[turbofan] Serialize context chains.

Additionally:
- Remove partiality from ContextRef::previous as long
  as we don't need it.
- Fix a nasty bug in serialization dispatch (the order
  of types was incorrect).

Bug: v8:7790
Change-Id: I354a69cf37e1dcdd691aab8af668c5cef165cf1e
Reviewed-on: https://chromium-review.googlesource.com/1224438Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55889}

src/compiler/js-context-specialization.cc

@@ -144,8 +144,9 @@ Reduction JSContextSpecialization::ReduceJSLoadContext(Node* node) {
 
   // Now walk up the concrete context chain for the remaining depth.
   ContextRef concrete = maybe_concrete.value();
+  concrete.Serialize();  // TODO(neis): Remove later.
   for (; depth > 0; --depth) {
-    concrete = concrete.previous().value();
+    concrete = concrete.previous();
   }
 
   if (!access.immutable()) {
@@ -205,8 +206,9 @@ Reduction JSContextSpecialization::ReduceJSStoreContext(Node* node) {
 
   // Now walk up the concrete context chain for the remaining depth.
   ContextRef concrete = maybe_concrete.value();
+  concrete.Serialize();  // TODO(neis): Remove later.
   for (; depth > 0; --depth) {
-    concrete = concrete.previous().value();
+    concrete = concrete.previous();
   }
 
   return SimplifyJSStoreContext(node, jsgraph()->Constant(concrete), depth);

src/compiler/js-heap-broker.cc

@@ -233,10 +233,38 @@ class MutableHeapNumberData : public HeapObjectData {
 
 class ContextData : public HeapObjectData {
  public:
-  ContextData(JSHeapBroker* broker, Handle<Context> object, HeapObjectType type)
-      : HeapObjectData(broker, object, type) {}
+  ContextData(JSHeapBroker* broker, Handle<Context> object,
+              HeapObjectType type);
+  void Serialize();
+
+  ContextData* previous() const {
+    CHECK(serialized_);
+    return previous_;
+  }
+
+ private:
+  bool serialized_ = false;
+  ContextData* previous_ = nullptr;
 };
 
+ContextData::ContextData(JSHeapBroker* broker, Handle<Context> object,
+                         HeapObjectType type)
+    : HeapObjectData(broker, object, type) {}
+
+void ContextData::Serialize() {
+  if (serialized_) return;
+  serialized_ = true;
+
+  Handle<Context> context = Handle<Context>::cast(object());
+
+  DCHECK_NULL(previous_);
+  // Context::previous DCHECK-fails when called on the native context.
+  if (!context->IsNativeContext()) {
+    previous_ = broker()->GetOrCreateData(context->previous())->AsContext();
+    previous_->Serialize();
+  }
+}
+
 class NativeContextData : public ContextData {
  public:
 #define DECL_ACCESSOR(type, name) \
@@ -1104,14 +1132,17 @@ bool ObjectRef::equals(const ObjectRef& other) const {
 
 Isolate* ObjectRef::isolate() const { return broker()->isolate(); }
 
-base::Optional<ContextRef> ContextRef::previous() const {
+ContextRef ContextRef::previous() const {
+  if (broker()->mode() == JSHeapBroker::kDisabled) {
     AllowHandleAllocation handle_allocation;
     AllowHandleDereference handle_dereference;
-  Context* previous = object<Context>()->previous();
-  if (previous == nullptr) return base::Optional<ContextRef>();
-  return ContextRef(broker(), handle(previous, broker()->isolate()));
+    return ContextRef(
+        broker(), handle(object<Context>()->previous(), broker()->isolate()));
+  }
+  return ContextRef(data()->AsContext()->previous());
 }
 
+// Not needed for TypedLowering.
 ObjectRef ContextRef::get(int index) const {
   AllowHandleAllocation handle_allocation;
   AllowHandleDereference handle_dereference;
@@ -1332,9 +1363,8 @@ HeapObjectType HeapObjectRef::type() const {
   if (broker()->mode() == JSHeapBroker::kDisabled) {
     AllowHandleDereference allow_handle_dereference;
     return broker()->HeapObjectTypeFromMap(object<HeapObject>()->map());
-  } else {
-    return data()->AsHeapObject()->type();
   }
+  return data()->AsHeapObject()->type();
 }
 
 NativeContextRef JSHeapBroker::native_context() {
@@ -1970,6 +2000,12 @@ void ModuleRef::Serialize() {
   data()->AsModule()->Serialize();
 }
 
+void ContextRef::Serialize() {
+  if (broker()->mode() == JSHeapBroker::kDisabled) return;
+  CHECK_EQ(broker()->mode(), JSHeapBroker::kSerializing);
+  data()->AsContext()->Serialize();
+}
+
 #undef BIMODAL_ACCESSOR
 #undef BIMODAL_ACCESSOR_B
 #undef BIMODAL_ACCESSOR_C

src/compiler/js-heap-broker.h

@@ -64,6 +64,10 @@ class HeapObjectType {
   V(JSRegExp)                      \
   /* Subtypes of Context */        \
   V(NativeContext)                 \
+  /* Subtypes of FixedArray */     \
+  V(Context)                       \
+  V(ScopeInfo)                     \
+  V(ScriptContextTable)            \
   /* Subtypes of FixedArrayBase */ \
   V(BytecodeArray)                 \
   V(FixedArray)                    \
@@ -78,10 +82,7 @@ class HeapObjectType {
   V(FeedbackVector)                \
   V(Map)                           \
   V(Module)                        \
-  V(ScopeInfo)                     \
-  V(ScriptContextTable)            \
   V(SharedFunctionInfo)            \
-  V(Context)                       \
   V(FixedArrayBase)                \
   V(HeapNumber)                    \
   V(JSObject)                      \
@@ -219,8 +220,9 @@ class MutableHeapNumberRef : public HeapObjectRef {
 class ContextRef : public HeapObjectRef {
  public:
   using HeapObjectRef::HeapObjectRef;
+  void Serialize();
 
-  base::Optional<ContextRef> previous() const;
+  ContextRef previous() const;
   ObjectRef get(int index) const;
 };
 

src/compiler/js-heap-copy-reducer.cc

@@ -30,6 +30,7 @@ Reduction JSHeapCopyReducer::Reduce(Node* node) {
       if (object.IsJSFunction()) object.AsJSFunction().Serialize();
       if (object.IsJSObject()) object.AsJSObject().SerializeObjectCreateMap();
       if (object.IsModule()) object.AsModule().Serialize();
+      if (object.IsContext()) object.AsContext().Serialize();
       break;
     }
     case IrOpcode::kJSCreateArray: {