[compiler] Use MakeRef for remaining types

This is part of a CL series that establishes MakeRef/TryMakeRef as
the bottleneck for Ref construction. We do this by converting direct
constructor uses to (Try)MakeRef calls, and then marking the ctor
as protected.

Bug: v8:7790
Change-Id: I26faa6bc1934662c81ae127dee64bddffa428de9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2874165Reviewed-by: Santiago Aboy Solanes <solanes@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74371}

src/compiler/bytecode-graph-builder.cc

@@ -2298,7 +2298,9 @@ void BytecodeGraphBuilder::VisitPopContext() {
 }
 
 void BytecodeGraphBuilder::VisitCreateClosure() {
-  SharedFunctionInfoRef shared_info(broker(), GetConstantForIndexOperand(0));
+  SharedFunctionInfoRef shared_info =
+      MakeRef(broker(),
+              Handle<SharedFunctionInfo>::cast(GetConstantForIndexOperand(0)));
   AllocationType allocation =
       interpreter::CreateClosureFlags::PretenuredBit::decode(
           bytecode_iterator().GetFlagOperand(2))

src/compiler/compilation-dependencies.cc

@@ -697,7 +697,7 @@ void CompilationDependencies::DependOnStablePrototypeChains(
     MapContainer const& receiver_maps, WhereToStart start,
     base::Optional<JSObjectRef> last_prototype) {
   for (auto map : receiver_maps) {
-    MapRef receiver_map(broker_, map);
+    MapRef receiver_map = MakeRef(broker_, map);
     if (start == kStartAtReceiver) DependOnStableMap(receiver_map);
     if (receiver_map.IsPrimitiveMap()) {
       // Perform the implicit ToObject for primitives here.

src/compiler/heap-refs.cc

@@ -2869,7 +2869,7 @@ base::Optional<MapRef> JSObjectRef::GetObjectCreateMap() const {
     Handle<Map> instance_map;
     if (Map::TryGetObjectCreateMap(broker()->isolate(), object())
             .ToHandle(&instance_map)) {
-      return MapRef(broker(), instance_map);
+      return MakeRef(broker(), instance_map);
     } else {
       return base::Optional<MapRef>();
     }
@@ -2877,7 +2877,7 @@ base::Optional<MapRef> JSObjectRef::GetObjectCreateMap() const {
   ObjectData* map_data = data()->AsJSObject()->object_create_map(broker());
   if (map_data == nullptr) return base::Optional<MapRef>();
   if (map_data->should_access_heap()) {
-    return MapRef(broker(), map_data->object());
+    return MakeRef(broker(), Handle<Map>::cast(map_data->object()));
   }
   return MapRef(broker(), map_data->AsMap());
 }
@@ -4367,7 +4367,7 @@ bool JSFunctionRef::serialized_code_and_feedback() const {
 
 CodeRef JSFunctionRef::code() const {
   if (data_->should_access_heap() || broker()->is_concurrent_inlining()) {
-    return CodeRef(broker(), broker()->CanonicalPersistentHandle(
+    return MakeRef(broker(), broker()->CanonicalPersistentHandle(
                                  object()->code(kAcquireLoad)));
   }
 

src/compiler/heap-refs.h

@@ -275,6 +275,8 @@ class HeapObjectType {
 
 // Constructors are carefully defined such that we do a type check on
 // the outermost Ref class in the inheritance chain only.
+//
+// Note this macro changes public/protected/private state.
 // TODO(jgruber): Remove DEFINE_REF_CONSTRUCTOR once all types use the new
 // pattern based on TryMakeRef.
 #define DEFINE_REF_CONSTRUCTOR(Name, Base)                                  \
@@ -686,7 +688,7 @@ class BigIntRef : public HeapObjectRef {
 
 class V8_EXPORT_PRIVATE MapRef : public HeapObjectRef {
  public:
-  DEFINE_REF_CONSTRUCTOR(Map, HeapObjectRef)
+  DEFINE_REF_CONSTRUCTOR2(Map, HeapObjectRef)
 
   Handle<Map> object() const;
 
@@ -933,7 +935,7 @@ class ScopeInfoRef : public HeapObjectRef {
 
 class V8_EXPORT_PRIVATE SharedFunctionInfoRef : public HeapObjectRef {
  public:
-  DEFINE_REF_CONSTRUCTOR(SharedFunctionInfo, HeapObjectRef)
+  DEFINE_REF_CONSTRUCTOR2(SharedFunctionInfo, HeapObjectRef)
 
   Handle<SharedFunctionInfo> object() const;
 
@@ -1058,7 +1060,7 @@ class JSGlobalProxyRef : public JSObjectRef {
 
 class CodeRef : public HeapObjectRef {
  public:
-  DEFINE_REF_CONSTRUCTOR(Code, HeapObjectRef)
+  DEFINE_REF_CONSTRUCTOR2(Code, HeapObjectRef)
 
   Handle<Code> object() const;
 

src/compiler/js-create-lowering.cc

@@ -151,8 +151,8 @@ Reduction JSCreateLowering::ReduceJSCreateArguments(Node* node) {
   FrameState frame_state{NodeProperties::GetFrameStateInput(node)};
   Node* const control = graph()->start();
   FrameStateInfo state_info = frame_state.frame_state_info();
-  SharedFunctionInfoRef shared(broker(),
-                               state_info.shared_info().ToHandleChecked());
+  SharedFunctionInfoRef shared =
+      MakeRef(broker(), state_info.shared_info().ToHandleChecked());
 
   // Use the ArgumentsAccessStub for materializing both mapped and unmapped
   // arguments object, but only for non-inlined (i.e. outermost) frames.
@@ -404,7 +404,7 @@ Reduction JSCreateLowering::ReduceJSCreateGeneratorObject(Node* node) {
     int parameter_count_no_receiver = shared.internal_formal_parameter_count();
     int length = parameter_count_no_receiver +
                  shared.GetBytecodeArray().register_count();
-    MapRef fixed_array_map(broker(), factory()->fixed_array_map());
+    MapRef fixed_array_map = MakeRef(broker(), factory()->fixed_array_map());
     AllocationBuilder ab(jsgraph(), effect, control);
     if (!ab.CanAllocateArray(length, fixed_array_map)) {
       return NoChange();
@@ -775,7 +775,7 @@ Reduction JSCreateLowering::ReduceJSCreateAsyncFunctionObject(Node* node) {
   Node* control = NodeProperties::GetControlInput(node);
 
   // Create the register file.
-  MapRef fixed_array_map(broker(), factory()->fixed_array_map());
+  MapRef fixed_array_map = MakeRef(broker(), factory()->fixed_array_map());
   AllocationBuilder ab(jsgraph(), effect, control);
   CHECK(ab.CanAllocateArray(register_count, fixed_array_map));
   ab.AllocateArray(register_count, fixed_array_map);
@@ -879,7 +879,7 @@ Reduction JSCreateLowering::ReduceJSCreateBoundFunction(Node* node) {
   CreateBoundFunctionParameters const& p =
       CreateBoundFunctionParametersOf(node->op());
   int const arity = static_cast<int>(p.arity());
-  MapRef const map(broker(), p.map());
+  MapRef const map = MakeRef(broker(), p.map());
   Node* bound_target_function = NodeProperties::GetValueInput(node, 0);
   Node* bound_this = NodeProperties::GetValueInput(node, 1);
   Node* effect = NodeProperties::GetEffectInput(node);
@@ -888,7 +888,7 @@ Reduction JSCreateLowering::ReduceJSCreateBoundFunction(Node* node) {
   // Create the [[BoundArguments]] for the result.
   Node* bound_arguments = jsgraph()->EmptyFixedArrayConstant();
   if (arity > 0) {
-    MapRef fixed_array_map(broker(), factory()->fixed_array_map());
+    MapRef fixed_array_map = MakeRef(broker(), factory()->fixed_array_map());
     AllocationBuilder ab(jsgraph(), effect, control);
     CHECK(ab.CanAllocateArray(arity, fixed_array_map));
     ab.AllocateArray(arity, fixed_array_map);
@@ -920,7 +920,7 @@ Reduction JSCreateLowering::ReduceJSCreateBoundFunction(Node* node) {
 Reduction JSCreateLowering::ReduceJSCreateClosure(Node* node) {
   JSCreateClosureNode n(node);
   CreateClosureParameters const& p = n.Parameters();
-  SharedFunctionInfoRef shared(broker(), p.shared_info());
+  SharedFunctionInfoRef shared = MakeRef(broker(), p.shared_info());
   FeedbackCellRef feedback_cell = n.GetFeedbackCellRefChecked(broker());
   HeapObjectRef code = MakeRef(broker(), p.code());
   Effect effect = n.effect();
@@ -931,7 +931,7 @@ Reduction JSCreateLowering::ReduceJSCreateClosure(Node* node) {
   // seen more than one instantiation, this simplifies the generated code and
   // also serves as a heuristic of which allocation sites benefit from it.
   if (!feedback_cell.map().equals(
-          MapRef(broker(), factory()->many_closures_cell_map()))) {
+          MakeRef(broker(), factory()->many_closures_cell_map()))) {
     return NoChange();
   }
 
@@ -1037,7 +1037,7 @@ Reduction JSCreateLowering::ReduceJSCreateKeyValueArray(Node* node) {
   Node* length = jsgraph()->Constant(2);
 
   AllocationBuilder aa(jsgraph(), effect, graph()->start());
-  aa.AllocateArray(2, MapRef(broker(), factory()->fixed_array_map()));
+  aa.AllocateArray(2, MakeRef(broker(), factory()->fixed_array_map()));
   aa.Store(AccessBuilder::ForFixedArrayElement(PACKED_ELEMENTS),
            jsgraph()->ZeroConstant(), key);
   aa.Store(AccessBuilder::ForFixedArrayElement(PACKED_ELEMENTS),
@@ -1357,7 +1357,7 @@ Reduction JSCreateLowering::ReduceJSCreateObject(Node* node) {
   if (instance_map.is_dictionary_map()) {
     DCHECK_EQ(prototype_const.map().oddball_type(), OddballType::kNull);
     // Allocate an empty NameDictionary as backing store for the properties.
-    MapRef map(broker(), factory()->name_dictionary_map());
+    MapRef map = MakeRef(broker(), factory()->name_dictionary_map());
     int capacity =
         NameDictionary::ComputeCapacity(NameDictionary::kInitialCapacity);
     DCHECK(base::bits::IsPowerOfTwo(capacity));
@@ -1433,7 +1433,7 @@ Node* JSCreateLowering::TryAllocateArguments(Node* effect, Node* control,
   auto parameters_it = parameters_access.begin_without_receiver();
 
   // Actually allocate the backing store.
-  MapRef fixed_array_map(broker(), factory()->fixed_array_map());
+  MapRef fixed_array_map = MakeRef(broker(), factory()->fixed_array_map());
   AllocationBuilder ab(jsgraph(), effect, control);
   if (!ab.CanAllocateArray(argument_count, fixed_array_map)) {
     return nullptr;
@@ -1464,7 +1464,7 @@ Node* JSCreateLowering::TryAllocateRestArguments(Node* effect, Node* control,
       parameters_access.begin_without_receiver_and_skip(start_index);
 
   // Actually allocate the backing store.
-  MapRef fixed_array_map(broker(), factory()->fixed_array_map());
+  MapRef fixed_array_map = MakeRef(broker(), factory()->fixed_array_map());
   AllocationBuilder ab(jsgraph(), effect, control);
   if (!ab.CanAllocateArray(num_elements, fixed_array_map)) {
     return nullptr;
@@ -1499,14 +1499,14 @@ Node* JSCreateLowering::TryAllocateAliasedArguments(
   int mapped_count = std::min(argument_count, parameter_count);
   *has_aliased_arguments = true;
 
-  MapRef sloppy_arguments_elements_map(
-      broker(), factory()->sloppy_arguments_elements_map());
+  MapRef sloppy_arguments_elements_map =
+      MakeRef(broker(), factory()->sloppy_arguments_elements_map());
   if (!AllocationBuilder::CanAllocateSloppyArgumentElements(
           mapped_count, sloppy_arguments_elements_map)) {
     return nullptr;
   }
 
-  MapRef fixed_array_map(broker(), factory()->fixed_array_map());
+  MapRef fixed_array_map = MakeRef(broker(), factory()->fixed_array_map());
   if (!AllocationBuilder::CanAllocateArray(argument_count, fixed_array_map)) {
     return nullptr;
   }
@@ -1564,8 +1564,8 @@ Node* JSCreateLowering::TryAllocateAliasedArguments(
   }
 
   int mapped_count = parameter_count;
-  MapRef sloppy_arguments_elements_map(
-      broker(), factory()->sloppy_arguments_elements_map());
+  MapRef sloppy_arguments_elements_map =
+      MakeRef(broker(), factory()->sloppy_arguments_elements_map());
   if (!AllocationBuilder::CanAllocateSloppyArgumentElements(
           mapped_count, sloppy_arguments_elements_map)) {
     return nullptr;
@@ -1620,7 +1620,7 @@ Node* JSCreateLowering::AllocateElements(Node* effect, Node* control,
 
   // Actually allocate the backing store.
   AllocationBuilder a(jsgraph(), effect, control);
-  a.AllocateArray(capacity, MapRef(broker(), elements_map), allocation);
+  a.AllocateArray(capacity, MakeRef(broker(), elements_map), allocation);
   for (int i = 0; i < capacity; ++i) {
     Node* index = jsgraph()->Constant(i);
     a.Store(access, index, value);
@@ -1645,7 +1645,7 @@ Node* JSCreateLowering::AllocateElements(Node* effect, Node* control,
 
   // Actually allocate the backing store.
   AllocationBuilder a(jsgraph(), effect, control);
-  a.AllocateArray(capacity, MapRef(broker(), elements_map), allocation);
+  a.AllocateArray(capacity, MakeRef(broker(), elements_map), allocation);
   for (int i = 0; i < capacity; ++i) {
     Node* index = jsgraph()->Constant(i);
     a.Store(access, index, values[i]);
@@ -1699,7 +1699,7 @@ base::Optional<Node*> JSCreateLowering::TryAllocateFastLiteral(
       AllocationBuilder builder(jsgraph(), effect, control);
       builder.Allocate(HeapNumber::kSize, allocation);
       builder.Store(AccessBuilder::ForMap(),
-                    MapRef(broker(), factory()->heap_number_map()));
+                    MakeRef(broker(), factory()->heap_number_map()));
       builder.Store(AccessBuilder::ForHeapNumberValue(),
                     jsgraph()->Constant(number));
       value = effect = builder.Finish();

src/compiler/js-generic-lowering.cc

@@ -716,7 +716,7 @@ void JSGenericLowering::LowerJSCreateLiteralArray(Node* node) {
 void JSGenericLowering::LowerJSGetTemplateObject(Node* node) {
   JSGetTemplateObjectNode n(node);
   GetTemplateObjectParameters const& p = n.Parameters();
-  SharedFunctionInfoRef shared(broker(), p.shared());
+  SharedFunctionInfoRef shared = MakeRef(broker(), p.shared());
   TemplateObjectDescriptionRef description = MakeRef(broker(), p.description());
 
   DCHECK_EQ(node->op()->ControlInputCount(), 1);

src/compiler/js-heap-broker.cc

@@ -466,7 +466,7 @@ ElementAccessFeedback::ElementAccessFeedback(Zone* zone,
 bool ElementAccessFeedback::HasOnlyStringMaps(JSHeapBroker* broker) const {
   for (auto const& group : transition_groups()) {
     for (Handle<Map> map : group) {
-      if (!MapRef(broker, map).IsStringMap()) return false;
+      if (!MakeRef(broker, map).IsStringMap()) return false;
     }
   }
   return true;
@@ -996,7 +996,7 @@ ElementAccessFeedback const& JSHeapBroker::ProcessFeedbackMapsForElementAccess(
   MapHandles possible_transition_targets;
   possible_transition_targets.reserve(maps.size());
   for (Handle<Map> map : maps) {
-    MapRef map_ref(this, map);
+    MapRef map_ref = MakeRef(this, map);
     map_ref.SerializeRootMap();
 
     if (CanInlineElementAccess(map_ref) &&

src/compiler/js-heap-copy-reducer.cc

@@ -55,8 +55,7 @@ Reduction JSHeapCopyReducer::Reduce(Node* node) {
     case IrOpcode::kJSCreateArguments: {
       Node* const frame_state = NodeProperties::GetFrameStateInput(node);
       FrameStateInfo state_info = FrameStateInfoOf(frame_state->op());
-      SharedFunctionInfoRef shared(broker(),
-                                   state_info.shared_info().ToHandleChecked());
+      MakeRef(broker(), state_info.shared_info().ToHandleChecked());
       break;
     }
     case IrOpcode::kJSCreateBlockContext: {

src/compiler/js-inlining-heuristic.cc

@@ -124,7 +124,7 @@ JSInliningHeuristic::Candidate JSInliningHeuristic::CollectFunctions(
     JSCreateClosureNode n(callee);
     CreateClosureParameters const& p = n.Parameters();
     FeedbackCellRef feedback_cell = n.GetFeedbackCellRefChecked(broker());
-    SharedFunctionInfoRef shared_info(broker(), p.shared_info());
+    SharedFunctionInfoRef shared_info = MakeRef(broker(), p.shared_info());
     out.shared_info = shared_info;
     if (feedback_cell.value().has_value() &&
         CanConsiderForInlining(broker(), shared_info, *feedback_cell.value())) {

src/compiler/js-inlining.cc

@@ -475,7 +475,8 @@ Reduction JSInliner::ReduceJSCall(Node* node) {
   if (!shared_info.has_value()) return NoChange();
   DCHECK(shared_info->IsInlineable());
 
-  SharedFunctionInfoRef outer_shared_info(broker(), info_->shared_info());
+  SharedFunctionInfoRef outer_shared_info =
+      MakeRef(broker(), info_->shared_info());
 
   // Constructor must be constructable.
   if (node->opcode() == IrOpcode::kJSConstruct &&

src/compiler/js-native-context-specialization.cc

@@ -36,7 +36,7 @@ namespace {
 
 bool HasNumberMaps(JSHeapBroker* broker, ZoneVector<Handle<Map>> const& maps) {
   for (auto map : maps) {
-    MapRef map_ref(broker, map);
+    MapRef map_ref = MakeRef(broker, map);
     if (map_ref.IsHeapNumberMap()) return true;
   }
   return false;
@@ -45,7 +45,7 @@ bool HasNumberMaps(JSHeapBroker* broker, ZoneVector<Handle<Map>> const& maps) {
 bool HasOnlyJSArrayMaps(JSHeapBroker* broker,
                         ZoneVector<Handle<Map>> const& maps) {
   for (auto map : maps) {
-    MapRef map_ref(broker, map);
+    MapRef map_ref = MakeRef(broker, map);
     if (!map_ref.IsJSArrayMap()) return false;
   }
   return true;
@@ -228,13 +228,13 @@ Reduction JSNativeContextSpecialization::ReduceJSAsyncFunctionEnter(
 
   // Create the JSAsyncFunctionObject based on the SharedFunctionInfo
   // extracted from the top-most frame in {frame_state}.
-  SharedFunctionInfoRef shared(
+  SharedFunctionInfoRef shared = MakeRef(
       broker(),
       FrameStateInfoOf(frame_state->op()).shared_info().ToHandleChecked());
   DCHECK(shared.is_compiled());
   int register_count = shared.internal_formal_parameter_count() +
                        shared.GetBytecodeArray().register_count();
-  MapRef fixed_array_map(broker(), factory()->fixed_array_map());
+  MapRef fixed_array_map = MakeRef(broker(), factory()->fixed_array_map());
   AllocationBuilder ab(jsgraph(), effect, control);
   if (!ab.CanAllocateArray(register_count, fixed_array_map)) {
     return NoChange();
@@ -540,7 +540,7 @@ JSNativeContextSpecialization::InferHasInPrototypeChain(
   bool all = true;
   bool none = true;
   for (size_t i = 0; i < receiver_maps.size(); ++i) {
-    MapRef map(broker(), receiver_maps[i]);
+    MapRef map = MakeRef(broker(), receiver_maps[i]);
     if (result == NodeProperties::kUnreliableMaps && !map.is_stable()) {
       return kMayBeInPrototypeChain;
     }
@@ -741,7 +741,7 @@ Reduction JSNativeContextSpecialization::ReduceJSResolvePromise(Node* node) {
   } else {
     // Obtain pre-computed access infos from the broker.
     for (auto map : resolution_maps) {
-      MapRef map_ref(broker(), map);
+      MapRef map_ref = MakeRef(broker(), map);
       access_infos.push_back(broker()->GetPropertyAccessInfo(
           map_ref, MakeRef(broker(), isolate()->factory()->then_string()),
           AccessMode::kLoad, dependencies()));
@@ -1193,7 +1193,8 @@ Reduction JSNativeContextSpecialization::ReduceNamedAccess(
   // contexts' global proxy, and turn that into a direct access to the
   // corresponding global object instead.
   if (lookup_start_object_maps.size() == 1) {
-    MapRef lookup_start_object_map(broker(), lookup_start_object_maps[0]);
+    MapRef lookup_start_object_map =
+        MakeRef(broker(), lookup_start_object_maps[0]);
     if (lookup_start_object_map.equals(
             broker()->target_native_context().global_proxy_object().map()) &&
         !broker()->target_native_context().global_object().IsDetached()) {
@@ -1206,7 +1207,7 @@ Reduction JSNativeContextSpecialization::ReduceNamedAccess(
   {
     ZoneVector<PropertyAccessInfo> access_infos_for_feedback(zone());
     for (Handle<Map> map_handle : lookup_start_object_maps) {
-      MapRef map(broker(), map_handle);
+      MapRef map = MakeRef(broker(), map_handle);
       if (map.is_deprecated()) continue;
       PropertyAccessInfo access_info = broker()->GetPropertyAccessInfo(
           map, feedback.name(), access_mode, dependencies(),
@@ -1674,7 +1675,7 @@ void JSNativeContextSpecialization::RemoveImpossibleMaps(
     maps->erase(
         std::remove_if(maps->begin(), maps->end(),
                        [root_map, this](Handle<Map> map) {
-                         MapRef map_ref(broker(), map);
+                         MapRef map_ref = MakeRef(broker(), map);
                          return map_ref.is_abandoned_prototype_map() ||
                                 (map_ref.FindRootMap().has_value() &&
                                  !map_ref.FindRootMap()->equals(*root_map));
@@ -1763,7 +1764,7 @@ Reduction JSNativeContextSpecialization::ReduceElementAccess(
     ZoneVector<MapRef> prototype_maps(zone());
     for (ElementAccessInfo const& access_info : access_infos) {
       for (Handle<Map> map : access_info.lookup_start_object_maps()) {
-        MapRef receiver_map(broker(), map);
+        MapRef receiver_map = MakeRef(broker(), map);
         // If the {receiver_map} has a prototype and its elements backing
         // store is either holey, or we have a potentially growing store,
         // then we need to check that all prototypes have stable maps with
@@ -1810,11 +1811,11 @@ Reduction JSNativeContextSpecialization::ReduceElementAccess(
     ElementAccessInfo access_info = access_infos.front();
 
     // Perform possible elements kind transitions.
-    MapRef transition_target(broker(),
-                             access_info.lookup_start_object_maps().front());
+    MapRef transition_target =
+        MakeRef(broker(), access_info.lookup_start_object_maps().front());
     for (auto source : access_info.transition_sources()) {
       DCHECK_EQ(access_info.lookup_start_object_maps().size(), 1);
-      MapRef transition_source(broker(), source);
+      MapRef transition_source = MakeRef(broker(), source);
       effect = graph()->NewNode(
           simplified()->TransitionElementsKind(ElementsTransition(
               IsSimpleMapChangeTransition(transition_source.elements_kind(),
@@ -1862,10 +1863,10 @@ Reduction JSNativeContextSpecialization::ReduceElementAccess(
       Node* this_control = fallthrough_control;
 
       // Perform possible elements kind transitions.
-      MapRef transition_target(broker(),
-                               access_info.lookup_start_object_maps().front());
+      MapRef transition_target =
+          MakeRef(broker(), access_info.lookup_start_object_maps().front());
       for (auto source : access_info.transition_sources()) {
-        MapRef transition_source(broker(), source);
+        MapRef transition_source = MakeRef(broker(), source);
         DCHECK_EQ(access_info.lookup_start_object_maps().size(), 1);
         this_effect = graph()->NewNode(
             simplified()->TransitionElementsKind(ElementsTransition(
@@ -2513,7 +2514,7 @@ JSNativeContextSpecialization::BuildPropertyStore(
           a.Allocate(HeapNumber::kSize, AllocationType::kYoung,
                      Type::OtherInternal());
           a.Store(AccessBuilder::ForMap(),
-                  MapRef(broker(), factory()->heap_number_map()));
+                  MakeRef(broker(), factory()->heap_number_map()));
           FieldAccess value_field_access = AccessBuilder::ForHeapNumberValue();
           value_field_access.const_field_info = field_access.const_field_info;
           a.Store(value_field_access, value);
@@ -2620,7 +2621,7 @@ JSNativeContextSpecialization::BuildPropertyStore(
     if (access_info.transition_map().ToHandle(&transition_map)) {
       // Check if we need to grow the properties backing store
       // with this transitioning store.
-      MapRef transition_map_ref(broker(), transition_map);
+      MapRef transition_map_ref = MakeRef(broker(), transition_map);
       MapRef original_map = transition_map_ref.GetBackPointer().AsMap();
       if (original_map.UnusedPropertyFields() == 0) {
         DCHECK(!field_index.is_inobject());
@@ -3470,7 +3471,7 @@ bool JSNativeContextSpecialization::CanTreatHoleAsUndefined(
   // or Object.prototype objects as their prototype (in any of the current
   // native contexts, as the global Array protector works isolate-wide).
   for (Handle<Map> map : receiver_maps) {
-    MapRef receiver_map(broker(), map);
+    MapRef receiver_map = MakeRef(broker(), map);
     ObjectRef receiver_prototype = receiver_map.prototype();
     if (!receiver_prototype.IsJSObject() ||
         !broker()->IsArrayOrObjectPrototype(receiver_prototype.AsJSObject())) {
@@ -3496,7 +3497,7 @@ bool JSNativeContextSpecialization::InferMaps(
     // For untrusted maps, we can still use the information
     // if the maps are stable.
     for (size_t i = 0; i < map_set.size(); ++i) {
-      MapRef map(broker(), map_set[i]);
+      MapRef map = MakeRef(broker(), map_set[i]);
       if (!map.is_stable()) return false;
     }
     for (size_t i = 0; i < map_set.size(); ++i) {

src/compiler/js-typed-lowering.cc

@@ -1629,8 +1629,8 @@ Reduction JSTypedLowering::ReduceJSConstruct(Node* node) {
 
     // Patch {node} to an indirect call via the {function}s construct stub.
     bool use_builtin_construct_stub = function.shared().construct_as_builtin();
-    CodeRef code(broker(),
-                 use_builtin_construct_stub
+    CodeRef code = MakeRef(
+        broker(), use_builtin_construct_stub
                       ? BUILTIN_CODE(isolate(), JSBuiltinsConstructStub)
                       : BUILTIN_CODE(isolate(), JSConstructStubGeneric));
     STATIC_ASSERT(JSConstructNode::TargetIndex() == 0);
@@ -1713,7 +1713,7 @@ Reduction JSTypedLowering::ReduceJSCall(Node* node) {
   } else if (target->opcode() == IrOpcode::kJSCreateClosure) {
     CreateClosureParameters const& ccp =
         JSCreateClosureNode{target}.Parameters();
-    shared = SharedFunctionInfoRef(broker(), ccp.shared_info());
+    shared = MakeRef(broker(), ccp.shared_info());
   } else if (target->opcode() == IrOpcode::kCheckClosure) {
     FeedbackCellRef cell = MakeRef(broker(), FeedbackCellOf(target->op()));
     base::Optional<FeedbackVectorRef> feedback_vector = cell.value();

src/compiler/map-inference.cc

@@ -68,7 +68,7 @@ bool MapInference::AllOfInstanceTypesUnsafe(
   CHECK(HaveMaps());
 
   auto instance_type = [this, f](Handle<Map> map) {
-    MapRef map_ref(broker_, map);
+    MapRef map_ref = MakeRef(broker_, map);
     return f(map_ref.instance_type());
   };
   return std::all_of(maps_.begin(), maps_.end(), instance_type);
@@ -79,7 +79,7 @@ bool MapInference::AnyOfInstanceTypesUnsafe(
   CHECK(HaveMaps());
 
   auto instance_type = [this, f](Handle<Map> map) {
-    MapRef map_ref(broker_, map);
+    MapRef map_ref = MakeRef(broker_, map);
     return f(map_ref.instance_type());
   };
 
@@ -134,13 +134,13 @@ bool MapInference::RelyOnMapsHelper(CompilationDependencies* dependencies,
   if (Safe()) return true;
 
   auto is_stable = [this](Handle<Map> map) {
-    MapRef map_ref(broker_, map);
+    MapRef map_ref = MakeRef(broker_, map);
     return map_ref.is_stable();
   };
   if (dependencies != nullptr &&
       std::all_of(maps_.cbegin(), maps_.cend(), is_stable)) {
     for (Handle<Map> map : maps_) {
-      dependencies->DependOnStableMap(MapRef(broker_, map));
+      dependencies->DependOnStableMap(MakeRef(broker_, map));
     }
     SetGuarded();
     return true;

src/compiler/pipeline.cc

@@ -2650,7 +2650,8 @@ bool PipelineImpl::CreateGraph() {
 
   // Determine the Typer operation flags.
   {
-    SharedFunctionInfoRef shared_info(data->broker(), info()->shared_info());
+    SharedFunctionInfoRef shared_info =
+        MakeRef(data->broker(), info()->shared_info());
     if (is_sloppy(shared_info.language_mode()) &&
         shared_info.IsUserJavaScript()) {
       // Sloppy mode functions always have an Object for this.

src/compiler/property-access-builder.cc

@@ -35,7 +35,7 @@ SimplifiedOperatorBuilder* PropertyAccessBuilder::simplified() const {
 bool HasOnlyStringMaps(JSHeapBroker* broker,
                        ZoneVector<Handle<Map>> const& maps) {
   for (auto map : maps) {
-    MapRef map_ref(broker, map);
+    MapRef map_ref = MakeRef(broker, map);
     if (!map_ref.IsStringMap()) return false;
   }
   return true;
@@ -46,7 +46,7 @@ namespace {
 bool HasOnlyNumberMaps(JSHeapBroker* broker,
                        ZoneVector<Handle<Map>> const& maps) {
   for (auto map : maps) {
-    MapRef map_ref(broker, map);
+    MapRef map_ref = MakeRef(broker, map);
     if (map_ref.instance_type() != HEAP_NUMBER_TYPE) return false;
   }
   return true;
@@ -89,7 +89,7 @@ void PropertyAccessBuilder::BuildCheckMaps(
     MapRef object_map = m.Ref(broker()).map();
     if (object_map.is_stable()) {
       for (Handle<Map> map : maps) {
-        if (MapRef(broker(), map).equals(object_map)) {
+        if (MakeRef(broker(), map).equals(object_map)) {
           dependencies()->DependOnStableMap(object_map);
           return;
         }
@@ -99,7 +99,7 @@ void PropertyAccessBuilder::BuildCheckMaps(
   ZoneHandleSet<Map> map_set;
   CheckMapsFlags flags = CheckMapsFlag::kNone;
   for (Handle<Map> map : maps) {
-    MapRef object_map(broker(), map);
+    MapRef object_map = MakeRef(broker(), map);
     map_set.insert(object_map.object(), graph()->zone());
     if (object_map.is_migration_target()) {
       flags |= CheckMapsFlag::kTryMigrateInstance;
@@ -198,7 +198,7 @@ Node* PropertyAccessBuilder::TryFoldLoadConstantDataField(
     if (std::find_if(
             access_info.lookup_start_object_maps().begin(),
             access_info.lookup_start_object_maps().end(), [&](Handle<Map> map) {
-              return MapRef(broker(), map).equals(lookup_start_object_map);
+              return MakeRef(broker(), map).equals(lookup_start_object_map);
             }) == access_info.lookup_start_object_maps().end()) {
       // The map of the lookup_start_object is not in the feedback, let us bail
       // out.
@@ -330,7 +330,7 @@ Node* PropertyAccessBuilder::BuildLoadDataField(
     // used by the LoadElimination to eliminate map checks on the result.
     Handle<Map> field_map;
     if (access_info.field_map().ToHandle(&field_map)) {
-      MapRef field_map_ref(broker(), field_map);
+      MapRef field_map_ref = MakeRef(broker(), field_map);
       if (field_map_ref.is_stable()) {
         dependencies()->DependOnStableMap(field_map_ref);
         field_access.map = field_map;

src/compiler/serializer-for-background-compilation.cc

@@ -1148,7 +1148,7 @@ Hints SerializerForBackgroundCompilation::Run() {
 
   TRACE_BROKER_MEMORY(broker(), "[serializer start] Broker zone usage: "
                                     << broker()->zone()->allocation_size());
-  SharedFunctionInfoRef shared(broker(), function().shared());
+  SharedFunctionInfoRef shared = MakeRef(broker(), function().shared());
   FeedbackVectorRef feedback_vector_ref = MakeRef(broker(), feedback_vector());
   if (!broker()->ShouldBeSerializedForCompilation(shared, feedback_vector_ref,
                                                   arguments_)) {
@@ -2277,7 +2277,7 @@ void SerializerForBackgroundCompilation::ProcessApiCall(
   if (!target_template_info.has_call_code()) return;
   target_template_info.SerializeCallCode();
 
-  SharedFunctionInfoRef target_ref(broker(), target);
+  SharedFunctionInfoRef target_ref = MakeRef(broker(), target);
   target_ref.SerializeFunctionTemplateInfo();
 
   if (target_template_info.accept_any_receiver() &&
@@ -2313,7 +2313,7 @@ void SerializerForBackgroundCompilation::ProcessApiCall(
 void SerializerForBackgroundCompilation::ProcessReceiverMapForApiCall(
     FunctionTemplateInfoRef target, Handle<Map> receiver) {
   if (!receiver->is_access_check_needed()) {
-    MapRef receiver_map(broker(), receiver);
+    MapRef receiver_map = MakeRef(broker(), receiver);
     TRACE_BROKER(broker(), "Serializing holder for target: " << target);
     target.LookupHolderOfExpectedType(receiver_map,
                                       SerializationPolicy::kSerializeIfNeeded);
@@ -2361,10 +2361,10 @@ void SerializerForBackgroundCompilation::ProcessBuiltinCall(
         if (arguments.size() >= 1) {
           ProcessMapHintsForPromises(arguments[0]);
         }
-        SharedFunctionInfoRef(
+        MakeRef(
             broker(),
             broker()->isolate()->factory()->promise_catch_finally_shared_fun());
-        SharedFunctionInfoRef(
+        MakeRef(
             broker(),
             broker()->isolate()->factory()->promise_then_finally_shared_fun());
       }
@@ -2501,13 +2501,11 @@ void SerializerForBackgroundCompilation::ProcessBuiltinCall(
               kMissingArgumentsAreUnknown, result_hints);
         }
       }
-      SharedFunctionInfoRef(
-          broker(), broker()
+      MakeRef(broker(), broker()
                             ->isolate()
                             ->factory()
                             ->promise_capability_default_reject_shared_fun());
-      SharedFunctionInfoRef(
-          broker(), broker()
+      MakeRef(broker(), broker()
                             ->isolate()
                             ->factory()
                             ->promise_capability_default_resolve_shared_fun());
@@ -2612,7 +2610,7 @@ void SerializerForBackgroundCompilation::ProcessHintsForOrdinaryHasInstance(
 void SerializerForBackgroundCompilation::ProcessHintsForHasInPrototypeChain(
     Hints const& instance_hints) {
   auto processMap = [&](Handle<Map> map_handle) {
-    MapRef map(broker(), map_handle);
+    MapRef map = MakeRef(broker(), map_handle);
     while (map.IsJSObjectMap()) {
       map.SerializePrototype();
       map = map.prototype().map();
@@ -2656,11 +2654,11 @@ void SerializerForBackgroundCompilation::ProcessMapHintsForPromises(
     if (!constant->IsJSPromise()) continue;
     Handle<Map> map(Handle<HeapObject>::cast(constant)->map(),
                     broker()->isolate());
-    MapRef(broker(), map).SerializePrototype();
+    MakeRef(broker(), map).SerializePrototype();
   }
   for (auto map : receiver_hints.maps()) {
     if (!map->IsJSPromiseMap()) continue;
-    MapRef(broker(), map).SerializePrototype();
+    MakeRef(broker(), map).SerializePrototype();
   }
 }
 
@@ -2689,7 +2687,7 @@ void SerializerForBackgroundCompilation::ProcessHintsForRegExpTest(
     Handle<JSObject> regexp(Handle<JSObject>::cast(hint));
     Handle<Map> regexp_map(regexp->map(), broker()->isolate());
     PropertyAccessInfo ai_exec =
-        ProcessMapForRegExpTest(MapRef(broker(), regexp_map));
+        ProcessMapForRegExpTest(MakeRef(broker(), regexp_map));
     Handle<JSObject> holder;
     if (ai_exec.IsFastDataConstant() && !ai_exec.holder().ToHandle(&holder)) {
       // The property is on the object itself.
@@ -2702,7 +2700,7 @@ void SerializerForBackgroundCompilation::ProcessHintsForRegExpTest(
 
   for (auto map : regexp_hints.maps()) {
     if (!map->IsJSRegExpMap()) continue;
-    ProcessMapForRegExpTest(MapRef(broker(), map));
+    ProcessMapForRegExpTest(MakeRef(broker(), map));
   }
 }
 
@@ -2732,7 +2730,7 @@ void SerializerForBackgroundCompilation::ProcessHintsForFunctionBind(
 
   for (auto map : receiver_hints.maps()) {
     if (!map->IsJSFunctionMap()) continue;
-    MapRef map_ref(broker(), map);
+    MapRef map_ref = MakeRef(broker(), map);
     ProcessMapForFunctionBind(map_ref);
   }
 }
@@ -2890,7 +2888,7 @@ void SerializerForBackgroundCompilation::ProcessCheckContextExtensions(
     ProcessContextAccess(context_hints, Context::EXTENSION_INDEX, i,
                          kSerializeSlot);
   }
-  SharedFunctionInfoRef shared(broker(), function().shared());
+  SharedFunctionInfoRef shared = MakeRef(broker(), function().shared());
   shared.SerializeScopeInfoChain();
 }
 
@@ -3105,7 +3103,7 @@ SerializerForBackgroundCompilation::ProcessMapForNamedPropertyAccess(
       if (access_info.IsDataField() || access_info.IsFastDataConstant()) {
         Handle<Map> transition_map;
         if (access_info.transition_map().ToHandle(&transition_map)) {
-          MapRef map_ref(broker(), transition_map);
+          MapRef map_ref = MakeRef(broker(), transition_map);
           TRACE_BROKER(broker(), "Propagating transition map "
                                      << map_ref << " to receiver hints.");
           receiver->AddMap(transition_map, zone(), broker_, false);
@@ -3235,7 +3233,7 @@ void SerializerForBackgroundCompilation::ProcessNamedAccess(
     Hints* receiver, NamedAccessFeedback const& feedback,
     AccessMode access_mode, Hints* result_hints) {
   for (Handle<Map> map : feedback.maps()) {
-    MapRef map_ref(broker(), map);
+    MapRef map_ref = MakeRef(broker(), map);
     TRACE_BROKER(broker(), "Propagating feedback map "
                                << map_ref << " to receiver hints.");
     receiver->AddMap(map, zone(), broker_, false);
@@ -3243,7 +3241,7 @@ void SerializerForBackgroundCompilation::ProcessNamedAccess(
 
   for (Handle<Map> map :
        GetRelevantReceiverMaps(broker()->isolate(), receiver->maps())) {
-    MapRef map_ref(broker(), map);
+    MapRef map_ref = MakeRef(broker(), map);
     ProcessMapForNamedPropertyAccess(receiver, map_ref, map_ref,
                                      feedback.name(), access_mode,
                                      base::nullopt, result_hints);
@@ -3279,9 +3277,9 @@ void SerializerForBackgroundCompilation::ProcessNamedSuperAccess(
   MapHandles receiver_maps =
       GetRelevantReceiverMaps(broker()->isolate(), receiver->maps());
   for (Handle<Map> receiver_map : receiver_maps) {
-    MapRef receiver_map_ref(broker(), receiver_map);
+    MapRef receiver_map_ref = MakeRef(broker(), receiver_map);
     for (Handle<Map> feedback_map : feedback.maps()) {
-      MapRef feedback_map_ref(broker(), feedback_map);
+      MapRef feedback_map_ref = MakeRef(broker(), feedback_map);
       ProcessMapForNamedPropertyAccess(
           receiver, receiver_map_ref, feedback_map_ref, feedback.name(),
           access_mode, base::nullopt, result_hints);
@@ -3289,7 +3287,7 @@ void SerializerForBackgroundCompilation::ProcessNamedSuperAccess(
   }
   if (receiver_maps.empty()) {
     for (Handle<Map> feedback_map : feedback.maps()) {
-      MapRef feedback_map_ref(broker(), feedback_map);
+      MapRef feedback_map_ref = MakeRef(broker(), feedback_map);
       ProcessMapForNamedPropertyAccess(
           receiver, base::nullopt, feedback_map_ref, feedback.name(),
           access_mode, base::nullopt, result_hints);
@@ -3302,7 +3300,7 @@ void SerializerForBackgroundCompilation::ProcessElementAccess(
     ElementAccessFeedback const& feedback, AccessMode access_mode) {
   for (auto const& group : feedback.transition_groups()) {
     for (Handle<Map> map_handle : group) {
-      MapRef map(broker(), map_handle);
+      MapRef map = MakeRef(broker(), map_handle);
       switch (access_mode) {
         case AccessMode::kHas:
         case AccessMode::kLoad:
@@ -3362,7 +3360,7 @@ void SerializerForBackgroundCompilation::ProcessElementAccess(
 
   // For JSNativeContextSpecialization::InferRootMap
   for (Handle<Map> map : receiver.maps()) {
-    MapRef map_ref(broker(), map);
+    MapRef map_ref = MakeRef(broker(), map);
     map_ref.SerializeRootMap();
   }
 }

test/cctest/compiler/serializer-tester.cc

@@ -86,7 +86,7 @@ void CheckForSerializedInlinee(const char* source, int argc = 0,
       tester.broker()
           ->FindCanonicalPersistentHandleForTesting<SharedFunctionInfo>(
               g_func->shared()));
-  SharedFunctionInfoRef g_sfi(tester.broker(), sfi);
+  SharedFunctionInfoRef g_sfi = MakeRef(tester.broker(), sfi);
   Handle<FeedbackVector> fv(
       tester.broker()->FindCanonicalPersistentHandleForTesting<FeedbackVector>(
           g_func->feedback_vector()));