[turbofan] Brokerize typed optimization.

Bug: v8:7790
Change-Id: Ia9526c507769f8a7f973a9ed7aedd7cc56d169d0
Reviewed-on: https://chromium-review.googlesource.com/1128756
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54322}

src/compiler/js-heap-broker.cc

@@ -17,6 +17,7 @@ HeapObjectRef::HeapObjectRef(Handle<Object> object) : ObjectRef(object) {
 }
 
 MapRef HeapObjectRef::map(const JSHeapBroker* broker) const {
+  AllowHandleAllocation handle_allocation;
   AllowHandleDereference allow_handle_dereference;
   return MapRef(handle(object<HeapObject>()->map(), broker->isolate()));
 }
@@ -68,6 +69,11 @@ bool ObjectRef::equals(const ObjectRef& other) const {
   return object<Object>().equals(other.object<Object>());
 }
 
+StringRef ObjectRef::TypeOf(const JSHeapBroker* broker) const {
+  AllowHandleDereference handle_dereference;
+  return StringRef(Object::TypeOf(broker->isolate(), object<Object>()));
+}
+
 base::Optional<ContextRef> ContextRef::previous(
     const JSHeapBroker* broker) const {
   AllowHandleAllocation handle_allocation;
@@ -179,6 +185,12 @@ MapRef JSFunctionRef::DependOnInitialMap(
   return MapRef(initial_map);
 }
 
+void MapRef::DependOnStableMap(const JSHeapBroker* broker,
+                               CompilationDependencies* dependencies) const {
+  AllowHandleDereference allow_handle_dereference;
+  dependencies->DependOnStableMap(object<Map>());
+}
+
 int JSFunctionRef::GetInstanceSizeWithFinishedSlackTracking() const {
   AllowHandleDereference allow_handle_dereference;
   object<JSFunction>()->CompleteInobjectSlackTrackingIfActive();
@@ -226,6 +238,7 @@ ScriptContextTableRef::lookup(const NameRef& name) const {
 
 ScriptContextTableRef NativeContextRef::script_context_table(
     const JSHeapBroker* broker) const {
+  AllowHandleAllocation handle_allocation;
   AllowHandleDereference handle_dereference;
   return ScriptContextTableRef(
       handle(object<Context>()->script_context_table(), broker->isolate()));
@@ -263,12 +276,14 @@ double JSObjectRef::RawFastDoublePropertyAt(FieldIndex index) const {
 
 ObjectRef JSObjectRef::RawFastPropertyAt(const JSHeapBroker* broker,
                                          FieldIndex index) const {
+  AllowHandleAllocation handle_allocation;
   AllowHandleDereference handle_dereference;
   return ObjectRef(
       handle(object<JSObject>()->RawFastPropertyAt(index), broker->isolate()));
 }
 
 FixedArrayBaseRef JSObjectRef::elements(const JSHeapBroker* broker) const {
+  AllowHandleAllocation handle_allocation;
   AllowHandleDereference handle_dereference;
   return FixedArrayBaseRef(
       handle(object<JSObject>()->elements(), broker->isolate()));
@@ -435,6 +450,7 @@ PropertyDetails MapRef::GetPropertyDetails(int i) const {
 }
 
 NameRef MapRef::GetPropertyKey(const JSHeapBroker* broker, int i) const {
+  AllowHandleAllocation handle_allocation;
   AllowHandleDereference allow_handle_dereference;
   return NameRef(handle(object<Map>()->instance_descriptors()->GetKey(i),
                         broker->isolate()));
@@ -461,39 +477,65 @@ bool MapRef::has_prototype_slot() const {
   return object<Map>()->has_prototype_slot();
 }
 
+bool MapRef::is_stable() const {
+  AllowHandleDereference allow_handle_dereference;
+  return object<Map>()->is_stable();
+}
+
+bool MapRef::CanTransition() const {
+  AllowHandleDereference allow_handle_dereference;
+  return object<Map>()->CanTransition();
+}
+
 ElementsKind JSArrayRef::GetElementsKind() const {
   AllowHandleDereference allow_handle_dereference;
   return object<JSArray>()->GetElementsKind();
 }
 
 ObjectRef JSArrayRef::length(const JSHeapBroker* broker) const {
+  AllowHandleAllocation handle_allocation;
   AllowHandleDereference allow_handle_dereference;
   return ObjectRef(handle(object<JSArray>()->length(), broker->isolate()));
 }
 
+int StringRef::length() const {
+  AllowHandleDereference allow_handle_dereference;
+  return object<String>()->length();
+}
+
+uint16_t StringRef::GetFirstChar() {
+  AllowHandleDereference allow_handle_dereference;
+  return object<String>()->Get(0);
+}
+
 ObjectRef JSRegExpRef::raw_properties_or_hash(
     const JSHeapBroker* broker) const {
+  AllowHandleAllocation handle_allocation;
   AllowHandleDereference allow_handle_dereference;
   return ObjectRef(
       handle(object<JSRegExp>()->raw_properties_or_hash(), broker->isolate()));
 }
 
 ObjectRef JSRegExpRef::data(const JSHeapBroker* broker) const {
+  AllowHandleAllocation handle_allocation;
   AllowHandleDereference allow_handle_dereference;
   return ObjectRef(handle(object<JSRegExp>()->data(), broker->isolate()));
 }
 
 ObjectRef JSRegExpRef::source(const JSHeapBroker* broker) const {
+  AllowHandleAllocation handle_allocation;
   AllowHandleDereference allow_handle_dereference;
   return ObjectRef(handle(object<JSRegExp>()->source(), broker->isolate()));
 }
 
 ObjectRef JSRegExpRef::flags(const JSHeapBroker* broker) const {
+  AllowHandleAllocation handle_allocation;
   AllowHandleDereference allow_handle_dereference;
   return ObjectRef(handle(object<JSRegExp>()->flags(), broker->isolate()));
 }
 
 ObjectRef JSRegExpRef::last_index(const JSHeapBroker* broker) const {
+  AllowHandleAllocation handle_allocation;
   AllowHandleDereference allow_handle_dereference;
   return ObjectRef(handle(object<JSRegExp>()->last_index(), broker->isolate()));
 }
@@ -509,6 +551,7 @@ bool FixedArrayRef::is_the_hole(const JSHeapBroker* broker, int i) const {
 }
 
 ObjectRef FixedArrayRef::get(const JSHeapBroker* broker, int i) const {
+  AllowHandleAllocation handle_allocation;
   AllowHandleDereference allow_handle_dereference;
   return ObjectRef(handle(object<FixedArray>()->get(i), broker->isolate()));
 }
@@ -545,6 +588,7 @@ bool SharedFunctionInfoRef::has_duplicate_parameters() const {
 
 MapRef NativeContextRef::fast_aliased_arguments_map(
     const JSHeapBroker* broker) const {
+  AllowHandleAllocation handle_allocation;
   AllowHandleDereference allow_handle_dereference;
   return MapRef(handle(object<Context>()->fast_aliased_arguments_map(),
                        broker->isolate()));
@@ -552,6 +596,7 @@ MapRef NativeContextRef::fast_aliased_arguments_map(
 
 MapRef NativeContextRef::sloppy_arguments_map(
     const JSHeapBroker* broker) const {
+  AllowHandleAllocation handle_allocation;
   AllowHandleDereference allow_handle_dereference;
   return MapRef(
       handle(object<Context>()->sloppy_arguments_map(), broker->isolate()));
@@ -559,6 +604,7 @@ MapRef NativeContextRef::sloppy_arguments_map(
 
 MapRef NativeContextRef::strict_arguments_map(
     const JSHeapBroker* broker) const {
+  AllowHandleAllocation handle_allocation;
   AllowHandleDereference allow_handle_dereference;
   return MapRef(
       handle(object<Context>()->strict_arguments_map(), broker->isolate()));
@@ -566,6 +612,7 @@ MapRef NativeContextRef::strict_arguments_map(
 
 MapRef NativeContextRef::js_array_fast_elements_map_index(
     const JSHeapBroker* broker) const {
+  AllowHandleAllocation handle_allocation;
   AllowHandleDereference allow_handle_dereference;
   return MapRef(handle(object<Context>()->js_array_fast_elements_map_index(),
                        broker->isolate()));
@@ -573,6 +620,7 @@ MapRef NativeContextRef::js_array_fast_elements_map_index(
 
 MapRef NativeContextRef::initial_array_iterator_map(
     const JSHeapBroker* broker) const {
+  AllowHandleAllocation handle_allocation;
   AllowHandleDereference allow_handle_dereference;
   return MapRef(handle(object<Context>()->initial_array_iterator_map(),
                        broker->isolate()));
@@ -580,6 +628,7 @@ MapRef NativeContextRef::initial_array_iterator_map(
 
 MapRef NativeContextRef::set_value_iterator_map(
     const JSHeapBroker* broker) const {
+  AllowHandleAllocation handle_allocation;
   AllowHandleDereference allow_handle_dereference;
   return MapRef(
       handle(object<Context>()->set_value_iterator_map(), broker->isolate()));
@@ -587,6 +636,7 @@ MapRef NativeContextRef::set_value_iterator_map(
 
 MapRef NativeContextRef::set_key_value_iterator_map(
     const JSHeapBroker* broker) const {
+  AllowHandleAllocation handle_allocation;
   AllowHandleDereference allow_handle_dereference;
   return MapRef(handle(object<Context>()->set_key_value_iterator_map(),
                        broker->isolate()));
@@ -594,6 +644,7 @@ MapRef NativeContextRef::set_key_value_iterator_map(
 
 MapRef NativeContextRef::map_key_iterator_map(
     const JSHeapBroker* broker) const {
+  AllowHandleAllocation handle_allocation;
   AllowHandleDereference allow_handle_dereference;
   return MapRef(
       handle(object<Context>()->map_key_iterator_map(), broker->isolate()));
@@ -601,6 +652,7 @@ MapRef NativeContextRef::map_key_iterator_map(
 
 MapRef NativeContextRef::map_value_iterator_map(
     const JSHeapBroker* broker) const {
+  AllowHandleAllocation handle_allocation;
   AllowHandleDereference allow_handle_dereference;
   return MapRef(
       handle(object<Context>()->map_value_iterator_map(), broker->isolate()));
@@ -608,6 +660,7 @@ MapRef NativeContextRef::map_value_iterator_map(
 
 MapRef NativeContextRef::map_key_value_iterator_map(
     const JSHeapBroker* broker) const {
+  AllowHandleAllocation handle_allocation;
   AllowHandleDereference allow_handle_dereference;
   return MapRef(handle(object<Context>()->map_key_value_iterator_map(),
                        broker->isolate()));

src/compiler/js-heap-broker.h

@@ -73,12 +73,12 @@ class HeapObjectType {
   V(ScopeInfo)                   \
   V(ScriptContextTable)          \
   V(SharedFunctionInfo)          \
-  V(Map)
+  V(Map)                         \
+  V(String)
 
 #define HEAP_BROKER_KIND_LIST(V) \
   HEAP_BROKER_DATA_LIST(V)       \
-  V(InternalizedString)          \
-  V(String)
+  V(InternalizedString)
 
 #define FORWARD_DECL(Name) class Name##Ref;
 HEAP_BROKER_DATA_LIST(FORWARD_DECL)
@@ -99,6 +99,8 @@ class ObjectRef {
 
   OddballType oddball_type(const JSHeapBroker* broker) const;
 
+  StringRef TypeOf(const JSHeapBroker* broker) const;
+
   bool IsSmi() const;
   int AsSmi() const;
 
@@ -282,9 +284,14 @@ class MapRef : public HeapObjectRef {
   bool IsJSArrayMap() const;
   bool IsFixedCowArrayMap(const JSHeapBroker* broker) const;
 
+  bool is_stable() const;
   bool has_prototype_slot() const;
+  bool CanTransition() const;
 
   bool IsInobjectSlackTrackingInProgress() const;
+
+  void DependOnStableMap(const JSHeapBroker* broker,
+                         CompilationDependencies* dependencies) const;
 };
 
 class FixedArrayBaseRef : public HeapObjectRef {
@@ -338,6 +345,14 @@ class SharedFunctionInfoRef : public HeapObjectRef {
   int function_map_index() const;
 };
 
+class StringRef : public NameRef {
+ public:
+  explicit StringRef(Handle<Object> object) : NameRef(object) {}
+
+  int length() const;
+  uint16_t GetFirstChar();
+};
+
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8

src/compiler/typed-optimization.cc

@@ -4,8 +4,10 @@
 
 #include "src/compiler/typed-optimization.h"
 
+#include "src/base/optional.h"
 #include "src/compiler/compilation-dependencies.h"
 #include "src/compiler/js-graph.h"
+#include "src/compiler/js-heap-broker.h"
 #include "src/compiler/node-matchers.h"
 #include "src/compiler/node-properties.h"
 #include "src/compiler/simplified-operator.h"
@@ -23,6 +25,7 @@ TypedOptimization::TypedOptimization(Editor* editor,
     : AdvancedReducer(editor),
       dependencies_(dependencies),
       jsgraph_(jsgraph),
+      js_heap_broker_(js_heap_broker),
       true_type_(Type::HeapConstant(js_heap_broker, factory()->true_value(),
                                     graph()->zone())),
       false_type_(Type::HeapConstant(js_heap_broker, factory()->false_value(),
@@ -32,6 +35,11 @@ TypedOptimization::TypedOptimization(Editor* editor,
 TypedOptimization::~TypedOptimization() {}
 
 Reduction TypedOptimization::Reduce(Node* node) {
+  DisallowHeapAllocation no_heap_allocation;
+  DisallowHandleAllocation no_handle_allocation;
+  DisallowHandleDereference no_handle_dereference;
+  DisallowCodeDependencyChange no_dependency_change;
+
   switch (node->opcode()) {
     case IrOpcode::kConvertReceiver:
       return ReduceConvertReceiver(node);
@@ -85,14 +93,14 @@ Reduction TypedOptimization::Reduce(Node* node) {
 
 namespace {
 
-MaybeHandle<Map> GetStableMapFromObjectType(Type object_type) {
+base::Optional<MapRef> GetStableMapFromObjectType(
+    const JSHeapBroker* js_heap_broker, Type object_type) {
   if (object_type.IsHeapConstant()) {
-    Handle<HeapObject> object =
-        Handle<HeapObject>::cast(object_type.AsHeapConstant()->Value());
-    Handle<Map> object_map(object->map(), object->GetIsolate());
-    if (object_map->is_stable()) return object_map;
+    HeapObjectRef object = object_type.AsHeapConstant()->Ref();
+    MapRef object_map = object.map(js_heap_broker);
+    if (object_map.is_stable()) return object_map;
   }
-  return MaybeHandle<Map>();
+  return {};
 }
 
 }  // namespace
@@ -140,15 +148,16 @@ Reduction TypedOptimization::ReduceCheckMaps(Node* node) {
   Node* const object = NodeProperties::GetValueInput(node, 0);
   Type const object_type = NodeProperties::GetType(object);
   Node* const effect = NodeProperties::GetEffectInput(node);
-  Handle<Map> object_map;
-  if (GetStableMapFromObjectType(object_type).ToHandle(&object_map)) {
+  base::Optional<MapRef> object_map =
+      GetStableMapFromObjectType(js_heap_broker(), object_type);
+  if (object_map.has_value()) {
     for (int i = 1; i < node->op()->ValueInputCount(); ++i) {
       Node* const map = NodeProperties::GetValueInput(node, i);
       Type const map_type = NodeProperties::GetType(map);
       if (map_type.IsHeapConstant() &&
-          map_type.AsHeapConstant()->Value().is_identical_to(object_map)) {
+          map_type.AsHeapConstant()->Ref().equals(*object_map)) {
         if (object_map->CanTransition()) {
-          dependencies()->DependOnStableMap(object_map);
+          object_map->DependOnStableMap(js_heap_broker(), dependencies());
         }
         return Replace(effect);
       }
@@ -210,12 +219,13 @@ Reduction TypedOptimization::ReduceLoadField(Node* node) {
     //  (1) map cannot transition further, or
     //  (2) deoptimization is enabled and we can add a code dependency on the
     //      stability of map (to guard the Constant type information).
-    Handle<Map> object_map;
-    if (GetStableMapFromObjectType(object_type).ToHandle(&object_map)) {
+    base::Optional<MapRef> object_map =
+        GetStableMapFromObjectType(js_heap_broker(), object_type);
+    if (object_map.has_value()) {
       if (object_map->CanTransition()) {
-        dependencies()->DependOnStableMap(object_map);
+        object_map->DependOnStableMap(js_heap_broker(), dependencies());
       }
-      Node* const value = jsgraph()->HeapConstant(object_map);
+      Node* const value = jsgraph()->Constant(js_heap_broker(), *object_map);
       ReplaceWithValue(node, value);
       return Replace(value);
     }
@@ -330,10 +340,10 @@ const Operator* TypedOptimization::NumberComparisonFor(const Operator* op) {
 
 Reduction TypedOptimization::
     TryReduceStringComparisonOfStringFromSingleCharCodeToConstant(
-        Node* comparison, Handle<String> string, bool inverted) {
+        Node* comparison, const StringRef& string, bool inverted) {
   switch (comparison->opcode()) {
     case IrOpcode::kStringEqual:
-      if (string->length() != 1) {
+      if (string.length() != 1) {
         // String.fromCharCode(x) always has length 1.
         return Replace(jsgraph()->BooleanConstant(false));
       }
@@ -341,7 +351,7 @@ Reduction TypedOptimization::
     case IrOpcode::kStringLessThan:
       V8_FALLTHROUGH;
     case IrOpcode::kStringLessThanOrEqual:
-      if (string->length() == 0) {
+      if (string.length() == 0) {
         // String.fromCharCode(x) <= "" is always false,
         // "" < String.fromCharCode(x) is always true.
         return Replace(jsgraph()->BooleanConstant(inverted));
@@ -358,11 +368,14 @@ Reduction TypedOptimization::
 // and {constant} {comparison} String.fromCharCode(x) if inverted is true.
 Reduction
 TypedOptimization::TryReduceStringComparisonOfStringFromSingleCharCode(
-    Node* comparison, Node* from_char_code, Node* constant, bool inverted) {
+    Node* comparison, Node* from_char_code, Type constant_type, bool inverted) {
   DCHECK_EQ(IrOpcode::kStringFromSingleCharCode, from_char_code->opcode());
-  HeapObjectMatcher m(constant);
-  if (!m.HasValue() || !m.Value()->IsString()) return NoChange();
-  Handle<String> string = Handle<String>::cast(m.Value());
+
+  if (!constant_type.IsHeapConstant()) return NoChange();
+  ObjectRef constant = constant_type.AsHeapConstant()->Ref();
+
+  if (!constant.IsString()) return NoChange();
+  StringRef string = constant.AsString();
 
   // Check if comparison can be resolved statically.
   Reduction red = TryReduceStringComparisonOfStringFromSingleCharCodeToConstant(
@@ -380,12 +393,12 @@ TypedOptimization::TryReduceStringComparisonOfStringFromSingleCharCode(
         simplified()->NumberBitwiseAnd(), from_char_code_repl,
         jsgraph()->Constant(std::numeric_limits<uint16_t>::max()));
   }
-  Node* constant_repl = jsgraph()->Constant(string->Get(0));
+  Node* constant_repl = jsgraph()->Constant(string.GetFirstChar());
 
   Node* number_comparison = nullptr;
   if (inverted) {
     // "x..." <= String.fromCharCode(z) is true if x < z.
-    if (string->length() > 1 &&
+    if (string.length() > 1 &&
         comparison->opcode() == IrOpcode::kStringLessThanOrEqual) {
       comparison_op = simplified()->NumberLessThan();
     }
@@ -393,7 +406,7 @@ TypedOptimization::TryReduceStringComparisonOfStringFromSingleCharCode(
         graph()->NewNode(comparison_op, constant_repl, from_char_code_repl);
   } else {
     // String.fromCharCode(z) < "x..." is true if z <= x.
-    if (string->length() > 1 &&
+    if (string.length() > 1 &&
         comparison->opcode() == IrOpcode::kStringLessThan) {
       comparison_op = simplified()->NumberLessThanOrEqual();
     }
@@ -410,6 +423,8 @@ Reduction TypedOptimization::ReduceStringComparison(Node* node) {
          IrOpcode::kStringLessThanOrEqual == node->opcode());
   Node* const lhs = NodeProperties::GetValueInput(node, 0);
   Node* const rhs = NodeProperties::GetValueInput(node, 1);
+  Type lhs_type = NodeProperties::GetType(lhs);
+  Type rhs_type = NodeProperties::GetType(rhs);
   if (lhs->opcode() == IrOpcode::kStringFromSingleCharCode) {
     if (rhs->opcode() == IrOpcode::kStringFromSingleCharCode) {
       Node* left = NodeProperties::GetValueInput(lhs, 0);
@@ -435,12 +450,12 @@ Reduction TypedOptimization::ReduceStringComparison(Node* node) {
       ReplaceWithValue(node, equal);
       return Replace(equal);
     } else {
-      return TryReduceStringComparisonOfStringFromSingleCharCode(node, lhs, rhs,
-                                                                 false);
+      return TryReduceStringComparisonOfStringFromSingleCharCode(
+          node, lhs, rhs_type, false);
     }
   } else if (rhs->opcode() == IrOpcode::kStringFromSingleCharCode) {
-    return TryReduceStringComparisonOfStringFromSingleCharCode(node, rhs, lhs,
-                                                               true);
+    return TryReduceStringComparisonOfStringFromSingleCharCode(node, rhs,
+                                                               lhs_type, true);
   }
   return NoChange();
 }
@@ -546,26 +561,34 @@ Reduction TypedOptimization::ReduceTypeOf(Node* node) {
   Type const type = NodeProperties::GetType(input);
   Factory* const f = factory();
   if (type.Is(Type::Boolean())) {
-    return Replace(jsgraph()->Constant(f->boolean_string()));
+    return Replace(
+        jsgraph()->Constant(js_heap_broker(), ObjectRef(f->boolean_string())));
   } else if (type.Is(Type::Number())) {
-    return Replace(jsgraph()->Constant(f->number_string()));
+    return Replace(
+        jsgraph()->Constant(js_heap_broker(), ObjectRef(f->number_string())));
   } else if (type.Is(Type::String())) {
-    return Replace(jsgraph()->Constant(f->string_string()));
+    return Replace(
+        jsgraph()->Constant(js_heap_broker(), ObjectRef(f->string_string())));
   } else if (type.Is(Type::BigInt())) {
-    return Replace(jsgraph()->Constant(f->bigint_string()));
+    return Replace(
+        jsgraph()->Constant(js_heap_broker(), ObjectRef(f->bigint_string())));
   } else if (type.Is(Type::Symbol())) {
-    return Replace(jsgraph()->Constant(f->symbol_string()));
+    return Replace(
+        jsgraph()->Constant(js_heap_broker(), ObjectRef(f->symbol_string())));
   } else if (type.Is(Type::OtherUndetectableOrUndefined())) {
-    return Replace(jsgraph()->Constant(f->undefined_string()));
+    return Replace(jsgraph()->Constant(js_heap_broker(),
+                                       ObjectRef(f->undefined_string())));
   } else if (type.Is(Type::NonCallableOrNull())) {
-    return Replace(jsgraph()->Constant(f->object_string()));
+    return Replace(
+        jsgraph()->Constant(js_heap_broker(), ObjectRef(f->object_string())));
   } else if (type.Is(Type::Function())) {
-    return Replace(jsgraph()->Constant(f->function_string()));
+    return Replace(
+        jsgraph()->Constant(js_heap_broker(), ObjectRef(f->function_string())));
   } else if (type.IsHeapConstant()) {
     return Replace(jsgraph()->Constant(
-        Object::TypeOf(isolate(), type.AsHeapConstant()->Value())));
+        js_heap_broker(),
+        type.AsHeapConstant()->Ref().TypeOf(js_heap_broker())));
   }
-
   return NoChange();
 }
 

src/compiler/typed-optimization.h

@@ -58,20 +58,24 @@ class V8_EXPORT_PRIVATE TypedOptimization final
   Reduction ReduceToBoolean(Node* node);
 
   Reduction TryReduceStringComparisonOfStringFromSingleCharCode(
-      Node* comparison, Node* from_char_code, Node* constant, bool inverted);
+      Node* comparison, Node* from_char_code, Type constant_type,
+      bool inverted);
   Reduction TryReduceStringComparisonOfStringFromSingleCharCodeToConstant(
-      Node* comparison, Handle<String> string, bool inverted);
+      Node* comparison, const StringRef& string, bool inverted);
   const Operator* NumberComparisonFor(const Operator* op);
 
-  CompilationDependencies* dependencies() const { return dependencies_; }
+  SimplifiedOperatorBuilder* simplified() const;
   Factory* factory() const;
   Graph* graph() const;
   Isolate* isolate() const;
+
+  CompilationDependencies* dependencies() const { return dependencies_; }
   JSGraph* jsgraph() const { return jsgraph_; }
-  SimplifiedOperatorBuilder* simplified() const;
+  const JSHeapBroker* js_heap_broker() const { return js_heap_broker_; }
 
   CompilationDependencies* const dependencies_;
   JSGraph* const jsgraph_;
+  const JSHeapBroker* js_heap_broker_;
   Type const true_type_;
   Type const false_type_;
   TypeCache const& type_cache_;