[compiler] Avoid HeapObject::GetHeap in BitSetType::Lub

Modifies several Type:: methods to take an Isolate to pass through to
BitSetType::Lub as well as their call sites.

Bug: v8:7786
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I9ac769c4c658995421fd28b9b1d77d6f84627116
Reviewed-on: https://chromium-review.googlesource.com/1071515
Commit-Queue: Dan Elphick <delphick@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53362}

src/compiler/access-info.cc

@@ -397,7 +397,8 @@ bool AccessInfoFactory::ComputePropertyAccessInfo(
               dependencies()->AssumeFieldOwner(field_owner_map);
 
               // Remember the field map, and try to infer a useful type.
-              field_type = Type::For(descriptors_field_type->AsClass());
+              field_type =
+                  Type::For(isolate(), descriptors_field_type->AsClass());
               field_map = descriptors_field_type->AsClass();
             }
           }
@@ -701,7 +702,7 @@ bool AccessInfoFactory::LookupTransition(Handle<Map> map, Handle<Name> name,
       dependencies()->AssumeFieldOwner(field_owner_map);
 
       // Remember the field map, and try to infer a useful type.
-      field_type = Type::For(descriptors_field_type->AsClass());
+      field_type = Type::For(isolate(), descriptors_field_type->AsClass());
       field_map = descriptors_field_type->AsClass();
     }
   }

src/compiler/js-create-lowering.cc

@@ -774,9 +774,10 @@ Reduction JSCreateLowering::ReduceJSCreateArray(Node* node) {
   Handle<JSFunction> constructor(native_context()->array_function(), isolate());
   Node* target = NodeProperties::GetValueInput(node, 0);
   Node* new_target = NodeProperties::GetValueInput(node, 1);
-  Type new_target_type = (target == new_target)
-                             ? Type::HeapConstant(constructor, zone())
-                             : NodeProperties::GetType(new_target);
+  Type new_target_type =
+      (target == new_target)
+          ? Type::HeapConstant(isolate(), constructor, zone())
+          : NodeProperties::GetType(new_target);
 
   // Extract original constructor function.
   if (new_target_type.IsHeapConstant() &&
@@ -1788,7 +1789,7 @@ Node* JSCreateLowering::AllocateFastLiteral(
   // Actually allocate and initialize the object.
   AllocationBuilder builder(jsgraph(), effect, control);
   builder.Allocate(boilerplate_map->instance_size(), pretenure,
-                   Type::For(boilerplate_map));
+                   Type::For(isolate(), boilerplate_map));
   builder.Store(AccessBuilder::ForMap(), boilerplate_map);
   builder.Store(AccessBuilder::ForJSObjectPropertiesOrHash(), properties);
   builder.Store(AccessBuilder::ForJSObjectElements(), elements);
@@ -1894,7 +1895,7 @@ Node* JSCreateLowering::AllocateLiteralRegExp(Node* effect, Node* control,
       JSRegExp::kSize + JSRegExp::kInObjectFieldCount * kPointerSize;
 
   AllocationBuilder builder(jsgraph(), effect, control);
-  builder.Allocate(size, pretenure, Type::For(boilerplate_map));
+  builder.Allocate(size, pretenure, Type::For(isolate(), boilerplate_map));
   builder.Store(AccessBuilder::ForMap(), boilerplate_map);
   builder.Store(AccessBuilder::ForJSObjectPropertiesOrHash(),
                 handle(boilerplate->raw_properties_or_hash(), isolate()));

src/compiler/js-native-context-specialization.cc

@@ -624,7 +624,8 @@ Reduction JSNativeContextSpecialization::ReduceGlobalAccess(
             Handle<Map> property_cell_value_map(
                 Handle<HeapObject>::cast(property_cell_value)->map(),
                 isolate());
-            property_cell_value_type = Type::For(property_cell_value_map);
+            property_cell_value_type =
+                Type::For(isolate(), property_cell_value_map);
             representation = MachineRepresentation::kTaggedPointer;
 
             // We can only use the property cell value map for map check

src/compiler/js-typed-lowering.cc

@@ -405,12 +405,11 @@ class JSBinopReduction final {
 // - immediately put in type bounds for all new nodes
 // - relax effects from generic but not-side-effecting operations
 
-JSTypedLowering::JSTypedLowering(Editor* editor,
-                                 JSGraph* jsgraph, Zone* zone)
+JSTypedLowering::JSTypedLowering(Editor* editor, JSGraph* jsgraph, Zone* zone)
     : AdvancedReducer(editor),
       jsgraph_(jsgraph),
-      empty_string_type_(
-          Type::HeapConstant(factory()->empty_string(), graph()->zone())),
+      empty_string_type_(Type::HeapConstant(
+          isolate(), factory()->empty_string(), graph()->zone())),
       pointer_comparable_type_(
           Type::Union(Type::Oddball(),
                       Type::Union(Type::SymbolOrReceiver(), empty_string_type_,

src/compiler/operation-typer.cc

@@ -19,17 +19,22 @@ namespace compiler {
 OperationTyper::OperationTyper(Isolate* isolate, Zone* zone)
     : zone_(zone), cache_(TypeCache::Get()) {
   Factory* factory = isolate->factory();
-  infinity_ = Type::NewConstant(factory->infinity_value(), zone);
-  minus_infinity_ = Type::NewConstant(factory->minus_infinity_value(), zone);
+  infinity_ = Type::NewConstant(isolate, factory->infinity_value(), zone);
+  minus_infinity_ =
+      Type::NewConstant(isolate, factory->minus_infinity_value(), zone);
   Type truncating_to_zero = Type::MinusZeroOrNaN();
   DCHECK(!truncating_to_zero.Maybe(Type::Integral32()));
 
-  singleton_empty_string_ = Type::HeapConstant(factory->empty_string(), zone);
-  singleton_NaN_string_ = Type::HeapConstant(factory->NaN_string(), zone);
-  singleton_zero_string_ = Type::HeapConstant(factory->zero_string(), zone);
-  singleton_false_ = Type::HeapConstant(factory->false_value(), zone);
-  singleton_true_ = Type::HeapConstant(factory->true_value(), zone);
-  singleton_the_hole_ = Type::HeapConstant(factory->the_hole_value(), zone);
+  singleton_empty_string_ =
+      Type::HeapConstant(isolate, factory->empty_string(), zone);
+  singleton_NaN_string_ =
+      Type::HeapConstant(isolate, factory->NaN_string(), zone);
+  singleton_zero_string_ =
+      Type::HeapConstant(isolate, factory->zero_string(), zone);
+  singleton_false_ = Type::HeapConstant(isolate, factory->false_value(), zone);
+  singleton_true_ = Type::HeapConstant(isolate, factory->true_value(), zone);
+  singleton_the_hole_ =
+      Type::HeapConstant(isolate, factory->the_hole_value(), zone);
   signed32ish_ = Type::Union(Type::Signed32(), truncating_to_zero, zone);
   unsigned32ish_ = Type::Union(Type::Unsigned32(), truncating_to_zero, zone);
 

src/compiler/pipeline.cc

@@ -1339,11 +1339,13 @@ struct ConcurrentOptimizationPrepPhase {
     // This is needed for escape analysis.
     NodeProperties::SetType(
         data->jsgraph()->FalseConstant(),
-        Type::HeapConstant(data->isolate()->factory()->false_value(),
+        Type::HeapConstant(data->isolate(),
+                           data->isolate()->factory()->false_value(),
                            data->jsgraph()->zone()));
     NodeProperties::SetType(
         data->jsgraph()->TrueConstant(),
-        Type::HeapConstant(data->isolate()->factory()->true_value(),
+        Type::HeapConstant(data->isolate(),
+                           data->isolate()->factory()->true_value(),
                            data->jsgraph()->zone()));
   }
 };

src/compiler/type-narrowing-reducer.cc

@@ -31,9 +31,11 @@ Reduction TypeNarrowingReducer::Reduce(Node* node) {
           right_type.Is(Type::PlainNumber())) {
         Factory* const factory = jsgraph()->isolate()->factory();
         if (left_type.Max() < right_type.Min()) {
-          new_type = Type::HeapConstant(factory->true_value(), zone());
+          new_type = Type::HeapConstant(jsgraph()->isolate(),
+                                        factory->true_value(), zone());
         } else if (left_type.Min() >= right_type.Max()) {
-          new_type = Type::HeapConstant(factory->false_value(), zone());
+          new_type = Type::HeapConstant(jsgraph()->isolate(),
+                                        factory->false_value(), zone());
         }
       }
       break;

src/compiler/typed-optimization.cc

@@ -22,9 +22,10 @@ TypedOptimization::TypedOptimization(Editor* editor,
     : AdvancedReducer(editor),
       dependencies_(dependencies),
       jsgraph_(jsgraph),
-      true_type_(Type::HeapConstant(factory()->true_value(), graph()->zone())),
-      false_type_(
-          Type::HeapConstant(factory()->false_value(), graph()->zone())),
+      true_type_(Type::HeapConstant(jsgraph->isolate(), factory()->true_value(),
+                                    graph()->zone())),
+      false_type_(Type::HeapConstant(
+          jsgraph->isolate(), factory()->false_value(), graph()->zone())),
       type_cache_(TypeCache::Get()) {}
 
 TypedOptimization::~TypedOptimization() {}

src/compiler/typer.cc

@@ -2181,7 +2181,7 @@ Type Typer::Visitor::TypeConstant(Handle<Object> value) {
   if (Type::IsInteger(*value)) {
     return Type::Range(value->Number(), value->Number(), zone());
   }
-  return Type::NewConstant(value, zone());
+  return Type::NewConstant(isolate(), value, zone());
 }
 
 }  // namespace compiler

src/compiler/types.cc

@@ -146,8 +146,9 @@ Type::bitset Type::BitsetLub() const {
   UNREACHABLE();
 }
 
-Type::bitset BitsetType::Lub(i::Map* map) {
+Type::bitset BitsetType::Lub(Isolate* isolate, i::Map* map) {
   DisallowHeapAllocation no_allocation;
+  Heap* heap = isolate->heap();
   switch (map->instance_type()) {
     case CONS_STRING_TYPE:
     case CONS_ONE_BYTE_STRING_TYPE:
@@ -178,7 +179,6 @@ Type::bitset BitsetType::Lub(i::Map* map) {
     case BIGINT_TYPE:
       return kBigInt;
     case ODDBALL_TYPE: {
-      Heap* heap = map->GetHeap();
       if (map == heap->undefined_map()) return kUndefined;
       if (map == heap->null_map()) return kNull;
       if (map == heap->boolean_map()) return kBoolean;
@@ -343,12 +343,12 @@ Type::bitset BitsetType::Lub(i::Map* map) {
   UNREACHABLE();
 }
 
-Type::bitset BitsetType::Lub(i::Object* value) {
+Type::bitset BitsetType::Lub(Isolate* isolate, i::Object* value) {
   DisallowHeapAllocation no_allocation;
   if (value->IsNumber()) {
     return Lub(value->Number());
   }
-  return Lub(i::HeapObject::cast(value)->map());
+  return Lub(isolate, i::HeapObject::cast(value)->map());
 }
 
 Type::bitset BitsetType::Lub(double value) {
@@ -831,7 +831,8 @@ Type Type::NewConstant(double value, Zone* zone) {
   return OtherNumberConstant(value, zone);
 }
 
-Type Type::NewConstant(i::Handle<i::Object> value, Zone* zone) {
+Type Type::NewConstant(Isolate* isolate, i::Handle<i::Object> value,
+                       Zone* zone) {
   if (IsInteger(*value)) {
     double v = value->Number();
     return Range(v, v, zone);
@@ -840,7 +841,7 @@ Type Type::NewConstant(i::Handle<i::Object> value, Zone* zone) {
   } else if (value->IsString() && !value->IsInternalizedString()) {
     return Type::String();
   }
-  return HeapConstant(i::Handle<i::HeapObject>::cast(value), zone);
+  return HeapConstant(isolate, i::Handle<i::HeapObject>::cast(value), zone);
 }
 
 Type Type::Union(Type type1, Type type2, Zone* zone) {
@@ -1066,8 +1067,9 @@ Type Type::OtherNumberConstant(double value, Zone* zone) {
 }
 
 // static
-Type Type::HeapConstant(i::Handle<i::HeapObject> value, Zone* zone) {
-  return FromTypeBase(HeapConstantType::New(value, zone));
+Type Type::HeapConstant(Isolate* isolate, i::Handle<i::HeapObject> value,
+                        Zone* zone) {
+  return FromTypeBase(HeapConstantType::New(isolate, value, zone));
 }
 
 // static

src/compiler/types.h

@@ -250,8 +250,8 @@ class V8_EXPORT_PRIVATE BitsetType {
   static double Max(bitset);
 
   static bitset Glb(double min, double max);
-  static bitset Lub(i::Map* map);
-  static bitset Lub(i::Object* value);
+  static bitset Lub(Isolate* isolate, i::Map* map);
+  static bitset Lub(Isolate* isolate, i::Object* value);
   static bitset Lub(double value);
   static bitset Lub(double min, double max);
   static bitset ExpandInternals(bitset bits);
@@ -361,14 +361,16 @@ class V8_EXPORT_PRIVATE Type {
   static Type UnsignedSmall() { return NewBitset(BitsetType::UnsignedSmall()); }
 
   static Type OtherNumberConstant(double value, Zone* zone);
-  static Type HeapConstant(i::Handle<i::HeapObject> value, Zone* zone);
+  static Type HeapConstant(Isolate* isolate, i::Handle<i::HeapObject> value,
+                           Zone* zone);
   static Type Range(double min, double max, Zone* zone);
   static Type Range(RangeType::Limits lims, Zone* zone);
   static Type Tuple(Type first, Type second, Type third, Zone* zone);
   static Type Union(int length, Zone* zone);
 
   // NewConstant is a factory that returns Constant, Range or Number.
-  static Type NewConstant(i::Handle<i::Object> value, Zone* zone);
+  static Type NewConstant(Isolate* isolate, i::Handle<i::Object> value,
+                          Zone* zone);
   static Type NewConstant(double value, Zone* zone);
 
   static Type Union(Type type1, Type type2, Zone* zone);
@@ -377,17 +379,21 @@ class V8_EXPORT_PRIVATE Type {
   static Type Of(double value, Zone* zone) {
     return NewBitset(BitsetType::ExpandInternals(BitsetType::Lub(value)));
   }
-  static Type Of(i::Object* value, Zone* zone) {
-    return NewBitset(BitsetType::ExpandInternals(BitsetType::Lub(value)));
+  static Type Of(Isolate* isolate, i::Object* value, Zone* zone) {
+    return NewBitset(
+        BitsetType::ExpandInternals(BitsetType::Lub(isolate, value)));
   }
-  static Type Of(i::Handle<i::Object> value, Zone* zone) {
-    return Of(*value, zone);
+  static Type Of(Isolate* isolate, i::Handle<i::Object> value, Zone* zone) {
+    return Of(isolate, *value, zone);
   }
 
-  static Type For(i::Map* map) {
-    return NewBitset(BitsetType::ExpandInternals(BitsetType::Lub(map)));
+  static Type For(Isolate* isolate, i::Map* map) {
+    return NewBitset(
+        BitsetType::ExpandInternals(BitsetType::Lub(isolate, map)));
+  }
+  static Type For(Isolate* isolate, i::Handle<i::Map> map) {
+    return For(isolate, *map);
   }
-  static Type For(i::Handle<i::Map> map) { return For(*map); }
 
   // Predicates.
   bool IsNone() const { return payload_ == None().payload_; }
@@ -555,8 +561,9 @@ class V8_EXPORT_PRIVATE HeapConstantType : public NON_EXPORTED_BASE(TypeBase) {
   friend class Type;
   friend class BitsetType;
 
-  static HeapConstantType* New(i::Handle<i::HeapObject> value, Zone* zone) {
-    BitsetType::bitset bitset = BitsetType::Lub(*value);
+  static HeapConstantType* New(Isolate* isolate, i::Handle<i::HeapObject> value,
+                               Zone* zone) {
+    BitsetType::bitset bitset = BitsetType::Lub(isolate, *value);
     return new (zone->New(sizeof(HeapConstantType)))
         HeapConstantType(bitset, value);
   }

test/cctest/types-fuzz.h

@@ -40,7 +40,7 @@ namespace compiler {
 class Types {
  public:
   Types(Zone* zone, Isolate* isolate, v8::base::RandomNumberGenerator* rng)
-      : zone_(zone), rng_(rng) {
+      : zone_(zone), isolate_(isolate), rng_(rng) {
 #define DECLARE_TYPE(name, value) \
   name = Type::name();            \
   types.push_back(name);
@@ -65,13 +65,13 @@ class Types {
     object2 = isolate->factory()->NewJSObjectFromMap(object_map);
     array = isolate->factory()->NewJSArray(20);
     uninitialized = isolate->factory()->uninitialized_value();
-    SmiConstant = Type::NewConstant(smi, zone);
-    Signed32Constant = Type::NewConstant(signed32, zone);
+    SmiConstant = Type::NewConstant(isolate, smi, zone);
+    Signed32Constant = Type::NewConstant(isolate, signed32, zone);
 
-    ObjectConstant1 = Type::HeapConstant(object1, zone);
-    ObjectConstant2 = Type::HeapConstant(object2, zone);
-    ArrayConstant = Type::HeapConstant(array, zone);
-    UninitializedConstant = Type::HeapConstant(uninitialized, zone);
+    ObjectConstant1 = Type::HeapConstant(isolate, object1, zone);
+    ObjectConstant2 = Type::HeapConstant(isolate, object2, zone);
+    ArrayConstant = Type::HeapConstant(isolate, array, zone);
+    UninitializedConstant = Type::HeapConstant(isolate, uninitialized, zone);
 
     values.push_back(smi);
     values.push_back(boxed_smi);
@@ -84,7 +84,7 @@ class Types {
     values.push_back(float2);
     values.push_back(float3);
     for (ValueVector::iterator it = values.begin(); it != values.end(); ++it) {
-      types.push_back(Type::NewConstant(*it, zone));
+      types.push_back(Type::NewConstant(isolate, *it, zone));
     }
 
     integers.push_back(isolate->factory()->NewNumber(-V8_INFINITY));
@@ -141,14 +141,14 @@ class Types {
   ValueVector values;
   ValueVector integers;  // "Integer" values used for range limits.
 
-  Type Of(Handle<i::Object> value) { return Type::Of(value, zone_); }
+  Type Of(Handle<i::Object> value) { return Type::Of(isolate_, value, zone_); }
 
   Type NewConstant(Handle<i::Object> value) {
-    return Type::NewConstant(value, zone_);
+    return Type::NewConstant(isolate_, value, zone_);
   }
 
   Type HeapConstant(Handle<i::HeapObject> value) {
-    return Type::HeapConstant(value, zone_);
+    return Type::HeapConstant(isolate_, value, zone_);
   }
 
   Type Range(double min, double max) { return Type::Range(min, max, zone_); }
@@ -186,7 +186,7 @@ class Types {
       }
       case 1: {  // constant
         int i = rng_->NextInt(static_cast<int>(values.size()));
-        return Type::NewConstant(values[i], zone_);
+        return Type::NewConstant(isolate_, values[i], zone_);
       }
       case 2: {  // range
         int i = rng_->NextInt(static_cast<int>(integers.size()));
@@ -213,6 +213,7 @@ class Types {
 
  private:
   Zone* zone_;
+  Isolate* isolate_;
   v8::base::RandomNumberGenerator* rng_;
 };
 

test/unittests/compiler/constant-folding-reducer-unittest.cc

@@ -86,8 +86,8 @@ class ConstantFoldingReducerTest : public TypedGraphTest {
 
 TEST_F(ConstantFoldingReducerTest, ParameterWithMinusZero) {
   {
-    Reduction r = Reduce(
-        Parameter(Type::NewConstant(factory()->minus_zero_value(), zone())));
+    Reduction r = Reduce(Parameter(
+        Type::NewConstant(isolate(), factory()->minus_zero_value(), zone())));
     ASSERT_TRUE(r.Changed());
     EXPECT_THAT(r.replacement(), IsNumberConstant(-0.0));
   }
@@ -98,7 +98,8 @@ TEST_F(ConstantFoldingReducerTest, ParameterWithMinusZero) {
   }
   {
     Reduction r = Reduce(Parameter(Type::Union(
-        Type::MinusZero(), Type::NewConstant(factory()->NewNumber(0), zone()),
+        Type::MinusZero(),
+        Type::NewConstant(isolate(), factory()->NewNumber(0), zone()),
         zone())));
     EXPECT_FALSE(r.Changed());
   }
@@ -107,7 +108,7 @@ TEST_F(ConstantFoldingReducerTest, ParameterWithMinusZero) {
 TEST_F(ConstantFoldingReducerTest, ParameterWithNull) {
   Handle<HeapObject> null = factory()->null_value();
   {
-    Reduction r = Reduce(Parameter(Type::NewConstant(null, zone())));
+    Reduction r = Reduce(Parameter(Type::NewConstant(isolate(), null, zone())));
     ASSERT_TRUE(r.Changed());
     EXPECT_THAT(r.replacement(), IsHeapConstant(null));
   }
@@ -124,13 +125,14 @@ TEST_F(ConstantFoldingReducerTest, ParameterWithNaN) {
                           std::numeric_limits<double>::signaling_NaN()};
   TRACED_FOREACH(double, nan, kNaNs) {
     Handle<Object> constant = factory()->NewNumber(nan);
-    Reduction r = Reduce(Parameter(Type::NewConstant(constant, zone())));
+    Reduction r =
+        Reduce(Parameter(Type::NewConstant(isolate(), constant, zone())));
     ASSERT_TRUE(r.Changed());
     EXPECT_THAT(r.replacement(), IsNumberConstant(IsNaN()));
   }
   {
-    Reduction r =
-        Reduce(Parameter(Type::NewConstant(factory()->nan_value(), zone())));
+    Reduction r = Reduce(Parameter(
+        Type::NewConstant(isolate(), factory()->nan_value(), zone())));
     ASSERT_TRUE(r.Changed());
     EXPECT_THAT(r.replacement(), IsNumberConstant(IsNaN()));
   }
@@ -144,7 +146,8 @@ TEST_F(ConstantFoldingReducerTest, ParameterWithNaN) {
 TEST_F(ConstantFoldingReducerTest, ParameterWithPlainNumber) {
   TRACED_FOREACH(double, value, kFloat64Values) {
     Handle<Object> constant = factory()->NewNumber(value);
-    Reduction r = Reduce(Parameter(Type::NewConstant(constant, zone())));
+    Reduction r =
+        Reduce(Parameter(Type::NewConstant(isolate(), constant, zone())));
     ASSERT_TRUE(r.Changed());
     EXPECT_THAT(r.replacement(), IsNumberConstant(value));
   }
@@ -163,7 +166,8 @@ TEST_F(ConstantFoldingReducerTest, ParameterWithUndefined) {
     EXPECT_THAT(r.replacement(), IsHeapConstant(undefined));
   }
   {
-    Reduction r = Reduce(Parameter(Type::NewConstant(undefined, zone())));
+    Reduction r =
+        Reduce(Parameter(Type::NewConstant(isolate(), undefined, zone())));
     ASSERT_TRUE(r.Changed());
     EXPECT_THAT(r.replacement(), IsHeapConstant(undefined));
   }
@@ -184,9 +188,10 @@ TEST_F(ConstantFoldingReducerTest, ToBooleanWithFalsish) {
                       Type::Undefined(),
                       Type::Union(
                           Type::Undetectable(),
-                          Type::Union(Type::NewConstant(
-                                          factory()->false_value(), zone()),
-                                      Type::Range(0.0, 0.0, zone()), zone()),
+                          Type::Union(
+                              Type::NewConstant(
+                                  isolate(), factory()->false_value(), zone()),
+                              Type::Range(0.0, 0.0, zone()), zone()),
                           zone()),
                       zone()),
                   zone()),
@@ -201,7 +206,7 @@ TEST_F(ConstantFoldingReducerTest, ToBooleanWithFalsish) {
 TEST_F(ConstantFoldingReducerTest, ToBooleanWithTruish) {
   Node* input = Parameter(
       Type::Union(
-          Type::NewConstant(factory()->true_value(), zone()),
+          Type::NewConstant(isolate(), factory()->true_value(), zone()),
           Type::Union(Type::DetectableReceiver(), Type::Symbol(), zone()),
           zone()),
       0);

test/unittests/compiler/graph-unittest.cc

@@ -60,7 +60,7 @@ Node* GraphTest::NumberConstant(volatile double value) {
 
 Node* GraphTest::HeapConstant(const Handle<HeapObject>& value) {
   Node* node = graph()->NewNode(common()->HeapConstant(value));
-  Type type = Type::NewConstant(value, zone());
+  Type type = Type::NewConstant(isolate(), value, zone());
   NodeProperties::SetType(node, type);
   return node;
 }

test/unittests/compiler/js-create-lowering-unittest.cc

@@ -70,7 +70,8 @@ class JSCreateLoweringTest : public TypedGraphTest {
 
 TEST_F(JSCreateLoweringTest, JSCreate) {
   Handle<JSFunction> function = isolate()->object_function();
-  Node* const target = Parameter(Type::HeapConstant(function, graph()->zone()));
+  Node* const target =
+      Parameter(Type::HeapConstant(isolate(), function, graph()->zone()));
   Node* const context = Parameter(Type::Any());
   Node* const effect = graph()->start();
   Node* const control = graph()->start();

test/unittests/compiler/typer-unittest.cc

@@ -174,7 +174,8 @@ class TyperTest : public TypedGraphTest {
             for (int x2 = rmin; x2 < rmin + width; x2++) {
               double result_value = opfun(x1, x2);
               Type result_type = Type::NewConstant(
-                  isolate()->factory()->NewNumber(result_value), zone());
+                  isolate(), isolate()->factory()->NewNumber(result_value),
+                  zone());
               EXPECT_TRUE(result_type.Is(expected_type));
             }
           }
@@ -195,19 +196,21 @@ class TyperTest : public TypedGraphTest {
         double x2 = RandomInt(r2.AsRange());
         double result_value = opfun(x1, x2);
         Type result_type = Type::NewConstant(
-            isolate()->factory()->NewNumber(result_value), zone());
+            isolate(), isolate()->factory()->NewNumber(result_value), zone());
         EXPECT_TRUE(result_type.Is(expected_type));
       }
     }
     // Test extreme cases.
     double x1 = +1e-308;
     double x2 = -1e-308;
-    Type r1 = Type::NewConstant(isolate()->factory()->NewNumber(x1), zone());
-    Type r2 = Type::NewConstant(isolate()->factory()->NewNumber(x2), zone());
+    Type r1 = Type::NewConstant(isolate(), isolate()->factory()->NewNumber(x1),
+                                zone());
+    Type r2 = Type::NewConstant(isolate(), isolate()->factory()->NewNumber(x2),
+                                zone());
     Type expected_type = TypeBinaryOp(op, r1, r2);
     double result_value = opfun(x1, x2);
     Type result_type = Type::NewConstant(
-        isolate()->factory()->NewNumber(result_value), zone());
+        isolate(), isolate()->factory()->NewNumber(result_value), zone());
     EXPECT_TRUE(result_type.Is(expected_type));
   }
 
@@ -222,6 +225,7 @@ class TyperTest : public TypedGraphTest {
         double x2 = RandomInt(r2.AsRange());
         bool result_value = opfun(x1, x2);
         Type result_type = Type::NewConstant(
+            isolate(),
             result_value ? isolate()->factory()->true_value()
                          : isolate()->factory()->false_value(),
             zone());
@@ -241,7 +245,7 @@ class TyperTest : public TypedGraphTest {
         int32_t x2 = static_cast<int32_t>(RandomInt(r2.AsRange()));
         double result_value = opfun(x1, x2);
         Type result_type = Type::NewConstant(
-            isolate()->factory()->NewNumber(result_value), zone());
+            isolate(), isolate()->factory()->NewNumber(result_value), zone());
         EXPECT_TRUE(result_type.Is(expected_type));
       }
     }