[turbofan] Fully brokerize JSInlining and EscapeAnalysis

Introduce JSGlobalObjectRef to the heap broker.

Bug: v8:7790
Change-Id: I055a0545b582d6ff4c4e0dd639ce532311a76fec
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1773267Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63472}

src/compiler/access-info.cc

@@ -446,7 +446,7 @@ PropertyAccessInfo AccessInfoFactory::ComputeAccessorDescriptorAccessInfo(
     CallOptimization optimization(isolate(), accessor);
     if (!optimization.is_simple_api_call() ||
         optimization.IsCrossContextLazyAccessorPair(
-            *broker()->native_context().object(), *map)) {
+            *broker()->target_native_context().object(), *map)) {
       return PropertyAccessInfo::Invalid(zone());
     }
 
@@ -557,7 +557,8 @@ PropertyAccessInfo AccessInfoFactory::ComputePropertyAccessInfo(
       // Perform the implicit ToObject for primitives here.
       // Implemented according to ES6 section 7.3.2 GetV (V, P).
       Handle<JSFunction> constructor;
-      if (Map::GetConstructorFunction(map, broker()->native_context().object())
+      if (Map::GetConstructorFunction(
+              map, broker()->target_native_context().object())
               .ToHandle(&constructor)) {
         map = handle(constructor->initial_map(), isolate());
         DCHECK(map->prototype().IsJSObject());

src/compiler/bytecode-graph-builder.cc

@@ -4072,7 +4072,6 @@ void BuildGraphFromBytecode(JSHeapBroker* broker, Zone* local_zone,
                             BailoutId osr_offset, JSGraph* jsgraph,
                             CallFrequency const& invocation_frequency,
                             SourcePositionTable* source_positions,
-                            Handle<NativeContext> native_context,
                             int inlining_id, BytecodeGraphBuilderFlags flags,
                             TickCounter* tick_counter) {
   BytecodeArrayRef bytecode_array_ref(broker, bytecode_array);
@@ -4080,11 +4079,10 @@ void BuildGraphFromBytecode(JSHeapBroker* broker, Zone* local_zone,
   FeedbackVectorRef feedback_vector_ref(broker, feedback_vector);
   SharedFunctionInfoRef shared_ref(broker, shared);
   DCHECK(shared_ref.IsSerializedForCompilation(feedback_vector_ref));
-  NativeContextRef native_context_ref(broker, native_context);
   BytecodeGraphBuilder builder(
       broker, local_zone, bytecode_array_ref, shared_ref, feedback_vector_ref,
       osr_offset, jsgraph, invocation_frequency, source_positions,
-      native_context_ref, inlining_id, flags, tick_counter);
+      broker->target_native_context(), inlining_id, flags, tick_counter);
   builder.CreateGraph();
 }
 

src/compiler/bytecode-graph-builder.h

@@ -45,7 +45,6 @@ void BuildGraphFromBytecode(JSHeapBroker* broker, Zone* local_zone,
                             BailoutId osr_offset, JSGraph* jsgraph,
                             CallFrequency const& invocation_frequency,
                             SourcePositionTable* source_positions,
-                            Handle<NativeContext> native_context,
                             int inlining_id, BytecodeGraphBuilderFlags flags,
                             TickCounter* tick_counter);
 

src/compiler/compilation-dependencies.cc

@@ -574,7 +574,7 @@ void CompilationDependencies::DependOnStablePrototypeChains(
       // Perform the implicit ToObject for primitives here.
       // Implemented according to ES6 section 7.3.2 GetV (V, P).
       base::Optional<JSFunctionRef> constructor =
-          broker_->native_context().GetConstructorFunction(receiver_map);
+          broker_->target_native_context().GetConstructorFunction(receiver_map);
       if (constructor.has_value()) receiver_map = constructor->initial_map();
     }
     DependOnStablePrototypeChain(this, receiver_map, last_prototype);

src/compiler/escape-analysis.cc

@@ -736,10 +736,9 @@ void ReduceNode(const Operator* op, EscapeAnalysisTracker::Scope* current,
           current->Get(map_field).To(&map)) {
         if (map) {
           Type const map_type = NodeProperties::GetType(map);
-          AllowHandleDereference handle_dereference;
           if (map_type.IsHeapConstant() &&
               params.maps().contains(
-                  Handle<Map>::cast(map_type.AsHeapConstant()->Value()))) {
+                  map_type.AsHeapConstant()->Ref().AsMap().object())) {
             current->MarkForDeletion();
             break;
           }

src/compiler/heap-refs.h

@@ -54,6 +54,7 @@ enum class OddballType : uint8_t {
   V(JSBoundFunction)               \
   V(JSDataView)                    \
   V(JSFunction)                    \
+  V(JSGlobalObject)                \
   V(JSGlobalProxy)                 \
   V(JSRegExp)                      \
   V(JSTypedArray)                  \
@@ -388,6 +389,7 @@ class ContextRef : public HeapObjectRef {
   V(JSFunction, promise_then)                                         \
   V(JSFunction, string_function)                                      \
   V(JSFunction, symbol_function)                                      \
+  V(JSGlobalObject, global_object)                                    \
   V(JSGlobalProxy, global_proxy_object)                               \
   V(JSObject, promise_prototype)                                      \
   V(Map, bound_function_with_constructor_map)                         \
@@ -581,7 +583,7 @@ class V8_EXPORT_PRIVATE MapRef : public HeapObjectRef {
   bool is_migration_target() const;
   bool supports_fast_array_iteration() const;
   bool supports_fast_array_resize() const;
-  bool IsMapOfCurrentGlobalProxy() const;
+  bool IsMapOfTargetGlobalProxy() const;
   bool is_abandoned_prototype_map() const;
 
   OddballType oddball_type() const;
@@ -850,6 +852,13 @@ class CellRef : public HeapObjectRef {
   ObjectRef value() const;
 };
 
+class JSGlobalObjectRef : public JSObjectRef {
+ public:
+  DEFINE_REF_CONSTRUCTOR(JSGlobalObject, JSObjectRef)
+
+  Handle<JSGlobalObject> object() const;
+};
+
 class JSGlobalProxyRef : public JSObjectRef {
  public:
   DEFINE_REF_CONSTRUCTOR(JSGlobalProxy, JSObjectRef)

src/compiler/js-call-reducer.cc

@@ -7259,7 +7259,7 @@ Isolate* JSCallReducer::isolate() const { return jsgraph()->isolate(); }
 Factory* JSCallReducer::factory() const { return isolate()->factory(); }
 
 NativeContextRef JSCallReducer::native_context() const {
-  return broker()->native_context();
+  return broker()->target_native_context();
 }
 
 CommonOperatorBuilder* JSCallReducer::common() const {

src/compiler/js-create-lowering.cc

@@ -1310,12 +1310,13 @@ namespace {
 base::Optional<MapRef> GetObjectCreateMap(JSHeapBroker* broker,
                                           HeapObjectRef prototype) {
   MapRef standard_map =
-      broker->native_context().object_function().initial_map();
+      broker->target_native_context().object_function().initial_map();
   if (prototype.equals(standard_map.prototype())) {
     return standard_map;
   }
   if (prototype.map().oddball_type() == OddballType::kNull) {
-    return broker->native_context().slow_object_with_null_prototype_map();
+    return broker->target_native_context()
+        .slow_object_with_null_prototype_map();
   }
   if (prototype.IsJSObject()) {
     return prototype.AsJSObject().GetObjectCreateMap();
@@ -1831,7 +1832,7 @@ SimplifiedOperatorBuilder* JSCreateLowering::simplified() const {
 }
 
 NativeContextRef JSCreateLowering::native_context() const {
-  return broker()->native_context();
+  return broker()->target_native_context();
 }
 
 }  // namespace compiler

src/compiler/js-heap-broker.cc

@@ -962,8 +962,8 @@ class MapData : public HeapObjectData {
   bool supports_fast_array_resize() const {
     return supports_fast_array_resize_;
   }
-  bool IsMapOfCurrentGlobalProxy() const {
-    return is_map_of_current_global_proxy_;
+  bool IsMapOfTargetGlobalProxy() const {
+    return is_map_of_target_global_proxy_;
   }
   bool is_abandoned_prototype_map() const {
     return is_abandoned_prototype_map_;
@@ -1027,7 +1027,7 @@ class MapData : public HeapObjectData {
   int const unused_property_fields_;
   bool const supports_fast_array_iteration_;
   bool const supports_fast_array_resize_;
-  bool const is_map_of_current_global_proxy_;
+  bool const is_map_of_target_global_proxy_;
   bool const is_abandoned_prototype_map_;
 
   bool serialized_elements_kind_generalizations_ = false;
@@ -1154,8 +1154,8 @@ MapData::MapData(JSHeapBroker* broker, ObjectData** storage, Handle<Map> object)
           SupportsFastArrayIteration(broker->isolate(), object)),
       supports_fast_array_resize_(
           SupportsFastArrayResize(broker->isolate(), object)),
-      is_map_of_current_global_proxy_(
-          object->IsMapOfGlobalProxy(broker->isolate()->native_context())),
+      is_map_of_target_global_proxy_(
+          object->IsMapOfGlobalProxy(broker->target_native_context().object())),
       is_abandoned_prototype_map_(object->is_abandoned_prototype_map()),
       elements_kind_generalizations_(broker->zone()) {}
 
@@ -1836,6 +1836,17 @@ void CellData::Serialize(JSHeapBroker* broker) {
   value_ = broker->GetOrCreateData(cell->value());
 }
 
+class JSGlobalObjectData : public JSObjectData {
+ public:
+  JSGlobalObjectData(JSHeapBroker* broker, ObjectData** storage,
+                     Handle<JSGlobalObject> object);
+};
+
+JSGlobalObjectData::JSGlobalObjectData(JSHeapBroker* broker,
+                                       ObjectData** storage,
+                                       Handle<JSGlobalObject> object)
+    : JSObjectData(broker, storage, object) {}
+
 class JSGlobalProxyData : public JSObjectData {
  public:
   JSGlobalProxyData(JSHeapBroker* broker, ObjectData** storage,
@@ -1860,8 +1871,9 @@ JSGlobalProxyData::JSGlobalProxyData(JSHeapBroker* broker, ObjectData** storage,
 namespace {
 base::Optional<PropertyCellRef> GetPropertyCellFromHeap(JSHeapBroker* broker,
                                                         Handle<Name> name) {
-  LookupIterator it(broker->isolate(),
-                    handle(broker->native_context().object()->global_object(),
+  LookupIterator it(
+      broker->isolate(),
+      handle(broker->target_native_context().object()->global_object(),
              broker->isolate()),
       name, LookupIterator::OWN);
   it.TryLookupCachedProperty();
@@ -2280,8 +2292,10 @@ void JSHeapBroker::Retire() {
 
 bool JSHeapBroker::SerializingAllowed() const { return mode() == kSerializing; }
 
-void JSHeapBroker::SetNativeContextRef() {
-  native_context_ = NativeContextRef(this, isolate()->native_context());
+void JSHeapBroker::SetNativeContextRef(Handle<NativeContext> context) {
+  // At the broker construction time, we don't yet have the canonical handle
+  // for the native context, that's why we need the explicit setter
+  target_native_context_ = NativeContextRef(this, context);
 }
 
 bool IsShareable(Handle<Object> object, Isolate* isolate) {
@@ -2406,7 +2420,7 @@ bool JSHeapBroker::IsArrayOrObjectPrototype(const JSObjectRef& object) const {
          array_and_object_prototypes_.end();
 }
 
-void JSHeapBroker::SerializeStandardObjects() {
+void JSHeapBroker::SerializeStandardObjects(Handle<NativeContext> context) {
   if (mode() == kDisabled) return;
   CHECK_EQ(mode(), kSerializing);
 
@@ -2417,8 +2431,10 @@ void JSHeapBroker::SerializeStandardObjects() {
   CollectArrayAndObjectPrototypes();
   SerializeTypedArrayStringTags();
 
-  SetNativeContextRef();
-  native_context().Serialize();
+  // It's important that this serialization happens after the
+  // CollectArrayAndObjectPrototypes is done.
+  SetNativeContextRef(context);
+  target_native_context().Serialize();
 
   Factory* const f = isolate()->factory();
 
@@ -2677,13 +2693,14 @@ bool MapRef::supports_fast_array_resize() const {
   return data()->AsMap()->supports_fast_array_resize();
 }
 
-bool MapRef::IsMapOfCurrentGlobalProxy() const {
+bool MapRef::IsMapOfTargetGlobalProxy() const {
   if (broker()->mode() == JSHeapBroker::kDisabled) {
     AllowHandleDereference allow_handle_dereference;
     AllowHandleAllocation handle_allocation;
-    return object()->IsMapOfGlobalProxy(broker()->isolate()->native_context());
+    return object()->IsMapOfGlobalProxy(
+        broker()->target_native_context().object());
   }
-  return data()->AsMap()->IsMapOfCurrentGlobalProxy();
+  return data()->AsMap()->IsMapOfTargetGlobalProxy();
 }
 
 int JSFunctionRef::InitialMapInstanceSizeWithMinSlack() const {
@@ -3837,8 +3854,8 @@ JSArrayRef SharedFunctionInfoRef::GetTemplateObject(
         Handle<TemplateObjectDescription>::cast(description.object());
     Handle<JSArray> template_object =
         TemplateObjectDescription::GetTemplateObject(
-            broker()->isolate(), broker()->native_context().object(), tod,
-            object(), slot.ToInt());
+            broker()->isolate(), broker()->target_native_context().object(),
+            tod, object(), slot.ToInt());
     return JSArrayRef(broker(), template_object);
   }
 
@@ -3852,7 +3869,7 @@ JSArrayRef SharedFunctionInfoRef::GetTemplateObject(
       Handle<TemplateObjectDescription>::cast(description.object());
   Handle<JSArray> template_object =
       TemplateObjectDescription::GetTemplateObject(
-          broker()->isolate(), broker()->native_context().object(), tod,
+          broker()->isolate(), broker()->target_native_context().object(), tod,
           object(), slot.ToInt());
   array = broker()->GetOrCreateData(template_object)->AsJSArray();
   data()->AsSharedFunctionInfo()->SetTemplateObject(slot, array);
@@ -4318,7 +4335,7 @@ ProcessedFeedback const& JSHeapBroker::ReadFeedbackForGlobalAccess(
     int const context_slot_index = FeedbackNexus::SlotIndexBits::decode(number);
     bool const immutable = FeedbackNexus::ImmutabilityBit::decode(number);
     Handle<Context> context = ScriptContextTable::GetContext(
-        isolate(), native_context().script_context_table().object(),
+        isolate(), target_native_context().script_context_table().object(),
         script_context_index);
     {
       ObjectRef contents(this,

src/compiler/js-heap-broker.h

@@ -67,13 +67,15 @@ class V8_EXPORT_PRIVATE JSHeapBroker {
  public:
   JSHeapBroker(Isolate* isolate, Zone* broker_zone, bool tracing_enabled);
 
-  void SetNativeContextRef();
-  void SerializeStandardObjects();
+  void SetNativeContextRef(Handle<NativeContext> context);
+  void SerializeStandardObjects(Handle<NativeContext> context);
 
   Isolate* isolate() const { return isolate_; }
   Zone* zone() const { return current_zone_; }
   bool tracing_enabled() const { return tracing_enabled_; }
-  NativeContextRef native_context() const { return native_context_.value(); }
+  NativeContextRef target_native_context() const {
+    return target_native_context_.value();
+  }
   PerIsolateCompilerCache* compiler_cache() const { return compiler_cache_; }
 
   enum BrokerMode { kDisabled, kSerializing, kSerialized, kRetired };
@@ -187,7 +189,7 @@ class V8_EXPORT_PRIVATE JSHeapBroker {
   Isolate* const isolate_;
   Zone* const broker_zone_;
   Zone* current_zone_;
-  base::Optional<NativeContextRef> native_context_;
+  base::Optional<NativeContextRef> target_native_context_;
   RefsMap* refs_;
   ZoneUnorderedSet<Handle<JSObject>, Handle<JSObject>::hash,
                    Handle<JSObject>::equal_to>

src/compiler/js-inlining.cc

@@ -305,7 +305,7 @@ base::Optional<SharedFunctionInfoRef> JSInliner::DetermineCallTarget(
     // TODO(turbofan): We might want to revisit this restriction later when we
     // have a need for this, and we know how to model different native contexts
     // in the same graph in a compositional way.
-    if (!function.native_context().equals(broker()->native_context())) {
+    if (!function.native_context().equals(broker()->target_native_context())) {
       return base::nullopt;
     }
 
@@ -466,20 +466,11 @@ Reduction JSInliner::ReduceJSCall(Node* node) {
       flags |= BytecodeGraphBuilderFlag::kBailoutOnUninitialized;
     }
     {
-      // TODO(mslekova): Remove the following once bytecode graph builder
-      // is brokerized. Also, remove the context argument from
-      // BuildGraphFromBytecode and extract it from the broker there.
-      AllowHandleDereference allow_handle_deref;
-      AllowHandleAllocation allow_handle_alloc;
-      AllowHeapAllocation allow_heap_alloc;
-      AllowCodeDependencyChange allow_code_dep_change;
       CallFrequency frequency = call.frequency();
-      Handle<NativeContext> native_context(info_->native_context(), isolate());
-      BuildGraphFromBytecode(broker(), zone(), bytecode_array.object(),
-                             shared_info->object(), feedback_vector.object(),
-                             BailoutId::None(), jsgraph(), frequency,
-                             source_positions_, native_context, inlining_id,
-                             flags, &info_->tick_counter());
+      BuildGraphFromBytecode(
+          broker(), zone(), bytecode_array.object(), shared_info->object(),
+          feedback_vector.object(), BailoutId::None(), jsgraph(), frequency,
+          source_positions_, inlining_id, flags, &info_->tick_counter());
     }
 
     // Extract the inlinee start/end nodes.
@@ -598,8 +589,8 @@ Reduction JSInliner::ReduceJSCall(Node* node) {
     Node* effect = NodeProperties::GetEffectInput(node);
     if (NodeProperties::CanBePrimitive(broker(), call.receiver(), effect)) {
       CallParameters const& p = CallParametersOf(node->op());
-      Node* global_proxy =
-          jsgraph()->Constant(broker()->native_context().global_proxy_object());
+      Node* global_proxy = jsgraph()->Constant(
+          broker()->target_native_context().global_proxy_object());
       Node* receiver = effect =
           graph()->NewNode(simplified()->ConvertReceiver(p.convert_mode()),
                            call.receiver(), global_proxy, effect, start);

src/compiler/js-native-context-specialization.cc

@@ -55,14 +55,14 @@ bool HasOnlyJSArrayMaps(JSHeapBroker* broker,
 
 JSNativeContextSpecialization::JSNativeContextSpecialization(
     Editor* editor, JSGraph* jsgraph, JSHeapBroker* broker, Flags flags,
-    Handle<Context> native_context, CompilationDependencies* dependencies,
-    Zone* zone, Zone* shared_zone)
+    CompilationDependencies* dependencies, Zone* zone, Zone* shared_zone)
     : AdvancedReducer(editor),
       jsgraph_(jsgraph),
       broker_(broker),
       flags_(flags),
-      global_object_(native_context->global_object(), jsgraph->isolate()),
-      global_proxy_(native_context->global_proxy(), jsgraph->isolate()),
+      global_object_(broker->target_native_context().global_object().object()),
+      global_proxy_(
+          broker->target_native_context().global_proxy_object().object()),
       dependencies_(dependencies),
       zone_(zone),
       shared_zone_(shared_zone),
@@ -668,7 +668,7 @@ Reduction JSNativeContextSpecialization::ReduceJSPromiseResolve(Node* node) {
   // Check if the {constructor} is the %Promise% function.
   HeapObjectMatcher m(constructor);
   if (!m.HasValue() ||
-      !m.Ref(broker()).equals(broker()->native_context().promise_function())) {
+      !m.Ref(broker()).equals(native_context().promise_function())) {
     return NoChange();
   }
 
@@ -1107,7 +1107,7 @@ Reduction JSNativeContextSpecialization::ReduceNamedAccess(
   // to the current native context's global object instead.
   if (access_infos.size() == 1 && access_infos[0].receiver_maps().size() == 1) {
     MapRef receiver_map(broker(), access_infos[0].receiver_maps()[0]);
-    if (receiver_map.IsMapOfCurrentGlobalProxy()) {
+    if (receiver_map.IsMapOfTargetGlobalProxy()) {
       return ReduceGlobalAccess(node, receiver, value, feedback.name(),
                                 access_mode, key);
     }

src/compiler/js-native-context-specialization.h

@@ -53,7 +53,6 @@ class V8_EXPORT_PRIVATE JSNativeContextSpecialization final
 
   JSNativeContextSpecialization(Editor* editor, JSGraph* jsgraph,
                                 JSHeapBroker* broker, Flags flags,
-                                Handle<Context> native_context,
                                 CompilationDependencies* dependencies,
                                 Zone* zone, Zone* shared_zone);
 
@@ -256,7 +255,9 @@ class V8_EXPORT_PRIVATE JSNativeContextSpecialization final
   Flags flags() const { return flags_; }
   Handle<JSGlobalObject> global_object() const { return global_object_; }
   Handle<JSGlobalProxy> global_proxy() const { return global_proxy_; }
-  NativeContextRef native_context() const { return broker()->native_context(); }
+  NativeContextRef native_context() const {
+    return broker()->target_native_context();
+  }
   CompilationDependencies* dependencies() const { return dependencies_; }
   Zone* zone() const { return zone_; }
   Zone* shared_zone() const { return shared_zone_; }

src/compiler/js-typed-lowering.cc

@@ -1652,7 +1652,8 @@ Reduction JSTypedLowering::ReduceJSCall(Node* node) {
     // require data from a foreign native context.
     if (is_sloppy(shared.language_mode()) && !shared.native() &&
         !receiver_type.Is(Type::Receiver())) {
-      if (!function.native_context().equals(broker()->native_context())) {
+      if (!function.native_context().equals(
+              broker()->target_native_context())) {
         return NoChange();
       }
       Node* global_proxy =

src/compiler/node-properties.cc

@@ -452,7 +452,7 @@ NodeProperties::InferReceiverMapsResult NodeProperties::InferReceiverMapsUnsafe(
       }
       case IrOpcode::kJSCreatePromise: {
         if (IsSame(receiver, effect)) {
-          *maps_return = ZoneHandleSet<Map>(broker->native_context()
+          *maps_return = ZoneHandleSet<Map>(broker->target_native_context()
                                                 .promise_function()
                                                 .initial_map()
                                                 .object());

src/compiler/pipeline.cc

@@ -1217,8 +1217,8 @@ struct GraphBuilderPhase {
         data->info()->shared_info(),
         handle(data->info()->closure()->feedback_vector(), data->isolate()),
         data->info()->osr_offset(), data->jsgraph(), frequency,
-        data->source_positions(), data->native_context(),
-        SourcePosition::kNotInlined, flags, &data->info()->tick_counter());
+        data->source_positions(), SourcePosition::kNotInlined, flags,
+        &data->info()->tick_counter());
   }
 };
 
@@ -1287,7 +1287,7 @@ struct InliningPhase {
     // that need to live until code generation.
     JSNativeContextSpecialization native_context_specialization(
         &graph_reducer, data->jsgraph(), data->broker(), flags,
-        data->native_context(), data->dependencies(), temp_zone, info->zone());
+        data->dependencies(), temp_zone, info->zone());
     JSInliningHeuristic inlining(&graph_reducer,
                                  data->info()->is_inlining_enabled()
                                      ? JSInliningHeuristic::kGeneralInlining
@@ -1362,7 +1362,7 @@ struct SerializeStandardObjectsPhase {
   static const char* phase_name() { return "V8.TFSerializeStandardObjects"; }
 
   void Run(PipelineData* data, Zone* temp_zone) {
-    data->broker()->SerializeStandardObjects();
+    data->broker()->SerializeStandardObjects(data->native_context());
   }
 };
 
@@ -2213,11 +2213,16 @@ bool PipelineImpl::CreateGraph() {
   }
 
   if (FLAG_concurrent_inlining) {
+    // The following is a workaround for the NativeContexRef storage being
+    // unpopulated when we start the SerializeStandardObjectsPhase, therefore
+    // stopping us from the ability to use the target_native_context getter
+    // in the MapData constructor.
+    data->broker()->SetNativeContextRef(data->native_context());
     data->broker()->StartSerializing();
     Run<SerializeStandardObjectsPhase>();
     Run<SerializationPhase>();
   } else {
-    data->broker()->SetNativeContextRef();
+    data->broker()->SetNativeContextRef(data->native_context());
   }
 
   Run<GraphBuilderPhase>();

src/compiler/serializer-for-background-compilation.cc

@@ -1554,8 +1554,8 @@ void SerializerForBackgroundCompilation::VisitCallJSRuntime(
   // BytecodeGraphBuilder::VisitCallJSRuntime needs the {runtime_index}
   // slot in the native context to be serialized.
   const int runtime_index = iterator->GetNativeContextIndexOperand(0);
-  broker()->native_context().get(runtime_index,
-                                 SerializationPolicy::kSerializeIfNeeded);
+  broker()->target_native_context().get(
+      runtime_index, SerializationPolicy::kSerializeIfNeeded);
   environment()->accumulator_hints().Clear();
 }
 
@@ -1758,7 +1758,7 @@ void SerializerForBackgroundCompilation::ProcessApiCall(
     if (hint->IsUndefined()) {
       // The receiver is the global proxy.
       Handle<JSGlobalProxy> global_proxy =
-          broker()->native_context().global_proxy_object().object();
+          broker()->target_native_context().global_proxy_object().object();
       ProcessReceiverMapForApiCall(
           target_template_info,
           handle(global_proxy->map(), broker()->isolate()));
@@ -2316,8 +2316,8 @@ SerializerForBackgroundCompilation::ProcessMapForNamedPropertyAccess(
   receiver_map.SerializeRootMap();
 
   // For JSNativeContextSpecialization::ReduceNamedAccess.
-  if (receiver_map.IsMapOfCurrentGlobalProxy()) {
-    broker()->native_context().global_proxy_object().GetPropertyCell(
+  if (receiver_map.IsMapOfTargetGlobalProxy()) {
+    broker()->target_native_context().global_proxy_object().GetPropertyCell(
         name, SerializationPolicy::kSerializeIfNeeded);
   }
 
@@ -2472,7 +2472,7 @@ void SerializerForBackgroundCompilation::ProcessNamedAccess(
   }
 
   JSGlobalProxyRef global_proxy =
-      broker()->native_context().global_proxy_object();
+      broker()->target_native_context().global_proxy_object();
   for (Handle<Object> hint : receiver.constants()) {
     ObjectRef object(broker(), hint);
     if (access_mode == AccessMode::kLoad && object.IsJSObject()) {

test/unittests/compiler/graph-unittest.cc

@@ -23,7 +23,7 @@ GraphTest::GraphTest(int num_parameters)
       node_origins_(&graph_) {
   graph()->SetStart(graph()->NewNode(common()->Start(num_parameters)));
   graph()->SetEnd(graph()->NewNode(common()->End(1), graph()->start()));
-  broker()->SetNativeContextRef();
+  broker()->SetNativeContextRef(isolate()->native_context());
 }
 
 GraphTest::~GraphTest() = default;

test/unittests/compiler/js-call-reducer-unittest.cc

@@ -24,7 +24,7 @@ class JSCallReducerTest : public TypedGraphTest {
  public:
   JSCallReducerTest()
       : TypedGraphTest(3), javascript_(zone()), deps_(broker(), zone()) {
-    broker()->SerializeStandardObjects();
+    broker()->SerializeStandardObjects(isolate()->native_context());
   }
   ~JSCallReducerTest() override = default;