Skip to content

V
V8
Commit 56d21252 authored by Georg Neis's avatar Georg Neis Committed by Commit Bot
Browse files
Options

[turbofan] Make the JSHeapBroker a member of ObjectRef. 

This makes it more convenient to work with brokerized data.

Bug: v8:7790
Change-Id: I7ffb4054b809c10c67787b2fb89a05e8ce8f4575
Reviewed-on: https://chromium-review.googlesource.com/1138248
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: 's avatarJaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54480}
parent b95def34
Show whitespace changes
Inline Side-by-side
Showing with 404 additions and 442 deletions
src/compiler/allocation-builder.h
View file @ 56d21252
......@@ -18,10 +18,8 @@ namespace compiler {
// allocated object and also provides helpers for commonly allocated objects.
class AllocationBuilder final {
public:
AllocationBuilder(JSGraph* jsgraph, const JSHeapBroker* js_heap_broker,
Node* effect, Node* control)
AllocationBuilder(JSGraph* jsgraph, Node* effect, Node* control)
: jsgraph_(jsgraph),
js_heap_broker_(js_heap_broker),
allocation_(nullptr),
effect_(effect),
control_(control) {}
......@@ -79,7 +77,7 @@ class AllocationBuilder final {
}
// Compound store of a constant into a field.
void Store(const FieldAccess& access, const ObjectRef& value) {
Store(access, jsgraph()->Constant(js_heap_broker(), value));
Store(access, jsgraph()->Constant(value));
}
void FinishAndChange(Node* node) {
......@@ -96,7 +94,6 @@ class AllocationBuilder final {
protected:
JSGraph* jsgraph() { return jsgraph_; }
const JSHeapBroker* js_heap_broker() { return js_heap_broker_; }
Isolate* isolate() const { return jsgraph_->isolate(); }
Graph* graph() { return jsgraph_->graph(); }
CommonOperatorBuilder* common() { return jsgraph_->common(); }
......@@ -104,7 +101,6 @@ class AllocationBuilder final {
private:
JSGraph* const jsgraph_;
const JSHeapBroker* const js_heap_broker_;
Node* allocation_;
Node* effect_;
Node* control_;
......
src/compiler/common-operator-reducer.cc
View file @ 56d21252
......@@ -27,8 +27,8 @@ Decision DecideCondition(const JSHeapBroker* broker, Node* const cond) {
}
case IrOpcode::kHeapConstant: {
HeapObjectMatcher mcond(cond);
ObjectRef object(mcond.Value());
return object.BooleanValue(broker) ? Decision::kTrue : Decision::kFalse;
return mcond.Ref(broker).BooleanValue() ? Decision::kTrue
: Decision::kFalse;
}
default:
return Decision::kUnknown;
......
src/compiler/constant-folding-reducer.cc
View file @ 56d21252
......@@ -37,12 +37,11 @@ Reduction ConstantFoldingReducer::Reduce(Node* node) {
if (!upper.IsNone()) {
Node* replacement = nullptr;
if (upper.IsHeapConstant()) {
replacement = jsgraph()->Constant(js_heap_broker(),
upper.AsHeapConstant()->Ref());
replacement = jsgraph()->Constant(upper.AsHeapConstant()->Ref());
} else if (upper.Is(Type::MinusZero())) {
Factory* factory = jsgraph()->isolate()->factory();
ObjectRef minus_zero(factory->minus_zero_value());
replacement = jsgraph()->Constant(js_heap_broker(), minus_zero);
ObjectRef minus_zero(js_heap_broker(), factory->minus_zero_value());
replacement = jsgraph()->Constant(minus_zero);
} else if (upper.Is(Type::NaN())) {
replacement = jsgraph()->NaNConstant();
} else if (upper.Is(Type::Null())) {
......
src/compiler/js-call-reducer.cc
View file @ 56d21252
......@@ -1730,7 +1730,7 @@ Reduction JSCallReducer::ReduceArrayFilter(Node* node,
Node* a; // Construct the output array.
{
AllocationBuilder ab(jsgraph(), js_heap_broker(), effect, control);
AllocationBuilder ab(jsgraph(), effect, control);
ab.Allocate(initial_map->instance_size(), NOT_TENURED, Type::Array());
ab.Store(AccessBuilder::ForMap(), initial_map);
Node* empty_fixed_array = jsgraph()->EmptyFixedArrayConstant();
......@@ -1739,8 +1739,8 @@ Reduction JSCallReducer::ReduceArrayFilter(Node* node,
ab.Store(AccessBuilder::ForJSArrayLength(packed_kind),
jsgraph()->ZeroConstant());
for (int i = 0; i < initial_map->GetInObjectProperties(); ++i) {
ab.Store(
AccessBuilder::ForJSObjectInObjectProperty(MapRef(initial_map), i),
ab.Store(AccessBuilder::ForJSObjectInObjectProperty(
MapRef(js_heap_broker(), initial_map), i),
jsgraph()->UndefinedConstant());
}
a = effect = ab.Finish();
......
src/compiler/js-context-specialization.cc
View file @ 56d21252
......@@ -105,7 +105,7 @@ base::Optional<ContextRef> GetSpecializationContext(
Maybe<OuterContext> maybe_outer) {
switch (node->opcode()) {
case IrOpcode::kHeapConstant: {
HeapObjectRef object(HeapConstantOf(node->op()));
HeapObjectRef object(broker, HeapConstantOf(node->op()));
if (object.IsContext()) return object.AsContext();
break;
}
......@@ -114,7 +114,7 @@ base::Optional<ContextRef> GetSpecializationContext(
if (maybe_outer.To(&outer) && IsContextParameter(node) &&
*distance >= outer.distance) {
*distance -= outer.distance;
return ContextRef(outer.context);
return ContextRef(broker, outer.context);
}
break;
}
......@@ -146,28 +146,26 @@ Reduction JSContextSpecialization::ReduceJSLoadContext(Node* node) {
// Now walk up the concrete context chain for the remaining depth.
ContextRef concrete = maybe_concrete.value();
for (; depth > 0; --depth) {
concrete = concrete.previous(js_heap_broker()).value();
concrete = concrete.previous().value();
}
if (!access.immutable()) {
// We found the requested context object but since the context slot is
// mutable we can only partially reduce the load.
return SimplifyJSLoadContext(
node, jsgraph()->Constant(js_heap_broker(), concrete), depth);
return SimplifyJSLoadContext(node, jsgraph()->Constant(concrete), depth);
}
// This will hold the final value, if we can figure it out.
base::Optional<ObjectRef> maybe_value;
maybe_value =
concrete.get(js_heap_broker(), static_cast<int>(access.index()));
maybe_value = concrete.get(static_cast<int>(access.index()));
if (maybe_value.has_value() && !maybe_value->IsSmi()) {
// Even though the context slot is immutable, the context might have escaped
// before the function to which it belongs has initialized the slot.
// We must be conservative and check if the value in the slot is currently
// the hole or undefined. Only if it is neither of these, can we be sure
// that it won't change anymore.
OddballType oddball_type = maybe_value->oddball_type(js_heap_broker());
OddballType oddball_type = maybe_value->oddball_type();
if (oddball_type == OddballType::kUndefined ||
oddball_type == OddballType::kHole) {
maybe_value.reset();
......@@ -175,15 +173,14 @@ Reduction JSContextSpecialization::ReduceJSLoadContext(Node* node) {
}
if (!maybe_value.has_value()) {
return SimplifyJSLoadContext(
node, jsgraph()->Constant(js_heap_broker(), concrete), depth);
return SimplifyJSLoadContext(node, jsgraph()->Constant(concrete), depth);
}
// Success. The context load can be replaced with the constant.
// TODO(titzer): record the specialization for sharing code across
// multiple contexts that have the same value in the corresponding context
// slot.
Node* constant = jsgraph_->Constant(js_heap_broker(), *maybe_value);
Node* constant = jsgraph_->Constant(*maybe_value);
ReplaceWithValue(node, constant);
return Replace(constant);
}
......@@ -210,11 +207,10 @@ Reduction JSContextSpecialization::ReduceJSStoreContext(Node* node) {
// Now walk up the concrete context chain for the remaining depth.
ContextRef concrete = maybe_concrete.value();
for (; depth > 0; --depth) {
concrete = concrete.previous(js_heap_broker()).value();
concrete = concrete.previous().value();
}
return SimplifyJSStoreContext(
node, jsgraph()->Constant(js_heap_broker(), concrete), depth);
return SimplifyJSStoreContext(node, jsgraph()->Constant(concrete), depth);
}
......
src/compiler/js-create-lowering.cc
View file @ 56d21252
......@@ -42,13 +42,10 @@ Node* GetArgumentsFrameState(Node* frame_state) {
// Checks whether allocation using the given target and new.target can be
// inlined.
bool IsAllocationInlineable(const JSFunctionRef& target,
const JSFunctionRef& new_target,
const JSHeapBroker* broker) {
const JSFunctionRef& new_target) {
return new_target.has_initial_map() &&
!new_target.initial_map(broker).is_dictionary_map() &&
new_target.initial_map(broker)
.constructor_or_backpointer(broker)
.equals(target);
!new_target.initial_map().is_dictionary_map() &&
new_target.initial_map().constructor_or_backpointer().equals(target);
}
// When initializing arrays, we'll unfold the loop if the number of
......@@ -136,15 +133,13 @@ Reduction JSCreateLowering::ReduceJSCreate(Node* node) {
if (!original_constructor.IsConstructor()) return NoChange();
// Check if we can inline the allocation.
if (!IsAllocationInlineable(constructor, original_constructor,
js_heap_broker())) {
if (!IsAllocationInlineable(constructor, original_constructor)) {
return NoChange();
}
// Add a dependency on the {initial_map} to make sure that this code is
// deoptimized whenever the {initial_map} changes.
MapRef initial_map =
original_constructor.DependOnInitialMap(js_heap_broker(), dependencies());
MapRef initial_map = original_constructor.DependOnInitialMap(dependencies());
// Force completion of inobject slack tracking before
// generating code to finalize the instance size.
......@@ -153,7 +148,7 @@ Reduction JSCreateLowering::ReduceJSCreate(Node* node) {
// Emit code to allocate the JSObject instance for the
// {original_constructor}.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
AllocationBuilder a(jsgraph(), effect, control);
a.Allocate(slack_tracking_result.instance_size);
a.Store(AccessBuilder::ForMap(), initial_map);
a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(),
......@@ -178,7 +173,8 @@ Reduction JSCreateLowering::ReduceJSCreateArguments(Node* node) {
Node* const outer_state = frame_state->InputAt(kFrameStateOuterStateInput);
Node* const control = graph()->start();
FrameStateInfo state_info = FrameStateInfoOf(frame_state->op());
SharedFunctionInfoRef shared(state_info.shared_info().ToHandleChecked());
SharedFunctionInfoRef shared(js_heap_broker(),
state_info.shared_info().ToHandleChecked());
// Use the ArgumentsAccessStub for materializing both mapped and unmapped
// arguments object, but only for non-inlined (i.e. outermost) frames.
......@@ -203,13 +199,11 @@ Reduction JSCreateLowering::ReduceJSCreateArguments(Node* node) {
&has_aliased_arguments);
// Load the arguments object map.
Node* const arguments_map = jsgraph()->Constant(
js_heap_broker(),
has_aliased_arguments
? native_context_ref().fast_aliased_arguments_map(
js_heap_broker())
: native_context_ref().sloppy_arguments_map(js_heap_broker()));
? native_context_ref().fast_aliased_arguments_map()
: native_context_ref().sloppy_arguments_map());
// Actually allocate and initialize the arguments object.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
AllocationBuilder a(jsgraph(), effect, control);
Node* properties = jsgraph()->EmptyFixedArrayConstant();
STATIC_ASSERT(JSSloppyArgumentsObject::kSize == 5 * kPointerSize);
a.Allocate(JSSloppyArgumentsObject::kSize);
......@@ -235,11 +229,10 @@ Reduction JSCreateLowering::ReduceJSCreateArguments(Node* node) {
graph()->NewNode(simplified()->NewArgumentsElements(0),
arguments_frame, arguments_length, effect);
// Load the arguments object map.
Node* const arguments_map = jsgraph()->Constant(
js_heap_broker(),
native_context_ref().strict_arguments_map(js_heap_broker()));
Node* const arguments_map =
jsgraph()->Constant(native_context_ref().strict_arguments_map());
// Actually allocate and initialize the arguments object.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
AllocationBuilder a(jsgraph(), effect, control);
Node* properties = jsgraph()->EmptyFixedArrayConstant();
STATIC_ASSERT(JSStrictArgumentsObject::kSize == 4 * kPointerSize);
a.Allocate(JSStrictArgumentsObject::kSize);
......@@ -267,11 +260,9 @@ Reduction JSCreateLowering::ReduceJSCreateArguments(Node* node) {
arguments_frame, rest_length, effect);
// Load the JSArray object map.
Node* const jsarray_map = jsgraph()->Constant(
js_heap_broker(),
native_context_ref().js_array_fast_elements_map_index(
js_heap_broker()));
native_context_ref().js_array_fast_elements_map_index());
// Actually allocate and initialize the jsarray.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
AllocationBuilder a(jsgraph(), effect, control);
Node* properties = jsgraph()->EmptyFixedArrayConstant();
STATIC_ASSERT(JSArray::kSize == 4 * kPointerSize);
a.Allocate(JSArray::kSize);
......@@ -313,13 +304,11 @@ Reduction JSCreateLowering::ReduceJSCreateArguments(Node* node) {
effect = elements->op()->EffectOutputCount() > 0 ? elements : effect;
// Load the arguments object map.
Node* const arguments_map = jsgraph()->Constant(
js_heap_broker(),
has_aliased_arguments
? native_context_ref().fast_aliased_arguments_map(
js_heap_broker())
: native_context_ref().sloppy_arguments_map(js_heap_broker()));
? native_context_ref().fast_aliased_arguments_map()
: native_context_ref().sloppy_arguments_map());
// Actually allocate and initialize the arguments object.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
AllocationBuilder a(jsgraph(), effect, control);
Node* properties = jsgraph()->EmptyFixedArrayConstant();
int length = args_state_info.parameter_count() - 1; // Minus receiver.
STATIC_ASSERT(JSSloppyArgumentsObject::kSize == 5 * kPointerSize);
......@@ -352,11 +341,10 @@ Reduction JSCreateLowering::ReduceJSCreateArguments(Node* node) {
Node* const elements = AllocateArguments(effect, control, args_state);
effect = elements->op()->EffectOutputCount() > 0 ? elements : effect;
// Load the arguments object map.
Node* const arguments_map = jsgraph()->Constant(
js_heap_broker(),
native_context_ref().strict_arguments_map(js_heap_broker()));
Node* const arguments_map =
jsgraph()->Constant(native_context_ref().strict_arguments_map());
// Actually allocate and initialize the arguments object.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
AllocationBuilder a(jsgraph(), effect, control);
Node* properties = jsgraph()->EmptyFixedArrayConstant();
int length = args_state_info.parameter_count() - 1; // Minus receiver.
STATIC_ASSERT(JSStrictArgumentsObject::kSize == 4 * kPointerSize);
......@@ -391,11 +379,9 @@ Reduction JSCreateLowering::ReduceJSCreateArguments(Node* node) {
effect = elements->op()->EffectOutputCount() > 0 ? elements : effect;
// Load the JSArray object map.
Node* const jsarray_map = jsgraph()->Constant(
js_heap_broker(),
native_context_ref().js_array_fast_elements_map_index(
js_heap_broker()));
native_context_ref().js_array_fast_elements_map_index());
// Actually allocate and initialize the jsarray.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
AllocationBuilder a(jsgraph(), effect, control);
Node* properties = jsgraph()->EmptyFixedArrayConstant();
// -1 to minus receiver
......@@ -439,18 +425,17 @@ Reduction JSCreateLowering::ReduceJSCreateGeneratorObject(Node* node) {
// Add a dependency on the {initial_map} to make sure that this code is
// deoptimized whenever the {initial_map} changes.
MapRef initial_map(
js_function.DependOnInitialMap(js_heap_broker(), dependencies()));
MapRef initial_map = js_function.DependOnInitialMap(dependencies());
DCHECK(initial_map.instance_type() == JS_GENERATOR_OBJECT_TYPE ||
initial_map.instance_type() == JS_ASYNC_GENERATOR_OBJECT_TYPE);
// Allocate a register file.
SharedFunctionInfoRef shared(js_function.shared(js_heap_broker()));
SharedFunctionInfoRef shared = js_function.shared();
DCHECK(shared.HasBytecodeArray());
int parameter_count_no_receiver = shared.internal_formal_parameter_count();
int size =
parameter_count_no_receiver + shared.GetBytecodeArrayRegisterCount();
AllocationBuilder ab(jsgraph(), js_heap_broker(), effect, control);
AllocationBuilder ab(jsgraph(), effect, control);
ab.AllocateArray(size, factory()->fixed_array_map());
for (int i = 0; i < size; ++i) {
ab.Store(AccessBuilder::ForFixedArraySlot(i),
......@@ -459,7 +444,7 @@ Reduction JSCreateLowering::ReduceJSCreateGeneratorObject(Node* node) {
Node* parameters_and_registers = effect = ab.Finish();
// Emit code to allocate the JS[Async]GeneratorObject instance.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
AllocationBuilder a(jsgraph(), effect, control);
a.Allocate(slack_tracking_result.instance_size);
Node* empty_fixed_array = jsgraph()->EmptyFixedArrayConstant();
Node* undefined = jsgraph()->UndefinedConstant();
......@@ -528,7 +513,7 @@ Reduction JSCreateLowering::ReduceNewArray(Node* node, Node* length,
Node* properties = jsgraph()->EmptyFixedArrayConstant();
// Perform the allocation of the actual JSArray object.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
AllocationBuilder a(jsgraph(), effect, control);
a.Allocate(initial_map->instance_size(), pretenure);
a.Store(AccessBuilder::ForMap(), initial_map);
a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(), properties);
......@@ -536,7 +521,8 @@ Reduction JSCreateLowering::ReduceNewArray(Node* node, Node* length,
a.Store(AccessBuilder::ForJSArrayLength(initial_map->elements_kind()),
length);
for (int i = 0; i < initial_map->GetInObjectProperties(); ++i) {
a.Store(AccessBuilder::ForJSObjectInObjectProperty(MapRef(initial_map), i),
a.Store(AccessBuilder::ForJSObjectInObjectProperty(
MapRef(js_heap_broker(), initial_map), i),
jsgraph()->UndefinedConstant());
}
RelaxControls(node);
......@@ -574,14 +560,15 @@ Reduction JSCreateLowering::ReduceNewArray(Node* node, Node* length,
Node* properties = jsgraph()->EmptyFixedArrayConstant();
// Perform the allocation of the actual JSArray object.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
AllocationBuilder a(jsgraph(), effect, control);
a.Allocate(initial_map->instance_size(), pretenure);
a.Store(AccessBuilder::ForMap(), initial_map);
a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(), properties);
a.Store(AccessBuilder::ForJSObjectElements(), elements);
a.Store(AccessBuilder::ForJSArrayLength(elements_kind), length);
for (int i = 0; i < initial_map->GetInObjectProperties(); ++i) {
a.Store(AccessBuilder::ForJSObjectInObjectProperty(MapRef(initial_map), i),
a.Store(AccessBuilder::ForJSObjectInObjectProperty(
MapRef(js_heap_broker(), initial_map), i),
jsgraph()->UndefinedConstant());
}
RelaxControls(node);
......@@ -630,14 +617,15 @@ Reduction JSCreateLowering::ReduceNewArray(Node* node,
Node* length = jsgraph()->Constant(static_cast<int>(values.size()));
// Perform the allocation of the actual JSArray object.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
AllocationBuilder a(jsgraph(), effect, control);
a.Allocate(initial_map->instance_size(), pretenure);
a.Store(AccessBuilder::ForMap(), initial_map);
a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(), properties);
a.Store(AccessBuilder::ForJSObjectElements(), elements);
a.Store(AccessBuilder::ForJSArrayLength(elements_kind), length);
for (int i = 0; i < initial_map->GetInObjectProperties(); ++i) {
a.Store(AccessBuilder::ForJSObjectInObjectProperty(MapRef(initial_map), i),
a.Store(AccessBuilder::ForJSObjectInObjectProperty(
MapRef(js_heap_broker(), initial_map), i),
jsgraph()->UndefinedConstant());
}
RelaxControls(node);
......@@ -730,9 +718,9 @@ Reduction JSCreateLowering::ReduceJSCreateArray(Node* node) {
DCHECK(original_constructor->IsConstructor());
// Check if we can inline the allocation.
if (IsAllocationInlineable(JSFunctionRef(constructor),
JSFunctionRef(original_constructor),
js_heap_broker())) {
if (IsAllocationInlineable(
JSFunctionRef(js_heap_broker(), constructor),
JSFunctionRef(js_heap_broker(), original_constructor))) {
// Force completion of inobject slack tracking before
// generating code to finalize the instance size.
original_constructor->CompleteInobjectSlackTrackingIfActive();
......@@ -856,10 +844,10 @@ Reduction JSCreateLowering::ReduceJSCreateArrayIterator(Node* node) {
Node* control = NodeProperties::GetControlInput(node);
// Create the JSArrayIterator result.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
AllocationBuilder a(jsgraph(), effect, control);
a.Allocate(JSArrayIterator::kSize, NOT_TENURED, Type::OtherObject());
a.Store(AccessBuilder::ForMap(),
native_context_ref().initial_array_iterator_map(js_heap_broker()));
native_context_ref().initial_array_iterator_map());
a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(),
jsgraph()->EmptyFixedArrayConstant());
a.Store(AccessBuilder::ForJSObjectElements(),
......@@ -877,7 +865,6 @@ Reduction JSCreateLowering::ReduceJSCreateArrayIterator(Node* node) {
namespace {
MapRef MapForCollectionIterationKind(const NativeContextRef& native_context,
const JSHeapBroker* broker,
CollectionKind collection_kind,
IterationKind iteration_kind) {
switch (collection_kind) {
......@@ -886,19 +873,19 @@ MapRef MapForCollectionIterationKind(const NativeContextRef& native_context,
case IterationKind::kKeys:
UNREACHABLE();
case IterationKind::kValues:
return native_context.set_value_iterator_map(broker);
return native_context.set_value_iterator_map();
case IterationKind::kEntries:
return native_context.set_key_value_iterator_map(broker);
return native_context.set_key_value_iterator_map();
}
break;
case CollectionKind::kMap:
switch (iteration_kind) {
case IterationKind::kKeys:
return native_context.map_key_iterator_map(broker);
return native_context.map_key_iterator_map();
case IterationKind::kValues:
return native_context.map_value_iterator_map(broker);
return native_context.map_value_iterator_map();
case IterationKind::kEntries:
return native_context.map_key_value_iterator_map(broker);
return native_context.map_key_value_iterator_map();
}
break;
}
......@@ -922,12 +909,11 @@ Reduction JSCreateLowering::ReduceJSCreateCollectionIterator(Node* node) {
iterated_object, effect, control);
// Create the JSArrayIterator result.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
AllocationBuilder a(jsgraph(), effect, control);
a.Allocate(JSCollectionIterator::kSize, NOT_TENURED, Type::OtherObject());
a.Store(
AccessBuilder::ForMap(),
MapForCollectionIterationKind(native_context_ref(), js_heap_broker(),
p.collection_kind(), p.iteration_kind()));
a.Store(AccessBuilder::ForMap(),
MapForCollectionIterationKind(
native_context_ref(), p.collection_kind(), p.iteration_kind()));
a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(),
jsgraph()->EmptyFixedArrayConstant());
a.Store(AccessBuilder::ForJSObjectElements(),
......@@ -946,7 +932,7 @@ Reduction JSCreateLowering::ReduceJSCreateBoundFunction(Node* node) {
CreateBoundFunctionParameters const& p =
CreateBoundFunctionParametersOf(node->op());
int const arity = static_cast<int>(p.arity());
MapRef const map(p.map());
MapRef const map(js_heap_broker(), p.map());
Node* bound_target_function = NodeProperties::GetValueInput(node, 0);
Node* bound_this = NodeProperties::GetValueInput(node, 1);
Node* effect = NodeProperties::GetEffectInput(node);
......@@ -955,7 +941,7 @@ Reduction JSCreateLowering::ReduceJSCreateBoundFunction(Node* node) {
// Create the [[BoundArguments]] for the result.
Node* bound_arguments = jsgraph()->EmptyFixedArrayConstant();
if (arity > 0) {
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
AllocationBuilder a(jsgraph(), effect, control);
a.AllocateArray(arity, factory()->fixed_array_map());
for (int i = 0; i < arity; ++i) {
a.Store(AccessBuilder::ForFixedArraySlot(i),
......@@ -965,7 +951,7 @@ Reduction JSCreateLowering::ReduceJSCreateBoundFunction(Node* node) {
}
// Create the JSBoundFunction result.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
AllocationBuilder a(jsgraph(), effect, control);
a.Allocate(JSBoundFunction::kSize, NOT_TENURED, Type::BoundFunction());
a.Store(AccessBuilder::ForMap(), map);
a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(),
......@@ -985,9 +971,9 @@ Reduction JSCreateLowering::ReduceJSCreateClosure(Node* node) {
DisallowHeapAccess no_heap_access;
DCHECK_EQ(IrOpcode::kJSCreateClosure, node->opcode());
CreateClosureParameters const& p = CreateClosureParametersOf(node->op());
SharedFunctionInfoRef shared(p.shared_info());
HeapObjectRef feedback_cell(p.feedback_cell());
HeapObjectRef code(p.code());
SharedFunctionInfoRef shared(js_heap_broker(), p.shared_info());
HeapObjectRef feedback_cell(js_heap_broker(), p.feedback_cell());
HeapObjectRef code(js_heap_broker(), p.code());
Node* effect = NodeProperties::GetEffectInput(node);
Node* control = NodeProperties::GetControlInput(node);
Node* context = NodeProperties::GetContextInput(node);
......@@ -995,13 +981,13 @@ Reduction JSCreateLowering::ReduceJSCreateClosure(Node* node) {
// Use inline allocation of closures only for instantiation sites that have
// seen more than one instantiation, this simplifies the generated code and
// also serves as a heuristic of which allocation sites benefit from it.
if (!feedback_cell.map(js_heap_broker())
.equals(MapRef(factory()->many_closures_cell_map()))) {
if (!feedback_cell.map().equals(
MapRef(js_heap_broker(), factory()->many_closures_cell_map()))) {
return NoChange();
}
MapRef function_map = native_context_ref().GetFunctionMapFromIndex(
js_heap_broker(), shared.function_map_index());
MapRef function_map =
native_context_ref().GetFunctionMapFromIndex(shared.function_map_index());
DCHECK(!function_map.IsInobjectSlackTrackingInProgress());
DCHECK(!function_map.is_dictionary_map());
......@@ -1018,7 +1004,7 @@ Reduction JSCreateLowering::ReduceJSCreateClosure(Node* node) {
// Emit code to allocate the JSFunction instance.
STATIC_ASSERT(JSFunction::kSizeWithoutPrototype == 7 * kPointerSize);
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
AllocationBuilder a(jsgraph(), effect, control);
a.Allocate(function_map.instance_size(), pretenure, Type::Function());
a.Store(AccessBuilder::ForMap(), function_map);
a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(),
......@@ -1054,7 +1040,7 @@ Reduction JSCreateLowering::ReduceJSCreateIterResultObject(Node* node) {
handle(native_context()->iterator_result_map(), isolate()));
// Emit code to allocate the JSIteratorResult instance.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, graph()->start());
AllocationBuilder a(jsgraph(), effect, graph()->start());
a.Allocate(JSIteratorResult::kSize);
a.Store(AccessBuilder::ForMap(), iterator_result_map);
a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(),
......@@ -1076,7 +1062,7 @@ Reduction JSCreateLowering::ReduceJSCreateStringIterator(Node* node) {
Node* map = jsgraph()->HeapConstant(
handle(native_context()->string_iterator_map(), isolate()));
// Allocate new iterator and attach the iterator to this string.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, graph()->start());
AllocationBuilder a(jsgraph(), effect, graph()->start());
a.Allocate(JSStringIterator::kSize, NOT_TENURED, Type::OtherObject());
a.Store(AccessBuilder::ForMap(), map);
a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(),
......@@ -1101,7 +1087,7 @@ Reduction JSCreateLowering::ReduceJSCreateKeyValueArray(Node* node) {
Node* properties = jsgraph()->EmptyFixedArrayConstant();
Node* length = jsgraph()->Constant(2);
AllocationBuilder aa(jsgraph(), js_heap_broker(), effect, graph()->start());
AllocationBuilder aa(jsgraph(), effect, graph()->start());
aa.AllocateArray(2, factory()->fixed_array_map());
aa.Store(AccessBuilder::ForFixedArrayElement(PACKED_ELEMENTS),
jsgraph()->ZeroConstant(), key);
......@@ -1109,7 +1095,7 @@ Reduction JSCreateLowering::ReduceJSCreateKeyValueArray(Node* node) {
jsgraph()->OneConstant(), value);
Node* elements = aa.Finish();
AllocationBuilder a(jsgraph(), js_heap_broker(), elements, graph()->start());
AllocationBuilder a(jsgraph(), elements, graph()->start());
a.Allocate(JSArray::kSize);
a.Store(AccessBuilder::ForMap(), array_map);
a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(), properties);
......@@ -1127,7 +1113,7 @@ Reduction JSCreateLowering::ReduceJSCreatePromise(Node* node) {
Handle<Map> promise_map(native_context()->promise_function()->initial_map(),
isolate());
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, graph()->start());
AllocationBuilder a(jsgraph(), effect, graph()->start());
a.Allocate(promise_map->instance_size());
a.Store(AccessBuilder::ForMap(), promise_map);
a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(),
......@@ -1156,19 +1142,18 @@ Reduction JSCreateLowering::ReduceJSCreateLiteralArrayOrObject(Node* node) {
Node* effect = NodeProperties::GetEffectInput(node);
Node* control = NodeProperties::GetControlInput(node);
FeedbackVectorRef feedback_vector(p.feedback().vector());
ObjectRef feedback =
feedback_vector.get(js_heap_broker(), p.feedback().slot());
FeedbackVectorRef feedback_vector(js_heap_broker(), p.feedback().vector());
ObjectRef feedback = feedback_vector.get(p.feedback().slot());
if (feedback.IsAllocationSite()) {
AllocationSiteRef site = feedback.AsAllocationSite();
if (site.IsFastLiteral(js_heap_broker())) {
if (site.IsFastLiteral()) {
PretenureFlag pretenure = NOT_TENURED;
if (FLAG_allocation_site_pretenuring) {
pretenure = dependencies()->DependOnPretenureMode(
site.object<AllocationSite>());
}
dependencies()->DependOnElementsKinds(site.object<AllocationSite>());
JSObjectRef boilerplate = site.boilerplate(js_heap_broker());
JSObjectRef boilerplate = site.boilerplate();
Node* value = effect =
AllocateFastLiteral(effect, control, boilerplate, pretenure);
ReplaceWithValue(node, value, effect, control);
......@@ -1213,13 +1198,14 @@ Reduction JSCreateLowering::ReduceJSCreateEmptyLiteralObject(Node* node) {
Node* properties = jsgraph()->EmptyFixedArrayConstant();
// Perform the allocation of the actual JSArray object.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
AllocationBuilder a(jsgraph(), effect, control);
a.Allocate(map->instance_size());
a.Store(AccessBuilder::ForMap(), js_object_map);
a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(), properties);
a.Store(AccessBuilder::ForJSObjectElements(), elements);
for (int i = 0; i < map->GetInObjectProperties(); i++) {
a.Store(AccessBuilder::ForJSObjectInObjectProperty(MapRef(map), i),
a.Store(AccessBuilder::ForJSObjectInObjectProperty(
MapRef(js_heap_broker(), map), i),
jsgraph()->UndefinedConstant());
}
......@@ -1235,9 +1221,8 @@ Reduction JSCreateLowering::ReduceJSCreateLiteralRegExp(Node* node) {
Node* effect = NodeProperties::GetEffectInput(node);
Node* control = NodeProperties::GetControlInput(node);
FeedbackVectorRef feedback_vector(p.feedback().vector());
ObjectRef feedback =
feedback_vector.get(js_heap_broker(), p.feedback().slot());
FeedbackVectorRef feedback_vector(js_heap_broker(), p.feedback().vector());
ObjectRef feedback = feedback_vector.get(p.feedback().slot());
if (feedback.IsJSRegExp()) {
JSRegExpRef boilerplate = feedback.AsJSRegExp();
Node* value = effect = AllocateLiteralRegExp(effect, control, boilerplate);
......@@ -1252,7 +1237,7 @@ Reduction JSCreateLowering::ReduceJSCreateFunctionContext(Node* node) {
DCHECK_EQ(IrOpcode::kJSCreateFunctionContext, node->opcode());
const CreateFunctionContextParameters& parameters =
CreateFunctionContextParametersOf(node->op());
ScopeInfoRef scope_info(parameters.scope_info());
ScopeInfoRef scope_info(js_heap_broker(), parameters.scope_info());
int slot_count = parameters.slot_count();
ScopeType scope_type = parameters.scope_type();
......@@ -1263,7 +1248,7 @@ Reduction JSCreateLowering::ReduceJSCreateFunctionContext(Node* node) {
Node* control = NodeProperties::GetControlInput(node);
Node* context = NodeProperties::GetContextInput(node);
Node* extension = jsgraph()->TheHoleConstant();
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
AllocationBuilder a(jsgraph(), effect, control);
STATIC_ASSERT(Context::MIN_CONTEXT_SLOTS == 4); // Ensure fully covered.
int context_length = slot_count + Context::MIN_CONTEXT_SLOTS;
Handle<Map> map;
......@@ -1298,13 +1283,13 @@ Reduction JSCreateLowering::ReduceJSCreateFunctionContext(Node* node) {
Reduction JSCreateLowering::ReduceJSCreateWithContext(Node* node) {
DisallowHeapAccess no_heap_access;
DCHECK_EQ(IrOpcode::kJSCreateWithContext, node->opcode());
ScopeInfoRef scope_info(ScopeInfoOf(node->op()));
ScopeInfoRef scope_info(js_heap_broker(), ScopeInfoOf(node->op()));
Node* extension = NodeProperties::GetValueInput(node, 0);
Node* effect = NodeProperties::GetEffectInput(node);
Node* control = NodeProperties::GetControlInput(node);
Node* context = NodeProperties::GetContextInput(node);
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
AllocationBuilder a(jsgraph(), effect, control);
STATIC_ASSERT(Context::MIN_CONTEXT_SLOTS == 4); // Ensure fully covered.
a.AllocateContext(Context::MIN_CONTEXT_SLOTS, factory()->with_context_map());
a.Store(AccessBuilder::ForContextSlot(Context::SCOPE_INFO_INDEX), scope_info);
......@@ -1320,14 +1305,14 @@ Reduction JSCreateLowering::ReduceJSCreateWithContext(Node* node) {
Reduction JSCreateLowering::ReduceJSCreateCatchContext(Node* node) {
DisallowHeapAccess no_heap_access;
DCHECK_EQ(IrOpcode::kJSCreateCatchContext, node->opcode());
ScopeInfoRef scope_info(ScopeInfoOf(node->op()));
ScopeInfoRef scope_info(js_heap_broker(), ScopeInfoOf(node->op()));
Node* exception = NodeProperties::GetValueInput(node, 0);
Node* effect = NodeProperties::GetEffectInput(node);
Node* control = NodeProperties::GetControlInput(node);
Node* context = NodeProperties::GetContextInput(node);
Node* extension = jsgraph()->TheHoleConstant();
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
AllocationBuilder a(jsgraph(), effect, control);
STATIC_ASSERT(Context::MIN_CONTEXT_SLOTS == 4); // Ensure fully covered.
a.AllocateContext(Context::MIN_CONTEXT_SLOTS + 1,
factory()->catch_context_map());
......@@ -1346,7 +1331,7 @@ Reduction JSCreateLowering::ReduceJSCreateCatchContext(Node* node) {
Reduction JSCreateLowering::ReduceJSCreateBlockContext(Node* node) {
DisallowHeapAccess no_heap_access;
DCHECK_EQ(IrOpcode::kJSCreateBlockContext, node->opcode());
ScopeInfoRef scope_info(ScopeInfoOf(node->op()));
ScopeInfoRef scope_info(js_heap_broker(), ScopeInfoOf(node->op()));
int const context_length = scope_info.ContextLength();
// Use inline allocation for block contexts up to a size limit.
......@@ -1357,7 +1342,7 @@ Reduction JSCreateLowering::ReduceJSCreateBlockContext(Node* node) {
Node* context = NodeProperties::GetContextInput(node);
Node* extension = jsgraph()->TheHoleConstant();
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
AllocationBuilder a(jsgraph(), effect, control);
STATIC_ASSERT(Context::MIN_CONTEXT_SLOTS == 4); // Ensure fully covered.
a.AllocateContext(context_length, factory()->block_context_map());
a.Store(AccessBuilder::ForContextSlot(Context::SCOPE_INFO_INDEX),
......@@ -1387,15 +1372,13 @@ Reduction JSCreateLowering::ReduceJSCreateObject(Node* node) {
if (!prototype_type.IsHeapConstant()) return NoChange();
HeapObjectRef prototype_const = prototype_type.AsHeapConstant()->Ref();
auto maybe_instance_map =
prototype_const.TryGetObjectCreateMap(js_heap_broker());
auto maybe_instance_map = prototype_const.TryGetObjectCreateMap();
if (!maybe_instance_map) return NoChange();
MapRef instance_map = maybe_instance_map.value();
Node* properties = jsgraph()->EmptyFixedArrayConstant();
if (instance_map.is_dictionary_map()) {
DCHECK_EQ(prototype_const.type(js_heap_broker()).oddball_type(),
OddballType::kNull);
DCHECK_EQ(prototype_const.type().oddball_type(), OddballType::kNull);
// Allocate an empty NameDictionary as backing store for the properties.
Handle<Map> map = isolate()->factory()->name_dictionary_map();
int capacity =
......@@ -1404,7 +1387,7 @@ Reduction JSCreateLowering::ReduceJSCreateObject(Node* node) {
int length = NameDictionary::EntryToIndex(capacity);
int size = NameDictionary::SizeFor(length);
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
AllocationBuilder a(jsgraph(), effect, control);
a.Allocate(size, NOT_TENURED, Type::Any());
a.Store(AccessBuilder::ForMap(), map);
// Initialize FixedArray fields.
......@@ -1440,7 +1423,7 @@ Reduction JSCreateLowering::ReduceJSCreateObject(Node* node) {
// Emit code to allocate the JSObject instance for the given
// {instance_map}.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
AllocationBuilder a(jsgraph(), effect, control);
a.Allocate(instance_size, NOT_TENURED, Type::Any());
a.Store(AccessBuilder::ForMap(), instance_map);
a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(), properties);
......@@ -1473,7 +1456,7 @@ Node* JSCreateLowering::AllocateArguments(Node* effect, Node* control,
auto parameters_it = ++parameters_access.begin();
// Actually allocate the backing store.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
AllocationBuilder a(jsgraph(), effect, control);
a.AllocateArray(argument_count, factory()->fixed_array_map());
for (int i = 0; i < argument_count; ++i, ++parameters_it) {
DCHECK_NOT_NULL((*parameters_it).node);
......@@ -1503,7 +1486,7 @@ Node* JSCreateLowering::AllocateRestArguments(Node* effect, Node* control,
}
// Actually allocate the backing store.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
AllocationBuilder a(jsgraph(), effect, control);
a.AllocateArray(num_elements, factory()->fixed_array_map());
for (int i = 0; i < num_elements; ++i, ++parameters_it) {
DCHECK_NOT_NULL((*parameters_it).node);
......@@ -1541,7 +1524,7 @@ Node* JSCreateLowering::AllocateAliasedArguments(
// The unmapped argument values recorded in the frame state are stored yet
// another indirection away and then linked into the parameter map below,
// whereas mapped argument values are replaced with a hole instead.
AllocationBuilder aa(jsgraph(), js_heap_broker(), effect, control);
AllocationBuilder aa(jsgraph(), effect, control);
aa.AllocateArray(argument_count, factory()->fixed_array_map());
for (int i = 0; i < mapped_count; ++i, ++parameters_it) {
aa.Store(AccessBuilder::ForFixedArraySlot(i), jsgraph()->TheHoleConstant());
......@@ -1553,7 +1536,7 @@ Node* JSCreateLowering::AllocateAliasedArguments(
Node* arguments = aa.Finish();
// Actually allocate the backing store.
AllocationBuilder a(jsgraph(), js_heap_broker(), arguments, control);
AllocationBuilder a(jsgraph(), arguments, control);
a.AllocateArray(mapped_count + 2, factory()->sloppy_arguments_elements_map());
a.Store(AccessBuilder::ForFixedArraySlot(0), context);
a.Store(AccessBuilder::ForFixedArraySlot(1), arguments);
......@@ -1595,7 +1578,7 @@ Node* JSCreateLowering::AllocateAliasedArguments(
arguments_frame, arguments_length, effect);
// Actually allocate the backing store.
AllocationBuilder a(jsgraph(), js_heap_broker(), arguments, control);
AllocationBuilder a(jsgraph(), arguments, control);
a.AllocateArray(mapped_count + 2, factory()->sloppy_arguments_elements_map());
a.Store(AccessBuilder::ForFixedArraySlot(0), context);
a.Store(AccessBuilder::ForFixedArraySlot(1), arguments);
......@@ -1627,7 +1610,7 @@ Node* JSCreateLowering::AllocateElements(Node* effect, Node* control,
Node* value = jsgraph()->TheHoleConstant();
// Actually allocate the backing store.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
AllocationBuilder a(jsgraph(), effect, control);
a.AllocateArray(capacity, elements_map, pretenure);
for (int i = 0; i < capacity; ++i) {
Node* index = jsgraph()->Constant(i);
......@@ -1652,7 +1635,7 @@ Node* JSCreateLowering::AllocateElements(Node* effect, Node* control,
: AccessBuilder::ForFixedArrayElement();
// Actually allocate the backing store.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
AllocationBuilder a(jsgraph(), effect, control);
a.AllocateArray(capacity, elements_map, pretenure);
for (int i = 0; i < capacity; ++i) {
Node* index = jsgraph()->Constant(i);
......@@ -1668,7 +1651,7 @@ Node* JSCreateLowering::AllocateFastLiteral(Node* effect, Node* control,
Node* properties = jsgraph()->EmptyFixedArrayConstant();
// Compute the in-object properties to store first (might have effects).
MapRef boilerplate_map = boilerplate.map(js_heap_broker());
MapRef boilerplate_map = boilerplate.map();
ZoneVector<std::pair<FieldAccess, Node*>> inobject_fields(zone());
inobject_fields.reserve(boilerplate_map.GetInObjectProperties());
int const boilerplate_nof = boilerplate_map.NumberOfOwnDescriptors();
......@@ -1677,7 +1660,7 @@ Node* JSCreateLowering::AllocateFastLiteral(Node* effect, Node* control,
boilerplate_map.GetPropertyDetails(i);
if (property_details.location() != kField) continue;
DCHECK_EQ(kData, property_details.kind());
NameRef property_name = boilerplate_map.GetPropertyKey(js_heap_broker(), i);
NameRef property_name = boilerplate_map.GetPropertyKey(i);
FieldIndex index = boilerplate_map.GetFieldIndexFor(i);
FieldAccess access = {
kTaggedBase, index.offset(), property_name.object<Name>(),
......@@ -1689,8 +1672,7 @@ Node* JSCreateLowering::AllocateFastLiteral(Node* effect, Node* control,
access.type = Type::Number();
value = jsgraph()->Constant(boilerplate.RawFastDoublePropertyAt(index));
} else {
ObjectRef boilerplate_value =
boilerplate.RawFastPropertyAt(js_heap_broker(), index);
ObjectRef boilerplate_value = boilerplate.RawFastPropertyAt(index);
if (boilerplate_value.IsJSObject()) {
JSObjectRef boilerplate_object = boilerplate_value.AsJSObject();
value = effect =
......@@ -1698,7 +1680,7 @@ Node* JSCreateLowering::AllocateFastLiteral(Node* effect, Node* control,
} else if (property_details.representation().IsDouble()) {
double number = boilerplate_value.AsMutableHeapNumber().value();
// Allocate a mutable HeapNumber box and store the value into it.
AllocationBuilder builder(jsgraph(), js_heap_broker(), effect, control);
AllocationBuilder builder(jsgraph(), effect, control);
builder.Allocate(HeapNumber::kSize, pretenure);
builder.Store(AccessBuilder::ForMap(),
factory()->mutable_heap_number_map());
......@@ -1707,12 +1689,11 @@ Node* JSCreateLowering::AllocateFastLiteral(Node* effect, Node* control,
value = effect = builder.Finish();
} else if (property_details.representation().IsSmi()) {
// Ensure that value is stored as smi.
value = boilerplate_value.oddball_type(js_heap_broker()) ==
OddballType::kUninitialized
value = boilerplate_value.oddball_type() == OddballType::kUninitialized
? jsgraph()->ZeroConstant()
: jsgraph()->Constant(boilerplate_value.AsSmi());
} else {
value = jsgraph()->Constant(js_heap_broker(), boilerplate_value);
value = jsgraph()->Constant(boilerplate_value);
}
}
inobject_fields.push_back(std::make_pair(access, value));
......@@ -1734,7 +1715,7 @@ Node* JSCreateLowering::AllocateFastLiteral(Node* effect, Node* control,
if (elements->op()->EffectOutputCount() > 0) effect = elements;
// Actually allocate and initialize the object.
AllocationBuilder builder(jsgraph(), js_heap_broker(), effect, control);
AllocationBuilder builder(jsgraph(), effect, control);
builder.Allocate(boilerplate_map.instance_size(), pretenure,
Type::For(js_heap_broker(), boilerplate_map.object<Map>()));
builder.Store(AccessBuilder::ForMap(), boilerplate_map);
......@@ -1744,7 +1725,7 @@ Node* JSCreateLowering::AllocateFastLiteral(Node* effect, Node* control,
JSArrayRef boilerplate_array = boilerplate.AsJSArray();
builder.Store(
AccessBuilder::ForJSArrayLength(boilerplate_array.GetElementsKind()),
boilerplate_array.length(js_heap_broker()));
boilerplate_array.length());
}
for (auto const& inobject_field : inobject_fields) {
builder.Store(inobject_field.first, inobject_field.second);
......@@ -1755,17 +1736,15 @@ Node* JSCreateLowering::AllocateFastLiteral(Node* effect, Node* control,
Node* JSCreateLowering::AllocateFastLiteralElements(Node* effect, Node* control,
JSObjectRef boilerplate,
PretenureFlag pretenure) {
FixedArrayBaseRef boilerplate_elements =
boilerplate.elements(js_heap_broker());
FixedArrayBaseRef boilerplate_elements = boilerplate.elements();
// Empty or copy-on-write elements just store a constant.
int const elements_length = boilerplate_elements.length();
MapRef elements_map = boilerplate_elements.map(js_heap_broker());
if (boilerplate_elements.length() == 0 ||
elements_map.IsFixedCowArrayMap(js_heap_broker())) {
MapRef elements_map = boilerplate_elements.map();
if (boilerplate_elements.length() == 0 || elements_map.IsFixedCowArrayMap()) {
if (pretenure == TENURED) {
boilerplate.EnsureElementsTenured(js_heap_broker());
boilerplate_elements = boilerplate.elements(js_heap_broker());
boilerplate.EnsureElementsTenured();
boilerplate_elements = boilerplate.elements();
}
return jsgraph()->HeapConstant(boilerplate_elements.object<HeapObject>());
}
......@@ -1784,23 +1763,22 @@ Node* JSCreateLowering::AllocateFastLiteralElements(Node* effect, Node* control,
} else {
FixedArrayRef elements = boilerplate_elements.AsFixedArray();
for (int i = 0; i < elements_length; ++i) {
if (elements.is_the_hole(js_heap_broker(), i)) {
if (elements.is_the_hole(i)) {
elements_values[i] = jsgraph()->TheHoleConstant();
} else {
ObjectRef element_value = elements.get(js_heap_broker(), i);
ObjectRef element_value = elements.get(i);
if (element_value.IsJSObject()) {
elements_values[i] = effect = AllocateFastLiteral(
effect, control, element_value.AsJSObject(), pretenure);
} else {
elements_values[i] =
jsgraph()->Constant(js_heap_broker(), element_value);
elements_values[i] = jsgraph()->Constant(element_value);
}
}
}
}
// Allocate the backing store array and store the elements.
AllocationBuilder builder(jsgraph(), js_heap_broker(), effect, control);
AllocationBuilder builder(jsgraph(), effect, control);
builder.AllocateArray(elements_length, elements_map.object<Map>(), pretenure);
ElementAccess const access =
(elements_map.instance_type() == FIXED_DOUBLE_ARRAY_TYPE)
......@@ -1814,7 +1792,7 @@ Node* JSCreateLowering::AllocateFastLiteralElements(Node* effect, Node* control,
Node* JSCreateLowering::AllocateLiteralRegExp(Node* effect, Node* control,
JSRegExpRef boilerplate) {
MapRef boilerplate_map = boilerplate.map(js_heap_broker());
MapRef boilerplate_map = boilerplate.map();
// Sanity check that JSRegExp object layout hasn't changed.
STATIC_ASSERT(JSRegExp::kDataOffset == JSObject::kHeaderSize);
......@@ -1830,23 +1808,19 @@ Node* JSCreateLowering::AllocateLiteralRegExp(Node* effect, Node* control,
const int size =
JSRegExp::kSize + JSRegExp::kInObjectFieldCount * kPointerSize;
AllocationBuilder builder(jsgraph(), js_heap_broker(), effect, control);
AllocationBuilder builder(jsgraph(), effect, control);
builder.Allocate(size, pretenure,
Type::For(js_heap_broker(), boilerplate_map.object<Map>()));
builder.Store(AccessBuilder::ForMap(), boilerplate_map);
builder.Store(AccessBuilder::ForJSObjectPropertiesOrHash(),
boilerplate.raw_properties_or_hash(js_heap_broker()));
builder.Store(AccessBuilder::ForJSObjectElements(),
boilerplate.elements(js_heap_broker()));
builder.Store(AccessBuilder::ForJSRegExpData(),
boilerplate.data(js_heap_broker()));
builder.Store(AccessBuilder::ForJSRegExpSource(),
boilerplate.source(js_heap_broker()));
builder.Store(AccessBuilder::ForJSRegExpFlags(),
boilerplate.flags(js_heap_broker()));
boilerplate.raw_properties_or_hash());
builder.Store(AccessBuilder::ForJSObjectElements(), boilerplate.elements());
builder.Store(AccessBuilder::ForJSRegExpData(), boilerplate.data());
builder.Store(AccessBuilder::ForJSRegExpSource(), boilerplate.source());
builder.Store(AccessBuilder::ForJSRegExpFlags(), boilerplate.flags());
builder.Store(AccessBuilder::ForJSRegExpLastIndex(),
boilerplate.last_index(js_heap_broker()));
boilerplate.last_index());
return builder.Finish();
}
......@@ -1866,7 +1840,7 @@ SimplifiedOperatorBuilder* JSCreateLowering::simplified() const {
}
NativeContextRef JSCreateLowering::native_context_ref() const {
return NativeContextRef(native_context());
return NativeContextRef(js_heap_broker(), native_context());
}
} // namespace compiler
......
src/compiler/js-graph.cc
View file @ 56d21252
......@@ -66,9 +66,9 @@ Node* JSGraph::Constant(Handle<Object> value) {
}
}
Node* JSGraph::Constant(const JSHeapBroker* broker, const ObjectRef& ref) {
Node* JSGraph::Constant(const ObjectRef& ref) {
if (ref.IsSmi()) return Constant(ref.AsSmi());
OddballType oddball_type = ref.oddball_type(broker);
OddballType oddball_type = ref.oddball_type();
if (ref.IsHeapNumber()) {
return Constant(ref.AsHeapNumber().value());
} else if (oddball_type == OddballType::kUndefined) {
......
src/compiler/js-graph.h
View file @ 56d21252
......@@ -56,8 +56,7 @@ class V8_EXPORT_PRIVATE JSGraph : public MachineGraph {
Node* Constant(Handle<Object> value);
// Like above, but doesn't access the heap directly.
// TODO(neis): Make the broker a member of JSGraph.
Node* Constant(const JSHeapBroker* broker, const ObjectRef& value);
Node* Constant(const ObjectRef& value);
// Creates a NumberConstant node, usually canonicalized.
Node* Constant(double value);
......
src/compiler/js-heap-broker.cc
View file @ 56d21252
......@@ -13,10 +13,11 @@ namespace v8 {
namespace internal {
namespace compiler {
MapRef HeapObjectRef::map(const JSHeapBroker* broker) const {
MapRef HeapObjectRef::map() const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference;
return MapRef(handle(object<HeapObject>()->map(), broker->isolate()));
return MapRef(broker(),
handle(object<HeapObject>()->map(), broker()->isolate()));
}
double HeapNumberRef::value() const {
......@@ -40,26 +41,26 @@ bool ObjectRef::equals(const ObjectRef& other) const {
return object<Object>().equals(other.object<Object>());
}
StringRef ObjectRef::TypeOf(const JSHeapBroker* broker) const {
StringRef ObjectRef::TypeOf() const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference handle_dereference;
return StringRef(Object::TypeOf(broker->isolate(), object<Object>()));
return StringRef(broker(),
Object::TypeOf(broker()->isolate(), object<Object>()));
}
base::Optional<ContextRef> ContextRef::previous(
const JSHeapBroker* broker) const {
base::Optional<ContextRef> ContextRef::previous() const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference handle_dereference;
Context* previous = object<Context>()->previous();
if (previous == nullptr) return base::Optional<ContextRef>();
return ContextRef(handle(previous, broker->isolate()));
return ContextRef(broker(), handle(previous, broker()->isolate()));
}
ObjectRef ContextRef::get(const JSHeapBroker* broker, int index) const {
ObjectRef ContextRef::get(int index) const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference handle_dereference;
Handle<Object> value(object<Context>()->get(index), broker->isolate());
return ObjectRef(value);
Handle<Object> value(object<Context>()->get(index), broker()->isolate());
return ObjectRef(broker(), value);
}
JSHeapBroker::JSHeapBroker(Isolate* isolate) : isolate_(isolate) {}
......@@ -108,24 +109,23 @@ base::Optional<int> JSHeapBroker::TryGetSmi(Handle<Object> object) {
} \
Name##Ref ObjectRef::As##Name() const { \
DCHECK(Is##Name()); \
return Name##Ref(object<HeapObject>()); \
return Name##Ref(broker(), object<HeapObject>()); \
}
HEAP_BROKER_OBJECT_LIST(DEFINE_IS_AND_AS)
#undef DEFINE_IS_AND_AS
HeapObjectType HeapObjectRef::type(const JSHeapBroker* broker) const {
HeapObjectType HeapObjectRef::type() const {
AllowHandleDereference allow_handle_dereference;
return broker->HeapObjectTypeFromMap(object<HeapObject>()->map());
return broker()->HeapObjectTypeFromMap(object<HeapObject>()->map());
}
base::Optional<MapRef> HeapObjectRef::TryGetObjectCreateMap(
const JSHeapBroker* broker) const {
base::Optional<MapRef> HeapObjectRef::TryGetObjectCreateMap() const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference;
Handle<Map> instance_map;
if (Map::TryGetObjectCreateMap(broker->isolate(), object<HeapObject>())
if (Map::TryGetObjectCreateMap(broker()->isolate(), object<HeapObject>())
.ToHandle(&instance_map)) {
return MapRef(instance_map);
return MapRef(broker(), instance_map);
} else {
return base::Optional<MapRef>();
}
......@@ -157,12 +157,12 @@ bool JSFunctionRef::IsConstructor() const {
}
MapRef JSFunctionRef::DependOnInitialMap(
const JSHeapBroker* broker, CompilationDependencies* dependencies) const {
CompilationDependencies* dependencies) const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference;
Handle<Map> initial_map =
dependencies->DependOnInitialMap(object<JSFunction>());
return MapRef(initial_map);
return MapRef(broker(), initial_map);
}
void JSFunctionRef::EnsureHasInitialMap() const {
......@@ -175,8 +175,8 @@ void JSFunctionRef::EnsureHasInitialMap() const {
JSFunction::EnsureHasInitialMap(object<JSFunction>());
}
void MapRef::DependOnStableMap(const JSHeapBroker* broker,
CompilationDependencies* dependencies) const {
// TODO(neis): Remove.
void MapRef::DependOnStableMap(CompilationDependencies* dependencies) const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference;
dependencies->DependOnStableMap(object<Map>());
......@@ -197,24 +197,25 @@ bool JSFunctionRef::has_initial_map() const {
return object<JSFunction>()->has_initial_map();
}
MapRef JSFunctionRef::initial_map(const JSHeapBroker* broker) const {
MapRef JSFunctionRef::initial_map() const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference;
return MapRef(handle(object<JSFunction>()->initial_map(), broker->isolate()));
return MapRef(broker(), handle(object<JSFunction>()->initial_map(),
broker()->isolate()));
}
SharedFunctionInfoRef JSFunctionRef::shared(const JSHeapBroker* broker) const {
SharedFunctionInfoRef JSFunctionRef::shared() const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference;
return SharedFunctionInfoRef(
handle(object<JSFunction>()->shared(), broker->isolate()));
broker(), handle(object<JSFunction>()->shared(), broker()->isolate()));
}
JSGlobalProxyRef JSFunctionRef::global_proxy(const JSHeapBroker* broker) const {
JSGlobalProxyRef JSFunctionRef::global_proxy() const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference;
return JSGlobalProxyRef(
handle(object<JSFunction>()->global_proxy(), broker->isolate()));
return JSGlobalProxyRef(broker(), handle(object<JSFunction>()->global_proxy(),
broker()->isolate()));
}
base::Optional<ScriptContextTableRef::LookupResult>
......@@ -230,40 +231,38 @@ ScriptContextTableRef::lookup(const NameRef& name) const {
}
Handle<Context> script_context =
ScriptContextTable::GetContext(table, lookup_result.context_index);
LookupResult result{ContextRef(script_context),
LookupResult result{ContextRef(broker(), script_context),
lookup_result.mode == VariableMode::kConst,
lookup_result.slot_index};
return result;
}
ScriptContextTableRef NativeContextRef::script_context_table(
const JSHeapBroker* broker) const {
ScriptContextTableRef NativeContextRef::script_context_table() const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference handle_dereference;
return ScriptContextTableRef(
handle(object<Context>()->script_context_table(), broker->isolate()));
broker(),
handle(object<Context>()->script_context_table(), broker()->isolate()));
}
OddballType ObjectRef::oddball_type(const JSHeapBroker* broker) const {
return IsSmi() ? OddballType::kNone
: AsHeapObject().type(broker).oddball_type();
OddballType ObjectRef::oddball_type() const {
return IsSmi() ? OddballType::kNone : AsHeapObject().type().oddball_type();
}
ObjectRef FeedbackVectorRef::get(const JSHeapBroker* broker,
FeedbackSlot slot) const {
ObjectRef FeedbackVectorRef::get(FeedbackSlot slot) const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference handle_dereference;
Handle<Object> value(object<FeedbackVector>()->Get(slot)->ToObject(),
broker->isolate());
return ObjectRef(value);
broker()->isolate());
return ObjectRef(broker(), value);
}
JSObjectRef AllocationSiteRef::boilerplate(const JSHeapBroker* broker) const {
JSObjectRef AllocationSiteRef::boilerplate() const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference handle_dereference;
Handle<JSObject> value(object<AllocationSite>()->boilerplate(),
broker->isolate());
return JSObjectRef(value);
broker()->isolate());
return JSObjectRef(broker(), value);
}
bool JSObjectRef::IsUnboxedDoubleField(FieldIndex index) const {
......@@ -276,19 +275,19 @@ double JSObjectRef::RawFastDoublePropertyAt(FieldIndex index) const {
return object<JSObject>()->RawFastDoublePropertyAt(index);
}
ObjectRef JSObjectRef::RawFastPropertyAt(const JSHeapBroker* broker,
FieldIndex index) const {
ObjectRef JSObjectRef::RawFastPropertyAt(FieldIndex index) const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference handle_dereference;
return ObjectRef(
handle(object<JSObject>()->RawFastPropertyAt(index), broker->isolate()));
return ObjectRef(broker(),
handle(object<JSObject>()->RawFastPropertyAt(index),
broker()->isolate()));
}
FixedArrayBaseRef JSObjectRef::elements(const JSHeapBroker* broker) const {
FixedArrayBaseRef JSObjectRef::elements() const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference handle_dereference;
return FixedArrayBaseRef(
handle(object<JSObject>()->elements(), broker->isolate()));
broker(), handle(object<JSObject>()->elements(), broker()->isolate()));
}
namespace {
......@@ -374,12 +373,12 @@ const int kMaxFastLiteralProperties = JSObject::kMaxInObjectProperties;
// Determines whether the given array or object literal boilerplate satisfies
// all limits to be considered for fast deep-copying and computes the total
// size of all objects that are part of the graph.
bool AllocationSiteRef::IsFastLiteral(const JSHeapBroker* broker) const {
bool AllocationSiteRef::IsFastLiteral() const {
AllowHandleAllocation allow_handle_allocation;
AllowHandleDereference allow_handle_dereference;
int max_properties = kMaxFastLiteralProperties;
Handle<JSObject> boilerplate(object<AllocationSite>()->boilerplate(),
broker->isolate());
broker()->isolate());
return IsFastLiteralHelper(boilerplate, kMaxFastLiteralDepth,
&max_properties);
}
......@@ -389,19 +388,18 @@ PretenureFlag AllocationSiteRef::GetPretenureMode() const {
return object<AllocationSite>()->GetPretenureMode();
}
void JSObjectRef::EnsureElementsTenured(const JSHeapBroker* broker) {
void JSObjectRef::EnsureElementsTenured() {
// TODO(jarin) Eventually, we will pretenure the boilerplates before
// the compilation job starts.
AllowHandleAllocation allow_handle_allocation;
AllowHandleDereference allow_handle_dereference;
Handle<FixedArrayBase> object_elements =
elements(broker).object<FixedArrayBase>();
Handle<FixedArrayBase> object_elements = elements().object<FixedArrayBase>();
if (Heap::InNewSpace(*object_elements)) {
// If we would like to pretenure a fixed cow array, we must ensure that
// the array is already in old space, otherwise we'll create too many
// old-to-new-space pointers (overflowing the store buffer).
object_elements = Handle<FixedArrayBase>(
broker->isolate()->factory()->CopyAndTenureFixedCOWArray(
broker()->isolate()->factory()->CopyAndTenureFixedCOWArray(
Handle<FixedArray>::cast(object_elements)));
object<JSObject>()->set_elements(*object_elements);
}
......@@ -432,11 +430,11 @@ bool MapRef::is_dictionary_map() const {
return object<Map>()->is_dictionary_map();
}
ObjectRef MapRef::constructor_or_backpointer(const JSHeapBroker* broker) const {
ObjectRef MapRef::constructor_or_backpointer() const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference;
return ObjectRef(
handle(object<Map>()->constructor_or_backpointer(), broker->isolate()));
return ObjectRef(broker(), handle(object<Map>()->constructor_or_backpointer(),
broker()->isolate()));
}
int MapRef::instance_size() const {
......@@ -454,11 +452,12 @@ PropertyDetails MapRef::GetPropertyDetails(int i) const {
return object<Map>()->instance_descriptors()->GetDetails(i);
}
NameRef MapRef::GetPropertyKey(const JSHeapBroker* broker, int i) const {
NameRef MapRef::GetPropertyKey(int i) const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference;
return NameRef(handle(object<Map>()->instance_descriptors()->GetKey(i),
broker->isolate()));
return NameRef(broker(),
handle(object<Map>()->instance_descriptors()->GetKey(i),
broker()->isolate()));
}
bool MapRef::IsJSArrayMap() const {
......@@ -471,10 +470,10 @@ bool MapRef::IsInobjectSlackTrackingInProgress() const {
return object<Map>()->IsInobjectSlackTrackingInProgress();
}
bool MapRef::IsFixedCowArrayMap(const JSHeapBroker* broker) const {
bool MapRef::IsFixedCowArrayMap() const {
AllowHandleDereference allow_handle_dereference;
return *object<Map>() ==
ReadOnlyRoots(broker->isolate()).fixed_cow_array_map();
ReadOnlyRoots(broker()->isolate()).fixed_cow_array_map();
}
bool MapRef::has_prototype_slot() const {
......@@ -497,10 +496,11 @@ ElementsKind JSArrayRef::GetElementsKind() const {
return object<JSArray>()->GetElementsKind();
}
ObjectRef JSArrayRef::length(const JSHeapBroker* broker) const {
ObjectRef JSArrayRef::length() const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference;
return ObjectRef(handle(object<JSArray>()->length(), broker->isolate()));
return ObjectRef(broker(),
handle(object<JSArray>()->length(), broker()->isolate()));
}
int StringRef::length() const {
......@@ -513,45 +513,50 @@ uint16_t StringRef::GetFirstChar() {
return object<String>()->Get(0);
}
double StringRef::ToNumber(const JSHeapBroker* broker) {
double StringRef::ToNumber() {
AllowHandleDereference allow_handle_dereference;
AllowHandleAllocation allow_handle_allocation;
AllowHeapAllocation allow_heap_allocation;
int flags = ALLOW_HEX | ALLOW_OCTAL | ALLOW_BINARY;
return StringToDouble(broker->isolate(), broker->isolate()->unicode_cache(),
object<String>(), flags);
return StringToDouble(broker()->isolate(),
broker()->isolate()->unicode_cache(), object<String>(),
flags);
}
ObjectRef JSRegExpRef::raw_properties_or_hash(
const JSHeapBroker* broker) const {
ObjectRef JSRegExpRef::raw_properties_or_hash() const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference;
return ObjectRef(
handle(object<JSRegExp>()->raw_properties_or_hash(), broker->isolate()));
return ObjectRef(broker(),
handle(object<JSRegExp>()->raw_properties_or_hash(),
broker()->isolate()));
}
ObjectRef JSRegExpRef::data(const JSHeapBroker* broker) const {
ObjectRef JSRegExpRef::data() const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference;
return ObjectRef(handle(object<JSRegExp>()->data(), broker->isolate()));
return ObjectRef(broker(),
handle(object<JSRegExp>()->data(), broker()->isolate()));
}
ObjectRef JSRegExpRef::source(const JSHeapBroker* broker) const {
ObjectRef JSRegExpRef::source() const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference;
return ObjectRef(handle(object<JSRegExp>()->source(), broker->isolate()));
return ObjectRef(broker(),
handle(object<JSRegExp>()->source(), broker()->isolate()));
}
ObjectRef JSRegExpRef::flags(const JSHeapBroker* broker) const {
ObjectRef JSRegExpRef::flags() const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference;
return ObjectRef(handle(object<JSRegExp>()->flags(), broker->isolate()));
return ObjectRef(broker(),
handle(object<JSRegExp>()->flags(), broker()->isolate()));
}
ObjectRef JSRegExpRef::last_index(const JSHeapBroker* broker) const {
ObjectRef JSRegExpRef::last_index() const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference;
return ObjectRef(handle(object<JSRegExp>()->last_index(), broker->isolate()));
return ObjectRef(
broker(), handle(object<JSRegExp>()->last_index(), broker()->isolate()));
}
int FixedArrayBaseRef::length() const {
......@@ -559,15 +564,16 @@ int FixedArrayBaseRef::length() const {
return object<FixedArrayBase>()->length();
}
bool FixedArrayRef::is_the_hole(const JSHeapBroker* broker, int i) const {
bool FixedArrayRef::is_the_hole(int i) const {
AllowHandleDereference allow_handle_dereference;
return object<FixedArray>()->is_the_hole(broker->isolate(), i);
return object<FixedArray>()->is_the_hole(broker()->isolate(), i);
}
ObjectRef FixedArrayRef::get(const JSHeapBroker* broker, int i) const {
ObjectRef FixedArrayRef::get(int i) const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference;
return ObjectRef(handle(object<FixedArray>()->get(i), broker->isolate()));
return ObjectRef(broker(),
handle(object<FixedArray>()->get(i), broker()->isolate()));
}
bool FixedDoubleArrayRef::is_the_hole(int i) const {
......@@ -645,104 +651,99 @@ int SharedFunctionInfoRef::GetBytecodeArrayRegisterCount() const {
return object<SharedFunctionInfo>()->GetBytecodeArray()->register_count();
}
MapRef NativeContextRef::fast_aliased_arguments_map(
const JSHeapBroker* broker) const {
MapRef NativeContextRef::fast_aliased_arguments_map() const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference;
return MapRef(handle(object<Context>()->fast_aliased_arguments_map(),
broker->isolate()));
return MapRef(broker(),
handle(object<Context>()->fast_aliased_arguments_map(),
broker()->isolate()));
}
MapRef NativeContextRef::sloppy_arguments_map(
const JSHeapBroker* broker) const {
MapRef NativeContextRef::sloppy_arguments_map() const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference;
return MapRef(
handle(object<Context>()->sloppy_arguments_map(), broker->isolate()));
return MapRef(broker(), handle(object<Context>()->sloppy_arguments_map(),
broker()->isolate()));
}
MapRef NativeContextRef::strict_arguments_map(
const JSHeapBroker* broker) const {
MapRef NativeContextRef::strict_arguments_map() const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference;
return MapRef(
handle(object<Context>()->strict_arguments_map(), broker->isolate()));
return MapRef(broker(), handle(object<Context>()->strict_arguments_map(),
broker()->isolate()));
}
MapRef NativeContextRef::js_array_fast_elements_map_index(
const JSHeapBroker* broker) const {
MapRef NativeContextRef::js_array_fast_elements_map_index() const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference;
return MapRef(handle(object<Context>()->js_array_fast_elements_map_index(),
broker->isolate()));
return MapRef(broker(),
handle(object<Context>()->js_array_fast_elements_map_index(),
broker()->isolate()));
}
MapRef NativeContextRef::initial_array_iterator_map(
const JSHeapBroker* broker) const {
MapRef NativeContextRef::initial_array_iterator_map() const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference;
return MapRef(handle(object<Context>()->initial_array_iterator_map(),
broker->isolate()));
return MapRef(broker(),
handle(object<Context>()->initial_array_iterator_map(),
broker()->isolate()));
}
MapRef NativeContextRef::set_value_iterator_map(
const JSHeapBroker* broker) const {
MapRef NativeContextRef::set_value_iterator_map() const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference;
return MapRef(
handle(object<Context>()->set_value_iterator_map(), broker->isolate()));
return MapRef(broker(), handle(object<Context>()->set_value_iterator_map(),
broker()->isolate()));
}
MapRef NativeContextRef::set_key_value_iterator_map(
const JSHeapBroker* broker) const {
MapRef NativeContextRef::set_key_value_iterator_map() const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference;
return MapRef(handle(object<Context>()->set_key_value_iterator_map(),
broker->isolate()));
return MapRef(broker(),
handle(object<Context>()->set_key_value_iterator_map(),
broker()->isolate()));
}
MapRef NativeContextRef::map_key_iterator_map(
const JSHeapBroker* broker) const {
MapRef NativeContextRef::map_key_iterator_map() const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference;
return MapRef(
handle(object<Context>()->map_key_iterator_map(), broker->isolate()));
return MapRef(broker(), handle(object<Context>()->map_key_iterator_map(),
broker()->isolate()));
}
MapRef NativeContextRef::map_value_iterator_map(
const JSHeapBroker* broker) const {
MapRef NativeContextRef::map_value_iterator_map() const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference;
return MapRef(
handle(object<Context>()->map_value_iterator_map(), broker->isolate()));
return MapRef(broker(), handle(object<Context>()->map_value_iterator_map(),
broker()->isolate()));
}
MapRef NativeContextRef::map_key_value_iterator_map(
const JSHeapBroker* broker) const {
MapRef NativeContextRef::map_key_value_iterator_map() const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference;
return MapRef(handle(object<Context>()->map_key_value_iterator_map(),
broker->isolate()));
return MapRef(broker(),
handle(object<Context>()->map_key_value_iterator_map(),
broker()->isolate()));
}
MapRef NativeContextRef::GetFunctionMapFromIndex(const JSHeapBroker* broker,
int index) const {
MapRef NativeContextRef::GetFunctionMapFromIndex(int index) const {
DCHECK_LE(index, Context::LAST_FUNCTION_MAP_INDEX);
DCHECK_GE(index, Context::FIRST_FUNCTION_MAP_INDEX);
return get(broker, index).AsMap();
return get(index).AsMap();
}
bool ObjectRef::BooleanValue(const JSHeapBroker* broker) {
bool ObjectRef::BooleanValue() {
AllowHandleDereference allow_handle_dereference;
return object<Object>()->BooleanValue(broker->isolate());
return object<Object>()->BooleanValue(broker()->isolate());
}
double ObjectRef::OddballToNumber(const JSHeapBroker* broker) const {
OddballType type = oddball_type(broker);
double ObjectRef::OddballToNumber() const {
OddballType type = oddball_type();
switch (type) {
case OddballType::kBoolean: {
ObjectRef true_ref(broker->isolate()->factory()->true_value());
ObjectRef true_ref(broker(),
broker()->isolate()->factory()->true_value());
return this->equals(true_ref) ? 1 : 0;
break;
}
......@@ -761,11 +762,11 @@ double ObjectRef::OddballToNumber(const JSHeapBroker* broker) const {
}
}
CellRef ModuleRef::GetCell(const JSHeapBroker* broker, int cell_index) {
CellRef ModuleRef::GetCell(int cell_index) {
AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference;
return CellRef(
handle(object<Module>()->GetCell(cell_index), broker->isolate()));
return CellRef(broker(), handle(object<Module>()->GetCell(cell_index),
broker()->isolate()));
}
} // namespace compiler
......
src/compiler/js-heap-broker.h
View file @ 56d21252
......@@ -94,7 +94,8 @@ HEAP_BROKER_OBJECT_LIST(FORWARD_DECL)
class ObjectRef {
public:
explicit ObjectRef(Handle<Object> object) : object_(object) {}
explicit ObjectRef(const JSHeapBroker* broker, Handle<Object> object)
: broker_(broker), object_(object) {}
template <typename T>
Handle<T> object() const {
......@@ -102,7 +103,7 @@ class ObjectRef {
return Handle<T>::cast(object_);
}
OddballType oddball_type(const JSHeapBroker* broker) const;
OddballType oddball_type() const;
bool IsSmi() const;
int AsSmi() const;
......@@ -117,11 +118,15 @@ class ObjectRef {
HEAP_BROKER_OBJECT_LIST(HEAP_AS_METHOD_DECL)
#undef HEAP_AS_METHOD_DECL
StringRef TypeOf(const JSHeapBroker* broker) const;
bool BooleanValue(const JSHeapBroker* broker);
double OddballToNumber(const JSHeapBroker* broker) const;
StringRef TypeOf() const;
bool BooleanValue();
double OddballToNumber() const;
protected:
const JSHeapBroker* broker() const { return broker_; }
private:
const JSHeapBroker* broker_;
Handle<Object> object_;
};
......@@ -129,10 +134,9 @@ class HeapObjectRef : public ObjectRef {
public:
using ObjectRef::ObjectRef;
HeapObjectType type(const JSHeapBroker* broker) const;
MapRef map(const JSHeapBroker* broker) const;
base::Optional<MapRef> TryGetObjectCreateMap(
const JSHeapBroker* broker) const;
HeapObjectType type() const;
MapRef map() const;
base::Optional<MapRef> TryGetObjectCreateMap() const;
bool IsSeqString() const;
bool IsExternalString() const;
};
......@@ -143,11 +147,10 @@ class JSObjectRef : public HeapObjectRef {
bool IsUnboxedDoubleField(FieldIndex index) const;
double RawFastDoublePropertyAt(FieldIndex index) const;
ObjectRef RawFastPropertyAt(const JSHeapBroker* broker,
FieldIndex index) const;
ObjectRef RawFastPropertyAt(FieldIndex index) const;
FixedArrayBaseRef elements(const JSHeapBroker* broker) const;
void EnsureElementsTenured(const JSHeapBroker* broker);
FixedArrayBaseRef elements() const;
void EnsureElementsTenured();
};
struct SlackTrackingResult {
......@@ -166,15 +169,13 @@ class JSFunctionRef : public JSObjectRef {
BuiltinFunctionId GetBuiltinFunctionId() const;
bool IsConstructor() const;
bool has_initial_map() const;
MapRef initial_map(const JSHeapBroker* broker) const;
MapRef initial_map() const;
MapRef DependOnInitialMap(const JSHeapBroker* broker,
CompilationDependencies* dependencies) const;
MapRef DependOnInitialMap(CompilationDependencies* dependencies) const;
JSGlobalProxyRef global_proxy(const JSHeapBroker* broker) const;
JSGlobalProxyRef global_proxy() const;
SlackTrackingResult FinishSlackTracking() const;
SharedFunctionInfoRef shared(const JSHeapBroker* broker) const;
SharedFunctionInfoRef shared() const;
void EnsureHasInitialMap() const;
};
......@@ -182,11 +183,11 @@ class JSRegExpRef : public JSObjectRef {
public:
using JSObjectRef::JSObjectRef;
ObjectRef raw_properties_or_hash(const JSHeapBroker* broker) const;
ObjectRef data(const JSHeapBroker* broker) const;
ObjectRef source(const JSHeapBroker* broker) const;
ObjectRef flags(const JSHeapBroker* broker) const;
ObjectRef last_index(const JSHeapBroker* broker) const;
ObjectRef raw_properties_or_hash() const;
ObjectRef data() const;
ObjectRef source() const;
ObjectRef flags() const;
ObjectRef last_index() const;
};
class HeapNumberRef : public HeapObjectRef {
......@@ -207,28 +208,28 @@ class ContextRef : public HeapObjectRef {
public:
using HeapObjectRef::HeapObjectRef;
base::Optional<ContextRef> previous(const JSHeapBroker* broker) const;
ObjectRef get(const JSHeapBroker* broker, int index) const;
base::Optional<ContextRef> previous() const;
ObjectRef get(int index) const;
};
class NativeContextRef : public ContextRef {
public:
using ContextRef::ContextRef;
ScriptContextTableRef script_context_table(const JSHeapBroker* broker) const;
ScriptContextTableRef script_context_table() const;
MapRef fast_aliased_arguments_map(const JSHeapBroker* broker) const;
MapRef sloppy_arguments_map(const JSHeapBroker* broker) const;
MapRef strict_arguments_map(const JSHeapBroker* broker) const;
MapRef js_array_fast_elements_map_index(const JSHeapBroker* broker) const;
MapRef initial_array_iterator_map(const JSHeapBroker* broker) const;
MapRef set_value_iterator_map(const JSHeapBroker* broker) const;
MapRef set_key_value_iterator_map(const JSHeapBroker* broker) const;
MapRef map_key_iterator_map(const JSHeapBroker* broker) const;
MapRef map_value_iterator_map(const JSHeapBroker* broker) const;
MapRef map_key_value_iterator_map(const JSHeapBroker* broker) const;
MapRef fast_aliased_arguments_map() const;
MapRef sloppy_arguments_map() const;
MapRef strict_arguments_map() const;
MapRef js_array_fast_elements_map_index() const;
MapRef initial_array_iterator_map() const;
MapRef set_value_iterator_map() const;
MapRef set_key_value_iterator_map() const;
MapRef map_key_iterator_map() const;
MapRef map_value_iterator_map() const;
MapRef map_key_value_iterator_map() const;
MapRef GetFunctionMapFromIndex(const JSHeapBroker* broker, int index) const;
MapRef GetFunctionMapFromIndex(int index) const;
};
class NameRef : public HeapObjectRef {
......@@ -253,16 +254,16 @@ class FeedbackVectorRef : public HeapObjectRef {
public:
using HeapObjectRef::HeapObjectRef;
ObjectRef get(const JSHeapBroker* broker, FeedbackSlot slot) const;
ObjectRef get(FeedbackSlot slot) const;
};
class AllocationSiteRef : public HeapObjectRef {
public:
using HeapObjectRef::HeapObjectRef;
JSObjectRef boilerplate(const JSHeapBroker* broker) const;
JSObjectRef boilerplate() const;
PretenureFlag GetPretenureMode() const;
bool IsFastLiteral(const JSHeapBroker* broker) const;
bool IsFastLiteral() const;
};
class MapRef : public HeapObjectRef {
......@@ -274,10 +275,10 @@ class MapRef : public HeapObjectRef {
int GetInObjectProperties() const;
int NumberOfOwnDescriptors() const;
PropertyDetails GetPropertyDetails(int i) const;
NameRef GetPropertyKey(const JSHeapBroker* broker, int i) const;
NameRef GetPropertyKey(int i) const;
FieldIndex GetFieldIndexFor(int i) const;
int GetInObjectPropertyOffset(int index) const;
ObjectRef constructor_or_backpointer(const JSHeapBroker* broker) const;
ObjectRef constructor_or_backpointer() const;
bool is_stable() const;
bool has_prototype_slot() const;
......@@ -286,10 +287,9 @@ class MapRef : public HeapObjectRef {
bool is_dictionary_map() const;
bool IsJSArrayMap() const;
bool IsFixedCowArrayMap(const JSHeapBroker* broker) const;
bool IsFixedCowArrayMap() const;
void DependOnStableMap(const JSHeapBroker* broker,
CompilationDependencies* dependencies) const;
void DependOnStableMap(CompilationDependencies* dependencies) const;
};
class FixedArrayBaseRef : public HeapObjectRef {
......@@ -303,8 +303,8 @@ class FixedArrayRef : public FixedArrayBaseRef {
public:
using FixedArrayBaseRef::FixedArrayBaseRef;
ObjectRef get(const JSHeapBroker* broker, int i) const;
bool is_the_hole(const JSHeapBroker* broker, int i) const;
ObjectRef get(int i) const;
bool is_the_hole(int i) const;
};
class FixedDoubleArrayRef : public FixedArrayBaseRef {
......@@ -320,7 +320,7 @@ class JSArrayRef : public JSObjectRef {
using JSObjectRef::JSObjectRef;
ElementsKind GetElementsKind() const;
ObjectRef length(const JSHeapBroker* broker) const;
ObjectRef length() const;
};
class ScopeInfoRef : public HeapObjectRef {
......@@ -354,29 +354,29 @@ class StringRef : public NameRef {
int length() const;
uint16_t GetFirstChar();
double ToNumber(const JSHeapBroker* broker);
double ToNumber();
};
class ModuleRef : public HeapObjectRef {
public:
explicit ModuleRef(Handle<Object> object) : HeapObjectRef(object) {}
using HeapObjectRef::HeapObjectRef;
CellRef GetCell(const JSHeapBroker* broker, int cell_index);
CellRef GetCell(int cell_index);
};
class CellRef : public HeapObjectRef {
public:
explicit CellRef(Handle<Object> object) : HeapObjectRef(object) {}
using HeapObjectRef::HeapObjectRef;
};
class JSGlobalProxyRef : public JSObjectRef {
public:
explicit JSGlobalProxyRef(Handle<Object> object) : JSObjectRef(object) {}
using JSObjectRef::JSObjectRef;
};
class CodeRef : public HeapObjectRef {
public:
explicit CodeRef(Handle<Object> object) : HeapObjectRef(object) {}
using HeapObjectRef::HeapObjectRef;
};
class InternalizedStringRef : public StringRef {
......
src/compiler/js-native-context-specialization.cc
View file @ 56d21252
......@@ -68,7 +68,7 @@ JSNativeContextSpecialization::JSNativeContextSpecialization(
global_object_(native_context->global_object(), jsgraph->isolate()),
global_proxy_(JSGlobalProxy::cast(native_context->global_proxy()),
jsgraph->isolate()),
native_context_(native_context),
native_context_(js_heap_broker, native_context),
dependencies_(dependencies),
zone_(zone),
type_cache_(TypeCache::Get()) {}
......@@ -520,7 +520,7 @@ Reduction JSNativeContextSpecialization::ReduceJSLoadContext(Node* node) {
// context (if any), so we can constant-fold those fields, which is
// safe, since the NATIVE_CONTEXT_INDEX slot is always immutable.
if (access.index() == Context::NATIVE_CONTEXT_INDEX) {
Node* value = jsgraph()->Constant(js_heap_broker(), native_context());
Node* value = jsgraph()->Constant(native_context());
ReplaceWithValue(node, value);
return Replace(value);
}
......@@ -732,19 +732,19 @@ Reduction JSNativeContextSpecialization::ReduceGlobalAccess(
Reduction JSNativeContextSpecialization::ReduceJSLoadGlobal(Node* node) {
DCHECK_EQ(IrOpcode::kJSLoadGlobal, node->opcode());
NameRef name(LoadGlobalParametersOf(node->op()).name());
NameRef name(js_heap_broker(), LoadGlobalParametersOf(node->op()).name());
Node* effect = NodeProperties::GetEffectInput(node);
// Try to lookup the name on the script context table first (lexical scoping).
base::Optional<ScriptContextTableRef::LookupResult> result =
native_context().script_context_table(js_heap_broker()).lookup(name);
native_context().script_context_table().lookup(name);
if (result) {
ObjectRef contents = result->context.get(js_heap_broker(), result->index);
OddballType oddball_type = contents.oddball_type(js_heap_broker());
ObjectRef contents = result->context.get(result->index);
OddballType oddball_type = contents.oddball_type();
if (oddball_type == OddballType::kHole) {
return NoChange();
}
Node* context = jsgraph()->Constant(js_heap_broker(), result->context);
Node* context = jsgraph()->Constant(result->context);
Node* value = effect = graph()->NewNode(
javascript()->LoadContext(0, result->index, result->immutable), context,
effect);
......@@ -759,21 +759,21 @@ Reduction JSNativeContextSpecialization::ReduceJSLoadGlobal(Node* node) {
Reduction JSNativeContextSpecialization::ReduceJSStoreGlobal(Node* node) {
DCHECK_EQ(IrOpcode::kJSStoreGlobal, node->opcode());
NameRef name(StoreGlobalParametersOf(node->op()).name());
NameRef name(js_heap_broker(), StoreGlobalParametersOf(node->op()).name());
Node* value = NodeProperties::GetValueInput(node, 0);
Node* effect = NodeProperties::GetEffectInput(node);
Node* control = NodeProperties::GetControlInput(node);
// Try to lookup the name on the script context table first (lexical scoping).
base::Optional<ScriptContextTableRef::LookupResult> result =
native_context().script_context_table(js_heap_broker()).lookup(name);
native_context().script_context_table().lookup(name);
if (result) {
ObjectRef contents = result->context.get(js_heap_broker(), result->index);
OddballType oddball_type = contents.oddball_type(js_heap_broker());
ObjectRef contents = result->context.get(result->index);
OddballType oddball_type = contents.oddball_type();
if (oddball_type == OddballType::kHole || result->immutable) {
return NoChange();
}
Node* context = jsgraph()->Constant(js_heap_broker(), result->context);
Node* context = jsgraph()->Constant(result->context);
effect = graph()->NewNode(javascript()->StoreContext(0, result->index),
value, context, effect, control);
ReplaceWithValue(node, value, effect, control);
......@@ -1774,7 +1774,7 @@ Node* JSNativeContextSpecialization::InlineApiCall(
Node* code = jsgraph()->HeapConstant(call_api_callback.code());
// Add CallApiCallbackStub's register argument as well.
Node* context = jsgraph()->Constant(js_heap_broker(), native_context());
Node* context = jsgraph()->Constant(native_context());
Node* inputs[10] = {code, context, data, holder, function_reference,
receiver};
int index = 6 + argc;
......@@ -1913,7 +1913,7 @@ JSNativeContextSpecialization::BuildPropertyStore(
!FLAG_unbox_double_fields) {
if (access_info.HasTransitionMap()) {
// Allocate a MutableHeapNumber for the new property.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
AllocationBuilder a(jsgraph(), effect, control);
a.Allocate(HeapNumber::kSize, NOT_TENURED, Type::OtherInternal());
a.Store(AccessBuilder::ForMap(),
factory()->mutable_heap_number_map());
......@@ -2768,7 +2768,7 @@ Node* JSNativeContextSpecialization::BuildExtendPropertiesBackingStore(
new_length_and_hash, effect, control);
// Allocate and initialize the new properties.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
AllocationBuilder a(jsgraph(), effect, control);
a.Allocate(PropertyArray::SizeFor(new_length), NOT_TENURED,
Type::OtherInternal());
a.Store(AccessBuilder::ForMap(), jsgraph()->PropertyArrayMapConstant());
......
src/compiler/js-typed-lowering.cc
View file @ 56d21252
......@@ -93,12 +93,13 @@ class JSBinopReduction final {
if (BothInputsAre(Type::String()) ||
BinaryOperationHintOf(node_->op()) == BinaryOperationHint::kString) {
HeapObjectBinopMatcher m(node_);
if (m.right().HasValue() && m.right().Ref().IsString()) {
StringRef right_string(m.right().Value());
const JSHeapBroker* broker = lowering_->js_heap_broker();
if (m.right().HasValue() && m.right().Ref(broker).IsString()) {
StringRef right_string = m.right().Ref(broker).AsString();
if (right_string.length() >= ConsString::kMinLength) return true;
}
if (m.left().HasValue() && m.left().Ref().IsString()) {
StringRef left_string(m.left().Value());
if (m.left().HasValue() && m.left().Ref(broker).IsString()) {
StringRef left_string = m.left().Ref(broker).AsString();
if (left_string.length() >= ConsString::kMinLength) {
// The invariant for ConsString requires the left hand side to be
// a sequential or external string if the right hand side is the
......@@ -718,11 +719,11 @@ Node* JSTypedLowering::BuildGetStringLength(Node* value) {
// TODO(bmeurer): Get rid of this hack and instead have a way to
// express the string length in the types.
HeapObjectMatcher m(value);
if (!m.HasValue() || !m.Ref().IsString()) {
if (!m.HasValue() || !m.Ref(js_heap_broker()).IsString()) {
return graph()->NewNode(simplified()->StringLength(), value);
}
return jsgraph()->Constant(m.Ref().AsString().length());
return jsgraph()->Constant(m.Ref(js_heap_broker()).AsString().length());
}
Reduction JSTypedLowering::ReduceSpeculativeNumberComparison(Node* node) {
......@@ -959,17 +960,15 @@ Reduction JSTypedLowering::ReduceJSToNumberOrNumericInput(Node* input) {
if (input_type.Is(Type::String())) {
HeapObjectMatcher m(input);
if (m.HasValue() && m.Ref().IsString()) {
StringRef input_value = m.Ref().AsString();
return Replace(
jsgraph()->Constant(input_value.ToNumber(js_heap_broker())));
if (m.HasValue() && m.Ref(js_heap_broker()).IsString()) {
StringRef input_value = m.Ref(js_heap_broker()).AsString();
return Replace(jsgraph()->Constant(input_value.ToNumber()));
}
}
if (input_type.IsHeapConstant()) {
ObjectRef input_value = input_type.AsHeapConstant()->Ref();
if (input_value.oddball_type(js_heap_broker()) != OddballType::kNone) {
return Replace(
jsgraph()->Constant(input_value.OddballToNumber(js_heap_broker())));
if (input_value.oddball_type() != OddballType::kNone) {
return Replace(jsgraph()->Constant(input_value.OddballToNumber()));
}
}
if (input_type.Is(Type::Number())) {
......@@ -1135,8 +1134,8 @@ Reduction JSTypedLowering::ReduceJSLoadNamed(Node* node) {
DCHECK_EQ(IrOpcode::kJSLoadNamed, node->opcode());
Node* receiver = NodeProperties::GetValueInput(node, 0);
Type receiver_type = NodeProperties::GetType(receiver);
NameRef name(NamedAccessOf(node->op()).name());
NameRef length_str(factory()->length_string());
NameRef name(js_heap_broker(), NamedAccessOf(node->op()).name());
NameRef length_str(js_heap_broker(), factory()->length_string());
// Optimize "length" property of strings.
if (name.equals(length_str) && receiver_type.Is(Type::String())) {
Node* value = graph()->NewNode(simplified()->StringLength(), receiver);
......@@ -1371,9 +1370,8 @@ Node* JSTypedLowering::BuildGetModuleCell(Node* node) {
if (module_type.IsHeapConstant()) {
ModuleRef module_constant = module_type.AsHeapConstant()->Ref().AsModule();
CellRef cell_constant(
module_constant.GetCell(js_heap_broker(), cell_index));
return jsgraph()->Constant(js_heap_broker(), cell_constant);
CellRef cell_constant(module_constant.GetCell(cell_index));
return jsgraph()->Constant(cell_constant);
}
FieldAccess field_access;
......@@ -1560,7 +1558,7 @@ Reduction JSTypedLowering::ReduceJSConstruct(Node* node) {
if (target_type.IsHeapConstant() &&
target_type.AsHeapConstant()->Ref().IsJSFunction()) {
JSFunctionRef function = target_type.AsHeapConstant()->Ref().AsJSFunction();
SharedFunctionInfoRef shared = function.shared(js_heap_broker());
SharedFunctionInfoRef shared = function.shared();
// Only optimize [[Construct]] here if {function} is a Constructor.
if (!function.IsConstructor()) return NoChange();
......@@ -1570,13 +1568,13 @@ Reduction JSTypedLowering::ReduceJSConstruct(Node* node) {
// Patch {node} to an indirect call via the {function}s construct stub.
bool use_builtin_construct_stub = shared.construct_as_builtin();
CodeRef code(use_builtin_construct_stub
CodeRef code(js_heap_broker(),
use_builtin_construct_stub
? BUILTIN_CODE(isolate(), JSBuiltinsConstructStub)
: BUILTIN_CODE(isolate(), JSConstructStubGeneric));
node->RemoveInput(arity + 1);
node->InsertInput(graph()->zone(), 0,
jsgraph()->Constant(js_heap_broker(), code));
node->InsertInput(graph()->zone(), 0, jsgraph()->Constant(code));
node->InsertInput(graph()->zone(), 2, new_target);
node->InsertInput(graph()->zone(), 3, jsgraph()->Constant(arity));
node->InsertInput(graph()->zone(), 4, jsgraph()->UndefinedConstant());
......@@ -1643,7 +1641,7 @@ Reduction JSTypedLowering::ReduceJSCall(Node* node) {
if (target_type.IsHeapConstant() &&
target_type.AsHeapConstant()->Ref().IsJSFunction()) {
JSFunctionRef function = target_type.AsHeapConstant()->Ref().AsJSFunction();
SharedFunctionInfoRef shared = function.shared(js_heap_broker());
SharedFunctionInfoRef shared = function.shared();
if (shared.HasBreakInfo()) {
// Do not inline the call if we need to check whether to break at entry.
......@@ -1663,8 +1661,7 @@ Reduction JSTypedLowering::ReduceJSCall(Node* node) {
// Check if we need to convert the {receiver}.
if (is_sloppy(shared.language_mode()) && !shared.native() &&
!receiver_type.Is(Type::Receiver())) {
Node* global_proxy = jsgraph()->Constant(
js_heap_broker(), function.global_proxy(js_heap_broker()));
Node* global_proxy = jsgraph()->Constant(function.global_proxy());
receiver = effect =
graph()->NewNode(simplified()->ConvertReceiver(convert_mode),
receiver, global_proxy, effect, control);
......
src/compiler/node-matchers.h
View file @ 56d21252
......@@ -18,6 +18,8 @@ namespace v8 {
namespace internal {
namespace compiler {
class JSHeapBroker;
// A pattern matcher for nodes.
struct NodeMatcher {
explicit NodeMatcher(Node* node) : node_(node) {}
......@@ -193,7 +195,9 @@ struct HeapObjectMatcher final
return this->HasValue() && this->Value().address() == value.address();
}
ObjectRef Ref() const { return ObjectRef(this->Value()); }
ObjectRef Ref(const JSHeapBroker* broker) const {
return ObjectRef(broker, this->Value());
}
};
......
src/compiler/simplified-operator-reducer.cc
View file @ 56d21252
......@@ -62,8 +62,7 @@ Reduction SimplifiedOperatorReducer::Reduce(Node* node) {
case IrOpcode::kChangeTaggedToBit: {
HeapObjectMatcher m(node->InputAt(0));
if (m.HasValue()) {
HeapObjectRef object(m.Value());
return ReplaceInt32(object.BooleanValue(js_heap_broker()));
return ReplaceInt32(m.Ref(js_heap_broker()).BooleanValue());
}
if (m.IsChangeBitToTagged()) return Replace(m.InputAt(0));
break;
......
src/compiler/typed-optimization.cc
View file @ 56d21252
......@@ -93,7 +93,7 @@ base::Optional<MapRef> GetStableMapFromObjectType(
const JSHeapBroker* js_heap_broker, Type object_type) {
if (object_type.IsHeapConstant()) {
HeapObjectRef object = object_type.AsHeapConstant()->Ref();
MapRef object_map = object.map(js_heap_broker);
MapRef object_map = object.map();
if (object_map.is_stable()) return object_map;
}
return {};
......@@ -153,7 +153,7 @@ Reduction TypedOptimization::ReduceCheckMaps(Node* node) {
if (map_type.IsHeapConstant() &&
map_type.AsHeapConstant()->Ref().equals(*object_map)) {
if (object_map->CanTransition()) {
object_map->DependOnStableMap(js_heap_broker(), dependencies());
object_map->DependOnStableMap(dependencies());
}
return Replace(effect);
}
......@@ -219,9 +219,9 @@ Reduction TypedOptimization::ReduceLoadField(Node* node) {
GetStableMapFromObjectType(js_heap_broker(), object_type);
if (object_map.has_value()) {
if (object_map->CanTransition()) {
object_map->DependOnStableMap(js_heap_broker(), dependencies());
object_map->DependOnStableMap(dependencies());
}
Node* const value = jsgraph()->Constant(js_heap_broker(), *object_map);
Node* const value = jsgraph()->Constant(*object_map);
ReplaceWithValue(node, value);
return Replace(value);
}
......@@ -558,32 +558,30 @@ Reduction TypedOptimization::ReduceTypeOf(Node* node) {
Factory* const f = factory();
if (type.Is(Type::Boolean())) {
return Replace(
jsgraph()->Constant(js_heap_broker(), ObjectRef(f->boolean_string())));
jsgraph()->Constant(ObjectRef(js_heap_broker(), f->boolean_string())));
} else if (type.Is(Type::Number())) {
return Replace(
jsgraph()->Constant(js_heap_broker(), ObjectRef(f->number_string())));
jsgraph()->Constant(ObjectRef(js_heap_broker(), f->number_string())));
} else if (type.Is(Type::String())) {
return Replace(
jsgraph()->Constant(js_heap_broker(), ObjectRef(f->string_string())));
jsgraph()->Constant(ObjectRef(js_heap_broker(), f->string_string())));
} else if (type.Is(Type::BigInt())) {
return Replace(
jsgraph()->Constant(js_heap_broker(), ObjectRef(f->bigint_string())));
jsgraph()->Constant(ObjectRef(js_heap_broker(), f->bigint_string())));
} else if (type.Is(Type::Symbol())) {
return Replace(
jsgraph()->Constant(js_heap_broker(), ObjectRef(f->symbol_string())));
jsgraph()->Constant(ObjectRef(js_heap_broker(), f->symbol_string())));
} else if (type.Is(Type::OtherUndetectableOrUndefined())) {
return Replace(jsgraph()->Constant(js_heap_broker(),
ObjectRef(f->undefined_string())));
return Replace(jsgraph()->Constant(
ObjectRef(js_heap_broker(), f->undefined_string())));
} else if (type.Is(Type::NonCallableOrNull())) {
return Replace(
jsgraph()->Constant(js_heap_broker(), ObjectRef(f->object_string())));
jsgraph()->Constant(ObjectRef(js_heap_broker(), f->object_string())));
} else if (type.Is(Type::Function())) {
return Replace(
jsgraph()->Constant(js_heap_broker(), ObjectRef(f->function_string())));
jsgraph()->Constant(ObjectRef(js_heap_broker(), f->function_string())));
} else if (type.IsHeapConstant()) {
return Replace(jsgraph()->Constant(
js_heap_broker(),
type.AsHeapConstant()->Ref().TypeOf(js_heap_broker())));
return Replace(jsgraph()->Constant(type.AsHeapConstant()->Ref().TypeOf()));
}
return NoChange();
}
......
src/compiler/types.cc
View file @ 56d21252
......@@ -827,7 +827,7 @@ Type Type::NewConstant(const JSHeapBroker* js_heap_broker,
return NewConstant(static_cast<double>(maybe_smi.value()), zone);
}
HeapObjectRef heap_ref(value);
HeapObjectRef heap_ref(js_heap_broker, value);
if (heap_ref.IsHeapNumber()) {
return NewConstant(heap_ref.AsHeapNumber().value(), zone);
}
......@@ -1064,7 +1064,7 @@ Type Type::OtherNumberConstant(double value, Zone* zone) {
Type Type::HeapConstant(const JSHeapBroker* js_heap_broker,
Handle<i::Object> value, Zone* zone) {
return FromTypeBase(
HeapConstantType::New(js_heap_broker, HeapObjectRef(value), zone));
HeapConstantType::New(HeapObjectRef(js_heap_broker, value), zone));
}
// static
......
src/compiler/types.h
View file @ 56d21252
......@@ -541,11 +541,10 @@ class V8_EXPORT_PRIVATE HeapConstantType : public NON_EXPORTED_BASE(TypeBase) {
friend class Type;
friend class BitsetType;
static HeapConstantType* New(const JSHeapBroker* broker,
const HeapObjectRef& heap_ref, Zone* zone) {
static HeapConstantType* New(const HeapObjectRef& heap_ref, Zone* zone) {
DCHECK(!heap_ref.IsHeapNumber());
DCHECK_IMPLIES(heap_ref.IsString(), heap_ref.IsInternalizedString());
BitsetType::bitset bitset = BitsetType::Lub(heap_ref.type(broker));
BitsetType::bitset bitset = BitsetType::Lub(heap_ref.type());
return new (zone->New(sizeof(HeapConstantType)))
HeapConstantType(bitset, heap_ref);
}
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment