[TurboFan] Serializing context information

In TurboFan, context specialization is an optimization that tries to
either replace the load of a value from the context with a constant,
or if that can't be achieved, at least reduce the hops up the
context chain by starting a walk to the required depth from the
first constant context that it can reach.

Currently, this optimization is performed by looking into the
heap during a reducer pass. With fully concurrent TurboFan, we
need to instead gather information about contexts we may want
to perform this optimization on during serialization.

This CL adds functionality to the serializer to recognize and
model operations that affect the context register. We add to the
hinting structure already used by the serializer. There is
a new type of hint: a VirtualContext. This is a tuple consisting
of a handle to a Context, and a distance field that indicates how
far away in a to-be-realized chain this VirtualContext sits from
the context in the handle. For example:

bytecode stream:
...
CreateBlockContext
...

After a block context is created, the accumulator now contains
a VirtualContext Hint with a distance of 1 from any context hints
that we are keeping track of in the current context register.

More details in the design doc here:
https://docs.google.com/document/d/1Y0LKKCEenLWyAZTetoAIpKTZRCxaNdkYV8X1GaCax2A/edit?usp=sharing

Change-Id: I63732ebd106cc138fb1e9789d0676ece63e15d27
Bug: v8:7790
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1605941
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62370}

src/compiler/js-context-specialization.cc

@@ -144,9 +144,10 @@ Reduction JSContextSpecialization::ReduceJSLoadContext(Node* node) {
 
   // Now walk up the concrete context chain for the remaining depth.
   ContextRef concrete = maybe_concrete.value();
-  concrete.SerializeContextChain();  // TODO(neis): Remove later.
-  for (; depth > 0; --depth) {
-    concrete = concrete.previous();
+  concrete = concrete.previous(&depth);
+  if (depth > 0) {
+    TRACE_BROKER_MISSING(broker(), "previous value for context " << concrete);
+    return SimplifyJSLoadContext(node, jsgraph()->Constant(concrete), depth);
   }
 
   if (!access.immutable()) {
@@ -157,8 +158,6 @@ Reduction JSContextSpecialization::ReduceJSLoadContext(Node* node) {
 
   // This will hold the final value, if we can figure it out.
   base::Optional<ObjectRef> maybe_value;
-
-  concrete.SerializeSlot(static_cast<int>(access.index()));
   maybe_value = concrete.get(static_cast<int>(access.index()));
   if (maybe_value.has_value() && !maybe_value->IsSmi()) {
     // Even though the context slot is immutable, the context might have escaped
@@ -174,6 +173,9 @@ Reduction JSContextSpecialization::ReduceJSLoadContext(Node* node) {
   }
 
   if (!maybe_value.has_value()) {
+    TRACE_BROKER_MISSING(broker(), "slot value " << access.index()
+                                                 << " for context "
+                                                 << concrete);
     return SimplifyJSLoadContext(node, jsgraph()->Constant(concrete), depth);
   }
 
@@ -207,9 +209,10 @@ Reduction JSContextSpecialization::ReduceJSStoreContext(Node* node) {
 
   // Now walk up the concrete context chain for the remaining depth.
   ContextRef concrete = maybe_concrete.value();
-  concrete.SerializeContextChain();  // TODO(neis): Remove later.
-  for (; depth > 0; --depth) {
-    concrete = concrete.previous();
+  concrete = concrete.previous(&depth);
+  if (depth > 0) {
+    TRACE_BROKER_MISSING(broker(), "previous value for context " << concrete);
+    return SimplifyJSStoreContext(node, jsgraph()->Constant(concrete), depth);
   }
 
   return SimplifyJSStoreContext(node, jsgraph()->Constant(concrete), depth);

src/compiler/js-heap-broker.cc

@@ -531,7 +531,6 @@ class ContextData : public HeapObjectData {
   void SerializeContextChain(JSHeapBroker* broker);
 
   ContextData* previous() const {
-    CHECK(serialized_context_chain_);
     return previous_;
   }
 
@@ -539,8 +538,10 @@ class ContextData : public HeapObjectData {
 
   ObjectData* GetSlot(int index) {
     auto search = slots_.find(index);
-    CHECK(search != slots_.end());
-    return search->second;
+    if (search != slots_.end()) {
+      return search->second;
+    }
+    return nullptr;
   }
 
   void SerializeScopeInfo(JSHeapBroker* broker);
@@ -548,7 +549,6 @@ class ContextData : public HeapObjectData {
 
  private:
   ZoneMap<int, ObjectData*> slots_;
-  bool serialized_context_chain_ = false;
   ContextData* previous_ = nullptr;
   ScopeInfoData* scope_info_ = nullptr;
 };
@@ -558,15 +558,12 @@ ContextData::ContextData(JSHeapBroker* broker, ObjectData** storage,
     : HeapObjectData(broker, storage, object), slots_(broker->zone()) {}
 
 void ContextData::SerializeContextChain(JSHeapBroker* broker) {
-  if (serialized_context_chain_) return;
-  serialized_context_chain_ = true;
+  if (previous_ != nullptr) return;
 
-  TraceScope tracer(broker, this, "ContextData::SerializeContextChain");
   Handle<Context> context = Handle<Context>::cast(object());
-
-  DCHECK_NULL(previous_);
   // Context::previous DCHECK-fails when called on the native context.
   if (!context->IsNativeContext()) {
+    TraceScope tracer(broker, this, "ContextData::SerializeContextChain");
     previous_ = broker->GetOrCreateData(context->previous())->AsContext();
     previous_->SerializeContextChain(broker);
   }
@@ -574,7 +571,7 @@ void ContextData::SerializeContextChain(JSHeapBroker* broker) {
 
 void ContextData::SerializeSlot(JSHeapBroker* broker, int index) {
   TraceScope tracer(broker, this, "ContextData::SerializeSlot");
-  TRACE(broker, "Serializing script context slot " << index);
+  TRACE(broker, "Serializing context slot " << index);
   Handle<Context> context = Handle<Context>::cast(object());
   CHECK(index >= 0 && index < context->length());
   ObjectData* odata = broker->GetOrCreateData(context->get(index));
@@ -1896,25 +1893,39 @@ bool ObjectRef::equals(const ObjectRef& other) const {
 
 Isolate* ObjectRef::isolate() const { return broker()->isolate(); }
 
-ContextRef ContextRef::previous() const {
+ContextRef ContextRef::previous(size_t* depth) const {
+  DCHECK_NOT_NULL(depth);
+  DCHECK_GE(*depth, 0);
   if (broker()->mode() == JSHeapBroker::kDisabled) {
     AllowHandleAllocation handle_allocation;
     AllowHandleDereference handle_dereference;
-    return ContextRef(broker(),
-                      handle(object()->previous(), broker()->isolate()));
+    Context current = *object();
+    while (*depth != 0) {
+      current = current.previous();
+      (*depth)--;
+    }
+    return ContextRef(broker(), handle(current, broker()->isolate()));
+  }
+  ContextData* current = this->data()->AsContext();
+  while (*depth != 0 && current->previous() != nullptr) {
+    current = current->previous();
+    (*depth)--;
   }
-  return ContextRef(broker(), data()->AsContext()->previous());
+  return ContextRef(broker(), current);
 }
 
-// Not needed for TypedLowering.
-ObjectRef ContextRef::get(int index) const {
+base::Optional<ObjectRef> ContextRef::get(int index) const {
   if (broker()->mode() == JSHeapBroker::kDisabled) {
     AllowHandleAllocation handle_allocation;
     AllowHandleDereference handle_dereference;
     Handle<Object> value(object()->get(index), broker()->isolate());
     return ObjectRef(broker(), value);
   }
-  return ObjectRef(broker(), data()->AsContext()->GetSlot(index));
+  ObjectData* optional_slot = data()->AsContext()->GetSlot(index);
+  if (optional_slot != nullptr) {
+    return ObjectRef(broker(), optional_slot);
+  }
+  return base::nullopt;
 }
 
 JSHeapBroker::JSHeapBroker(Isolate* isolate, Zone* broker_zone,
@@ -2459,6 +2470,11 @@ bool AllocationSiteRef::IsFastLiteral() const {
   return data()->AsAllocationSite()->IsFastLiteral();
 }
 
+void JSObjectRef::SerializeElements() {
+  CHECK_EQ(broker()->mode(), JSHeapBroker::kSerializing);
+  data()->AsJSObject()->SerializeElements(broker());
+}
+
 void JSObjectRef::EnsureElementsTenured() {
   if (broker()->mode() == JSHeapBroker::kDisabled) {
     AllowHandleAllocation allow_handle_allocation;
@@ -2909,7 +2925,7 @@ MapRef NativeContextRef::GetFunctionMapFromIndex(int index) const {
   DCHECK_GE(index, Context::FIRST_FUNCTION_MAP_INDEX);
   DCHECK_LE(index, Context::LAST_FUNCTION_MAP_INDEX);
   if (broker()->mode() == JSHeapBroker::kDisabled) {
-    return get(index).AsMap();
+    return get(index).value().AsMap();
   }
   return MapRef(broker(), data()->AsNativeContext()->function_maps().at(
                               index - Context::FIRST_FUNCTION_MAP_INDEX));

src/compiler/js-heap-broker.h

@@ -229,6 +229,7 @@ class JSObjectRef : public HeapObjectRef {
   ObjectRef RawFastPropertyAt(FieldIndex index) const;
 
   FixedArrayBaseRef elements() const;
+  void SerializeElements();
   void EnsureElementsTenured();
   ElementsKind GetElementsKind() const;
 
@@ -317,10 +318,14 @@ class ContextRef : public HeapObjectRef {
   Handle<Context> object() const;
 
   void SerializeContextChain();
-  ContextRef previous() const;
+
+  // {previous} decrements n by 1 for each previous link successfully
+  // followed. If depth != 0 on function return, then it only got
+  // partway to the desired depth.
+  ContextRef previous(size_t* depth) const;
 
   void SerializeSlot(int index);
-  ObjectRef get(int index) const;
+  base::Optional<ObjectRef> get(int index) const;
 
   // We only serialize the ScopeInfo if certain Promise
   // builtins are called.

test/cctest/compiler/serializer-tester.cc

@@ -264,7 +264,7 @@ TEST(SerializeUnconditionalJump) {
       "function f() {"
       "  function p() {};"
       "  function q() {};"
-      "  if (a) g(q);"
+      "  if (a) q();"
       "  else g(p);"
       "  return p;"
       "};"