[turbofan] Remove heap access from BytecodeGraphBuilder

BytecodeGraphBuilder is now completely heap-access free.

Bug: v8:7790
Change-Id: I86a26550cb65015a804dbabf117e11d2bc6aff60
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1773255
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63470}

src/compiler/bytecode-graph-builder.cc

@@ -1935,15 +1935,12 @@ void BytecodeGraphBuilder::VisitCreateClosure() {
           ? AllocationType::kOld
           : AllocationType::kYoung;
 
-  // TODO(mslekova): Remove this allocation.
-  AllowHandleAllocation allow_handle_alloc;
-  AllowHandleDereference allow_handle_deref;
   const Operator* op = javascript()->CreateClosure(
       shared_info.object(),
-      feedback_vector().object()->GetClosureFeedbackCell(
-          bytecode_iterator().GetIndexOperand(1)),
-      handle(jsgraph()->isolate()->builtins()->builtin(Builtins::kCompileLazy),
-             isolate()),
+      feedback_vector()
+          .GetClosureFeedbackCell(bytecode_iterator().GetIndexOperand(1))
+          .object(),
+      jsgraph()->isolate()->builtins()->builtin_handle(Builtins::kCompileLazy),
       allocation);
   Node* closure = NewNode(op);
   environment()->BindAccumulator(closure);

src/compiler/heap-refs.h

@@ -491,6 +491,7 @@ class FeedbackVectorRef : public HeapObjectRef {
   Handle<FeedbackVector> object() const;
 
   ObjectRef get(FeedbackSlot slot) const;
+  FeedbackCellRef GetClosureFeedbackCell(int index) const;
 
   void SerializeSlots();
 };

src/compiler/js-heap-broker.cc

@@ -1267,17 +1267,38 @@ class FeedbackVectorData : public HeapObjectData {
   FeedbackVectorData(JSHeapBroker* broker, ObjectData** storage,
                      Handle<FeedbackVector> object);
 
+  FeedbackCellData* GetClosureFeedbackCell(JSHeapBroker* broker,
+                                           int index) const;
+
   void SerializeSlots(JSHeapBroker* broker);
 
  private:
   bool serialized_ = false;
   ZoneVector<ObjectData*> feedback_;
+  ZoneVector<ObjectData*> closure_feedback_cell_array_;
 };
 
 FeedbackVectorData::FeedbackVectorData(JSHeapBroker* broker,
                                        ObjectData** storage,
                                        Handle<FeedbackVector> object)
-    : HeapObjectData(broker, storage, object), feedback_(broker->zone()) {}
+    : HeapObjectData(broker, storage, object),
+      feedback_(broker->zone()),
+      closure_feedback_cell_array_(broker->zone()) {}
+
+FeedbackCellData* FeedbackVectorData::GetClosureFeedbackCell(
+    JSHeapBroker* broker, int index) const {
+  CHECK_GE(index, 0);
+
+  size_t cell_array_size = closure_feedback_cell_array_.size();
+  if (!serialized_) {
+    DCHECK_EQ(cell_array_size, 0);
+    TRACE_BROKER_MISSING(broker,
+                         " closure feedback cell array for vector " << this);
+    return nullptr;
+  }
+  CHECK_LT(index, cell_array_size);
+  return closure_feedback_cell_array_[index]->AsFeedbackCell();
+}
 
 void FeedbackVectorData::SerializeSlots(JSHeapBroker* broker) {
   if (serialized_) return;
@@ -1304,6 +1325,16 @@ void FeedbackVectorData::SerializeSlots(JSHeapBroker* broker) {
   }
   DCHECK_EQ(vector->length(), feedback_.size());
   TRACE(broker, "Copied " << feedback_.size() << " slots");
+
+  DCHECK(closure_feedback_cell_array_.empty());
+  int length = vector->closure_feedback_cell_array().length();
+  closure_feedback_cell_array_.reserve(length);
+  for (int i = 0; i < length; ++i) {
+    Handle<FeedbackCell> cell = vector->GetClosureFeedbackCell(i);
+    ObjectData* cell_data = broker->GetOrCreateData(cell);
+    closure_feedback_cell_array_.push_back(cell_data);
+  }
+  TRACE(broker, "Copied " << length << " feedback cells");
 }
 
 class FixedArrayBaseData : public HeapObjectData {
@@ -2723,6 +2754,18 @@ ObjectRef FeedbackVectorRef::get(FeedbackSlot slot) const {
   return ObjectRef(broker(), data()->AsFeedbackVector()->feedback().at(i));
 }
 
+FeedbackCellRef FeedbackVectorRef::GetClosureFeedbackCell(int index) const {
+  if (broker()->mode() == JSHeapBroker::kDisabled) {
+    AllowHandleAllocation handle_allocation;
+    AllowHandleDereference handle_dereference;
+    return FeedbackCellRef(broker(), object()->GetClosureFeedbackCell(index));
+  }
+
+  return FeedbackCellRef(
+      broker(),
+      data()->AsFeedbackVector()->GetClosureFeedbackCell(broker(), index));
+}
+
 double JSObjectRef::RawFastDoublePropertyAt(FieldIndex index) const {
   if (broker()->mode() == JSHeapBroker::kDisabled) {
     AllowHandleDereference handle_dereference;