[turbofan] Serialize Object::BooleanValue.

Bug: v8:7790
Change-Id: Ic48c7d869d98b64195f699c47b1a250ae6ad2440
Reviewed-on: https://chromium-review.googlesource.com/1227127Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55982}

src/compiler/js-heap-broker.cc

@@ -52,17 +52,20 @@ class ObjectData : public ZoneObject {
 
 class HeapObjectData : public ObjectData {
  public:
+  HeapObjectData(JSHeapBroker* broker, Handle<HeapObject> object,
+                 HeapObjectType type);
+
   static HeapObjectData* Serialize(JSHeapBroker* broker,
                                    Handle<HeapObject> object);
 
   HeapObjectType type() const { return type_; }
+  bool boolean_value() const { return boolean_value_; }
   MapData* map() const { return map_; }
 
-  HeapObjectData(JSHeapBroker* broker, Handle<HeapObject> object,
-                 HeapObjectType type);
 
  private:
   HeapObjectType const type_;
+  bool const boolean_value_;
   MapData* const map_;
 };
 
@@ -605,6 +608,7 @@ HeapObjectData::HeapObjectData(JSHeapBroker* broker, Handle<HeapObject> object,
                                HeapObjectType type)
     : ObjectData(broker, object, false),
       type_(type),
+      boolean_value_(object->BooleanValue(broker->isolate())),
       map_(broker->GetOrCreateData(object->map())->AsMap()) {
   CHECK(broker->SerializingAllowed());
 }
@@ -1912,9 +1916,12 @@ MapRef NativeContextRef::GetInitialJSArrayMap(ElementsKind kind) const {
   }
 }
 
-bool ObjectRef::BooleanValue() {
-  AllowHandleDereference allow_handle_dereference;
-  return object<Object>()->BooleanValue(broker()->isolate());
+bool ObjectRef::BooleanValue() const {
+  if (broker()->mode() == JSHeapBroker::kDisabled) {
+    AllowHandleDereference allow_handle_dereference;
+    return object<Object>()->BooleanValue(broker()->isolate());
+  }
+  return IsSmi() ? (AsSmi() != 0) : data()->AsHeapObject()->boolean_value();
 }
 
 double ObjectRef::OddballToNumber() const {

src/compiler/js-heap-broker.h

@@ -80,15 +80,15 @@ class HeapObjectType {
   V(Cell)                          \
   V(Code)                          \
   V(FeedbackVector)                \
-  V(Map)                           \
-  V(Module)                        \
-  V(SharedFunctionInfo)            \
   V(FixedArrayBase)                \
   V(HeapNumber)                    \
   V(JSObject)                      \
+  V(Map)                           \
+  V(Module)                        \
   V(MutableHeapNumber)             \
   V(Name)                          \
   V(PropertyCell)                  \
+  V(SharedFunctionInfo)            \
   /* Subtypes of Object */         \
   V(HeapObject)
 
@@ -127,7 +127,7 @@ class ObjectRef {
   HEAP_BROKER_OBJECT_LIST(HEAP_AS_METHOD_DECL)
 #undef HEAP_AS_METHOD_DECL
 
-  bool BooleanValue();
+  bool BooleanValue() const;
   double OddballToNumber() const;
 
   Isolate* isolate() const;

src/utils.cc

@@ -400,11 +400,9 @@ void init_memcopy_functions() {
 #endif
 }
 
-
+// Returns false iff d is NaN, +0, or -0.
 bool DoubleToBoolean(double d) {
-  // NaN, +0, and -0 should return the false object
   IeeeDoubleArchType u;
-
   u.d = d;
   if (u.bits.exp == 2047) {
     // Detect NaN for IEEE double precision floating point.