[turbofan] Make the JSHeapBroker a member of ObjectRef.

This makes it more convenient to work with brokerized data.

Bug: v8:7790
Change-Id: I7ffb4054b809c10c67787b2fb89a05e8ce8f4575
Reviewed-on: https://chromium-review.googlesource.com/1138248
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54480}

src/compiler/allocation-builder.h

@@ -18,10 +18,8 @@ namespace compiler {
 // allocated object and also provides helpers for commonly allocated objects.
 class AllocationBuilder final {
  public:
-  AllocationBuilder(JSGraph* jsgraph, const JSHeapBroker* js_heap_broker,
-                    Node* effect, Node* control)
+  AllocationBuilder(JSGraph* jsgraph, Node* effect, Node* control)
       : jsgraph_(jsgraph),
-        js_heap_broker_(js_heap_broker),
         allocation_(nullptr),
         effect_(effect),
         control_(control) {}
@@ -79,7 +77,7 @@ class AllocationBuilder final {
   }
   // Compound store of a constant into a field.
   void Store(const FieldAccess& access, const ObjectRef& value) {
-    Store(access, jsgraph()->Constant(js_heap_broker(), value));
+    Store(access, jsgraph()->Constant(value));
   }
 
   void FinishAndChange(Node* node) {
@@ -96,7 +94,6 @@ class AllocationBuilder final {
 
  protected:
   JSGraph* jsgraph() { return jsgraph_; }
-  const JSHeapBroker* js_heap_broker() { return js_heap_broker_; }
   Isolate* isolate() const { return jsgraph_->isolate(); }
   Graph* graph() { return jsgraph_->graph(); }
   CommonOperatorBuilder* common() { return jsgraph_->common(); }
@@ -104,7 +101,6 @@ class AllocationBuilder final {
 
  private:
   JSGraph* const jsgraph_;
-  const JSHeapBroker* const js_heap_broker_;
   Node* allocation_;
   Node* effect_;
   Node* control_;

src/compiler/common-operator-reducer.cc

@@ -27,8 +27,8 @@ Decision DecideCondition(const JSHeapBroker* broker, Node* const cond) {
     }
     case IrOpcode::kHeapConstant: {
       HeapObjectMatcher mcond(cond);
-      ObjectRef object(mcond.Value());
-      return object.BooleanValue(broker) ? Decision::kTrue : Decision::kFalse;
+      return mcond.Ref(broker).BooleanValue() ? Decision::kTrue
+                                              : Decision::kFalse;
     }
     default:
       return Decision::kUnknown;

src/compiler/constant-folding-reducer.cc

@@ -37,12 +37,11 @@ Reduction ConstantFoldingReducer::Reduce(Node* node) {
     if (!upper.IsNone()) {
       Node* replacement = nullptr;
       if (upper.IsHeapConstant()) {
-        replacement = jsgraph()->Constant(js_heap_broker(),
-                                          upper.AsHeapConstant()->Ref());
+        replacement = jsgraph()->Constant(upper.AsHeapConstant()->Ref());
       } else if (upper.Is(Type::MinusZero())) {
         Factory* factory = jsgraph()->isolate()->factory();
-        ObjectRef minus_zero(factory->minus_zero_value());
-        replacement = jsgraph()->Constant(js_heap_broker(), minus_zero);
+        ObjectRef minus_zero(js_heap_broker(), factory->minus_zero_value());
+        replacement = jsgraph()->Constant(minus_zero);
       } else if (upper.Is(Type::NaN())) {
         replacement = jsgraph()->NaNConstant();
       } else if (upper.Is(Type::Null())) {

src/compiler/js-call-reducer.cc

@@ -1730,7 +1730,7 @@ Reduction JSCallReducer::ReduceArrayFilter(Node* node,
 
   Node* a;  // Construct the output array.
   {
-    AllocationBuilder ab(jsgraph(), js_heap_broker(), effect, control);
+    AllocationBuilder ab(jsgraph(), effect, control);
     ab.Allocate(initial_map->instance_size(), NOT_TENURED, Type::Array());
     ab.Store(AccessBuilder::ForMap(), initial_map);
     Node* empty_fixed_array = jsgraph()->EmptyFixedArrayConstant();
@@ -1739,9 +1739,9 @@ Reduction JSCallReducer::ReduceArrayFilter(Node* node,
     ab.Store(AccessBuilder::ForJSArrayLength(packed_kind),
              jsgraph()->ZeroConstant());
     for (int i = 0; i < initial_map->GetInObjectProperties(); ++i) {
-      ab.Store(
-          AccessBuilder::ForJSObjectInObjectProperty(MapRef(initial_map), i),
-          jsgraph()->UndefinedConstant());
+      ab.Store(AccessBuilder::ForJSObjectInObjectProperty(
+                   MapRef(js_heap_broker(), initial_map), i),
+               jsgraph()->UndefinedConstant());
     }
     a = effect = ab.Finish();
   }

src/compiler/js-context-specialization.cc

@@ -105,7 +105,7 @@ base::Optional<ContextRef> GetSpecializationContext(
     Maybe<OuterContext> maybe_outer) {
   switch (node->opcode()) {
     case IrOpcode::kHeapConstant: {
-      HeapObjectRef object(HeapConstantOf(node->op()));
+      HeapObjectRef object(broker, HeapConstantOf(node->op()));
       if (object.IsContext()) return object.AsContext();
       break;
     }
@@ -114,7 +114,7 @@ base::Optional<ContextRef> GetSpecializationContext(
       if (maybe_outer.To(&outer) && IsContextParameter(node) &&
           *distance >= outer.distance) {
         *distance -= outer.distance;
-        return ContextRef(outer.context);
+        return ContextRef(broker, outer.context);
       }
       break;
     }
@@ -146,28 +146,26 @@ Reduction JSContextSpecialization::ReduceJSLoadContext(Node* node) {
   // Now walk up the concrete context chain for the remaining depth.
   ContextRef concrete = maybe_concrete.value();
   for (; depth > 0; --depth) {
-    concrete = concrete.previous(js_heap_broker()).value();
+    concrete = concrete.previous().value();
   }
 
   if (!access.immutable()) {
     // We found the requested context object but since the context slot is
     // mutable we can only partially reduce the load.
-    return SimplifyJSLoadContext(
-        node, jsgraph()->Constant(js_heap_broker(), concrete), depth);
+    return SimplifyJSLoadContext(node, jsgraph()->Constant(concrete), depth);
   }
 
   // This will hold the final value, if we can figure it out.
   base::Optional<ObjectRef> maybe_value;
 
-  maybe_value =
-      concrete.get(js_heap_broker(), static_cast<int>(access.index()));
+  maybe_value = concrete.get(static_cast<int>(access.index()));
   if (maybe_value.has_value() && !maybe_value->IsSmi()) {
     // Even though the context slot is immutable, the context might have escaped
     // before the function to which it belongs has initialized the slot.
     // We must be conservative and check if the value in the slot is currently
     // the hole or undefined. Only if it is neither of these, can we be sure
     // that it won't change anymore.
-    OddballType oddball_type = maybe_value->oddball_type(js_heap_broker());
+    OddballType oddball_type = maybe_value->oddball_type();
     if (oddball_type == OddballType::kUndefined ||
         oddball_type == OddballType::kHole) {
       maybe_value.reset();
@@ -175,15 +173,14 @@ Reduction JSContextSpecialization::ReduceJSLoadContext(Node* node) {
   }
 
   if (!maybe_value.has_value()) {
-    return SimplifyJSLoadContext(
-        node, jsgraph()->Constant(js_heap_broker(), concrete), depth);
+    return SimplifyJSLoadContext(node, jsgraph()->Constant(concrete), depth);
   }
 
   // Success. The context load can be replaced with the constant.
   // TODO(titzer): record the specialization for sharing code across
   // multiple contexts that have the same value in the corresponding context
   // slot.
-  Node* constant = jsgraph_->Constant(js_heap_broker(), *maybe_value);
+  Node* constant = jsgraph_->Constant(*maybe_value);
   ReplaceWithValue(node, constant);
   return Replace(constant);
 }
@@ -210,11 +207,10 @@ Reduction JSContextSpecialization::ReduceJSStoreContext(Node* node) {
   // Now walk up the concrete context chain for the remaining depth.
   ContextRef concrete = maybe_concrete.value();
   for (; depth > 0; --depth) {
-    concrete = concrete.previous(js_heap_broker()).value();
+    concrete = concrete.previous().value();
   }
 
-  return SimplifyJSStoreContext(
-      node, jsgraph()->Constant(js_heap_broker(), concrete), depth);
+  return SimplifyJSStoreContext(node, jsgraph()->Constant(concrete), depth);
 }
 
 

src/compiler/js-graph.cc

@@ -66,9 +66,9 @@ Node* JSGraph::Constant(Handle<Object> value) {
   }
 }
 
-Node* JSGraph::Constant(const JSHeapBroker* broker, const ObjectRef& ref) {
+Node* JSGraph::Constant(const ObjectRef& ref) {
   if (ref.IsSmi()) return Constant(ref.AsSmi());
-  OddballType oddball_type = ref.oddball_type(broker);
+  OddballType oddball_type = ref.oddball_type();
   if (ref.IsHeapNumber()) {
     return Constant(ref.AsHeapNumber().value());
   } else if (oddball_type == OddballType::kUndefined) {

src/compiler/js-graph.h

@@ -56,8 +56,7 @@ class V8_EXPORT_PRIVATE JSGraph : public MachineGraph {
   Node* Constant(Handle<Object> value);
 
   // Like above, but doesn't access the heap directly.
-  // TODO(neis): Make the broker a member of JSGraph.
-  Node* Constant(const JSHeapBroker* broker, const ObjectRef& value);
+  Node* Constant(const ObjectRef& value);
 
   // Creates a NumberConstant node, usually canonicalized.
   Node* Constant(double value);

src/compiler/js-heap-broker.h

@@ -94,7 +94,8 @@ HEAP_BROKER_OBJECT_LIST(FORWARD_DECL)
 
 class ObjectRef {
  public:
-  explicit ObjectRef(Handle<Object> object) : object_(object) {}
+  explicit ObjectRef(const JSHeapBroker* broker, Handle<Object> object)
+      : broker_(broker), object_(object) {}
 
   template <typename T>
   Handle<T> object() const {
@@ -102,7 +103,7 @@ class ObjectRef {
     return Handle<T>::cast(object_);
   }
 
-  OddballType oddball_type(const JSHeapBroker* broker) const;
+  OddballType oddball_type() const;
 
   bool IsSmi() const;
   int AsSmi() const;
@@ -117,11 +118,15 @@ class ObjectRef {
   HEAP_BROKER_OBJECT_LIST(HEAP_AS_METHOD_DECL)
 #undef HEAP_AS_METHOD_DECL
 
-  StringRef TypeOf(const JSHeapBroker* broker) const;
-  bool BooleanValue(const JSHeapBroker* broker);
-  double OddballToNumber(const JSHeapBroker* broker) const;
+  StringRef TypeOf() const;
+  bool BooleanValue();
+  double OddballToNumber() const;
+
+ protected:
+  const JSHeapBroker* broker() const { return broker_; }
 
  private:
+  const JSHeapBroker* broker_;
   Handle<Object> object_;
 };
 
@@ -129,10 +134,9 @@ class HeapObjectRef : public ObjectRef {
  public:
   using ObjectRef::ObjectRef;
 
-  HeapObjectType type(const JSHeapBroker* broker) const;
-  MapRef map(const JSHeapBroker* broker) const;
-  base::Optional<MapRef> TryGetObjectCreateMap(
-      const JSHeapBroker* broker) const;
+  HeapObjectType type() const;
+  MapRef map() const;
+  base::Optional<MapRef> TryGetObjectCreateMap() const;
   bool IsSeqString() const;
   bool IsExternalString() const;
 };
@@ -143,11 +147,10 @@ class JSObjectRef : public HeapObjectRef {
 
   bool IsUnboxedDoubleField(FieldIndex index) const;
   double RawFastDoublePropertyAt(FieldIndex index) const;
-  ObjectRef RawFastPropertyAt(const JSHeapBroker* broker,
-                              FieldIndex index) const;
+  ObjectRef RawFastPropertyAt(FieldIndex index) const;
 
-  FixedArrayBaseRef elements(const JSHeapBroker* broker) const;
-  void EnsureElementsTenured(const JSHeapBroker* broker);
+  FixedArrayBaseRef elements() const;
+  void EnsureElementsTenured();
 };
 
 struct SlackTrackingResult {
@@ -166,15 +169,13 @@ class JSFunctionRef : public JSObjectRef {
   BuiltinFunctionId GetBuiltinFunctionId() const;
   bool IsConstructor() const;
   bool has_initial_map() const;
-  MapRef initial_map(const JSHeapBroker* broker) const;
+  MapRef initial_map() const;
 
-  MapRef DependOnInitialMap(const JSHeapBroker* broker,
-                            CompilationDependencies* dependencies) const;
+  MapRef DependOnInitialMap(CompilationDependencies* dependencies) const;
 
-  JSGlobalProxyRef global_proxy(const JSHeapBroker* broker) const;
+  JSGlobalProxyRef global_proxy() const;
   SlackTrackingResult FinishSlackTracking() const;
-  SharedFunctionInfoRef shared(const JSHeapBroker* broker) const;
-
+  SharedFunctionInfoRef shared() const;
   void EnsureHasInitialMap() const;
 };
 
@@ -182,11 +183,11 @@ class JSRegExpRef : public JSObjectRef {
  public:
   using JSObjectRef::JSObjectRef;
 
-  ObjectRef raw_properties_or_hash(const JSHeapBroker* broker) const;
-  ObjectRef data(const JSHeapBroker* broker) const;
-  ObjectRef source(const JSHeapBroker* broker) const;
-  ObjectRef flags(const JSHeapBroker* broker) const;
-  ObjectRef last_index(const JSHeapBroker* broker) const;
+  ObjectRef raw_properties_or_hash() const;
+  ObjectRef data() const;
+  ObjectRef source() const;
+  ObjectRef flags() const;
+  ObjectRef last_index() const;
 };
 
 class HeapNumberRef : public HeapObjectRef {
@@ -207,28 +208,28 @@ class ContextRef : public HeapObjectRef {
  public:
   using HeapObjectRef::HeapObjectRef;
 
-  base::Optional<ContextRef> previous(const JSHeapBroker* broker) const;
-  ObjectRef get(const JSHeapBroker* broker, int index) const;
+  base::Optional<ContextRef> previous() const;
+  ObjectRef get(int index) const;
 };
 
 class NativeContextRef : public ContextRef {
  public:
   using ContextRef::ContextRef;
 
-  ScriptContextTableRef script_context_table(const JSHeapBroker* broker) const;
+  ScriptContextTableRef script_context_table() const;
 
-  MapRef fast_aliased_arguments_map(const JSHeapBroker* broker) const;
-  MapRef sloppy_arguments_map(const JSHeapBroker* broker) const;
-  MapRef strict_arguments_map(const JSHeapBroker* broker) const;
-  MapRef js_array_fast_elements_map_index(const JSHeapBroker* broker) const;
-  MapRef initial_array_iterator_map(const JSHeapBroker* broker) const;
-  MapRef set_value_iterator_map(const JSHeapBroker* broker) const;
-  MapRef set_key_value_iterator_map(const JSHeapBroker* broker) const;
-  MapRef map_key_iterator_map(const JSHeapBroker* broker) const;
-  MapRef map_value_iterator_map(const JSHeapBroker* broker) const;
-  MapRef map_key_value_iterator_map(const JSHeapBroker* broker) const;
+  MapRef fast_aliased_arguments_map() const;
+  MapRef sloppy_arguments_map() const;
+  MapRef strict_arguments_map() const;
+  MapRef js_array_fast_elements_map_index() const;
+  MapRef initial_array_iterator_map() const;
+  MapRef set_value_iterator_map() const;
+  MapRef set_key_value_iterator_map() const;
+  MapRef map_key_iterator_map() const;
+  MapRef map_value_iterator_map() const;
+  MapRef map_key_value_iterator_map() const;
 
-  MapRef GetFunctionMapFromIndex(const JSHeapBroker* broker, int index) const;
+  MapRef GetFunctionMapFromIndex(int index) const;
 };
 
 class NameRef : public HeapObjectRef {
@@ -253,16 +254,16 @@ class FeedbackVectorRef : public HeapObjectRef {
  public:
   using HeapObjectRef::HeapObjectRef;
 
-  ObjectRef get(const JSHeapBroker* broker, FeedbackSlot slot) const;
+  ObjectRef get(FeedbackSlot slot) const;
 };
 
 class AllocationSiteRef : public HeapObjectRef {
  public:
   using HeapObjectRef::HeapObjectRef;
 
-  JSObjectRef boilerplate(const JSHeapBroker* broker) const;
+  JSObjectRef boilerplate() const;
   PretenureFlag GetPretenureMode() const;
-  bool IsFastLiteral(const JSHeapBroker* broker) const;
+  bool IsFastLiteral() const;
 };
 
 class MapRef : public HeapObjectRef {
@@ -274,10 +275,10 @@ class MapRef : public HeapObjectRef {
   int GetInObjectProperties() const;
   int NumberOfOwnDescriptors() const;
   PropertyDetails GetPropertyDetails(int i) const;
-  NameRef GetPropertyKey(const JSHeapBroker* broker, int i) const;
+  NameRef GetPropertyKey(int i) const;
   FieldIndex GetFieldIndexFor(int i) const;
   int GetInObjectPropertyOffset(int index) const;
-  ObjectRef constructor_or_backpointer(const JSHeapBroker* broker) const;
+  ObjectRef constructor_or_backpointer() const;
 
   bool is_stable() const;
   bool has_prototype_slot() const;
@@ -286,10 +287,9 @@ class MapRef : public HeapObjectRef {
 
   bool is_dictionary_map() const;
   bool IsJSArrayMap() const;
-  bool IsFixedCowArrayMap(const JSHeapBroker* broker) const;
+  bool IsFixedCowArrayMap() const;
 
-  void DependOnStableMap(const JSHeapBroker* broker,
-                         CompilationDependencies* dependencies) const;
+  void DependOnStableMap(CompilationDependencies* dependencies) const;
 };
 
 class FixedArrayBaseRef : public HeapObjectRef {
@@ -303,8 +303,8 @@ class FixedArrayRef : public FixedArrayBaseRef {
  public:
   using FixedArrayBaseRef::FixedArrayBaseRef;
 
-  ObjectRef get(const JSHeapBroker* broker, int i) const;
-  bool is_the_hole(const JSHeapBroker* broker, int i) const;
+  ObjectRef get(int i) const;
+  bool is_the_hole(int i) const;
 };
 
 class FixedDoubleArrayRef : public FixedArrayBaseRef {
@@ -320,7 +320,7 @@ class JSArrayRef : public JSObjectRef {
   using JSObjectRef::JSObjectRef;
 
   ElementsKind GetElementsKind() const;
-  ObjectRef length(const JSHeapBroker* broker) const;
+  ObjectRef length() const;
 };
 
 class ScopeInfoRef : public HeapObjectRef {
@@ -354,29 +354,29 @@ class StringRef : public NameRef {
 
   int length() const;
   uint16_t GetFirstChar();
-  double ToNumber(const JSHeapBroker* broker);
+  double ToNumber();
 };
 
 class ModuleRef : public HeapObjectRef {
  public:
-  explicit ModuleRef(Handle<Object> object) : HeapObjectRef(object) {}
+  using HeapObjectRef::HeapObjectRef;
 
-  CellRef GetCell(const JSHeapBroker* broker, int cell_index);
+  CellRef GetCell(int cell_index);
 };
 
 class CellRef : public HeapObjectRef {
  public:
-  explicit CellRef(Handle<Object> object) : HeapObjectRef(object) {}
+  using HeapObjectRef::HeapObjectRef;
 };
 
 class JSGlobalProxyRef : public JSObjectRef {
  public:
-  explicit JSGlobalProxyRef(Handle<Object> object) : JSObjectRef(object) {}
+  using JSObjectRef::JSObjectRef;
 };
 
 class CodeRef : public HeapObjectRef {
  public:
-  explicit CodeRef(Handle<Object> object) : HeapObjectRef(object) {}
+  using HeapObjectRef::HeapObjectRef;
 };
 
 class InternalizedStringRef : public StringRef {

src/compiler/js-native-context-specialization.cc

@@ -68,7 +68,7 @@ JSNativeContextSpecialization::JSNativeContextSpecialization(
       global_object_(native_context->global_object(), jsgraph->isolate()),
       global_proxy_(JSGlobalProxy::cast(native_context->global_proxy()),
                     jsgraph->isolate()),
-      native_context_(native_context),
+      native_context_(js_heap_broker, native_context),
       dependencies_(dependencies),
       zone_(zone),
       type_cache_(TypeCache::Get()) {}
@@ -520,7 +520,7 @@ Reduction JSNativeContextSpecialization::ReduceJSLoadContext(Node* node) {
   // context (if any), so we can constant-fold those fields, which is
   // safe, since the NATIVE_CONTEXT_INDEX slot is always immutable.
   if (access.index() == Context::NATIVE_CONTEXT_INDEX) {
-    Node* value = jsgraph()->Constant(js_heap_broker(), native_context());
+    Node* value = jsgraph()->Constant(native_context());
     ReplaceWithValue(node, value);
     return Replace(value);
   }
@@ -732,19 +732,19 @@ Reduction JSNativeContextSpecialization::ReduceGlobalAccess(
 
 Reduction JSNativeContextSpecialization::ReduceJSLoadGlobal(Node* node) {
   DCHECK_EQ(IrOpcode::kJSLoadGlobal, node->opcode());
-  NameRef name(LoadGlobalParametersOf(node->op()).name());
+  NameRef name(js_heap_broker(), LoadGlobalParametersOf(node->op()).name());
   Node* effect = NodeProperties::GetEffectInput(node);
 
   // Try to lookup the name on the script context table first (lexical scoping).
   base::Optional<ScriptContextTableRef::LookupResult> result =
-      native_context().script_context_table(js_heap_broker()).lookup(name);
+      native_context().script_context_table().lookup(name);
   if (result) {
-    ObjectRef contents = result->context.get(js_heap_broker(), result->index);
-    OddballType oddball_type = contents.oddball_type(js_heap_broker());
+    ObjectRef contents = result->context.get(result->index);
+    OddballType oddball_type = contents.oddball_type();
     if (oddball_type == OddballType::kHole) {
       return NoChange();
     }
-    Node* context = jsgraph()->Constant(js_heap_broker(), result->context);
+    Node* context = jsgraph()->Constant(result->context);
     Node* value = effect = graph()->NewNode(
         javascript()->LoadContext(0, result->index, result->immutable), context,
         effect);
@@ -759,21 +759,21 @@ Reduction JSNativeContextSpecialization::ReduceJSLoadGlobal(Node* node) {
 
 Reduction JSNativeContextSpecialization::ReduceJSStoreGlobal(Node* node) {
   DCHECK_EQ(IrOpcode::kJSStoreGlobal, node->opcode());
-  NameRef name(StoreGlobalParametersOf(node->op()).name());
+  NameRef name(js_heap_broker(), StoreGlobalParametersOf(node->op()).name());
   Node* value = NodeProperties::GetValueInput(node, 0);
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
 
   // Try to lookup the name on the script context table first (lexical scoping).
   base::Optional<ScriptContextTableRef::LookupResult> result =
-      native_context().script_context_table(js_heap_broker()).lookup(name);
+      native_context().script_context_table().lookup(name);
   if (result) {
-    ObjectRef contents = result->context.get(js_heap_broker(), result->index);
-    OddballType oddball_type = contents.oddball_type(js_heap_broker());
+    ObjectRef contents = result->context.get(result->index);
+    OddballType oddball_type = contents.oddball_type();
     if (oddball_type == OddballType::kHole || result->immutable) {
       return NoChange();
     }
-    Node* context = jsgraph()->Constant(js_heap_broker(), result->context);
+    Node* context = jsgraph()->Constant(result->context);
     effect = graph()->NewNode(javascript()->StoreContext(0, result->index),
                               value, context, effect, control);
     ReplaceWithValue(node, value, effect, control);
@@ -1774,7 +1774,7 @@ Node* JSNativeContextSpecialization::InlineApiCall(
   Node* code = jsgraph()->HeapConstant(call_api_callback.code());
 
   // Add CallApiCallbackStub's register argument as well.
-  Node* context = jsgraph()->Constant(js_heap_broker(), native_context());
+  Node* context = jsgraph()->Constant(native_context());
   Node* inputs[10] = {code,    context, data, holder, function_reference,
                       receiver};
   int index = 6 + argc;
@@ -1913,7 +1913,7 @@ JSNativeContextSpecialization::BuildPropertyStore(
             !FLAG_unbox_double_fields) {
           if (access_info.HasTransitionMap()) {
             // Allocate a MutableHeapNumber for the new property.
-            AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
+            AllocationBuilder a(jsgraph(), effect, control);
             a.Allocate(HeapNumber::kSize, NOT_TENURED, Type::OtherInternal());
             a.Store(AccessBuilder::ForMap(),
                     factory()->mutable_heap_number_map());
@@ -2768,7 +2768,7 @@ Node* JSNativeContextSpecialization::BuildExtendPropertiesBackingStore(
                        new_length_and_hash, effect, control);
 
   // Allocate and initialize the new properties.
-  AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
+  AllocationBuilder a(jsgraph(), effect, control);
   a.Allocate(PropertyArray::SizeFor(new_length), NOT_TENURED,
              Type::OtherInternal());
   a.Store(AccessBuilder::ForMap(), jsgraph()->PropertyArrayMapConstant());

src/compiler/js-typed-lowering.cc

@@ -93,12 +93,13 @@ class JSBinopReduction final {
     if (BothInputsAre(Type::String()) ||
         BinaryOperationHintOf(node_->op()) == BinaryOperationHint::kString) {
       HeapObjectBinopMatcher m(node_);
-      if (m.right().HasValue() && m.right().Ref().IsString()) {
-        StringRef right_string(m.right().Value());
+      const JSHeapBroker* broker = lowering_->js_heap_broker();
+      if (m.right().HasValue() && m.right().Ref(broker).IsString()) {
+        StringRef right_string = m.right().Ref(broker).AsString();
         if (right_string.length() >= ConsString::kMinLength) return true;
       }
-      if (m.left().HasValue() && m.left().Ref().IsString()) {
-        StringRef left_string(m.left().Value());
+      if (m.left().HasValue() && m.left().Ref(broker).IsString()) {
+        StringRef left_string = m.left().Ref(broker).AsString();
         if (left_string.length() >= ConsString::kMinLength) {
           // The invariant for ConsString requires the left hand side to be
           // a sequential or external string if the right hand side is the
@@ -718,11 +719,11 @@ Node* JSTypedLowering::BuildGetStringLength(Node* value) {
   // TODO(bmeurer): Get rid of this hack and instead have a way to
   // express the string length in the types.
   HeapObjectMatcher m(value);
-  if (!m.HasValue() || !m.Ref().IsString()) {
+  if (!m.HasValue() || !m.Ref(js_heap_broker()).IsString()) {
     return graph()->NewNode(simplified()->StringLength(), value);
   }
 
-  return jsgraph()->Constant(m.Ref().AsString().length());
+  return jsgraph()->Constant(m.Ref(js_heap_broker()).AsString().length());
 }
 
 Reduction JSTypedLowering::ReduceSpeculativeNumberComparison(Node* node) {
@@ -959,17 +960,15 @@ Reduction JSTypedLowering::ReduceJSToNumberOrNumericInput(Node* input) {
 
   if (input_type.Is(Type::String())) {
     HeapObjectMatcher m(input);
-    if (m.HasValue() && m.Ref().IsString()) {
-      StringRef input_value = m.Ref().AsString();
-      return Replace(
-          jsgraph()->Constant(input_value.ToNumber(js_heap_broker())));
+    if (m.HasValue() && m.Ref(js_heap_broker()).IsString()) {
+      StringRef input_value = m.Ref(js_heap_broker()).AsString();
+      return Replace(jsgraph()->Constant(input_value.ToNumber()));
     }
   }
   if (input_type.IsHeapConstant()) {
     ObjectRef input_value = input_type.AsHeapConstant()->Ref();
-    if (input_value.oddball_type(js_heap_broker()) != OddballType::kNone) {
-      return Replace(
-          jsgraph()->Constant(input_value.OddballToNumber(js_heap_broker())));
+    if (input_value.oddball_type() != OddballType::kNone) {
+      return Replace(jsgraph()->Constant(input_value.OddballToNumber()));
     }
   }
   if (input_type.Is(Type::Number())) {
@@ -1135,8 +1134,8 @@ Reduction JSTypedLowering::ReduceJSLoadNamed(Node* node) {
   DCHECK_EQ(IrOpcode::kJSLoadNamed, node->opcode());
   Node* receiver = NodeProperties::GetValueInput(node, 0);
   Type receiver_type = NodeProperties::GetType(receiver);
-  NameRef name(NamedAccessOf(node->op()).name());
-  NameRef length_str(factory()->length_string());
+  NameRef name(js_heap_broker(), NamedAccessOf(node->op()).name());
+  NameRef length_str(js_heap_broker(), factory()->length_string());
   // Optimize "length" property of strings.
   if (name.equals(length_str) && receiver_type.Is(Type::String())) {
     Node* value = graph()->NewNode(simplified()->StringLength(), receiver);
@@ -1371,9 +1370,8 @@ Node* JSTypedLowering::BuildGetModuleCell(Node* node) {
 
   if (module_type.IsHeapConstant()) {
     ModuleRef module_constant = module_type.AsHeapConstant()->Ref().AsModule();
-    CellRef cell_constant(
-        module_constant.GetCell(js_heap_broker(), cell_index));
-    return jsgraph()->Constant(js_heap_broker(), cell_constant);
+    CellRef cell_constant(module_constant.GetCell(cell_index));
+    return jsgraph()->Constant(cell_constant);
   }
 
   FieldAccess field_access;
@@ -1560,7 +1558,7 @@ Reduction JSTypedLowering::ReduceJSConstruct(Node* node) {
   if (target_type.IsHeapConstant() &&
       target_type.AsHeapConstant()->Ref().IsJSFunction()) {
     JSFunctionRef function = target_type.AsHeapConstant()->Ref().AsJSFunction();
-    SharedFunctionInfoRef shared = function.shared(js_heap_broker());
+    SharedFunctionInfoRef shared = function.shared();
 
     // Only optimize [[Construct]] here if {function} is a Constructor.
     if (!function.IsConstructor()) return NoChange();
@@ -1570,13 +1568,13 @@ Reduction JSTypedLowering::ReduceJSConstruct(Node* node) {
     // Patch {node} to an indirect call via the {function}s construct stub.
     bool use_builtin_construct_stub = shared.construct_as_builtin();
 
-    CodeRef code(use_builtin_construct_stub
+    CodeRef code(js_heap_broker(),
+                 use_builtin_construct_stub
                      ? BUILTIN_CODE(isolate(), JSBuiltinsConstructStub)
                      : BUILTIN_CODE(isolate(), JSConstructStubGeneric));
 
     node->RemoveInput(arity + 1);
-    node->InsertInput(graph()->zone(), 0,
-                      jsgraph()->Constant(js_heap_broker(), code));
+    node->InsertInput(graph()->zone(), 0, jsgraph()->Constant(code));
     node->InsertInput(graph()->zone(), 2, new_target);
     node->InsertInput(graph()->zone(), 3, jsgraph()->Constant(arity));
     node->InsertInput(graph()->zone(), 4, jsgraph()->UndefinedConstant());
@@ -1643,7 +1641,7 @@ Reduction JSTypedLowering::ReduceJSCall(Node* node) {
   if (target_type.IsHeapConstant() &&
       target_type.AsHeapConstant()->Ref().IsJSFunction()) {
     JSFunctionRef function = target_type.AsHeapConstant()->Ref().AsJSFunction();
-    SharedFunctionInfoRef shared = function.shared(js_heap_broker());
+    SharedFunctionInfoRef shared = function.shared();
 
     if (shared.HasBreakInfo()) {
       // Do not inline the call if we need to check whether to break at entry.
@@ -1663,8 +1661,7 @@ Reduction JSTypedLowering::ReduceJSCall(Node* node) {
     // Check if we need to convert the {receiver}.
     if (is_sloppy(shared.language_mode()) && !shared.native() &&
         !receiver_type.Is(Type::Receiver())) {
-      Node* global_proxy = jsgraph()->Constant(
-          js_heap_broker(), function.global_proxy(js_heap_broker()));
+      Node* global_proxy = jsgraph()->Constant(function.global_proxy());
       receiver = effect =
           graph()->NewNode(simplified()->ConvertReceiver(convert_mode),
                            receiver, global_proxy, effect, control);

src/compiler/node-matchers.h

@@ -18,6 +18,8 @@ namespace v8 {
 namespace internal {
 namespace compiler {
 
+class JSHeapBroker;
+
 // A pattern matcher for nodes.
 struct NodeMatcher {
   explicit NodeMatcher(Node* node) : node_(node) {}
@@ -193,7 +195,9 @@ struct HeapObjectMatcher final
     return this->HasValue() && this->Value().address() == value.address();
   }
 
-  ObjectRef Ref() const { return ObjectRef(this->Value()); }
+  ObjectRef Ref(const JSHeapBroker* broker) const {
+    return ObjectRef(broker, this->Value());
+  }
 };
 
 

src/compiler/simplified-operator-reducer.cc

@@ -62,8 +62,7 @@ Reduction SimplifiedOperatorReducer::Reduce(Node* node) {
     case IrOpcode::kChangeTaggedToBit: {
       HeapObjectMatcher m(node->InputAt(0));
       if (m.HasValue()) {
-        HeapObjectRef object(m.Value());
-        return ReplaceInt32(object.BooleanValue(js_heap_broker()));
+        return ReplaceInt32(m.Ref(js_heap_broker()).BooleanValue());
       }
       if (m.IsChangeBitToTagged()) return Replace(m.InputAt(0));
       break;

src/compiler/typed-optimization.cc

@@ -93,7 +93,7 @@ base::Optional<MapRef> GetStableMapFromObjectType(
     const JSHeapBroker* js_heap_broker, Type object_type) {
   if (object_type.IsHeapConstant()) {
     HeapObjectRef object = object_type.AsHeapConstant()->Ref();
-    MapRef object_map = object.map(js_heap_broker);
+    MapRef object_map = object.map();
     if (object_map.is_stable()) return object_map;
   }
   return {};
@@ -153,7 +153,7 @@ Reduction TypedOptimization::ReduceCheckMaps(Node* node) {
       if (map_type.IsHeapConstant() &&
           map_type.AsHeapConstant()->Ref().equals(*object_map)) {
         if (object_map->CanTransition()) {
-          object_map->DependOnStableMap(js_heap_broker(), dependencies());
+          object_map->DependOnStableMap(dependencies());
         }
         return Replace(effect);
       }
@@ -219,9 +219,9 @@ Reduction TypedOptimization::ReduceLoadField(Node* node) {
         GetStableMapFromObjectType(js_heap_broker(), object_type);
     if (object_map.has_value()) {
       if (object_map->CanTransition()) {
-        object_map->DependOnStableMap(js_heap_broker(), dependencies());
+        object_map->DependOnStableMap(dependencies());
       }
-      Node* const value = jsgraph()->Constant(js_heap_broker(), *object_map);
+      Node* const value = jsgraph()->Constant(*object_map);
       ReplaceWithValue(node, value);
       return Replace(value);
     }
@@ -558,32 +558,30 @@ Reduction TypedOptimization::ReduceTypeOf(Node* node) {
   Factory* const f = factory();
   if (type.Is(Type::Boolean())) {
     return Replace(
-        jsgraph()->Constant(js_heap_broker(), ObjectRef(f->boolean_string())));
+        jsgraph()->Constant(ObjectRef(js_heap_broker(), f->boolean_string())));
   } else if (type.Is(Type::Number())) {
     return Replace(
-        jsgraph()->Constant(js_heap_broker(), ObjectRef(f->number_string())));
+        jsgraph()->Constant(ObjectRef(js_heap_broker(), f->number_string())));
   } else if (type.Is(Type::String())) {
     return Replace(
-        jsgraph()->Constant(js_heap_broker(), ObjectRef(f->string_string())));
+        jsgraph()->Constant(ObjectRef(js_heap_broker(), f->string_string())));
   } else if (type.Is(Type::BigInt())) {
     return Replace(
-        jsgraph()->Constant(js_heap_broker(), ObjectRef(f->bigint_string())));
+        jsgraph()->Constant(ObjectRef(js_heap_broker(), f->bigint_string())));
   } else if (type.Is(Type::Symbol())) {
     return Replace(
-        jsgraph()->Constant(js_heap_broker(), ObjectRef(f->symbol_string())));
+        jsgraph()->Constant(ObjectRef(js_heap_broker(), f->symbol_string())));
   } else if (type.Is(Type::OtherUndetectableOrUndefined())) {
-    return Replace(jsgraph()->Constant(js_heap_broker(),
-                                       ObjectRef(f->undefined_string())));
+    return Replace(jsgraph()->Constant(
+        ObjectRef(js_heap_broker(), f->undefined_string())));
   } else if (type.Is(Type::NonCallableOrNull())) {
     return Replace(
-        jsgraph()->Constant(js_heap_broker(), ObjectRef(f->object_string())));
+        jsgraph()->Constant(ObjectRef(js_heap_broker(), f->object_string())));
   } else if (type.Is(Type::Function())) {
     return Replace(
-        jsgraph()->Constant(js_heap_broker(), ObjectRef(f->function_string())));
+        jsgraph()->Constant(ObjectRef(js_heap_broker(), f->function_string())));
   } else if (type.IsHeapConstant()) {
-    return Replace(jsgraph()->Constant(
-        js_heap_broker(),
-        type.AsHeapConstant()->Ref().TypeOf(js_heap_broker())));
+    return Replace(jsgraph()->Constant(type.AsHeapConstant()->Ref().TypeOf()));
   }
   return NoChange();
 }

src/compiler/types.cc

@@ -827,7 +827,7 @@ Type Type::NewConstant(const JSHeapBroker* js_heap_broker,
     return NewConstant(static_cast<double>(maybe_smi.value()), zone);
   }
 
-  HeapObjectRef heap_ref(value);
+  HeapObjectRef heap_ref(js_heap_broker, value);
   if (heap_ref.IsHeapNumber()) {
     return NewConstant(heap_ref.AsHeapNumber().value(), zone);
   }
@@ -1064,7 +1064,7 @@ Type Type::OtherNumberConstant(double value, Zone* zone) {
 Type Type::HeapConstant(const JSHeapBroker* js_heap_broker,
                         Handle<i::Object> value, Zone* zone) {
   return FromTypeBase(
-      HeapConstantType::New(js_heap_broker, HeapObjectRef(value), zone));
+      HeapConstantType::New(HeapObjectRef(js_heap_broker, value), zone));
 }
 
 // static

src/compiler/types.h

@@ -541,11 +541,10 @@ class V8_EXPORT_PRIVATE HeapConstantType : public NON_EXPORTED_BASE(TypeBase) {
   friend class Type;
   friend class BitsetType;
 
-  static HeapConstantType* New(const JSHeapBroker* broker,
-                               const HeapObjectRef& heap_ref, Zone* zone) {
+  static HeapConstantType* New(const HeapObjectRef& heap_ref, Zone* zone) {
     DCHECK(!heap_ref.IsHeapNumber());
     DCHECK_IMPLIES(heap_ref.IsString(), heap_ref.IsInternalizedString());
-    BitsetType::bitset bitset = BitsetType::Lub(heap_ref.type(broker));
+    BitsetType::bitset bitset = BitsetType::Lub(heap_ref.type());
     return new (zone->New(sizeof(HeapConstantType)))
         HeapConstantType(bitset, heap_ref);
   }