[turbofan] Brokerize Function.prototype.bind

Bug: v8:7790
Change-Id: I2985f5740b947445723ce0f5072a32be48d22be1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1709410
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62895}

src/compiler/heap-refs.h

@@ -71,6 +71,7 @@ enum class OddballType : uint8_t {
   V(String)                        \
   V(Symbol)                        \
   /* Subtypes of HeapObject */     \
+  V(AccessorInfo)                  \
   V(AllocationSite)                \
   V(BigInt)                        \
   V(CallHandlerInfo)               \
@@ -233,10 +234,9 @@ class JSObjectRef : public HeapObjectRef {
 
   // Return the value of the property identified by the field {index}
   // if {index} is known to be an own data property of the object.
-  base::Optional<ObjectRef> GetOwnProperty(Representation field_representation,
-                                           FieldIndex index,
-                                           bool serialize = false) const;
-
+  base::Optional<ObjectRef> GetOwnDataProperty(
+      Representation field_representation, FieldIndex index,
+      bool serialize = false) const;
   FixedArrayBaseRef elements() const;
   void SerializeElements();
   void EnsureElementsTenured();
@@ -463,6 +463,12 @@ class CallHandlerInfoRef : public HeapObjectRef {
   ObjectRef data() const;
 };
 
+class AccessorInfoRef : public HeapObjectRef {
+ public:
+  using HeapObjectRef::HeapObjectRef;
+  Handle<AccessorInfo> object() const;
+};
+
 class AllocationSiteRef : public HeapObjectRef {
  public:
   using HeapObjectRef::HeapObjectRef;
@@ -550,12 +556,14 @@ class V8_EXPORT_PRIVATE MapRef : public HeapObjectRef {
   // Concerning the underlying instance_descriptors:
   void SerializeOwnDescriptors();
   void SerializeOwnDescriptor(int descriptor_index);
+  bool serialized_own_descriptor(int descriptor_index) const;
   MapRef FindFieldOwner(int descriptor_index) const;
   PropertyDetails GetPropertyDetails(int descriptor_index) const;
   NameRef GetPropertyKey(int descriptor_index) const;
   FieldIndex GetFieldIndexFor(int descriptor_index) const;
   ObjectRef GetFieldType(int descriptor_index) const;
   bool IsUnboxedDoubleField(int descriptor_index) const;
+  ObjectRef GetStrongValue(int descriptor_number) const;
 
   // Available after calling JSFunctionRef::Serialize on a function that has
   // this map as initial map.

src/compiler/js-call-reducer.cc

@@ -487,9 +487,6 @@ Reduction JSCallReducer::ReduceFunctionPrototypeApply(Node* node) {
   NodeProperties::ChangeOp(
       node,
       javascript()->Call(arity, p.frequency(), VectorSlotPair(), convert_mode));
-  // TODO(mslekova): Remove once ReduceJSCall is brokerized.
-  AllowHandleDereference allow_handle_dereference;
-  AllowHandleAllocation allow_handle_allocation;
   // Try to further reduce the JSCall {node}.
   Reduction const reduction = ReduceJSCall(node);
   return reduction.Changed() ? reduction : Changed(node);
@@ -497,6 +494,8 @@ Reduction JSCallReducer::ReduceFunctionPrototypeApply(Node* node) {
 
 // ES section #sec-function.prototype.bind
 Reduction JSCallReducer::ReduceFunctionPrototypeBind(Node* node) {
+  DisallowHeapAccessIf no_heap_acess(FLAG_concurrent_inlining);
+
   DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
   CallParameters const& p = CallParametersOf(node->op());
   if (p.speculation_mode() == SpeculationMode::kDisallowSpeculation) {
@@ -527,14 +526,32 @@ Reduction JSCallReducer::ReduceFunctionPrototypeBind(Node* node) {
 
   MapRef first_receiver_map(broker(), receiver_maps[0]);
   bool const is_constructor = first_receiver_map.is_constructor();
-  first_receiver_map.SerializePrototype();
+
+  if (FLAG_concurrent_inlining) {
+    if (!first_receiver_map.serialized_prototype()) {
+      TRACE_BROKER_MISSING(
+          broker(), "serialized prototype on map " << first_receiver_map);
+      return inference.NoChange();
+    }
+  } else {
+    first_receiver_map.SerializePrototype();
+  }
   ObjectRef const prototype = first_receiver_map.prototype();
   for (Handle<Map> const map : receiver_maps) {
     MapRef receiver_map(broker(), map);
 
+    if (FLAG_concurrent_inlining) {
+      if (!receiver_map.serialized_prototype()) {
+        TRACE_BROKER_MISSING(broker(),
+                             "serialized prototype on map " << receiver_map);
+        return inference.NoChange();
+      }
+    } else {
+      receiver_map.SerializePrototype();
+    }
+
     // Check for consistency among the {receiver_maps}.
     STATIC_ASSERT(LAST_TYPE == LAST_FUNCTION_TYPE);
-    receiver_map.SerializePrototype();
     if (!receiver_map.prototype().equals(prototype) ||
         receiver_map.is_constructor() != is_constructor ||
         receiver_map.instance_type() < FIRST_FUNCTION_TYPE) {
@@ -550,28 +567,31 @@ Reduction JSCallReducer::ReduceFunctionPrototypeBind(Node* node) {
     // recomputed even if the actual value of the object changes.
     // This mirrors the checks done in builtins-function-gen.cc at
     // runtime otherwise.
-    Handle<DescriptorArray> descriptors(
-        receiver_map.object()->instance_descriptors(), isolate());
-    int minimum_nof_descriptors = i::Max(JSFunction::kLengthDescriptorIndex,
-                                         JSFunction::kNameDescriptorIndex) +
+    int minimum_nof_descriptors = std::max(JSFunction::kLengthDescriptorIndex,
+                                           JSFunction::kNameDescriptorIndex) +
                                   1;
-    if (receiver_map.object()->NumberOfOwnDescriptors() <
-        minimum_nof_descriptors) {
-      return inference.NoChange();
-    }
-    if (descriptors->GetKey(JSFunction::kLengthDescriptorIndex) !=
-        ReadOnlyRoots(isolate()).length_string()) {
-      return inference.NoChange();
-    }
-    if (!descriptors->GetStrongValue(JSFunction::kLengthDescriptorIndex)
-             .IsAccessorInfo()) {
+    if (receiver_map.NumberOfOwnDescriptors() < minimum_nof_descriptors) {
       return inference.NoChange();
     }
-    if (descriptors->GetKey(JSFunction::kNameDescriptorIndex) !=
-        ReadOnlyRoots(isolate()).name_string()) {
+    if (!receiver_map.serialized_own_descriptor(
+            JSFunction::kLengthDescriptorIndex) ||
+        !receiver_map.serialized_own_descriptor(
+            JSFunction::kNameDescriptorIndex)) {
+      TRACE_BROKER_MISSING(broker(),
+                           "serialized descriptors on map " << receiver_map);
       return inference.NoChange();
     }
-    if (!descriptors->GetStrongValue(JSFunction::kNameDescriptorIndex)
+    ReadOnlyRoots roots(isolate());
+    StringRef length_string(broker(), roots.length_string_handle());
+    StringRef name_string(broker(), roots.name_string_handle());
+
+    if (!receiver_map.GetPropertyKey(JSFunction::kLengthDescriptorIndex)
+             .equals(length_string) ||
+        !receiver_map.GetStrongValue(JSFunction::kLengthDescriptorIndex)
+             .IsAccessorInfo() ||
+        !receiver_map.GetPropertyKey(JSFunction::kNameDescriptorIndex)
+             .equals(name_string) ||
+        !receiver_map.GetStrongValue(JSFunction::kNameDescriptorIndex)
              .IsAccessorInfo()) {
       return inference.NoChange();
     }
@@ -655,9 +675,6 @@ Reduction JSCallReducer::ReduceFunctionPrototypeCall(Node* node) {
   NodeProperties::ChangeOp(
       node,
       javascript()->Call(arity, p.frequency(), VectorSlotPair(), convert_mode));
-  // TODO(mslekova): Remove once ReduceJSCall is brokerized.
-  AllowHandleDereference allow_handle_dereference;
-  AllowHandleAllocation allow_handle_allocation;
   // Try to further reduce the JSCall {node}.
   Reduction const reduction = ReduceJSCall(node);
   return reduction.Changed() ? reduction : Changed(node);
@@ -3319,6 +3336,10 @@ base::Optional<HeapObjectRef> GetHeapObjectFeedback(
 }  // namespace
 
 Reduction JSCallReducer::ReduceJSCall(Node* node) {
+  // TODO(mslekova): Remove once ReduceJSCall is brokerized.
+  AllowHandleDereference allow_handle_dereference;
+  AllowHandleAllocation allow_handle_allocation;
+
   DCHECK_EQ(IrOpcode::kJSCall, node->opcode());
   CallParameters const& p = CallParametersOf(node->op());
   Node* target = NodeProperties::GetValueInput(node, 0);
@@ -7213,7 +7234,7 @@ Reduction JSCallReducer::ReduceRegExpPrototypeTest(Node* node) {
     JSObjectRef holder_ref(broker(), holder);
 
     // Bail out if the exec method is not the original one.
-    base::Optional<ObjectRef> constant = holder_ref.GetOwnProperty(
+    base::Optional<ObjectRef> constant = holder_ref.GetOwnDataProperty(
         ai_exec.field_representation(), ai_exec.field_index());
     if (!constant.has_value() ||
         !constant->equals(native_context().regexp_exec_function())) {

src/compiler/js-heap-broker.cc

@@ -256,12 +256,6 @@ class JSObjectField {
   uint64_t number_bits_ = 0;
 };
 
-struct FieldIndexHasher {
-  size_t operator()(FieldIndex field_index) const {
-    return field_index.index();
-  }
-};
-
 class JSObjectData : public HeapObjectData {
  public:
   JSObjectData(JSHeapBroker* broker, ObjectData** storage,
@@ -284,9 +278,9 @@ class JSObjectData : public HeapObjectData {
 
   ObjectData* GetOwnConstantElement(JSHeapBroker* broker, uint32_t index,
                                     bool serialize);
-  ObjectData* GetOwnProperty(JSHeapBroker* broker,
-                             Representation representation,
-                             FieldIndex field_index, bool serialize);
+  ObjectData* GetOwnDataProperty(JSHeapBroker* broker,
+                                 Representation representation,
+                                 FieldIndex field_index, bool serialize);
 
   // This method is only used to assert our invariants.
   bool cow_or_empty_elements_tenured() const;
@@ -316,7 +310,9 @@ class JSObjectData : public HeapObjectData {
   // (2) are known not to (possibly they don't exist at all).
   // In case (2), the second pair component is nullptr.
   // For simplicity, this may in theory overlap with inobject_fields_.
-  ZoneUnorderedMap<FieldIndex, ObjectData*, FieldIndexHasher> own_properties_;
+  // The keys of the map are the property_index() values of the
+  // respective property FieldIndex'es.
+  ZoneUnorderedMap<int, ObjectData*> own_properties_;
 };
 
 void JSObjectData::SerializeObjectCreateMap(JSHeapBroker* broker) {
@@ -353,14 +349,15 @@ base::Optional<ObjectRef> GetOwnElementFromHeap(JSHeapBroker* broker,
   return base::nullopt;
 }
 
-ObjectRef GetOwnPropertyFromHeap(JSHeapBroker* broker,
-                                 Handle<JSObject> receiver,
-                                 Representation representation,
-                                 FieldIndex field_index) {
+ObjectRef GetOwnDataPropertyFromHeap(JSHeapBroker* broker,
+                                     Handle<JSObject> receiver,
+                                     Representation representation,
+                                     FieldIndex field_index) {
   Handle<Object> constant =
       JSObject::FastPropertyAt(receiver, representation, field_index);
   return ObjectRef(broker, constant);
 }
+
 }  // namespace
 
 ObjectData* JSObjectData::GetOwnConstantElement(JSHeapBroker* broker,
@@ -382,11 +379,11 @@ ObjectData* JSObjectData::GetOwnConstantElement(JSHeapBroker* broker,
   return result;
 }
 
-ObjectData* JSObjectData::GetOwnProperty(JSHeapBroker* broker,
-                                         Representation representation,
-                                         FieldIndex field_index,
-                                         bool serialize) {
-  auto p = own_properties_.find(field_index);
+ObjectData* JSObjectData::GetOwnDataProperty(JSHeapBroker* broker,
+                                             Representation representation,
+                                             FieldIndex field_index,
+                                             bool serialize) {
+  auto p = own_properties_.find(field_index.property_index());
   if (p != own_properties_.end()) return p->second;
 
   if (!serialize) {
@@ -396,10 +393,10 @@ ObjectData* JSObjectData::GetOwnProperty(JSHeapBroker* broker,
     return nullptr;
   }
 
-  ObjectRef property = GetOwnPropertyFromHeap(
+  ObjectRef property = GetOwnDataPropertyFromHeap(
       broker, Handle<JSObject>::cast(object()), representation, field_index);
   ObjectData* result(property.data());
-  own_properties_.insert(std::make_pair(field_index, result));
+  own_properties_.insert(std::make_pair(field_index.property_index(), result));
   return result;
 }
 
@@ -842,6 +839,12 @@ bool IsInlinableFastLiteral(Handle<JSObject> boilerplate) {
 
 }  // namespace
 
+class AccessorInfoData : public HeapObjectData {
+ public:
+  AccessorInfoData(JSHeapBroker* broker, ObjectData** storage,
+                   Handle<AccessorInfo> object);
+};
+
 class AllocationSiteData : public HeapObjectData {
  public:
   AllocationSiteData(JSHeapBroker* broker, ObjectData** storage,
@@ -891,6 +894,7 @@ class ScriptContextTableData : public HeapObjectData {
 
 struct PropertyDescriptor {
   NameData* key = nullptr;
+  ObjectData* value = nullptr;
   PropertyDetails details = PropertyDetails::Empty();
   FieldIndex field_index;
   MapData* field_owner = nullptr;
@@ -942,6 +946,7 @@ class MapData : public HeapObjectData {
   // on field owner(s).
   void SerializeOwnDescriptor(JSHeapBroker* broker, int descriptor_index);
   void SerializeOwnDescriptors(JSHeapBroker* broker);
+  ObjectData* GetStrongValue(int descriptor_index) const;
   DescriptorArrayData* instance_descriptors() const {
     return instance_descriptors_;
   }
@@ -1006,6 +1011,10 @@ class MapData : public HeapObjectData {
   bool serialized_for_element_store_ = false;
 };
 
+AccessorInfoData::AccessorInfoData(JSHeapBroker* broker, ObjectData** storage,
+                                   Handle<AccessorInfo> object)
+    : HeapObjectData(broker, storage, object) {}
+
 AllocationSiteData::AllocationSiteData(JSHeapBroker* broker,
                                        ObjectData** storage,
                                        Handle<AllocationSite> object)
@@ -1896,6 +1905,13 @@ void MapData::SerializeOwnDescriptors(JSHeapBroker* broker) {
   }
 }
 
+ObjectData* MapData::GetStrongValue(int descriptor_index) const {
+  auto data = instance_descriptors_->contents().find(descriptor_index);
+  if (data == instance_descriptors_->contents().end()) return nullptr;
+
+  return data->second.value;
+}
+
 void MapData::SerializeOwnDescriptor(JSHeapBroker* broker,
                                      int descriptor_index) {
   TraceScope tracer(broker, this, "MapData::SerializeOwnDescriptor");
@@ -1907,7 +1923,7 @@ void MapData::SerializeOwnDescriptor(JSHeapBroker* broker,
   }
 
   ZoneMap<int, PropertyDescriptor>& contents =
-      instance_descriptors_->contents();
+      instance_descriptors()->contents();
   CHECK_LT(descriptor_index, map->NumberOfOwnDescriptors());
   if (contents.find(descriptor_index) != contents.end()) return;
 
@@ -1919,6 +1935,11 @@ void MapData::SerializeOwnDescriptor(JSHeapBroker* broker,
   PropertyDescriptor d;
   d.key =
       broker->GetOrCreateData(descriptors->GetKey(descriptor_index))->AsName();
+  MaybeObject value = descriptors->GetValue(descriptor_index);
+  HeapObject obj;
+  if (value.GetHeapObjectIfStrong(&obj)) {
+    d.value = broker->GetOrCreateData(handle(obj, broker->isolate()));
+  }
   d.details = descriptors->GetDetails(descriptor_index);
   if (d.details.location() == kField) {
     d.field_index = FieldIndex::ForDescriptor(*map, descriptor_index);
@@ -3129,6 +3150,17 @@ BIMODAL_ACCESSOR_C(String, int, length)
 
 BIMODAL_ACCESSOR(FeedbackCell, HeapObject, value)
 
+ObjectRef MapRef::GetStrongValue(int descriptor_index) const {
+  if (broker()->mode() == JSHeapBroker::kDisabled) {
+    AllowHandleDereference allow_handle_dereference;
+    return ObjectRef(broker(),
+                     handle(object()->instance_descriptors().GetStrongValue(
+                                descriptor_index),
+                            broker()->isolate()));
+  }
+  return ObjectRef(broker(), data()->AsMap()->GetStrongValue(descriptor_index));
+}
+
 void* JSTypedArrayRef::external_pointer() const {
   if (broker()->mode() == JSHeapBroker::kDisabled) {
     AllowHandleDereference allow_handle_dereference;
@@ -3314,14 +3346,15 @@ base::Optional<ObjectRef> ObjectRef::GetOwnConstantElement(
   return ObjectRef(broker(), element);
 }
 
-base::Optional<ObjectRef> JSObjectRef::GetOwnProperty(
+base::Optional<ObjectRef> JSObjectRef::GetOwnDataProperty(
     Representation field_representation, FieldIndex index,
     bool serialize) const {
   if (broker()->mode() == JSHeapBroker::kDisabled) {
-    return GetOwnPropertyFromHeap(broker(), Handle<JSObject>::cast(object()),
-                                  field_representation, index);
+    return GetOwnDataPropertyFromHeap(broker(),
+                                      Handle<JSObject>::cast(object()),
+                                      field_representation, index);
   }
-  ObjectData* property = data()->AsJSObject()->GetOwnProperty(
+  ObjectData* property = data()->AsJSObject()->GetOwnDataProperty(
       broker(), field_representation, index, serialize);
   if (property == nullptr) return base::nullopt;
   return ObjectRef(broker(), property);
@@ -3703,6 +3736,16 @@ void MapRef::SerializeOwnDescriptor(int descriptor_index) {
   data()->AsMap()->SerializeOwnDescriptor(broker(), descriptor_index);
 }
 
+bool MapRef::serialized_own_descriptor(int descriptor_index) const {
+  CHECK_LT(descriptor_index, NumberOfOwnDescriptors());
+  if (broker()->mode() == JSHeapBroker::kDisabled) return true;
+  DescriptorArrayData* desc_array_data =
+      data()->AsMap()->instance_descriptors();
+  if (!desc_array_data) return false;
+  return desc_array_data->contents().find(descriptor_index) !=
+         desc_array_data->contents().end();
+}
+
 void MapRef::SerializeBackPointer() {
   if (broker()->mode() == JSHeapBroker::kDisabled) return;
   CHECK_EQ(broker()->mode(), JSHeapBroker::kSerializing);

src/compiler/serializer-for-background-compilation.cc

@@ -361,7 +361,8 @@ class SerializerForBackgroundCompilation {
       FunctionTemplateInfoRef& target,  // NOLINT(runtime/references)
       Handle<Map> receiver);
   void ProcessBuiltinCall(Handle<SharedFunctionInfo> target,
-                          const HintsVector& arguments);
+                          const HintsVector& arguments,
+                          SpeculationMode speculation_mode);
 
   void ProcessJump(interpreter::BytecodeArrayIterator* iterator);
 
@@ -376,6 +377,7 @@ class SerializerForBackgroundCompilation {
   void ProcessHintsForRegExpTest(Hints const& regexp_hints);
   PropertyAccessInfo ProcessMapForRegExpTest(MapRef map);
   void ProcessHintsForFunctionCall(Hints const& target_hints);
+  void ProcessHintsForFunctionBind(Hints const& receiver_hints);
 
   GlobalAccessFeedback const* ProcessFeedbackForGlobalAccess(FeedbackSlot slot);
   NamedAccessFeedback const* ProcessFeedbackMapsForNamedAccess(
@@ -1492,6 +1494,8 @@ void SerializerForBackgroundCompilation::ProcessCallOrConstruct(
   }
 
   environment()->accumulator_hints().Clear();
+  FeedbackNexus nexus(environment()->function().feedback_vector(), slot);
+  SpeculationMode speculation_mode = nexus.GetSpeculationMode();
 
   for (auto hint : callee.constants()) {
     if (!hint->IsJSFunction()) continue;
@@ -1505,7 +1509,7 @@ void SerializerForBackgroundCompilation::ProcessCallOrConstruct(
       ProcessApiCall(shared, arguments);
       DCHECK(!shared->IsInlineable());
     } else if (shared->HasBuiltinId()) {
-      ProcessBuiltinCall(shared, arguments);
+      ProcessBuiltinCall(shared, arguments, speculation_mode);
       DCHECK(!shared->IsInlineable());
     }
 
@@ -1523,7 +1527,7 @@ void SerializerForBackgroundCompilation::ProcessCallOrConstruct(
       ProcessApiCall(shared, arguments);
       DCHECK(!shared->IsInlineable());
     } else if (shared->HasBuiltinId()) {
-      ProcessBuiltinCall(shared, arguments);
+      ProcessBuiltinCall(shared, arguments, speculation_mode);
       DCHECK(!shared->IsInlineable());
     }
 
@@ -1608,7 +1612,8 @@ void SerializerForBackgroundCompilation::ProcessReceiverMapForApiCall(
 }
 
 void SerializerForBackgroundCompilation::ProcessBuiltinCall(
-    Handle<SharedFunctionInfo> target, const HintsVector& arguments) {
+    Handle<SharedFunctionInfo> target, const HintsVector& arguments,
+    SpeculationMode speculation_mode) {
   DCHECK(target->HasBuiltinId());
   const int builtin_id = target->builtin_id();
   const char* name = Builtins::name(builtin_id);
@@ -1616,20 +1621,26 @@ void SerializerForBackgroundCompilation::ProcessBuiltinCall(
   switch (builtin_id) {
     case Builtins::kPromisePrototypeCatch: {
       // For JSCallReducer::ReducePromisePrototypeCatch.
-      CHECK_GE(arguments.size(), 1);
-      ProcessMapHintsForPromises(arguments[0]);
+      if (speculation_mode != SpeculationMode::kDisallowSpeculation) {
+        CHECK_GE(arguments.size(), 1);
+        ProcessMapHintsForPromises(arguments[0]);
+      }
       break;
     }
     case Builtins::kPromisePrototypeFinally: {
       // For JSCallReducer::ReducePromisePrototypeFinally.
-      CHECK_GE(arguments.size(), 1);
-      ProcessMapHintsForPromises(arguments[0]);
+      if (speculation_mode != SpeculationMode::kDisallowSpeculation) {
+        CHECK_GE(arguments.size(), 1);
+        ProcessMapHintsForPromises(arguments[0]);
+      }
       break;
     }
     case Builtins::kPromisePrototypeThen: {
       // For JSCallReducer::ReducePromisePrototypeThen.
-      CHECK_GE(arguments.size(), 1);
-      ProcessMapHintsForPromises(arguments[0]);
+      if (speculation_mode != SpeculationMode::kDisallowSpeculation) {
+        CHECK_GE(arguments.size(), 1);
+        ProcessMapHintsForPromises(arguments[0]);
+      }
       break;
     }
     case Builtins::kPromiseResolveTrampoline:
@@ -1650,18 +1661,27 @@ void SerializerForBackgroundCompilation::ProcessBuiltinCall(
       break;
     case Builtins::kRegExpPrototypeTest: {
       // For JSCallReducer::ReduceRegExpPrototypeTest.
-      if (arguments.size() >= 1) {
+      if (arguments.size() >= 1 &&
+          speculation_mode != SpeculationMode::kDisallowSpeculation) {
         Hints const& regexp_hints = arguments[0];
         ProcessHintsForRegExpTest(regexp_hints);
       }
       break;
     }
     case Builtins::kFunctionPrototypeCall:
-      if (arguments.size() >= 1) {
+      if (arguments.size() >= 1 &&
+          speculation_mode != SpeculationMode::kDisallowSpeculation) {
         Hints const& target_hints = arguments[0];
         ProcessHintsForFunctionCall(target_hints);
       }
       break;
+    case Builtins::kFastFunctionPrototypeBind:
+      if (arguments.size() >= 2 &&
+          speculation_mode != SpeculationMode::kDisallowSpeculation) {
+        Hints const& receiver_hints = arguments[1];
+        ProcessHintsForFunctionBind(receiver_hints);
+      }
+      break;
     default:
       break;
   }
@@ -1708,8 +1728,8 @@ PropertyAccessInfo SerializerForBackgroundCompilation::ProcessMapForRegExpTest(
   if (ai_exec.IsDataConstant() && ai_exec.holder().ToHandle(&holder)) {
     // The property is on the prototype chain.
     JSObjectRef holder_ref(broker(), holder);
-    holder_ref.GetOwnProperty(ai_exec.field_representation(),
-                              ai_exec.field_index(), true);
+    holder_ref.GetOwnDataProperty(ai_exec.field_representation(),
+                                  ai_exec.field_index(), true);
   }
   return ai_exec;
 }
@@ -1726,8 +1746,8 @@ void SerializerForBackgroundCompilation::ProcessHintsForRegExpTest(
     if (ai_exec.IsDataConstant() && !ai_exec.holder().ToHandle(&holder)) {
       // The property is on the object itself.
       JSObjectRef holder_ref(broker(), regexp);
-      holder_ref.GetOwnProperty(ai_exec.field_representation(),
-                                ai_exec.field_index(), true);
+      holder_ref.GetOwnDataProperty(ai_exec.field_representation(),
+                                    ai_exec.field_index(), true);
     }
   }
 
@@ -1746,6 +1766,35 @@ void SerializerForBackgroundCompilation::ProcessHintsForFunctionCall(
   }
 }
 
+namespace {
+void ProcessMapForFunctionBind(MapRef map) {
+  map.SerializePrototype();
+  int min_nof_descriptors = i::Max(JSFunction::kLengthDescriptorIndex,
+                                   JSFunction::kNameDescriptorIndex) +
+                            1;
+  if (map.NumberOfOwnDescriptors() >= min_nof_descriptors) {
+    map.SerializeOwnDescriptor(JSFunction::kLengthDescriptorIndex);
+    map.SerializeOwnDescriptor(JSFunction::kNameDescriptorIndex);
+  }
+}
+}  // namespace
+
+void SerializerForBackgroundCompilation::ProcessHintsForFunctionBind(
+    Hints const& receiver_hints) {
+  for (auto constant : receiver_hints.constants()) {
+    if (!constant->IsJSFunction()) continue;
+    JSFunctionRef function(broker(), constant);
+    function.Serialize();
+    ProcessMapForFunctionBind(function.map());
+  }
+
+  for (auto map : receiver_hints.maps()) {
+    if (!map->IsJSFunctionMap()) continue;
+    MapRef map_ref(broker(), map);
+    ProcessMapForFunctionBind(map_ref);
+  }
+}
+
 void SerializerForBackgroundCompilation::ContributeToJumpTargetEnvironment(
     int target_offset) {
   auto it = jump_target_environments_.find(target_offset);