      native_context().GetPromiseCapabilityDefaultRejectCode()->object();
   Node* reject = effect = graph()->NewNode(
-      javascript()->CreateClosure(
-          reject_shared.object(), factory()->many_closures_cell(),
-          handle(reject_shared.object()->GetCode(), isolate())),
+      javascript()->CreateClosure(reject_shared.object(),
+                                  factory()->many_closures_cell(), reject_code),
       promise_context, effect, control);
 
   const std::vector<Node*> checkpoint_parameters_continuation(

src/compiler/js-heap-broker.cc

@@ -601,11 +601,19 @@ class NativeContextData : public ContextData {
                     Handle<NativeContext> object);
   void Serialize(JSHeapBroker* broker);
 
+  void SerializeResolveCode(JSHeapBroker* broker);
+  CodeData* resolve_code() const { return resolve_code_; }
+
+  void SerializeRejectCode(JSHeapBroker* broker);
+  CodeData* reject_code() const { return reject_code_; }
+
  private:
   bool serialized_ = false;
 #define DECL_MEMBER(type, name) type##Data* name##_ = nullptr;
   BROKER_NATIVE_CONTEXT_FIELDS(DECL_MEMBER)
 #undef DECL_MEMBER
+  CodeData* resolve_code_ = nullptr;
+  CodeData* reject_code_ = nullptr;
   ZoneVector<MapData*> function_maps_;
 };
 
@@ -2941,6 +2949,52 @@ base::Optional<JSFunctionRef> NativeContextRef::GetConstructorFunction(
   }
 }
 
+void NativeContextRef::SerializePromiseCapabilityDefaultResolveCode() {
+  data()->AsNativeContext()->SerializeResolveCode(broker());
+}
+
+base::Optional<CodeRef>
+NativeContextRef::GetPromiseCapabilityDefaultResolveCode() const {
+  if (broker()->mode() == JSHeapBroker::kDisabled) {
+    AllowHandleDereference allow_handle_dereference;
+    AllowHandleAllocation allow_handle_allocation;
+
+    return CodeRef(
+        broker(),
+        handle(
+            promise_capability_default_resolve_shared_fun().object()->GetCode(),
+            broker()->isolate()));
+  }
+  CodeData* resolve_code = data()->AsNativeContext()->resolve_code();
+  if (resolve_code != nullptr) {
+    return CodeRef(broker(), resolve_code);
+  }
+  return base::Optional<CodeRef>();
+}
+
+void NativeContextRef::SerializePromiseCapabilityDefaultRejectCode() {
+  data()->AsNativeContext()->SerializeRejectCode(broker());
+}
+
+base::Optional<CodeRef>
+NativeContextRef::GetPromiseCapabilityDefaultRejectCode() const {
+  if (broker()->mode() == JSHeapBroker::kDisabled) {
+    AllowHandleDereference allow_handle_dereference;
+    AllowHandleAllocation allow_handle_allocation;
+
+    return CodeRef(
+        broker(),
+        handle(
+            promise_capability_default_reject_shared_fun().object()->GetCode(),
+            broker()->isolate()));
+  }
+  CodeData* reject_code = data()->AsNativeContext()->reject_code();
+  if (reject_code != nullptr) {
+    return CodeRef(broker(), reject_code);
+  }
+  return base::Optional<CodeRef>();
+}
+
 bool ObjectRef::IsNullOrUndefined() const {
   if (IsSmi()) return false;
   OddballType type = AsHeapObject().map().oddball_type();
@@ -3255,6 +3309,26 @@ void NativeContextData::Serialize(JSHeapBroker* broker) {
   }
 }
 
+void NativeContextData::SerializeResolveCode(JSHeapBroker* broker) {
+  resolve_code_ =
+      broker
+          ->GetOrCreateData(
+              Handle<SharedFunctionInfo>::cast(
+                  promise_capability_default_resolve_shared_fun()->object())
+                  ->GetCode())
+          ->AsCode();
+}
+
+void NativeContextData::SerializeRejectCode(JSHeapBroker* broker) {
+  reject_code_ =
+      broker
+          ->GetOrCreateData(
+              Handle<SharedFunctionInfo>::cast(
+                  promise_capability_default_reject_shared_fun()->object())
+                  ->GetCode())
+          ->AsCode();
+}
+
 void JSFunctionRef::Serialize() {
   if (broker()->mode() == JSHeapBroker::kDisabled) return;
   CHECK_EQ(broker()->mode(), JSHeapBroker::kSerializing);

src/compiler/js-heap-broker.h

@@ -389,6 +389,11 @@ class NativeContextRef : public ContextRef {
   MapRef GetFunctionMapFromIndex(int index) const;
   MapRef GetInitialJSArrayMap(ElementsKind kind) const;
   base::Optional<JSFunctionRef> GetConstructorFunction(const MapRef& map) const;
+
+  void SerializePromiseCapabilityDefaultResolveCode();
+  base::Optional<CodeRef> GetPromiseCapabilityDefaultResolveCode() const;
+  void SerializePromiseCapabilityDefaultRejectCode();
+  base::Optional<CodeRef> GetPromiseCapabilityDefaultRejectCode() const;
 };
 
 class NameRef : public HeapObjectRef {

src/compiler/serializer-for-background-compilation.cc

@@ -868,6 +868,8 @@ void SerializerForBackgroundCompilation::ProcessBuiltinCall(
       TRACE_BROKER(broker(), "Serializing data for builtin PromiseConstructor");
       // For JSCallReducer::ReducePromiseConstructor.
       broker()->native_context().SerializeScopeInfo();
+      broker()->native_context().SerializePromiseCapabilityDefaultResolveCode();
+      broker()->native_context().SerializePromiseCapabilityDefaultRejectCode();
       break;
     }
     case Builtins::kPromisePrototypeCatch: {