[turbofan] Add AllocationSite serialization to the heap broker.

Bug: v8:7790
Change-Id: I268e8673ca5c8f6737cae8190d78caf325e864bd
Reviewed-on: https://chromium-review.googlesource.com/1177604Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55181}

src/compiler/compilation-dependencies.cc

@@ -203,7 +203,7 @@ class ElementsKindDependency final
       : site_(site), kind_(kind) {
     DCHECK(AllocationSite::ShouldTrack(kind_));
     DCHECK_EQ(kind_, site_.PointsToLiteral()
-                         ? site_.boilerplate().GetElementsKind()
+                         ? site_.boilerplate().value().GetElementsKind()
                          : site_.GetElementsKind());
   }
 
@@ -309,7 +309,7 @@ void CompilationDependencies::DependOnElementsKind(
     const AllocationSiteRef& site) {
   // Do nothing if the object doesn't have any useful element transitions left.
   ElementsKind kind = site.PointsToLiteral()
-                          ? site.boilerplate().GetElementsKind()
+                          ? site.boilerplate().value().GetElementsKind()
                           : site.GetElementsKind();
   if (AllocationSite::ShouldTrack(kind)) {
     dependencies_.push_front(new (zone_) ElementsKindDependency(site, kind));

src/compiler/js-create-lowering.cc

@@ -1138,7 +1138,7 @@ Reduction JSCreateLowering::ReduceJSCreateLiteralArrayOrObject(Node* node) {
         pretenure = dependencies()->DependOnPretenureMode(site);
       }
       dependencies()->DependOnElementsKinds(site);
-      JSObjectRef boilerplate = site.boilerplate();
+      JSObjectRef boilerplate = site.boilerplate().value();
       Node* value = effect =
           AllocateFastLiteral(effect, control, boilerplate, pretenure);
       ReplaceWithValue(node, value, effect, control);

src/compiler/js-heap-broker.h

@@ -267,11 +267,19 @@ class AllocationSiteRef : public HeapObjectRef {
  public:
   using HeapObjectRef::HeapObjectRef;
 
-  JSObjectRef boilerplate() const;
+  bool PointsToLiteral() const;
   PretenureFlag GetPretenureMode() const;
-  bool IsFastLiteral() const;
   ObjectRef nested_site() const;
-  bool PointsToLiteral() const;
+
+  // {IsFastLiteral} determines whether the given array or object literal
+  // boilerplate satisfies all limits to be considered for fast deep-copying
+  // and computes the total size of all objects that are part of the graph.
+  //
+  // If PointsToLiteral() is false, then IsFastLiteral() is also false.
+  bool IsFastLiteral() const;
+  // We only serialize boilerplate if IsFastLiteral is true.
+  base::Optional<JSObjectRef> boilerplate() const;
+
   ElementsKind GetElementsKind() const;
   bool CanInlineCall() const;
 };
@@ -285,27 +293,27 @@ class MapRef : public HeapObjectRef {
   int GetInObjectProperties() const;
   int GetInObjectPropertiesStartInWords() const;
   int NumberOfOwnDescriptors() const;
-  PropertyDetails GetPropertyDetails(int i) const;
-  NameRef GetPropertyKey(int i) const;
-  FieldIndex GetFieldIndexFor(int i) const;
   int GetInObjectPropertyOffset(int index) const;
-  ObjectRef constructor_or_backpointer() const;
   ElementsKind elements_kind() const;
-
-  base::Optional<MapRef> AsElementsKind(ElementsKind kind) const;
-
   bool is_stable() const;
   bool has_prototype_slot() const;
   bool is_deprecated() const;
   bool CanBeDeprecated() const;
   bool CanTransition() const;
   bool IsInobjectSlackTrackingInProgress() const;
-  MapRef FindFieldOwner(int descriptor) const;
   bool is_dictionary_map() const;
   bool IsJSArrayMap() const;
   bool IsFixedCowArrayMap() const;
 
+  ObjectRef constructor_or_backpointer() const;
+
+  base::Optional<MapRef> AsElementsKind(ElementsKind kind) const;
+
   // Concerning the underlying instance_descriptors:
+  MapRef FindFieldOwner(int descriptor) const;
+  PropertyDetails GetPropertyDetails(int i) const;
+  NameRef GetPropertyKey(int i) const;
+  FieldIndex GetFieldIndexFor(int i) const;
   ObjectRef GetFieldType(int descriptor) const;
 };
 

src/compiler/js-heap-copy-reducer.cc

@@ -28,6 +28,17 @@ Reduction JSHeapCopyReducer::Reduce(Node* node) {
       ObjectRef(broker(), HeapConstantOf(node->op()));
       break;
     }
+    case IrOpcode::kJSCreateLiteralArray:
+    case IrOpcode::kJSCreateLiteralObject: {
+      // TODO(neis, jarin) Force serialization of the entire feedback vector
+      // rather than just the one element.
+      CreateLiteralParameters const& p = CreateLiteralParametersOf(node->op());
+      Handle<Object> feedback(
+          p.feedback().vector()->Get(p.feedback().slot())->ToObject(),
+          broker()->isolate());
+      ObjectRef(broker(), feedback);
+      break;
+    }
     case IrOpcode::kJSCreateArray: {
       CreateArrayParameters const& p = CreateArrayParametersOf(node->op());
       Handle<AllocationSite> site;