[turbofan] Avoid use of ObjectLiteralMapFromCache.

Since the number of properties is always 0, we can just directly use the
Object function's initial map.

Bug: v8:7790
Change-Id: I061bd522f5bce1c059cd82f5946d8bc572dbfb27
Reviewed-on: https://chromium-review.googlesource.com/1180887Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55208}

src/compiler/js-create-lowering.cc

@@ -1176,7 +1176,7 @@ Reduction JSCreateLowering::ReduceJSCreateEmptyLiteralObject(Node* node) {
   Node* control = NodeProperties::GetControlInput(node);
 
   // Retrieve the initial map for the object.
-  MapRef map = native_context_ref().ObjectLiteralMapFromCache();
+  MapRef map = native_context_ref().object_function().initial_map();
   DCHECK(!map.is_dictionary_map());
   DCHECK(!map.IsInobjectSlackTrackingInProgress());
   Node* js_object_map = jsgraph()->Constant(map);

src/compiler/js-heap-broker.cc

@@ -756,15 +756,6 @@ ObjectRef MapRef::GetFieldType(int descriptor) const {
   return ObjectRef(broker(), field_type);
 }
 
-int StringRef::length() const {
-  if (broker()->mode() == JSHeapBroker::kDisabled) {
-    AllowHandleDereference allow_handle_dereference;
-    return object<String>()->length();
-  } else {
-    return data()->AsString()->length;
-  }
-}
-
 uint16_t StringRef::GetFirstChar() {
   if (broker()->mode() == JSHeapBroker::kDisabled) {
     AllowHandleDereference allow_handle_dereference;
@@ -947,6 +938,8 @@ HANDLE_ACCESSOR_C(SharedFunctionInfo, int, function_map_index)
 HANDLE_ACCESSOR_C(SharedFunctionInfo, int, internal_formal_parameter_count)
 HANDLE_ACCESSOR_C(SharedFunctionInfo, LanguageMode, language_mode)
 
+BIMODAL_ACCESSOR_C(String, int, length)
+
 // TODO(neis): Provide StringShape() on StringRef.
 
 bool JSFunctionRef::has_initial_map() const {
@@ -970,15 +963,6 @@ MapRef NativeContextRef::GetFunctionMapFromIndex(int index) const {
   return get(index).AsMap();
 }
 
-MapRef NativeContextRef::ObjectLiteralMapFromCache() const {
-  AllowHeapAllocation heap_allocation;
-  AllowHandleAllocation handle_allocation;
-  AllowHandleDereference allow_handle_dereference;
-  Factory* factory = broker()->isolate()->factory();
-  Handle<Map> map = factory->ObjectLiteralMapFromCache(object<Context>(), 0);
-  return MapRef(broker(), map);
-}
-
 MapRef NativeContextRef::GetInitialJSArrayMap(ElementsKind kind) const {
   switch (kind) {
     case PACKED_SMI_ELEMENTS:

src/compiler/js-heap-broker.h

@@ -213,6 +213,7 @@ class ContextRef : public HeapObjectRef {
 
 #define BROKER_NATIVE_CONTEXT_FIELDS(V)       \
   V(JSFunction, array_function)               \
+  V(JSFunction, object_function)              \
   V(JSFunction, promise_function)             \
   V(Map, fast_aliased_arguments_map)          \
   V(Map, initial_array_iterator_map)          \
@@ -242,7 +243,6 @@ class NativeContextRef : public ContextRef {
 #undef DECL_ACCESSOR
 
   MapRef GetFunctionMapFromIndex(int index) const;
-  MapRef ObjectLiteralMapFromCache() const;
   MapRef GetInitialJSArrayMap(ElementsKind kind) const;
 };
 
@@ -442,17 +442,19 @@ class V8_EXPORT_PRIVATE JSHeapBroker : public NON_EXPORTED_BASE(ZoneObject) {
   ObjectData* GetData(Handle<Object>) const;
   // Never returns nullptr.
   ObjectData* GetOrCreateData(Handle<Object>);
-  void AddData(Handle<Object> object, ObjectData* data);
 
   void Trace(const char* format, ...) const;
 
  private:
   friend class HeapObjectRef;
   friend class ObjectRef;
+  friend class ObjectData;
 
   // TODO(neis): Remove eventually.
   HeapObjectType HeapObjectTypeFromMap(Map* map) const;
 
+  void AddData(Handle<Object> object, ObjectData* data);
+
   Isolate* const isolate_;
   Zone* const zone_;
   ZoneUnorderedMap<Address, ObjectData*> refs_;

src/heap/factory.cc

@@ -3710,21 +3710,24 @@ Handle<JSObject> Factory::NewArgumentsObject(Handle<JSFunction> callee,
 Handle<Map> Factory::ObjectLiteralMapFromCache(Handle<Context> native_context,
                                                int number_of_properties) {
   DCHECK(native_context->IsNativeContext());
-  const int kMapCacheSize = 128;
+
+  if (number_of_properties == 0) {
+    // Reuse the initial map of the Object function if the literal has no
+    // predeclared properties.
+    return handle(native_context->object_function()->initial_map(), isolate());
+  }
+
   // We do not cache maps for too many properties or when running builtin code.
   if (isolate()->bootstrapper()->IsActive()) {
     return Map::Create(isolate(), number_of_properties);
   }
+
   // Use initial slow object proto map for too many properties.
+  const int kMapCacheSize = 128;
   if (number_of_properties > kMapCacheSize) {
     return handle(native_context->slow_object_with_object_prototype_map(),
                   isolate());
   }
-  if (number_of_properties == 0) {
-    // Reuse the initial map of the Object function if the literal has no
-    // predeclared properties.
-    return handle(native_context->object_function()->initial_map(), isolate());
-  }
 
   int cache_index = number_of_properties - 1;
   Handle<Object> maybe_cache(native_context->map_cache(), isolate());
@@ -3743,6 +3746,7 @@ Handle<Map> Factory::ObjectLiteralMapFromCache(Handle<Context> native_context,
       return handle(map, isolate());
     }
   }
+
   // Create a new map and add it to the cache.
   Handle<WeakFixedArray> cache = Handle<WeakFixedArray>::cast(maybe_cache);
   Handle<Map> map = Map::Create(isolate(), number_of_properties);