[compiler] Remove SerializerForBackgroundCompilation

Based on a CL by mvstanton@.

Bug: v8:7790,v8:12030,v8:12031,v8:12041
Change-Id: I58b75bd96c724a99133bec7d3bd6cf4e0c9be6d4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3059683Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#76055}

BUILD.bazel

@@ -2441,9 +2441,6 @@ filegroup(
         "src/compiler/scheduler.h",
         "src/compiler/select-lowering.cc",
         "src/compiler/select-lowering.h",
-        "src/compiler/serializer-for-background-compilation.cc",
-        "src/compiler/serializer-for-background-compilation.h",
-        "src/compiler/serializer-hints.h",
         "src/compiler/simplified-lowering.cc",
         "src/compiler/simplified-lowering.h",
         "src/compiler/simplified-operator.cc",

BUILD.gn

@@ -2603,8 +2603,6 @@ v8_header_set("v8_internal_headers") {
     "src/compiler/schedule.h",
     "src/compiler/scheduler.h",
     "src/compiler/select-lowering.h",
-    "src/compiler/serializer-for-background-compilation.h",
-    "src/compiler/serializer-hints.h",
     "src/compiler/simplified-lowering.h",
     "src/compiler/simplified-operator-reducer.h",
     "src/compiler/simplified-operator.h",
@@ -3611,7 +3609,6 @@ v8_compiler_sources = [
   "src/compiler/schedule.cc",
   "src/compiler/scheduler.cc",
   "src/compiler/select-lowering.cc",
-  "src/compiler/serializer-for-background-compilation.cc",
   "src/compiler/simplified-lowering.cc",
   "src/compiler/simplified-operator-reducer.cc",
   "src/compiler/simplified-operator.cc",

src/compiler/bytecode-graph-builder.cc

@@ -4562,8 +4562,6 @@ void BuildGraphFromBytecode(JSHeapBroker* broker, Zone* local_zone,
                             BytecodeGraphBuilderFlags flags,
                             TickCounter* tick_counter,
                             ObserveNodeInfo const& observe_node_info) {
-  DCHECK(broker->IsSerializedForCompilation(
-      shared_info, feedback_cell.value()->AsFeedbackVector()));
   BytecodeGraphBuilder builder(
       broker, local_zone, broker->target_native_context(), shared_info,
       feedback_cell, osr_offset, jsgraph, invocation_frequency,

src/compiler/compilation-dependencies.h

@@ -34,10 +34,6 @@ class V8_EXPORT_PRIVATE CompilationDependencies : public ZoneObject {
 
   V8_WARN_UNUSED_RESULT bool Commit(Handle<Code> code);
 
-  // TODO(jgruber): Remove this method once GetPropertyAccessInfo no longer
-  // uses the two-phase approach between serialization and compilation.
-  void ClearForConcurrentGetPropertyAccessInfo() { dependencies_.clear(); }
-
   // Return the initial map of {function} and record the assumption that it
   // stays the initial map.
   MapRef DependOnInitialMap(const JSFunctionRef& function);

src/compiler/heap-refs.cc

@@ -1660,10 +1660,7 @@ bool ObjectRef::equals(const ObjectRef& other) const {
     data_->used_status = ObjectData::Usage::kOnlyIdentityUsed;
   }
 #endif  // DEBUG
-  // TODO(jgruber): Consider going back to reference-equality on data_ once
-  // ObjectData objects are guaranteed to be canonicalized (see also:
-  // ClearReconstructibleData).
-  return data_->object().is_identical_to(other.data_->object());
+  return data_ == other.data_;
 }
 
 Isolate* ObjectRef::isolate() const { return broker()->isolate(); }
@@ -1783,11 +1780,11 @@ void JSHeapBroker::InitializeAndStartSerializing() {
 
   CollectArrayAndObjectPrototypes();
 
-  Factory* const f = isolate()->factory();
   SetTargetNativeContextRef(target_native_context().object());
   if (!is_concurrent_inlining()) {
     target_native_context().Serialize(NotConcurrentInliningTag{this});
 
+    Factory* const f = isolate()->factory();
     ObjectData* data;
     data = GetOrCreateData(f->array_buffer_detaching_protector());
     if (!data->should_access_heap()) {
@@ -1825,12 +1822,11 @@ void JSHeapBroker::InitializeAndStartSerializing() {
     if (!data->should_access_heap()) {
       data->AsPropertyCell()->Cache(this);
     }
+    GetOrCreateData(f->many_closures_cell());
+    GetOrCreateData(CodeFactory::CEntry(isolate(), 1, SaveFPRegsMode::kIgnore,
+                                        ArgvMode::kStack, true));
+    TRACE(this, "Finished serializing standard objects");
   }
-  GetOrCreateData(f->many_closures_cell());
-  GetOrCreateData(CodeFactory::CEntry(isolate(), 1, SaveFPRegsMode::kIgnore,
-                                      ArgvMode::kStack, true));
-
-  TRACE(this, "Finished serializing standard objects");
 }
 
 namespace {
@@ -1871,25 +1867,6 @@ struct CreateDataFunctor<RefSerializationKind::kNeverSerialized, ObjectData,
 
 }  // namespace
 
-void JSHeapBroker::ClearReconstructibleData() {
-  RefsMap::Entry* p = refs_->Start();
-  while (p != nullptr) {
-    Address key = p->key;
-    ObjectData* value = p->value;
-    p = refs_->Next(p);
-    if (value->IsMap() &&
-        value->kind() == ObjectDataKind::kBackgroundSerializedHeapObject) {
-      CHECK(!value->AsMap()->has_extra_serialized_data());
-    }
-    if (value->IsJSObject() &&
-        value->kind() == ObjectDataKind::kBackgroundSerializedHeapObject) {
-      CHECK(!value->AsJSObject()->has_extra_serialized_data());
-    }
-    // Can be reconstructed from the background thread.
-    CHECK_NOT_NULL(refs_->Remove(key));
-  }
-}
-
 ObjectData* JSHeapBroker::TryGetOrCreateData(Handle<Object> object,
                                              GetOrCreateDataFlags flags) {
   RefsMap::Entry* entry = refs_->Lookup(object.address());
@@ -2078,9 +2055,8 @@ OddballType MapRef::oddball_type() const {
 }
 
 FeedbackCellRef FeedbackVectorRef::GetClosureFeedbackCell(int index) const {
-  // These should all be available because we request the cell for each
-  // CreateClosure bytecode.
-  return MakeRef(broker(), object()->closure_feedback_cell(index));
+  return MakeRefAssumeMemoryFence(broker(),
+                                  object()->closure_feedback_cell(index));
 }
 
 base::Optional<ObjectRef> JSObjectRef::raw_properties_or_hash() const {
@@ -3303,11 +3279,7 @@ ScopeInfoRef SharedFunctionInfoRef::scope_info() const {
 }
 
 void JSObjectRef::SerializeObjectCreateMap(NotConcurrentInliningTag tag) {
-  if (data_->should_access_heap()) {
-    return;
-  }
-  CHECK_IMPLIES(!FLAG_turbo_concurrent_get_property_access_info,
-                broker()->mode() == JSHeapBroker::kSerializing);
+  if (data_->should_access_heap()) return;
   data()->AsJSObject()->SerializeObjectCreateMap(broker(), tag);
 }
 

src/compiler/heap-refs.h

@@ -518,6 +518,7 @@ class ContextRef : public HeapObjectRef {
   V(JSFunction, symbol_function)                 \
   V(JSGlobalObject, global_object)               \
   V(JSGlobalProxy, global_proxy_object)          \
+  V(JSObject, initial_array_prototype)           \
   V(JSObject, promise_prototype)                 \
   V(Map, async_function_object_map)              \
   V(Map, block_context_map)                      \

src/compiler/js-call-reducer.cc

@@ -7993,10 +7993,7 @@ Reduction JSCallReducer::ReduceRegExpPrototypeTest(Node* node) {
     access_infos.push_back(broker()->GetPropertyAccessInfo(
         MakeRef(broker(), map),
         MakeRef(broker(), isolate()->factory()->exec_string()),
-        AccessMode::kLoad, dependencies(),
-        broker()->is_concurrent_inlining()
-            ? SerializationPolicy::kAssumeSerialized
-            : SerializationPolicy::kSerializeIfNeeded));
+        AccessMode::kLoad, dependencies()));
   }
 
   PropertyAccessInfo ai_exec =

src/compiler/js-generic-lowering.cc

@@ -239,6 +239,7 @@ namespace {
 // some cases - unlike the full builtin, the megamorphic builtin does fewer
 // checks and does not collect feedback.
 bool ShouldUseMegamorphicLoadBuiltin(FeedbackSource const& source,
+                                     base::Optional<NameRef> name,
                                      JSHeapBroker* broker) {
   if (broker->is_native_context_independent()) {
     // The decision to use the megamorphic load builtin is made based on
@@ -247,7 +248,8 @@ bool ShouldUseMegamorphicLoadBuiltin(FeedbackSource const& source,
     return false;
   }
 
-  ProcessedFeedback const& feedback = broker->GetFeedback(source);
+  ProcessedFeedback const& feedback =
+      broker->GetFeedbackForPropertyAccess(source, AccessMode::kLoad, name);
 
   if (feedback.kind() == ProcessedFeedback::kElementAccess) {
     return feedback.AsElementAccess().transition_groups().empty();
@@ -263,6 +265,7 @@ bool ShouldUseMegamorphicLoadBuiltin(FeedbackSource const& source,
   }
   UNREACHABLE();
 }
+
 }  // namespace
 
 void JSGenericLowering::LowerJSHasProperty(Node* node) {
@@ -290,14 +293,14 @@ void JSGenericLowering::LowerJSLoadProperty(Node* node) {
     n->InsertInput(zone(), 2,
                    jsgraph()->TaggedIndexConstant(p.feedback().index()));
     ReplaceWithBuiltinCall(
-        node, ShouldUseMegamorphicLoadBuiltin(p.feedback(), broker())
+        node, ShouldUseMegamorphicLoadBuiltin(p.feedback(), {}, broker())
                   ? Builtin::kKeyedLoadICTrampoline_Megamorphic
                   : Builtin::kKeyedLoadICTrampoline);
   } else {
     n->InsertInput(zone(), 2,
                    jsgraph()->TaggedIndexConstant(p.feedback().index()));
     ReplaceWithBuiltinCall(
-        node, ShouldUseMegamorphicLoadBuiltin(p.feedback(), broker())
+        node, ShouldUseMegamorphicLoadBuiltin(p.feedback(), {}, broker())
                   ? Builtin::kKeyedLoadIC_Megamorphic
                   : Builtin::kKeyedLoadIC);
   }
@@ -319,7 +322,8 @@ void JSGenericLowering::LowerJSLoadNamed(Node* node) {
     node->InsertInput(zone(), 2,
                       jsgraph()->TaggedIndexConstant(p.feedback().index()));
     ReplaceWithBuiltinCall(
-        node, ShouldUseMegamorphicLoadBuiltin(p.feedback(), broker())
+        node, ShouldUseMegamorphicLoadBuiltin(
+                  p.feedback(), MakeRef(broker(), p.name()), broker())
                   ? Builtin::kLoadICTrampoline_Megamorphic
                   : Builtin::kLoadICTrampoline);
   } else {
@@ -327,7 +331,8 @@ void JSGenericLowering::LowerJSLoadNamed(Node* node) {
     node->InsertInput(zone(), 2,
                       jsgraph()->TaggedIndexConstant(p.feedback().index()));
     ReplaceWithBuiltinCall(
-        node, ShouldUseMegamorphicLoadBuiltin(p.feedback(), broker())
+        node, ShouldUseMegamorphicLoadBuiltin(
+                  p.feedback(), MakeRef(broker(), p.name()), broker())
                   ? Builtin::kLoadIC_Megamorphic
                   : Builtin::kLoadIC);
   }

src/compiler/js-heap-broker.h

@@ -15,7 +15,6 @@
 #include "src/compiler/heap-refs.h"
 #include "src/compiler/processed-feedback.h"
 #include "src/compiler/refs-map.h"
-#include "src/compiler/serializer-hints.h"
 #include "src/execution/local-isolate.h"
 #include "src/handles/handles.h"
 #include "src/handles/persistent-handles.h"
@@ -132,10 +131,9 @@ class V8_EXPORT_PRIVATE JSHeapBroker {
   bool is_turboprop() const { return code_kind_ == CodeKind::TURBOPROP; }
 
   NexusConfig feedback_nexus_config() const {
-    // TODO(mvstanton): when the broker gathers feedback on the background
-    // thread, this should return a local NexusConfig object which points
-    // to the associated LocalHeap.
-    return NexusConfig::FromMainThread(isolate());
+    return IsMainThread() ? NexusConfig::FromMainThread(isolate())
+                          : NexusConfig::FromBackgroundThread(
+                                isolate(), local_isolate()->heap());
   }
 
   enum BrokerMode { kDisabled, kSerializing, kSerialized, kRetired };
@@ -183,12 +181,11 @@ class V8_EXPORT_PRIVATE JSHeapBroker {
   bool HasFeedback(FeedbackSource const& source) const;
   void SetFeedback(FeedbackSource const& source,
                    ProcessedFeedback const* feedback);
-  ProcessedFeedback const& GetFeedback(FeedbackSource const& source) const;
   FeedbackSlotKind GetFeedbackSlotKind(FeedbackSource const& source) const;
 
   // TODO(neis): Move these into serializer when we're always in the background.
   ElementAccessFeedback const& ProcessFeedbackMapsForElementAccess(
-      MapHandles const& maps, KeyedAccessMode const& keyed_mode,
+      ZoneVector<MapRef>& maps, KeyedAccessMode const& keyed_mode,
       FeedbackSlotKind slot_kind);
 
   // Binary, comparison and for-in hints can be fully expressed via
@@ -216,71 +213,25 @@ class V8_EXPORT_PRIVATE JSHeapBroker {
 
   ProcessedFeedback const& ProcessFeedbackForBinaryOperation(
       FeedbackSource const& source);
-  ProcessedFeedback const& ProcessFeedbackForCall(FeedbackSource const& source);
   ProcessedFeedback const& ProcessFeedbackForCompareOperation(
       FeedbackSource const& source);
   ProcessedFeedback const& ProcessFeedbackForForIn(
       FeedbackSource const& source);
-  ProcessedFeedback const& ProcessFeedbackForGlobalAccess(
-      FeedbackSource const& source);
-  ProcessedFeedback const& ProcessFeedbackForInstanceOf(
-      FeedbackSource const& source);
-  ProcessedFeedback const& ProcessFeedbackForPropertyAccess(
-      FeedbackSource const& source, AccessMode mode,
-      base::Optional<NameRef> static_name);
-  ProcessedFeedback const& ProcessFeedbackForArrayOrObjectLiteral(
-      FeedbackSource const& source);
-  ProcessedFeedback const& ProcessFeedbackForRegExpLiteral(
-      FeedbackSource const& source);
-  ProcessedFeedback const& ProcessFeedbackForTemplateObject(
-      FeedbackSource const& source);
 
   bool FeedbackIsInsufficient(FeedbackSource const& source) const;
 
   base::Optional<NameRef> GetNameFeedback(FeedbackNexus const& nexus);
 
-  // If {policy} is {kAssumeSerialized} and the broker doesn't know about the
-  // combination of {map}, {name}, and {access_mode}, returns Invalid.
   PropertyAccessInfo GetPropertyAccessInfo(
       MapRef map, NameRef name, AccessMode access_mode,
-      CompilationDependencies* dependencies = nullptr,
-      SerializationPolicy policy = SerializationPolicy::kAssumeSerialized);
+      CompilationDependencies* dependencies);
 
   MinimorphicLoadPropertyAccessInfo GetPropertyAccessInfo(
       MinimorphicLoadPropertyAccessFeedback const& feedback,
-      FeedbackSource const& source,
-      SerializationPolicy policy = SerializationPolicy::kAssumeSerialized);
-
-  // Used to separate the problem of a concurrent GetPropertyAccessInfo (GPAI)
-  // from serialization. GPAI is currently called both during the serialization
-  // phase, and on the background thread. While some crucial objects (like
-  // JSObject) still must be serialized, we do the following:
-  // - Run GPAI during serialization to discover and serialize required objects.
-  // - After the serialization phase, clear cached property access infos.
-  // - On the background thread, rerun GPAI in a concurrent setting. The cache
-  //   has been cleared, thus the actual logic runs again.
-  // Once all required object kinds no longer require serialization, this
-  // should be removed together with all GPAI calls during serialization.
-  void ClearCachedPropertyAccessInfos() {
-    CHECK(FLAG_turbo_concurrent_get_property_access_info);
-    property_access_infos_.clear();
-  }
-
-  // As above, clear cached ObjectData that can be reconstructed, i.e. is
-  // either never-serialized or background-serialized.
-  void ClearReconstructibleData();
+      FeedbackSource const& source);
 
   StringRef GetTypedArrayStringTag(ElementsKind kind);
 
-  bool ShouldBeSerializedForCompilation(const SharedFunctionInfoRef& shared,
-                                        const FeedbackVectorRef& feedback,
-                                        const HintsVector& arguments) const;
-  void SetSerializedForCompilation(const SharedFunctionInfoRef& shared,
-                                   const FeedbackVectorRef& feedback,
-                                   const HintsVector& arguments);
-  bool IsSerializedForCompilation(const SharedFunctionInfoRef& shared,
-                                  const FeedbackVectorRef& feedback) const;
-
   bool IsMainThread() const {
     return local_isolate() == nullptr || local_isolate()->is_main_thread();
   }
@@ -420,6 +371,7 @@ class V8_EXPORT_PRIVATE JSHeapBroker {
   friend class ObjectData;
   friend class PropertyCellData;
 
+  ProcessedFeedback const& GetFeedback(FeedbackSource const& source) const;
   bool CanUseFeedback(const FeedbackNexus& nexus) const;
   const ProcessedFeedback& NewInsufficientFeedback(FeedbackSlotKind kind) const;
 
@@ -507,22 +459,6 @@ class V8_EXPORT_PRIVATE JSHeapBroker {
 
   ZoneVector<ObjectData*> typed_array_string_tags_;
 
-  struct SerializedFunction {
-    SharedFunctionInfoRef shared;
-    FeedbackVectorRef feedback;
-
-    bool operator<(const SerializedFunction& other) const {
-      if (shared.object().address() < other.shared.object().address()) {
-        return true;
-      }
-      if (shared.object().address() == other.shared.object().address()) {
-        return feedback.object().address() < other.feedback.object().address();
-      }
-      return false;
-    }
-  };
-  ZoneMultimap<SerializedFunction, HintsVector> serialized_functions_;
-
   CompilationDependencies* dependencies_ = nullptr;
 
   // The MapUpdater mutex is used in recursive patterns; for example,

src/compiler/js-heap-copy-reducer.cc

@@ -70,7 +70,7 @@ Reduction JSHeapCopyReducer::Reduce(Node* node) {
     case IrOpcode::kJSCreateEmptyLiteralArray: {
       FeedbackParameter const& p = FeedbackParameterOf(node->op());
       if (p.feedback().IsValid()) {
-        broker()->ProcessFeedbackForArrayOrObjectLiteral(p.feedback());
+        broker()->GetFeedbackForArrayOrObjectLiteral(p.feedback());
       }
       break;
     }
@@ -82,7 +82,7 @@ Reduction JSHeapCopyReducer::Reduce(Node* node) {
       FeedbackParameter const& p = FeedbackParameterOf(node->op());
       if (p.feedback().IsValid()) {
         // Unary ops are treated as binary ops with respect to feedback.
-        broker()->ProcessFeedbackForBinaryOperation(p.feedback());
+        broker()->GetFeedbackForBinaryOperation(p.feedback());
       }
       break;
     }
@@ -101,7 +101,7 @@ Reduction JSHeapCopyReducer::Reduce(Node* node) {
     case IrOpcode::kJSShiftRightLogical: {
       FeedbackParameter const& p = FeedbackParameterOf(node->op());
       if (p.feedback().IsValid()) {
-        broker()->ProcessFeedbackForBinaryOperation(p.feedback());
+        broker()->GetFeedbackForBinaryOperation(p.feedback());
       }
       break;
     }
@@ -114,7 +114,7 @@ Reduction JSHeapCopyReducer::Reduce(Node* node) {
     case IrOpcode::kJSStrictEqual: {
       FeedbackParameter const& p = FeedbackParameterOf(node->op());
       if (p.feedback().IsValid()) {
-        broker()->ProcessFeedbackForCompareOperation(p.feedback());
+        broker()->GetFeedbackForCompareOperation(p.feedback());
       }
       break;
     }
@@ -128,14 +128,14 @@ Reduction JSHeapCopyReducer::Reduce(Node* node) {
     case IrOpcode::kJSCreateLiteralObject: {
       CreateLiteralParameters const& p = CreateLiteralParametersOf(node->op());
       if (p.feedback().IsValid()) {
-        broker()->ProcessFeedbackForArrayOrObjectLiteral(p.feedback());
+        broker()->GetFeedbackForArrayOrObjectLiteral(p.feedback());
       }
       break;
     }
     case IrOpcode::kJSCreateLiteralRegExp: {
       CreateLiteralParameters const& p = CreateLiteralParametersOf(node->op());
       if (p.feedback().IsValid()) {
-        broker()->ProcessFeedbackForRegExpLiteral(p.feedback());
+        broker()->GetFeedbackForRegExpLiteral(p.feedback());
       }
       break;
     }
@@ -144,7 +144,7 @@ Reduction JSHeapCopyReducer::Reduce(Node* node) {
           GetTemplateObjectParametersOf(node->op());
       MakeRef(broker(), p.shared());
       MakeRef(broker(), p.description());
-      broker()->ProcessFeedbackForTemplateObject(p.feedback());
+      broker()->GetFeedbackForTemplateObject(p.feedback());
       break;
     }
     case IrOpcode::kJSCreateWithContext: {
@@ -155,8 +155,8 @@ Reduction JSHeapCopyReducer::Reduce(Node* node) {
       NamedAccess const& p = NamedAccessOf(node->op());
       NameRef name = MakeRef(broker(), p.name());
       if (p.feedback().IsValid()) {
-        broker()->ProcessFeedbackForPropertyAccess(p.feedback(),
-                                                   AccessMode::kLoad, name);
+        broker()->GetFeedbackForPropertyAccess(p.feedback(), AccessMode::kLoad,
+                                               name);
       }
       break;
     }
@@ -164,8 +164,8 @@ Reduction JSHeapCopyReducer::Reduce(Node* node) {
       NamedAccess const& p = NamedAccessOf(node->op());
       NameRef name = MakeRef(broker(), p.name());
       if (p.feedback().IsValid()) {
-        broker()->ProcessFeedbackForPropertyAccess(p.feedback(),
-                                                   AccessMode::kLoad, name);
+        broker()->GetFeedbackForPropertyAccess(p.feedback(), AccessMode::kLoad,
+                                               name);
       }
       break;
     }
@@ -212,8 +212,8 @@ Reduction JSHeapCopyReducer::Reduce(Node* node) {
       PropertyAccess const& p = PropertyAccessOf(node->op());
       AccessMode access_mode = AccessMode::kLoad;
       if (p.feedback().IsValid()) {
-        broker()->ProcessFeedbackForPropertyAccess(p.feedback(), access_mode,
-                                                   base::nullopt);
+        broker()->GetFeedbackForPropertyAccess(p.feedback(), access_mode,
+                                               base::nullopt);
       }
       break;
     }

src/compiler/js-inlining-heuristic.cc

@@ -37,13 +37,6 @@ bool CanConsiderForInlining(JSHeapBroker* broker,
   }
 
   DCHECK(shared.HasBytecodeArray());
-  if (!broker->IsSerializedForCompilation(shared, feedback_vector)) {
-    TRACE_BROKER_MISSING(
-        broker, "data for " << shared << " (not serialized for compilation)");
-    TRACE("Cannot consider " << shared << " for inlining with "
-                             << feedback_vector << " (missing data)");
-    return false;
-  }
   TRACE("Considering " << shared << " for inlining with " << feedback_vector);
   return true;
 }

src/compiler/js-inlining.cc

@@ -530,12 +530,6 @@ Reduction JSInliner::ReduceJSCall(Node* node) {
   // Determine the target's feedback vector and its context.
   Node* context;
   FeedbackCellRef feedback_cell = DetermineCallContext(node, &context);
-  if (!broker()->IsSerializedForCompilation(*shared_info,
-                                            *feedback_cell.value())) {
-    TRACE("Not inlining " << *shared_info << " into " << outer_shared_info
-                          << " because it wasn't serialized for compilation.");
-    return NoChange();
-  }
 
   TRACE("Inlining " << *shared_info << " into " << outer_shared_info
                     << ((exception_target != nullptr) ? " (inside try-block)"

src/compiler/js-native-context-specialization.cc

@@ -410,10 +410,7 @@ Reduction JSNativeContextSpecialization::ReduceJSInstanceOf(Node* node) {
   MapRef receiver_map = receiver_ref.map();
   NameRef name = MakeRef(broker(), isolate()->factory()->has_instance_symbol());
   PropertyAccessInfo access_info = broker()->GetPropertyAccessInfo(
-      receiver_map, name, AccessMode::kLoad, dependencies(),
-      broker()->is_concurrent_inlining()
-          ? SerializationPolicy::kAssumeSerialized
-          : SerializationPolicy::kSerializeIfNeeded);
+      receiver_map, name, AccessMode::kLoad, dependencies());
 
   // TODO(v8:11457) Support dictionary mode holders here.
   if (access_info.IsInvalid() || access_info.HasDictionaryHolder()) {
@@ -723,10 +720,7 @@ Reduction JSNativeContextSpecialization::ReduceJSResolvePromise(Node* node) {
     access_infos.push_back(broker()->GetPropertyAccessInfo(
         MakeRef(broker(), map),
         MakeRef(broker(), isolate()->factory()->then_string()),
-        AccessMode::kLoad, dependencies(),
-        broker()->is_concurrent_inlining()
-            ? SerializationPolicy::kAssumeSerialized
-            : SerializationPolicy::kSerializeIfNeeded));
+        AccessMode::kLoad, dependencies()));
   }
   PropertyAccessInfo access_info =
       access_info_factory.FinalizePropertyAccessInfosAsOne(access_infos,
@@ -1077,11 +1071,7 @@ Reduction JSNativeContextSpecialization::ReduceMinimorphicPropertyAccess(
   }
 
   MinimorphicLoadPropertyAccessInfo access_info =
-      broker()->GetPropertyAccessInfo(
-          feedback, source,
-          broker()->is_concurrent_inlining()
-              ? SerializationPolicy::kAssumeSerialized
-              : SerializationPolicy::kSerializeIfNeeded);
+      broker()->GetPropertyAccessInfo(feedback, source);
   if (access_info.IsInvalid()) return NoChange();
 
   PropertyAccessBuilder access_builder(jsgraph(), broker(), nullptr);
@@ -1091,8 +1081,8 @@ Reduction JSNativeContextSpecialization::ReduceMinimorphicPropertyAccess(
   }
 
   ZoneHandleSet<Map> maps;
-  for (Handle<Map> map : feedback.maps()) {
-    maps.insert(map, graph()->zone());
+  for (const MapRef& map : feedback.maps()) {
+    maps.insert(map.object(), graph()->zone());
   }
 
   effect = graph()->NewNode(
@@ -1148,7 +1138,9 @@ Reduction JSNativeContextSpecialization::ReduceNamedAccess(
   // Either infer maps from the graph or use the feedback.
   ZoneVector<Handle<Map>> lookup_start_object_maps(zone());
   if (!InferMaps(lookup_start_object, effect, &lookup_start_object_maps)) {
-    lookup_start_object_maps = feedback.maps();
+    for (const MapRef& map : feedback.maps()) {
+      lookup_start_object_maps.push_back(map.object());
+    }
   }
   RemoveImpossibleMaps(lookup_start_object, &lookup_start_object_maps);
 
@@ -1180,10 +1172,7 @@ Reduction JSNativeContextSpecialization::ReduceNamedAccess(
       MapRef map = MakeRef(broker(), map_handle);
       if (map.is_deprecated()) continue;
       PropertyAccessInfo access_info = broker()->GetPropertyAccessInfo(
-          map, feedback.name(), access_mode, dependencies(),
-          broker()->is_concurrent_inlining()
-              ? SerializationPolicy::kAssumeSerialized
-              : SerializationPolicy::kSerializeIfNeeded);
+          map, feedback.name(), access_mode, dependencies());
       access_infos_for_feedback.push_back(access_info);
     }
 
@@ -1636,6 +1625,7 @@ Reduction JSNativeContextSpecialization::ReduceElementAccessOnString(
 }
 
 namespace {
+
 base::Optional<JSTypedArrayRef> GetTypedArrayConstant(JSHeapBroker* broker,
                                                       Node* receiver) {
   HeapObjectMatcher m(receiver);
@@ -1646,6 +1636,7 @@ base::Optional<JSTypedArrayRef> GetTypedArrayConstant(JSHeapBroker* broker,
   if (typed_array.is_on_heap()) return base::nullopt;
   return typed_array;
 }
+
 }  // namespace
 
 void JSNativeContextSpecialization::RemoveImpossibleMaps(
@@ -1664,6 +1655,20 @@ void JSNativeContextSpecialization::RemoveImpossibleMaps(
   }
 }
 
+void JSNativeContextSpecialization::RemoveImpossibleMaps(
+    Node* object, ZoneVector<MapRef>* maps) const {
+  base::Optional<MapRef> root_map = InferRootMap(object);
+  if (root_map.has_value() && !root_map->is_abandoned_prototype_map()) {
+    maps->erase(std::remove_if(maps->begin(), maps->end(),
+                               [root_map](const MapRef& map) {
+                                 return map.is_abandoned_prototype_map() ||
+                                        (map.FindRootMap().has_value() &&
+                                         !map.FindRootMap()->equals(*root_map));
+                               }),
+                maps->end());
+  }
+}
+
 // Possibly refine the feedback using inferred map information from the graph.
 ElementAccessFeedback const&
 JSNativeContextSpecialization::TryRefineElementAccessFeedback(

src/compiler/js-native-context-specialization.h

@@ -213,6 +213,7 @@ class V8_EXPORT_PRIVATE JSNativeContextSpecialization final
   bool CanTreatHoleAsUndefined(ZoneVector<MapRef> const& receiver_maps);
 
   void RemoveImpossibleMaps(Node* object, ZoneVector<Handle<Map>>* maps) const;
+  void RemoveImpossibleMaps(Node* object, ZoneVector<MapRef>* maps) const;
 
   ElementAccessFeedback const& TryRefineElementAccessFeedback(
       ElementAccessFeedback const& feedback, Node* receiver,

src/compiler/pipeline.cc

@@ -69,7 +69,6 @@
 #include "src/compiler/schedule.h"
 #include "src/compiler/scheduler.h"
 #include "src/compiler/select-lowering.h"
-#include "src/compiler/serializer-for-background-compilation.h"
 #include "src/compiler/simplified-lowering.h"
 #include "src/compiler/simplified-operator-reducer.h"
 #include "src/compiler/simplified-operator.h"
@@ -675,8 +674,8 @@ class PipelineImpl final {
   template <typename Phase, typename... Args>
   void Run(Args&&... args);
 
-  // Step A.1. Serialize the data needed for the compilation front-end.
-  void Serialize();
+  // Step A.1. Initialize the heap broker.
+  void InitializeHeapBroker();
 
   // Step A.2. Run the graph creation and initial optimization passes.
   bool CreateGraph();
@@ -1204,10 +1203,11 @@ PipelineCompilationJob::Status PipelineCompilationJob::PrepareJobImpl(
 
   if (compilation_info()->is_osr()) data_.InitializeOsrHelper();
 
-  // Serialize() and CreateGraph() may already use IsPendingAllocation.
+  // InitializeHeapBroker() and CreateGraph() may already use
+  // IsPendingAllocation.
   isolate->heap()->PublishPendingAllocations();
 
-  pipeline_.Serialize();
+  pipeline_.InitializeHeapBroker();
 
   if (!data_.broker()->is_concurrent_inlining()) {
     if (!pipeline_.CreateGraph()) {
@@ -1539,42 +1539,6 @@ struct CopyMetadataForConcurrentCompilePhase {
   }
 };
 
-struct SerializationPhase {
-  DECL_MAIN_THREAD_PIPELINE_PHASE_CONSTANTS(Serialization)
-
-  void Run(PipelineData* data, Zone* temp_zone) {
-    SerializerForBackgroundCompilationFlags flags;
-    if (data->info()->bailout_on_uninitialized()) {
-      flags |= SerializerForBackgroundCompilationFlag::kBailoutOnUninitialized;
-    }
-    if (data->info()->source_positions()) {
-      flags |= SerializerForBackgroundCompilationFlag::kCollectSourcePositions;
-    }
-    if (data->info()->analyze_environment_liveness()) {
-      flags |=
-          SerializerForBackgroundCompilationFlag::kAnalyzeEnvironmentLiveness;
-    }
-    if (data->info()->inlining()) {
-      flags |= SerializerForBackgroundCompilationFlag::kEnableTurboInlining;
-    }
-    RunSerializerForBackgroundCompilation(
-        data->zone_stats(), data->broker(), data->dependencies(),
-        data->info()->closure(), flags, data->info()->osr_offset());
-    if (data->specialization_context().IsJust()) {
-      MakeRef(data->broker(),
-              data->specialization_context().FromJust().context);
-    }
-    if (FLAG_stress_concurrent_inlining) {
-      if (FLAG_turbo_concurrent_get_property_access_info) {
-        data->broker()->ClearCachedPropertyAccessInfos();
-        data->dependencies()->ClearForConcurrentGetPropertyAccessInfo();
-      }
-      // Force re-serialization from the background thread.
-      data->broker()->ClearReconstructibleData();
-    }
-  }
-};
-
 struct TypedLoweringPhase {
   DECL_PIPELINE_PHASE_CONSTANTS(TypedLowering)
 
@@ -2657,8 +2621,8 @@ void PipelineImpl::RunPrintAndVerify(const char* phase, bool untyped) {
   }
 }
 
-void PipelineImpl::Serialize() {
-  PipelineData* data = this->data_;
+void PipelineImpl::InitializeHeapBroker() {
+  PipelineData* data = data_;
 
   data->BeginPhaseKind("V8.TFBrokerInitAndSerialization");
 
@@ -2682,7 +2646,6 @@ void PipelineImpl::Serialize() {
   data->broker()->SetTargetNativeContextRef(data->native_context());
   if (data->broker()->is_concurrent_inlining()) {
     Run<HeapBrokerInitializationPhase>();
-    Run<SerializationPhase>();
     data->broker()->StopSerializing();
   }
   data->EndPhaseKind();
@@ -3353,7 +3316,7 @@ MaybeHandle<Code> Pipeline::GenerateCodeForTesting(
     CompilationHandleScope compilation_scope(isolate, info);
     CanonicalHandleScope canonical(isolate, info);
     info->ReopenHandlesInNewHandleScope(isolate);
-    pipeline.Serialize();
+    pipeline.InitializeHeapBroker();
     // Emulating the proper pipeline, we call CreateGraph on different places
     // (i.e before or after creating a LocalIsolateScope) depending on
     // is_concurrent_inlining.

src/compiler/processed-feedback.h

@@ -162,15 +162,15 @@ class ElementAccessFeedback : public ProcessedFeedback {
 
 class NamedAccessFeedback : public ProcessedFeedback {
  public:
-  NamedAccessFeedback(NameRef const& name, ZoneVector<Handle<Map>> const& maps,
+  NamedAccessFeedback(NameRef const& name, ZoneVector<MapRef> const& maps,
                       FeedbackSlotKind slot_kind);
 
   NameRef const& name() const { return name_; }
-  ZoneVector<Handle<Map>> const& maps() const { return maps_; }
+  ZoneVector<MapRef> const& maps() const { return maps_; }
 
  private:
   NameRef const name_;
-  ZoneVector<Handle<Map>> const maps_;
+  ZoneVector<MapRef> const maps_;
 };
 
 class MinimorphicLoadPropertyAccessFeedback : public ProcessedFeedback {
@@ -178,19 +178,19 @@ class MinimorphicLoadPropertyAccessFeedback : public ProcessedFeedback {
   MinimorphicLoadPropertyAccessFeedback(NameRef const& name,
                                         FeedbackSlotKind slot_kind,
                                         Handle<Object> handler,
-                                        ZoneVector<Handle<Map>> const& maps,
+                                        ZoneVector<MapRef> const& maps,
                                         bool has_migration_target_maps);
 
   NameRef const& name() const { return name_; }
   bool is_monomorphic() const { return maps_.size() == 1; }
   Handle<Object> handler() const { return handler_; }
-  ZoneVector<Handle<Map>> const& maps() const { return maps_; }
+  ZoneVector<MapRef> const& maps() const { return maps_; }
   bool has_migration_target_maps() const { return has_migration_target_maps_; }
 
  private:
   NameRef const name_;
   Handle<Object> const handler_;
-  ZoneVector<Handle<Map>> const maps_;
+  ZoneVector<MapRef> const maps_;
   bool const has_migration_target_maps_;
 };
 

src/compiler/serializer-for-background-compilation.h

-// Copyright 2018 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef V8_COMPILER_SERIALIZER_FOR_BACKGROUND_COMPILATION_H_
-#define V8_COMPILER_SERIALIZER_FOR_BACKGROUND_COMPILATION_H_
-
-#include "src/handles/handles.h"
-
-namespace v8 {
-namespace internal {
-
-class BytecodeOffset;
-class Zone;
-
-namespace compiler {
-
-class CompilationDependencies;
-class JSHeapBroker;
-class ZoneStats;
-
-enum class SerializerForBackgroundCompilationFlag : uint8_t {
-  kBailoutOnUninitialized = 1 << 0,
-  kCollectSourcePositions = 1 << 1,
-  kAnalyzeEnvironmentLiveness = 1 << 2,
-  kEnableTurboInlining = 1 << 3,
-};
-using SerializerForBackgroundCompilationFlags =
-    base::Flags<SerializerForBackgroundCompilationFlag>;
-
-void RunSerializerForBackgroundCompilation(
-    ZoneStats* zone_stats, JSHeapBroker* broker,
-    CompilationDependencies* dependencies, Handle<JSFunction> closure,
-    SerializerForBackgroundCompilationFlags flags, BytecodeOffset osr_offset);
-
-}  // namespace compiler
-}  // namespace internal
-}  // namespace v8
-
-#endif  // V8_COMPILER_SERIALIZER_FOR_BACKGROUND_COMPILATION_H_

src/compiler/serializer-hints.h

-// Copyright 2019 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// This file defines the hints classed gathered temporarily by the
-// SerializerForBackgroundCompilation while it's analysing the bytecode
-// and copying the necessary data to the JSHeapBroker for further usage
-// by the reducers that run on the background thread.
-
-#ifndef V8_COMPILER_SERIALIZER_HINTS_H_
-#define V8_COMPILER_SERIALIZER_HINTS_H_
-
-#include "src/compiler/functional-list.h"
-#include "src/handles/handles.h"
-#include "src/zone/zone-containers.h"
-
-namespace v8 {
-namespace internal {
-
-class Context;
-class Object;
-class Map;
-
-namespace compiler {
-
-template <typename T, typename EqualTo>
-class FunctionalSet {
- public:
-  void Add(T const& elem, Zone* zone) {
-    for (auto const& l : data_) {
-      if (equal_to(l, elem)) return;
-    }
-    data_.PushFront(elem, zone);
-  }
-
-  void Union(FunctionalSet<T, EqualTo> other, Zone* zone) {
-    if (!data_.TriviallyEquals(other.data_)) {
-      // Choose the larger side as tail.
-      if (data_.Size() < other.data_.Size()) std::swap(data_, other.data_);
-      for (auto const& elem : other.data_) Add(elem, zone);
-    }
-  }
-
-  bool IsEmpty() const { return data_.begin() == data_.end(); }
-
-  // Warning: quadratic time complexity.
-  bool Includes(FunctionalSet<T, EqualTo> const& other) const {
-    return std::all_of(other.begin(), other.end(), [&](T const& other_elem) {
-      return std::any_of(this->begin(), this->end(), [&](T const& this_elem) {
-        return equal_to(this_elem, other_elem);
-      });
-    });
-  }
-  bool operator==(const FunctionalSet<T, EqualTo>& other) const {
-    return this->data_.TriviallyEquals(other.data_) ||
-           (this->data_.Size() == other.data_.Size() && this->Includes(other) &&
-            other.Includes(*this));
-  }
-  bool operator!=(const FunctionalSet<T, EqualTo>& other) const {
-    return !(*this == other);
-  }
-
-  size_t Size() const { return data_.Size(); }
-
-  using iterator = typename FunctionalList<T>::iterator;
-
-  iterator begin() const { return data_.begin(); }
-  iterator end() const { return data_.end(); }
-
- private:
-  static EqualTo equal_to;
-  FunctionalList<T> data_;
-};
-
-template <typename T, typename EqualTo>
-EqualTo FunctionalSet<T, EqualTo>::equal_to;
-
-struct VirtualContext {
-  unsigned int distance;
-  Handle<Context> context;
-
-  VirtualContext(unsigned int distance_in, Handle<Context> context_in)
-      : distance(distance_in), context(context_in) {
-    CHECK_GT(distance, 0);
-  }
-  bool operator==(const VirtualContext& other) const {
-    return context.equals(other.context) && distance == other.distance;
-  }
-};
-
-class VirtualClosure;
-struct VirtualBoundFunction;
-
-using ConstantsSet = FunctionalSet<Handle<Object>, Handle<Object>::equal_to>;
-using VirtualContextsSet =
-    FunctionalSet<VirtualContext, std::equal_to<VirtualContext>>;
-using MapsSet = FunctionalSet<Handle<Map>, Handle<Map>::equal_to>;
-using VirtualClosuresSet =
-    FunctionalSet<VirtualClosure, std::equal_to<VirtualClosure>>;
-using VirtualBoundFunctionsSet =
-    FunctionalSet<VirtualBoundFunction, std::equal_to<VirtualBoundFunction>>;
-
-struct HintsImpl;
-class JSHeapBroker;
-
-class Hints {
- public:
-  Hints() = default;  // Empty.
-  static Hints SingleConstant(Handle<Object> constant, Zone* zone);
-  static Hints SingleMap(Handle<Map> map, Zone* zone);
-
-  // For inspection only.
-  ConstantsSet constants() const;
-  MapsSet maps() const;
-  VirtualClosuresSet virtual_closures() const;
-  VirtualContextsSet virtual_contexts() const;
-  VirtualBoundFunctionsSet virtual_bound_functions() const;
-
-  bool IsEmpty() const;
-  bool operator==(Hints const& other) const;
-  bool operator!=(Hints const& other) const;
-
-#ifdef ENABLE_SLOW_DCHECKS
-  bool Includes(Hints const& other) const;
-#endif
-
-  Hints Copy(Zone* zone) const;              // Shallow.
-  Hints CopyToParentZone(Zone* zone, JSHeapBroker* broker) const;  // Deep.
-
-  // As an optimization, empty hints can be represented as {impl_} being
-  // {nullptr}, i.e., as not having allocated a {HintsImpl} object. As a
-  // consequence, some operations need to force allocation prior to doing their
-  // job. In particular, backpropagation from a child serialization
-  // can only work if the hints were already allocated in the parent zone.
-  bool IsAllocated() const { return impl_ != nullptr; }
-  void EnsureShareable(Zone* zone) { EnsureAllocated(zone, false); }
-
-  // Make {this} an alias of {other}.
-  void Reset(Hints* other, Zone* zone);
-
-  void Merge(Hints const& other, Zone* zone, JSHeapBroker* broker);
-
-  // Destructive updates: if the hints are shared by several registers,
-  // then the following updates will be seen by all of them:
-  void AddConstant(Handle<Object> constant, Zone* zone, JSHeapBroker* broker);
-  void AddMap(Handle<Map> map, Zone* zone, JSHeapBroker* broker,
-              bool check_zone_equality = true);
-  void AddVirtualClosure(VirtualClosure const& virtual_closure, Zone* zone,
-                         JSHeapBroker* broker);
-  void AddVirtualContext(VirtualContext const& virtual_context, Zone* zone,
-                         JSHeapBroker* broker);
-  void AddVirtualBoundFunction(VirtualBoundFunction const& bound_function,
-                               Zone* zone, JSHeapBroker* broker);
-  void Add(Hints const& other, Zone* zone, JSHeapBroker* broker);
-
- private:
-  friend std::ostream& operator<<(std::ostream&, const Hints& hints);
-  HintsImpl* impl_ = nullptr;
-
-  void EnsureAllocated(Zone* zone, bool check_zone_equality = true);
-
-  // Helper for Add and Merge.
-  bool Union(Hints const& other);
-
-  static const size_t kMaxHintsSize = 50;
-  static_assert(kMaxHintsSize >= 1, "must allow for at least one hint");
-};
-
-using HintsVector = ZoneVector<Hints>;
-
-}  // namespace compiler
-}  // namespace internal
-}  // namespace v8
-
-#endif  // V8_COMPILER_SERIALIZER_HINTS_H_

src/flags/flag-definitions.h

@@ -706,9 +706,6 @@ DEFINE_IMPLICATION(stress_concurrent_inlining, concurrent_inlining)
 DEFINE_NEG_IMPLICATION(stress_concurrent_inlining, lazy_feedback_allocation)
 DEFINE_WEAK_VALUE_IMPLICATION(stress_concurrent_inlining, interrupt_budget,
                               15 * KB)
-DEFINE_BOOL(
-    turbo_concurrent_get_property_access_info, true,
-    "concurrently call GetPropertyAccessInfo (only with --concurrent-inlining)")
 DEFINE_INT(max_serializer_nesting, 25,
            "maximum levels for nesting child serializers")
 DEFINE_WEAK_IMPLICATION(future, concurrent_inlining)

src/ic/handler-configuration-inl.h

@@ -216,8 +216,12 @@ Handle<Smi> StoreHandler::StoreSlow(Isolate* isolate,
 }
 
 Handle<Smi> StoreHandler::StoreProxy(Isolate* isolate) {
+  return handle(StoreProxy(), isolate);
+}
+
+Smi StoreHandler::StoreProxy() {
   int config = KindBits::encode(kProxy);
-  return handle(Smi::FromInt(config), isolate);
+  return Smi::FromInt(config);
 }
 
 Handle<Smi> StoreHandler::StoreField(Isolate* isolate, Kind kind,

src/ic/handler-configuration.h

@@ -354,6 +354,7 @@ class StoreHandler final : public DataHandler {
 
   // Creates a Smi-handler for storing a property on a proxy.
   static inline Handle<Smi> StoreProxy(Isolate* isolate);
+  static inline Smi StoreProxy();
 
   // Decodes the KeyedAccessStoreMode from a {handler}.
   static KeyedAccessStoreMode GetKeyedAccessStoreMode(MaybeObject handler);

src/objects/feedback-vector.cc

@@ -1244,14 +1244,14 @@ KeyedAccessStoreMode FeedbackNexus::GetKeyedAccessStoreMode() const {
         continue;
       } else {
         Code code = FromCodeT(CodeT::cast(data_handler->smi_handler()));
-        handler = handle(code, vector().GetIsolate());
+        handler = config()->NewHandle(code);
       }
 
     } else if (maybe_code_handler.object()->IsSmi()) {
       // Skip for Proxy Handlers.
-      if (*(maybe_code_handler.object()) ==
-          *StoreHandler::StoreProxy(GetIsolate()))
+      if (*maybe_code_handler.object() == StoreHandler::StoreProxy()) {
         continue;
+      }
       // Decode the KeyedAccessStoreMode information from the Handler.
       mode = StoreHandler::GetKeyedAccessStoreMode(*maybe_code_handler);
       if (mode != STANDARD_STORE) return mode;
@@ -1260,7 +1260,7 @@ KeyedAccessStoreMode FeedbackNexus::GetKeyedAccessStoreMode() const {
       // Element store without prototype chain check.
       if (V8_EXTERNAL_CODE_SPACE_BOOL) {
         Code code = FromCodeT(CodeT::cast(*maybe_code_handler.object()));
-        handler = handle(code, vector().GetIsolate());
+        handler = config()->NewHandle(code);
       } else {
         handler = Handle<Code>::cast(maybe_code_handler.object());
       }

test/cctest/BUILD.gn

@@ -89,8 +89,6 @@ v8_source_set("cctest_sources") {
     "compiler/function-tester.cc",
     "compiler/function-tester.h",
     "compiler/node-observer-tester.h",
-    "compiler/serializer-tester.cc",
-    "compiler/serializer-tester.h",
     "compiler/test-basic-block-profiler.cc",
     "compiler/test-branch-combine.cc",
     "compiler/test-calls-with-arraylike-or-spread.cc",

test/cctest/cctest.status

@@ -136,6 +136,10 @@
   'test-strings/Traverse': [PASS, HEAVY],
   'test-swiss-name-dictionary-csa/DeleteAtBoundaries': [PASS, HEAVY],
   'test-swiss-name-dictionary-csa/SameH2': [PASS, HEAVY],
+
+  # TODO(v8:12030): Fix lazy source positions in combination with concurrent
+  # inlining.
+  'test-cpu-profiler/DetailedSourcePositionAPI_Inlining': [SKIP],
 }],  # ALWAYS
 
 ##############################################################################
@@ -611,7 +615,6 @@
 
   # Tests that generate code at runtime.
   'codegen-tester/*': [SKIP],
-  'serializer-tester/*': [SKIP],
   'test-accessor-assembler/*': [SKIP],
   'test-assembler-*': [SKIP],
   'test-basic-block-profiler/*': [SKIP],
@@ -686,17 +689,6 @@
 ##############################################################################
 ['variant == jitless', {
   # https://crbug.com/v8/7777
-  'serializer-tester/SerializeCallAnyReceiver': [SKIP],
-  'serializer-tester/SerializeCallArguments': [SKIP],
-  'serializer-tester/SerializeCallProperty': [SKIP],
-  'serializer-tester/SerializeCallProperty2': [SKIP],
-  'serializer-tester/SerializeCallUndefinedReceiver': [SKIP],
-  'serializer-tester/SerializeCallUndefinedReceiver2': [SKIP],
-  'serializer-tester/SerializeCallWithSpread': [SKIP],
-  'serializer-tester/SerializeConstruct': [SKIP],
-  'serializer-tester/SerializeConstructWithSpread': [SKIP],
-  'serializer-tester/SerializeInlinedClosure': [SKIP],
-  'serializer-tester/SerializeInlinedFunction': [SKIP],
   'test-cpu-profiler/TickLinesOptimized': [SKIP],
   'test-heap/TestOptimizeAfterBytecodeFlushingCandidate': [SKIP],
   'test-js-to-wasm/*': [SKIP],
@@ -742,8 +734,6 @@
   # Turboprop doesn't use call feedback and hence doesn't inline even if
   # the inlining flag is explicitly set.
   'test-cpu-profiler/DetailedSourcePositionAPI_Inlining': [SKIP],
-  'serializer-tester/BoundFunctionArguments': [SKIP],
-  'serializer-tester/BoundFunctionTarget': [SKIP],
   'test-calls-with-arraylike-or-spread/*': [SKIP],
   'test-js-to-wasm/*': [SKIP],
 }],  # variant == turboprop or variant == turboprop_as_toptier
@@ -819,28 +809,7 @@
   'test-invalidated-slots/InvalidatedSlotsNoInvalidatedRanges': [SKIP],
   'test-invalidated-slots/InvalidatedSlotsResetObjectRegression': [SKIP],
   'test-invalidated-slots/InvalidatedSlotsSomeInvalidatedRanges': [SKIP],
-  # Requires --concurrent_inlining / --finalize_streaming_on_background:
-  'serializer-tester/ArrowFunctionInlined': [SKIP],
-  'serializer-tester/BoundFunctionArguments': [SKIP],
-  'serializer-tester/BoundFunctionResult': [SKIP],
-  'serializer-tester/BoundFunctionTarget': [SKIP],
-  'serializer-tester/MergeJumpTargetEnvironment': [SKIP],
-  'serializer-tester/MultipleFunctionCalls': [SKIP],
-  'serializer-tester/SerializeCallAnyReceiver': [SKIP],
-  'serializer-tester/SerializeCallArguments': [SKIP],
-  'serializer-tester/SerializeCallProperty': [SKIP],
-  'serializer-tester/SerializeCallProperty2': [SKIP],
-  'serializer-tester/SerializeCallUndefinedReceiver': [SKIP],
-  'serializer-tester/SerializeCallUndefinedReceiver2': [SKIP],
-  'serializer-tester/SerializeCallWithSpread': [SKIP],
-  'serializer-tester/SerializeConditionalJump': [SKIP],
-  'serializer-tester/SerializeConstruct': [SKIP],
-  'serializer-tester/SerializeConstructSuper': [SKIP],
-  'serializer-tester/SerializeConstructWithSpread': [SKIP],
-  'serializer-tester/SerializeEmptyFunction': [SKIP],
-  'serializer-tester/SerializeInlinedClosure': [SKIP],
-  'serializer-tester/SerializeInlinedFunction': [SKIP],
-  'serializer-tester/SerializeUnconditionalJump': [SKIP],
+  # Requires --finalize_streaming_on_background:
   'test-concurrent-allocation/ConcurrentAllocationWhileMainThreadIsParked': [SKIP],
   'test-concurrent-allocation/ConcurrentAllocationWhileMainThreadParksAndUnparks': [SKIP],
   'test-concurrent-allocation/ConcurrentAllocationWhileMainThreadRunsWithSafepoints': [SKIP],

test/mjsunit/compiler/concurrent-invalidate-transition-map.js

@@ -27,7 +27,7 @@
 
 // Flags: --allow-natives-syntax
 // Flags: --concurrent-recompilation --block-concurrent-recompilation
-// Flags: --no-always-opt --no-turbo-concurrent-get-property-access-info
+// Flags: --no-always-opt
 
 if (!%IsConcurrentRecompilationSupported()) {
   print("Concurrent recompilation is disabled. Skipping this test.");

test/mjsunit/compiler/concurrent-proto-change.js

@@ -27,7 +27,7 @@
 
 // Flags: --allow-natives-syntax --no-always-opt
 // Flags: --concurrent-recompilation --block-concurrent-recompilation
-// Flags: --no-always-opt --no-turbo-concurrent-get-property-access-info
+// Flags: --no-always-opt
 
 if (!%IsConcurrentRecompilationSupported()) {
   print("Concurrent recompilation is disabled. Skipping this test.");

test/mjsunit/concurrent-initial-prototype-change-1.js

@@ -29,8 +29,6 @@
 // Flags: --concurrent-recompilation --block-concurrent-recompilation
 // Flags: --nostress-opt --no-always-opt
 // Flags: --no-turboprop
-// Flags: --no-concurrent-inlining
-// Flags: --no-turbo-concurrent-get-property-access-info
 
 // --nostress-opt is in place because this particular optimization
 // (guaranteeing that the Array prototype chain has no elements) is

test/mjsunit/const-dict-tracking.js

@@ -3,9 +3,7 @@
 // found in the LICENSE file.
 //
 // Flags: --allow-natives-syntax --opt --no-always-opt
-// Flags: --no-stress-flush-code
-// Flags: --block-concurrent-recompilation
-// Flags: --no-turbo-concurrent-get-property-access-info
+// Flags: --no-stress-flush-code --block-concurrent-recompilation
 //
 // Tests tracking of constness of properties stored in dictionary
 // mode prototypes.

test/mjsunit/mjsunit.status

@@ -208,6 +208,23 @@
   # dispatcher *without* aborting existing jobs.
   'interrupt-budget-override': [PASS,FAIL],
   'never-optimize': [PASS,FAIL],
+
+  # TODO(v8:12041): Reimplement an %UnblockConcurrentRecompilation pattern that
+  # works with concurrent compilation (i.e. without main-thread serialization).
+  'compiler/concurrent-invalidate-transition-map': [SKIP],
+  'compiler/concurrent-proto-change': [SKIP],
+  'compiler/regress-905555': [SKIP],
+  'compiler/regress-905555-2': [SKIP],
+  'concurrent-initial-prototype-change-1': [SKIP],
+  'const-dict-tracking': [SKIP],
+
+  # TODO(v8:12031): Reimplement elements kinds transitions when concurrent
+  # inlining.
+  'compiler/call-with-arraylike-or-spread-4': [SKIP],
+  'elements-kind': [SKIP],
+  'elements-transition-hoisting': [SKIP],
+  'regress/regress-7254': [SKIP],
+  'regress/regress-7510': [SKIP],
 }],  # ALWAYS
 
 ##############################################################################