[turbofan] Add missing data to the serializer

The serializer was missing the opportunity to process calls later
constructed by JSNativeContextSpecialization::InlinePropertySetterCall
and InlinePropertyGetterCall. Added a test to ensure we're not missing
the data anymore.

This drops the "Missing data" warnings when running ARES-6 from 1044
to only 12.

Bug: v8:7790
Change-Id: Ic4b8a4cb2ac3927371b75f22de011b9957502319
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1937147Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65220}

src/compiler/serializer-for-background-compilation.cc

@@ -621,6 +621,12 @@ Hints Hints::SingleConstant(Handle<Object> constant, Zone* zone) {
   return result;
 }
 
+Hints Hints::SingleMap(Handle<Map> map, Zone* zone) {
+  Hints result;
+  result.AddMap(map, zone);
+  return result;
+}
+
 ConstantsSet Hints::constants() const {
   return IsAllocated() ? impl_->constants_ : ConstantsSet();
 }
@@ -2084,8 +2090,7 @@ void SerializerForBackgroundCompilation::ProcessCallOrConstruct(
   }
 
   // For JSNativeContextSpecialization::InferReceiverRootMap
-  Hints new_accumulator_hints =
-      result_hints_from_new_target.Copy(zone());  // XXX
+  Hints new_accumulator_hints = result_hints_from_new_target.Copy(zone());
 
   ProcessCallOrConstructRecursive(callee, new_target, *arguments,
                                   speculation_mode, padding,
@@ -2893,8 +2898,16 @@ SerializerForBackgroundCompilation::ProcessMapForNamedPropertyAccess(
     if (access_info.constant()->IsJSFunction()) {
       JSFunctionRef function(broker(), access_info.constant());
 
-      // For JSCallReducer::ReduceJSCall.
-      function.Serialize();
+      // For JSCallReducer and JSInlining(Heuristic).
+      HintsVector arguments({Hints::SingleMap(receiver_map.object(), zone())},
+                            zone());
+      // In the case of a setter any added result hints won't make sense, but
+      // they will be ignored anyways by Process*PropertyAccess due to the
+      // access mode not being kLoad.
+      ProcessCalleeForCallOrConstruct(
+          function.object(), base::nullopt, arguments,
+          SpeculationMode::kDisallowSpeculation, kMissingArgumentsAreUndefined,
+          result_hints);
 
       // For JSCallReducer::ReduceCallApiFunction.
       Handle<SharedFunctionInfo> sfi = function.shared().object();
@@ -3033,8 +3046,6 @@ void SerializerForBackgroundCompilation::ProcessNamedPropertyAccess(
 
   if (access_mode == AccessMode::kLoad) {
     environment()->accumulator_hints() = new_accumulator_hints;
-  } else {
-    DCHECK(new_accumulator_hints.IsEmpty());
   }
 }
 

src/compiler/serializer-hints.h

@@ -104,6 +104,7 @@ class Hints {
  public:
   Hints() = default;  // Empty.
   static Hints SingleConstant(Handle<Object> constant, Zone* zone);
+  static Hints SingleMap(Handle<Map> map, Zone* zone);
 
   // For inspection only.
   ConstantsSet constants() const;

test/mjsunit/compiler/serializer-accessors.js

+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+class C {
+  get prop() {
+    return 42;
+  }
+  set prop(v) {
+    %TurbofanStaticAssert(v === 43);
+  }
+}
+
+const c = new C();
+
+function foo() {
+  %TurbofanStaticAssert(c.prop === 42);
+  c.prop = 43;
+}
+
+%PrepareFunctionForOptimization(
+    Object.getOwnPropertyDescriptor(C.prototype, 'prop').get);
+%PrepareFunctionForOptimization(
+    Object.getOwnPropertyDescriptor(C.prototype, 'prop').set);
+%PrepareFunctionForOptimization(foo);
+foo();
+foo();
+%OptimizeFunctionOnNextCall(foo);
+foo();

test/mjsunit/mjsunit.status

@@ -1086,6 +1086,7 @@
   'compiler/load-elimination-const-field': [SKIP],
   'compiler/constant-fold-add-static': [SKIP],
   'compiler/serializer-feedback-propagation-*': [SKIP],
+  'compiler/serializer-accessors': [SKIP],
 
   # Some tests rely on inlining.
   'compiler/opt-higher-order-functions': [SKIP],