[turbofan] Brokerize JSCreateLowering::JSCreate*Context

Bug: v8:7790
Change-Id: I053eac9c9b49c65a2f751b1b107e32f7603e63a9
Reviewed-on: https://chromium-review.googlesource.com/1126113Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54234}

src/compiler/js-create-lowering.cc

@@ -1249,10 +1249,11 @@ Reduction JSCreateLowering::ReduceJSCreateLiteralRegExp(Node* node) {
 }
 
 Reduction JSCreateLowering::ReduceJSCreateFunctionContext(Node* node) {
+  DisallowHandleDereference disallow_dereference;
   DCHECK_EQ(IrOpcode::kJSCreateFunctionContext, node->opcode());
   const CreateFunctionContextParameters& parameters =
       CreateFunctionContextParametersOf(node->op());
-  Handle<ScopeInfo> scope_info = parameters.scope_info();
+  ScopeInfoRef scope_info(parameters.scope_info());
   int slot_count = parameters.slot_count();
   ScopeType scope_type = parameters.scope_type();
 
@@ -1296,8 +1297,9 @@ Reduction JSCreateLowering::ReduceJSCreateFunctionContext(Node* node) {
 }
 
 Reduction JSCreateLowering::ReduceJSCreateWithContext(Node* node) {
+  DisallowHandleDereference disallow_dereference;
   DCHECK_EQ(IrOpcode::kJSCreateWithContext, node->opcode());
-  Handle<ScopeInfo> scope_info = ScopeInfoOf(node->op());
+  ScopeInfoRef scope_info(ScopeInfoOf(node->op()));
   Node* extension = NodeProperties::GetValueInput(node, 0);
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
@@ -1317,8 +1319,9 @@ Reduction JSCreateLowering::ReduceJSCreateWithContext(Node* node) {
 }
 
 Reduction JSCreateLowering::ReduceJSCreateCatchContext(Node* node) {
+  DisallowHandleDereference disallow_dereference;
   DCHECK_EQ(IrOpcode::kJSCreateCatchContext, node->opcode());
-  Handle<ScopeInfo> scope_info = ScopeInfoOf(node->op());
+  ScopeInfoRef scope_info(ScopeInfoOf(node->op()));
   Node* exception = NodeProperties::GetValueInput(node, 0);
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
@@ -1342,9 +1345,10 @@ Reduction JSCreateLowering::ReduceJSCreateCatchContext(Node* node) {
 }
 
 Reduction JSCreateLowering::ReduceJSCreateBlockContext(Node* node) {
+  DisallowHandleDereference disallow_dereference;
   DCHECK_EQ(IrOpcode::kJSCreateBlockContext, node->opcode());
-  Handle<ScopeInfo> scope_info = ScopeInfoOf(node->op());
-  int const context_length = scope_info->ContextLength();
+  ScopeInfoRef scope_info(ScopeInfoOf(node->op()));
+  int const context_length = scope_info.ContextLength();
 
   // Use inline allocation for block contexts up to a size limit.
   if (context_length < kBlockContextAllocationLimit) {

src/compiler/js-heap-broker.cc

@@ -451,6 +451,11 @@ double FixedDoubleArrayRef::get_scalar(int i) const {
   return object<FixedDoubleArray>()->get_scalar(i);
 }
 
+int ScopeInfoRef::ContextLength() const {
+  AllowHandleDereference allow_handle_dereference;
+  return object<ScopeInfo>()->ContextLength();
+}
+
 int SharedFunctionInfoRef::internal_formal_parameter_count() const {
   AllowHandleDereference allow_handle_dereference;
   return object<SharedFunctionInfo>()->internal_formal_parameter_count();

src/compiler/js-heap-broker.h

@@ -68,6 +68,7 @@ class HeapObjectType {
   V(MutableHeapNumber)           \
   V(Name)                        \
   V(NativeContext)               \
+  V(ScopeInfo)                   \
   V(ScriptContextTable)          \
   V(SharedFunctionInfo)          \
   V(Map)
@@ -289,6 +290,13 @@ class JSArrayRef : public JSObjectRef {
   ObjectRef length(const JSHeapBroker* broker) const;
 };
 
+class ScopeInfoRef : public HeapObjectRef {
+ public:
+  explicit ScopeInfoRef(Handle<Object> object) : HeapObjectRef(object) {}
+
+  int ContextLength() const;
+};
+
 class SharedFunctionInfoRef : public HeapObjectRef {
  public:
   explicit SharedFunctionInfoRef(Handle<Object> object)