[turbofan] Use heap broker for accesses in JSCreateLowering::ReduceJSCreateLiteralArrayOrObject.

This does not move the dependency management there, yet.

Bug: v8:7790
Change-Id: Ia8b473a89c2853ffeba4adf84ac8814f403279c9
Reviewed-on: https://chromium-review.googlesource.com/1112256
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54004}

src/compiler/js-create-lowering.h

@@ -24,6 +24,7 @@ namespace compiler {
 class CommonOperatorBuilder;
 class JSGraph;
 class JSHeapBroker;
+class JSObjectRef;
 class JSOperatorBuilder;
 class MachineOperatorBuilder;
 class SimplifiedOperatorBuilder;
@@ -97,10 +98,9 @@ class V8_EXPORT_PRIVATE JSCreateLowering final
                          std::vector<Node*> const& values,
                          PretenureFlag pretenure);
   Node* AllocateFastLiteral(Node* effect, Node* control,
-                            Handle<JSObject> boilerplate,
-                            PretenureFlag pretenure);
+                            JSObjectRef boilerplate, PretenureFlag pretenure);
   Node* AllocateFastLiteralElements(Node* effect, Node* control,
-                                    Handle<JSObject> boilerplate,
+                                    JSObjectRef boilerplate,
                                     PretenureFlag pretenure);
   Node* AllocateLiteralRegExp(Node* effect, Node* control,
                               Handle<JSRegExp> boilerplate);

src/compiler/js-heap-broker.h

@@ -20,6 +20,7 @@ enum class OddballType : uint8_t {
   kUndefined,
   kNull,
   kHole,
+  kUninitialized,
   kOther,  // Oddball, but none of the above.
   kAny     // Any Oddball.
 };
@@ -53,13 +54,22 @@ class HeapObjectType {
 };
 
 #define HEAP_BROKER_DATA_LIST(V) \
+  V(AllocationSite)              \
   V(Context)                     \
+  V(FeedbackVector)              \
+  V(FixedArray)                  \
+  V(FixedArrayBase)              \
+  V(FixedDoubleArray)            \
   V(HeapNumber)                  \
   V(HeapObject)                  \
+  V(JSArray)                     \
   V(JSFunction)                  \
+  V(JSObject)                    \
+  V(MutableHeapNumber)           \
   V(Name)                        \
   V(NativeContext)               \
-  V(ScriptContextTable)
+  V(ScriptContextTable)          \
+  V(Map)
 
 #define HEAP_BROKER_KIND_LIST(V) \
   HEAP_BROKER_DATA_LIST(V)       \
@@ -105,6 +115,8 @@ class HeapObjectRef : public ObjectRef {
   explicit HeapObjectRef(Handle<Object> object);
   HeapObjectType type(const JSHeapBroker* broker) const;
 
+  MapRef map(const JSHeapBroker* broker) const;
+
  private:
   friend class JSHeapBroker;
 };
@@ -129,7 +141,20 @@ class V8_EXPORT_PRIVATE JSHeapBroker : public NON_EXPORTED_BASE(ZoneObject) {
   Isolate* const isolate_;
 };
 
-class JSFunctionRef : public HeapObjectRef {
+class JSObjectRef : public HeapObjectRef {
+ public:
+  explicit JSObjectRef(Handle<Object> object) : HeapObjectRef(object) {}
+
+  bool IsUnboxedDoubleField(FieldIndex index) const;
+  double RawFastDoublePropertyAt(FieldIndex index) const;
+  ObjectRef RawFastPropertyAt(const JSHeapBroker* broker,
+                              FieldIndex index) const;
+
+  FixedArrayBaseRef elements(const JSHeapBroker* broker) const;
+  void EnsureElementsTenured(const JSHeapBroker* broker);
+};
+
+class JSFunctionRef : public JSObjectRef {
  public:
   explicit JSFunctionRef(Handle<Object> object);
   bool HasBuiltinFunctionId() const;
@@ -142,6 +167,12 @@ class HeapNumberRef : public HeapObjectRef {
   double value() const;
 };
 
+class MutableHeapNumberRef : public HeapObjectRef {
+ public:
+  explicit MutableHeapNumberRef(Handle<Object> object);
+  double value() const;
+};
+
 class ContextRef : public HeapObjectRef {
  public:
   explicit ContextRef(Handle<Object> object);
@@ -173,6 +204,73 @@ class ScriptContextTableRef : public HeapObjectRef {
   base::Optional<LookupResult> lookup(const NameRef& name) const;
 };
 
+class FeedbackVectorRef : public HeapObjectRef {
+ public:
+  explicit FeedbackVectorRef(Handle<Object> object) : HeapObjectRef(object) {}
+  ObjectRef get(const JSHeapBroker* broker, FeedbackSlot slot) const;
+};
+
+class AllocationSiteRef : public HeapObjectRef {
+ public:
+  explicit AllocationSiteRef(Handle<HeapObject> object)
+      : HeapObjectRef(object) {}
+
+  JSObjectRef boilerplate(const JSHeapBroker* broker) const;
+  PretenureFlag GetPretenureMode() const;
+
+  bool IsFastLiteral(const JSHeapBroker* broker);
+};
+
+class MapRef : public HeapObjectRef {
+ public:
+  explicit MapRef(Handle<HeapObject> object) : HeapObjectRef(object) {}
+
+  int instance_size() const;
+  InstanceType instance_type() const;
+  int GetInObjectProperties() const;
+  int NumberOfOwnDescriptors() const;
+  PropertyDetails GetPropertyDetails(int i) const;
+  NameRef GetPropertyKey(const JSHeapBroker* broker, int i) const;
+  FieldIndex GetFieldIndexFor(int i) const;
+
+  bool IsJSArrayMap() const;
+  bool IsFixedCowArrayMap(const JSHeapBroker* broker) const;
+};
+
+class FixedArrayBaseRef : public HeapObjectRef {
+ public:
+  explicit FixedArrayBaseRef(Handle<HeapObject> object)
+      : HeapObjectRef(object) {}
+
+  int length() const;
+};
+
+class FixedArrayRef : public FixedArrayBaseRef {
+ public:
+  explicit FixedArrayRef(Handle<HeapObject> object)
+      : FixedArrayBaseRef(object) {}
+
+  bool is_the_hole(const JSHeapBroker* broker, int i) const;
+  ObjectRef get(const JSHeapBroker* broker, int i) const;
+};
+
+class FixedDoubleArrayRef : public FixedArrayBaseRef {
+ public:
+  explicit FixedDoubleArrayRef(Handle<HeapObject> object)
+      : FixedArrayBaseRef(object) {}
+
+  bool is_the_hole(int i) const;
+  double get_scalar(int i) const;
+};
+
+class JSArrayRef : public JSObjectRef {
+ public:
+  explicit JSArrayRef(Handle<Object> object) : JSObjectRef(object) {}
+
+  ElementsKind GetElementsKind() const;
+  ObjectRef length(const JSHeapBroker* broker) const;
+};
+
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8

src/compiler/types.cc

@@ -164,6 +164,8 @@ Type::bitset BitsetType::Lub(HeapObjectType const& type) {
       return kBigInt;
     case ODDBALL_TYPE:
       switch (type.oddball_type()) {
+        case OddballType::kNone:
+          break;
         case OddballType::kHole:
           return kHole;
         case OddballType::kBoolean:
@@ -172,14 +174,14 @@ Type::bitset BitsetType::Lub(HeapObjectType const& type) {
           return kNull;
         case OddballType::kUndefined:
           return kUndefined;
+        case OddballType::kUninitialized:
         case OddballType::kOther:
           // TODO(neis): We should add a kOtherOddball type.
           return kOtherInternal;
         case OddballType::kAny:
           return kOddball | kOtherInternal;
-        default:
-          UNREACHABLE();
       }
+      UNREACHABLE();
     case HEAP_NUMBER_TYPE:
       return kNumber;
     case JS_OBJECT_TYPE: