Reland "[TurboFan] Move SFI and BytecodeArray to kNeverSerialized"

This reverts commit ff606a06.

This fix makes a handle persistent that was missing in the original CL.

Bug: v8:7790, chromium:1158322
Change-Id: I53079f5c32523313cff76130d2a40c3de5bb0638
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2629270
Auto-Submit: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72134}

src/compiler/bytecode-graph-builder.cc

@@ -1526,8 +1526,9 @@ void BytecodeGraphBuilder::VisitLdaSmi() {
 }
 
 void BytecodeGraphBuilder::VisitLdaConstant() {
-  ObjectRef object(
-      broker(), bytecode_iterator().GetConstantForIndexOperand(0, isolate()));
+  ObjectRef object(broker(),
+                   bytecode_iterator().GetConstantForIndexOperand(0, isolate()),
+                   ObjectRef::BackgroundSerialization::kAllowed);
   Node* node = jsgraph()->Constant(object);
   environment()->BindAccumulator(node);
 }

src/compiler/heap-refs.h

@@ -63,6 +63,8 @@ enum class OddballType : uint8_t {
   V(ScopeInfo)                                      \
   /* Subtypes of String */                          \
   V(InternalizedString)                             \
+  /* Subtypes of FixedArrayBase */                  \
+  V(BytecodeArray)                                  \
   /* Subtypes of Name */                            \
   V(Symbol)                                         \
   /* Subtypes of HeapObject */                      \
@@ -70,8 +72,21 @@ enum class OddballType : uint8_t {
   V(ArrayBoilerplateDescription)                    \
   V(CallHandlerInfo)                                \
   V(Cell)                                           \
+  V(SharedFunctionInfo)                             \
   V(TemplateObjectDescription)
 
+// This list is sorted such that subtypes appear before their supertypes.
+// DO NOT VIOLATE THIS PROPERTY!
+// Classes in this list behave like serialized classes, but they allow lazy
+// serialization from background threads where this is safe (e.g. for objects
+// that are immutable and fully initialized once visible). Pass
+// ObjectRef::BackgroundSerialization::kAllowed to the ObjectRef constructor
+// for objects where serialization from the background thread is safe.
+#define HEAP_BROKER_POSSIBLY_BACKGROUND_SERIALIZED_OBJECT_LIST(V) \
+  /* Subtypes of HeapObject */                                    \
+  V(BigInt)                                                       \
+  V(HeapNumber)
+
 // This list is sorted such that subtypes appear before their supertypes.
 // DO NOT VIOLATE THIS PROPERTY!
 #define HEAP_BROKER_SERIALIZED_OBJECT_LIST(V) \
@@ -90,7 +105,6 @@ enum class OddballType : uint8_t {
   V(Context)                                  \
   V(ScriptContextTable)                       \
   /* Subtypes of FixedArrayBase */            \
-  V(BytecodeArray)                            \
   V(FixedArray)                               \
   V(FixedDoubleArray)                         \
   /* Subtypes of Name */                      \
@@ -99,19 +113,16 @@ enum class OddballType : uint8_t {
   V(JSObject)                                 \
   /* Subtypes of HeapObject */                \
   V(AllocationSite)                           \
-  V(BigInt)                                   \
   V(Code)                                     \
   V(DescriptorArray)                          \
   V(FeedbackCell)                             \
   V(FeedbackVector)                           \
   V(FixedArrayBase)                           \
   V(FunctionTemplateInfo)                     \
-  V(HeapNumber)                               \
   V(JSReceiver)                               \
   V(Map)                                      \
   V(Name)                                     \
   V(PropertyCell)                             \
-  V(SharedFunctionInfo)                       \
   V(SourceTextModule)                         \
   /* Subtypes of Object */                    \
   V(HeapObject)
@@ -124,18 +135,25 @@ class PerIsolateCompilerCache;
 class PropertyAccessInfo;
 #define FORWARD_DECL(Name) class Name##Ref;
 HEAP_BROKER_SERIALIZED_OBJECT_LIST(FORWARD_DECL)
+HEAP_BROKER_POSSIBLY_BACKGROUND_SERIALIZED_OBJECT_LIST(FORWARD_DECL)
 HEAP_BROKER_NEVER_SERIALIZED_OBJECT_LIST(FORWARD_DECL)
 #undef FORWARD_DECL
 
 class V8_EXPORT_PRIVATE ObjectRef {
  public:
+  enum class BackgroundSerialization {
+    kDisallowed,
+    kAllowed,
+  };
+
   ObjectRef(JSHeapBroker* broker, Handle<Object> object,
+            BackgroundSerialization background_serialization =
+                BackgroundSerialization::kDisallowed,
             bool check_type = true);
   ObjectRef(JSHeapBroker* broker, ObjectData* data, bool check_type = true)
       : data_(data), broker_(broker) {
     CHECK_NOT_NULL(data_);
   }
-
   Handle<Object> object() const;
 
   bool equals(const ObjectRef& other) const;
@@ -146,11 +164,13 @@ class V8_EXPORT_PRIVATE ObjectRef {
 
 #define HEAP_IS_METHOD_DECL(Name) bool Is##Name() const;
   HEAP_BROKER_SERIALIZED_OBJECT_LIST(HEAP_IS_METHOD_DECL)
+  HEAP_BROKER_POSSIBLY_BACKGROUND_SERIALIZED_OBJECT_LIST(HEAP_IS_METHOD_DECL)
   HEAP_BROKER_NEVER_SERIALIZED_OBJECT_LIST(HEAP_IS_METHOD_DECL)
 #undef HEAP_IS_METHOD_DECL
 
 #define HEAP_AS_METHOD_DECL(Name) Name##Ref As##Name() const;
   HEAP_BROKER_SERIALIZED_OBJECT_LIST(HEAP_AS_METHOD_DECL)
+  HEAP_BROKER_POSSIBLY_BACKGROUND_SERIALIZED_OBJECT_LIST(HEAP_AS_METHOD_DECL)
   HEAP_BROKER_NEVER_SERIALIZED_OBJECT_LIST(HEAP_AS_METHOD_DECL)
 #undef HEAP_AS_METHOD_DECL
 
@@ -241,8 +261,10 @@ class HeapObjectType {
 // the outermost Ref class in the inheritance chain only.
 #define DEFINE_REF_CONSTRUCTOR(name, base)                                  \
   name##Ref(JSHeapBroker* broker, Handle<Object> object,                    \
+            BackgroundSerialization background_serialization =              \
+                BackgroundSerialization::kDisallowed,                       \
             bool check_type = true)                                         \
-      : base(broker, object, false) {                                       \
+      : base(broker, object, background_serialization, false) {             \
     if (check_type) {                                                       \
       CHECK(Is##name());                                                    \
     }                                                                       \

src/compiler/js-graph.cc

@@ -48,11 +48,12 @@ Node* JSGraph::CEntryStubConstant(int result_size, SaveFPRegsMode save_doubles,
 
 Node* JSGraph::Constant(const ObjectRef& ref) {
   if (ref.IsSmi()) return Constant(ref.AsSmi());
-  OddballType oddball_type =
-      ref.AsHeapObject().GetHeapObjectType().oddball_type();
   if (ref.IsHeapNumber()) {
     return Constant(ref.AsHeapNumber().value());
-  } else if (oddball_type == OddballType::kUndefined) {
+  }
+  OddballType oddball_type =
+      ref.AsHeapObject().GetHeapObjectType().oddball_type();
+  if (oddball_type == OddballType::kUndefined) {
     DCHECK(ref.object().equals(isolate()->factory()->undefined_value()));
     return UndefinedConstant();
   } else if (oddball_type == OddballType::kNull) {

src/compiler/js-heap-broker.h

@@ -148,9 +148,14 @@ class V8_EXPORT_PRIVATE JSHeapBroker {
   Handle<Object> GetRootHandle(Object object);
 
   // Never returns nullptr.
-  ObjectData* GetOrCreateData(Handle<Object>);
+  ObjectData* GetOrCreateData(
+      Handle<Object>,
+      ObjectRef::BackgroundSerialization background_serialization =
+          ObjectRef::BackgroundSerialization::kDisallowed);
   // Like the previous but wraps argument in handle first (for convenience).
-  ObjectData* GetOrCreateData(Object);
+  ObjectData* GetOrCreateData(
+      Object, ObjectRef::BackgroundSerialization background_serialization =
+                  ObjectRef::BackgroundSerialization::kDisallowed);
 
   // Check if {object} is any native context's %ArrayPrototype% or
   // %ObjectPrototype%.

src/compiler/serializer-for-background-compilation.cc

@@ -1523,10 +1523,14 @@ void SerializerForBackgroundCompilation::VisitInvokeIntrinsic(
 
 void SerializerForBackgroundCompilation::VisitLdaConstant(
     BytecodeArrayIterator* iterator) {
-  ObjectRef object(
-      broker(), iterator->GetConstantForIndexOperand(0, broker()->isolate()));
-  environment()->accumulator_hints() =
-      Hints::SingleConstant(object.object(), zone());
+  Handle<Object> constant =
+      iterator->GetConstantForIndexOperand(0, broker()->isolate());
+  // TODO(v8:7790): FixedArrays still need to be serialized until they are
+  // moved to kNeverSerialized.
+  if (!FLAG_turbo_direct_heap_access || constant->IsFixedArray()) {
+    ObjectRef(broker(), constant);
+  }
+  environment()->accumulator_hints() = Hints::SingleConstant(constant, zone());
 }
 
 void SerializerForBackgroundCompilation::VisitPushContext(
@@ -2257,7 +2261,7 @@ void SerializerForBackgroundCompilation::ProcessApiCall(
 
   FunctionTemplateInfoRef target_template_info(
       broker(),
-      handle(target->function_data(kAcquireLoad), broker()->isolate()));
+      broker()->CanonicalPersistentHandle(target->function_data(kAcquireLoad)));
   if (!target_template_info.has_call_code()) return;
   target_template_info.SerializeCallCode();
 

src/execution/local-isolate.h

@@ -110,8 +110,7 @@ class V8_NODISCARD SharedMutexGuardIfOffThread<LocalIsolate, kIsShared> final {
   SharedMutexGuardIfOffThread(base::SharedMutex* mutex, LocalIsolate* isolate) {
     DCHECK_NOT_NULL(mutex);
     DCHECK_NOT_NULL(isolate);
-    DCHECK(!isolate->is_main_thread());
-    mutex_guard_.emplace(mutex);
+    if (!isolate->is_main_thread()) mutex_guard_.emplace(mutex);
   }
 
   SharedMutexGuardIfOffThread(const SharedMutexGuardIfOffThread&) = delete;