[turbofan] Cleanup JSFunction and NativeContext serialization.

Bug: v8:7790
Change-Id: I93ecb8540a002b6bfca857c2938920ac52308df1
Reviewed-on: https://chromium-review.googlesource.com/1193874Reviewed-by: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55580}

src/compiler/js-heap-broker.h

@@ -175,14 +175,18 @@ class JSFunctionRef : public JSObjectRef {
  public:
   using JSObjectRef::JSObjectRef;
 
-  bool IsConstructor() const;
   bool has_initial_map() const;
-  MapRef initial_map() const;
   bool has_prototype() const;
-  ObjectRef prototype() const;
+  bool IsConstructor() const;
   bool PrototypeRequiresRuntimeLookup() const;
-  JSGlobalProxyRef global_proxy() const;
   int InitialMapInstanceSizeWithMinSlack() const;
+
+  void Serialize();
+
+  // The following are available only after calling Serialize().
+  ObjectRef prototype() const;
+  MapRef initial_map() const;
+  JSGlobalProxyRef global_proxy() const;
   SharedFunctionInfoRef shared() const;
 };
 
@@ -401,7 +405,7 @@ class SharedFunctionInfoRef : public HeapObjectRef {
   BytecodeArrayRef GetBytecodeArray() const;
 #define DECL_ACCESSOR(type, name) type name() const;
   BROKER_SFI_FIELDS(DECL_ACCESSOR)
-#undef DECL_ACCSESOR
+#undef DECL_ACCESSOR
 };
 
 class StringRef : public NameRef {

src/compiler/js-heap-copy-reducer.cc

@@ -25,7 +25,8 @@ JSHeapBroker* JSHeapCopyReducer::broker() { return broker_; }
 Reduction JSHeapCopyReducer::Reduce(Node* node) {
   switch (node->opcode()) {
     case IrOpcode::kHeapConstant: {
-      ObjectRef(broker(), HeapConstantOf(node->op()));
+      ObjectRef object(broker(), HeapConstantOf(node->op()));
+      if (object.IsJSFunction()) object.AsJSFunction().Serialize();
       break;
     }
     case IrOpcode::kJSCreateArray: {

src/compiler/js-native-context-specialization.cc

@@ -408,6 +408,9 @@ Reduction JSNativeContextSpecialization::ReduceJSOrdinaryHasInstance(
   // Optimize if we currently know the "prototype" property.
   if (m.Value()->IsJSFunction()) {
     JSFunctionRef function = m.Ref(js_heap_broker()).AsJSFunction();
+    // TODO(neis): This is a temporary hack needed because the copy reducer
+    // runs only after this pass.
+    function.Serialize();
     // TODO(neis): Remove the has_prototype_slot condition once the broker is
     // always enabled.
     if (!function.map().has_prototype_slot() || !function.has_prototype() ||
@@ -1100,6 +1103,9 @@ Reduction JSNativeContextSpecialization::ReduceJSLoadNamed(Node* node) {
         p.name().is_identical_to(factory()->prototype_string())) {
       // Optimize "prototype" property of functions.
       JSFunctionRef function = m.Ref(js_heap_broker()).AsJSFunction();
+      // TODO(neis): This is a temporary hack needed because the copy reducer
+      // runs only after this pass.
+      function.Serialize();
       // TODO(neis): Remove the has_prototype_slot condition once the broker is
       // always enabled.
       if (!function.map().has_prototype_slot() || !function.has_prototype() ||

src/compiler/pipeline.cc

@@ -1997,6 +1997,10 @@ bool PipelineImpl::CreateGraph() {
     data->node_origins()->AddDecorator();
   }
 
+  if (FLAG_concurrent_compiler_frontend) {
+    data->js_heap_broker()->SerializeStandardObjects();
+  }
+
   Run<GraphBuilderPhase>();
   RunPrintAndVerify(GraphBuilderPhase::phase_name(), true);
 
@@ -2034,7 +2038,6 @@ bool PipelineImpl::CreateGraph() {
     Run<ConcurrentOptimizationPrepPhase>();
 
     if (FLAG_concurrent_compiler_frontend) {
-      data->js_heap_broker()->SerializeStandardObjects();
       Run<CopyMetadataForConcurrentCompilePhase>();
     }
 

src/compiler/typer.cc

@@ -1419,6 +1419,7 @@ Type Typer::Visitor::JSCallTyper(Type fun, Typer* t) {
     return Type::NonInternal();
   }
   JSFunctionRef function = fun.AsHeapConstant()->Ref().AsJSFunction();
+  function.Serialize();
   if (!function.shared().HasBuiltinFunctionId()) {
     return Type::NonInternal();
   }

test/unittests/compiler/js-create-lowering-unittest.cc

@@ -33,7 +33,11 @@ class JSCreateLoweringTest : public TypedGraphTest {
       : TypedGraphTest(3),
         javascript_(zone()),
         deps_(isolate(), zone()),
-        handle_scope_(isolate()) {}
+        handle_scope_(isolate()) {
+    if (FLAG_concurrent_compiler_frontend) {
+      js_heap_broker()->SerializeStandardObjects();
+    }
+  }
   ~JSCreateLoweringTest() override {}
 
  protected: