[TurboFan] Transition SharedFunctionInfo to kNeverSerialized (2)

This is the 2nd step in series of CLs to move the SharedFunctionInfo
class to kNeverSerialized and make it concurrently accessible from
the background thread. This CL:
* Changes optimization of GetTemplateObject in JSCreateLowering to
  only perform the optimization of a template object exists in the
  SharedFunctionInfo[Ref], but skips the optimization if one is
  missing instead of allocating a new one on demand.

Bug: v8:7790
Change-Id: Ic37d8333676e54b3f8d69416480df12bd90723ea
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2463229
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71189}

src/compiler/heap-refs.h

@@ -817,13 +817,6 @@ class V8_EXPORT_PRIVATE SharedFunctionInfoRef : public HeapObjectRef {
     return GetInlineability() == SharedFunctionInfo::kIsInlineable;
   }
 
-  // Template objects may not be created at compilation time. This method
-  // wraps the retrieval of the template object and creates it if
-  // necessary.
-  JSArrayRef GetTemplateObject(
-      TemplateObjectDescriptionRef description, FeedbackSource const& source,
-      SerializationPolicy policy = SerializationPolicy::kAssumeSerialized);
-
   void SerializeFunctionTemplateInfo();
   base::Optional<FunctionTemplateInfoRef> function_template_info() const;
 

src/compiler/js-create-lowering.cc

@@ -1201,10 +1201,15 @@ Reduction JSCreateLowering::ReduceJSCreateLiteralRegExp(Node* node) {
 Reduction JSCreateLowering::ReduceJSGetTemplateObject(Node* node) {
   JSGetTemplateObjectNode n(node);
   GetTemplateObjectParameters const& parameters = n.Parameters();
-  SharedFunctionInfoRef shared(broker(), parameters.shared());
-  JSArrayRef template_object = shared.GetTemplateObject(
-      TemplateObjectDescriptionRef(broker(), parameters.description()),
-      parameters.feedback());
+
+  const ProcessedFeedback& feedback =
+      broker()->GetFeedbackForTemplateObject(parameters.feedback());
+  // TODO(v8:7790): Consider not generating JSGetTemplateObject operator
+  // in the BytecodeGraphBuilder in the first place, if template_object is not
+  // available.
+  if (feedback.IsInsufficient()) return NoChange();
+
+  JSArrayRef template_object = feedback.AsTemplateObject().value();
   Node* value = jsgraph()->Constant(template_object);
   ReplaceWithValue(node, value);
   return Replace(value);

src/compiler/js-heap-broker.cc

@@ -4230,48 +4230,6 @@ bool JSFunctionRef::serialized() const {
   return data()->AsJSFunction()->serialized();
 }
 
-JSArrayRef SharedFunctionInfoRef::GetTemplateObject(
-    TemplateObjectDescriptionRef description, FeedbackSource const& source,
-    SerializationPolicy policy) {
-  // First, see if we have processed feedback from the vector, respecting
-  // the serialization policy.
-  ProcessedFeedback const& feedback =
-      policy == SerializationPolicy::kSerializeIfNeeded
-          ? broker()->ProcessFeedbackForTemplateObject(source)
-          : broker()->GetFeedbackForTemplateObject(source);
-
-  if (!feedback.IsInsufficient()) {
-    return feedback.AsTemplateObject().value();
-  }
-
-  if (data_->should_access_heap()) {
-    AllowHandleAllocationIfNeeded allow_handle_allocation(data()->kind(),
-                                                          broker()->mode());
-    AllowHandleDereferenceIfNeeded allow_handle_dereference(data()->kind(),
-                                                            broker()->mode());
-    Handle<JSArray> template_object =
-        TemplateObjectDescription::GetTemplateObject(
-            isolate(), broker()->target_native_context().object(),
-            description.object(), object(), source.slot.ToInt());
-    return JSArrayRef(broker(), template_object);
-  }
-
-  ObjectData* array =
-      data()->AsSharedFunctionInfo()->GetTemplateObject(source.slot);
-  if (array != nullptr) return JSArrayRef(broker(), array);
-
-  CHECK_EQ(policy, SerializationPolicy::kSerializeIfNeeded);
-  CHECK_EQ(broker()->mode(), JSHeapBroker::kSerializing);
-
-  Handle<JSArray> template_object =
-      TemplateObjectDescription::GetTemplateObject(
-          broker()->isolate(), broker()->target_native_context().object(),
-          description.object(), object(), source.slot.ToInt());
-  array = broker()->GetOrCreateData(template_object);
-  data()->AsSharedFunctionInfo()->SetTemplateObject(source.slot, array);
-  return JSArrayRef(broker(), array);
-}
-
 void SharedFunctionInfoRef::SerializeFunctionTemplateInfo() {
   if (data_->should_access_heap()) return;
   CHECK_EQ(broker()->mode(), JSHeapBroker::kSerializing);

src/compiler/js-heap-copy-reducer.cc

@@ -152,10 +152,9 @@ Reduction JSHeapCopyReducer::Reduce(Node* node) {
     case IrOpcode::kJSGetTemplateObject: {
       GetTemplateObjectParameters const& p =
           GetTemplateObjectParametersOf(node->op());
-      SharedFunctionInfoRef shared(broker(), p.shared());
-      TemplateObjectDescriptionRef description(broker(), p.description());
-      shared.GetTemplateObject(description, p.feedback(),
-                               SerializationPolicy::kSerializeIfNeeded);
+      SharedFunctionInfoRef(broker(), p.shared());
+      TemplateObjectDescriptionRef(broker(), p.description());
+      broker()->ProcessFeedbackForTemplateObject(p.feedback());
       break;
     }
     case IrOpcode::kJSCreateWithContext: {

src/compiler/pipeline.cc

@@ -1723,6 +1723,10 @@ struct GenericLoweringPhase {
     JSGenericLowering generic_lowering(data->jsgraph(), &graph_reducer,
                                        data->broker());
     AddReducer(data, &graph_reducer, &generic_lowering);
+
+    // JSGEnericLowering accesses the heap due to ObjectRef's type checks.
+    UnparkedScopeIfNeeded scope(data->broker());
+
     graph_reducer.ReduceGraph();
   }
 };

src/compiler/serializer-for-background-compilation.cc

@@ -1375,11 +1375,16 @@ void SerializerForBackgroundCompilation::VisitGetTemplateObject(
       broker(), iterator->GetConstantForIndexOperand(0, broker()->isolate()));
   FeedbackSlot slot = iterator->GetSlotOperand(1);
   FeedbackSource source(feedback_vector(), slot);
-  SharedFunctionInfoRef shared(broker(), function().shared());
-  JSArrayRef template_object = shared.GetTemplateObject(
-      description, source, SerializationPolicy::kSerializeIfNeeded);
-  environment()->accumulator_hints() =
-      Hints::SingleConstant(template_object.object(), zone());
+
+  ProcessedFeedback const& feedback =
+      broker()->ProcessFeedbackForTemplateObject(source);
+  if (feedback.IsInsufficient()) {
+    environment()->accumulator_hints() = Hints();
+  } else {
+    JSArrayRef template_object = feedback.AsTemplateObject().value();
+    environment()->accumulator_hints() =
+        Hints::SingleConstant(template_object.object(), zone());
+  }
 }
 
 void SerializerForBackgroundCompilation::VisitLdaTrue(