[turbofan] Brokerize some more in JSCallReducer.

Bug: v8:7790
Change-Id: I14bac46ef7457ea142f79f96fc5a2018d429dcc8
Reviewed-on: https://chromium-review.googlesource.com/c/1297323
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56962}

src/compiler/js-call-reducer.cc

@@ -502,8 +502,8 @@ Reduction JSCallReducer::ReduceFunctionPrototypeCall(Node* node) {
   Node* context;
   HeapObjectMatcher m(target);
   if (m.HasValue()) {
-    Handle<JSFunction> function = Handle<JSFunction>::cast(m.Value());
-    context = jsgraph()->HeapConstant(handle(function->context(), isolate()));
+    JSFunctionRef function = m.Ref(broker()).AsJSFunction();
+    context = jsgraph()->Constant(function.context());
   } else {
     context = effect = graph()->NewNode(
         simplified()->LoadField(AccessBuilder::ForJSFunctionContext()), target,
@@ -855,9 +855,8 @@ Reduction JSCallReducer::ReduceReflectGet(Node* node) {
         javascript()->CallRuntime(Runtime::kThrowTypeError, 2),
         jsgraph()->Constant(
             static_cast<int>(MessageTemplate::kCalledOnNonObject)),
-        jsgraph()->HeapConstant(
-            factory()->NewStringFromAsciiChecked("Reflect.get")),
-        context, frame_state, efalse, if_false);
+        jsgraph()->HeapConstant(factory()->ReflectGet_string()), context,
+        frame_state, efalse, if_false);
   }
 
   // Otherwise just use the existing GetPropertyStub.
@@ -933,9 +932,8 @@ Reduction JSCallReducer::ReduceReflectHas(Node* node) {
         javascript()->CallRuntime(Runtime::kThrowTypeError, 2),
         jsgraph()->Constant(
             static_cast<int>(MessageTemplate::kCalledOnNonObject)),
-        jsgraph()->HeapConstant(
-            factory()->NewStringFromAsciiChecked("Reflect.has")),
-        context, frame_state, efalse, if_false);
+        jsgraph()->HeapConstant(factory()->ReflectHas_string()), context,
+        frame_state, efalse, if_false);
   }
 
   // Otherwise just use the existing {JSHasProperty} logic.
@@ -2561,24 +2559,24 @@ Reduction JSCallReducer::ReduceArrayIndexOfIncludes(
     return NoChange();
   }
 
-  Handle<Map> receiver_map;
-  if (!NodeProperties::GetMapWitness(broker(), node).ToHandle(&receiver_map))
+  Handle<Map> map;
+  if (!NodeProperties::GetMapWitness(broker(), node).ToHandle(&map))
     return NoChange();
 
-  if (!CanInlineArrayIteratingBuiltin(isolate(),
-                                      MapRef(broker(), receiver_map)))
+  MapRef receiver_map(broker(), map);
+  if (!CanInlineArrayIteratingBuiltin(isolate(), receiver_map))
     return NoChange();
 
-  if (IsHoleyElementsKind(receiver_map->elements_kind())) {
+  ElementsKind const elements_kind = receiver_map.elements_kind();
+  if (IsHoleyElementsKind(elements_kind)) {
     dependencies()->DependOnProtector(
         PropertyCellRef(broker(), factory()->no_elements_protector()));
   }
 
   Callable const callable =
       search_variant == SearchVariant::kIndexOf
-          ? GetCallableForArrayIndexOf(receiver_map->elements_kind(), isolate())
-          : GetCallableForArrayIncludes(receiver_map->elements_kind(),
-                                        isolate());
+          ? GetCallableForArrayIndexOf(elements_kind, isolate())
+          : GetCallableForArrayIncludes(elements_kind, isolate());
   CallDescriptor const* const desc = Linkage::GetStubCallDescriptor(
       graph()->zone(), callable.descriptor(),
       callable.descriptor().GetStackParameterCount(), CallDescriptor::kNoFlags,
@@ -2596,8 +2594,7 @@ Reduction JSCallReducer::ReduceArrayIndexOfIncludes(
                              ? NodeProperties::GetValueInput(node, 2)
                              : jsgraph()->UndefinedConstant();
   Node* length = effect = graph()->NewNode(
-      simplified()->LoadField(
-          AccessBuilder::ForJSArrayLength(receiver_map->elements_kind())),
+      simplified()->LoadField(AccessBuilder::ForJSArrayLength(elements_kind)),
       receiver, effect, control);
   Node* new_from_index = jsgraph()->ZeroConstant();
   if (node->op()->ValueInputCount() >= 4) {
@@ -2658,7 +2655,7 @@ Reduction JSCallReducer::ReduceArraySome(Node* node,
 
   if (receiver_maps.size() == 0) return NoChange();
 
-  const ElementsKind kind = receiver_maps[0]->elements_kind();
+  const ElementsKind kind = MapRef(broker(), receiver_maps[0]).elements_kind();
 
   for (Handle<Map> map : receiver_maps) {
     MapRef receiver_map(broker(), map);

src/compiler/js-heap-broker.cc

@@ -284,6 +284,7 @@ class JSFunctionData : public JSObjectData {
 
   void Serialize(JSHeapBroker* broker);
 
+  ContextData* context() const { return context_; }
   NativeContextData* native_context() const { return native_context_; }
   MapData* initial_map() const { return initial_map_; }
   ObjectData* prototype() const { return prototype_; }
@@ -300,6 +301,7 @@ class JSFunctionData : public JSObjectData {
 
   bool serialized_ = false;
 
+  ContextData* context_ = nullptr;
   NativeContextData* native_context_ = nullptr;
   MapData* initial_map_ = nullptr;
   ObjectData* prototype_ = nullptr;
@@ -749,11 +751,13 @@ void JSFunctionData::Serialize(JSHeapBroker* broker) {
   TraceScope tracer(broker, this, "JSFunctionData::Serialize");
   Handle<JSFunction> function = Handle<JSFunction>::cast(object());
 
+  DCHECK_NULL(context_);
   DCHECK_NULL(native_context_);
   DCHECK_NULL(initial_map_);
   DCHECK_NULL(prototype_);
   DCHECK_NULL(shared_);
 
+  context_ = broker->GetOrCreateData(function->context())->AsContext();
   native_context_ =
       broker->GetOrCreateData(function->native_context())->AsNativeContext();
   shared_ = broker->GetOrCreateData(function->shared())->AsSharedFunctionInfo();
@@ -2059,6 +2063,7 @@ BIMODAL_ACCESSOR(JSArray, Object, length)
 BIMODAL_ACCESSOR_C(JSFunction, bool, has_prototype)
 BIMODAL_ACCESSOR_C(JSFunction, bool, has_initial_map)
 BIMODAL_ACCESSOR_C(JSFunction, bool, PrototypeRequiresRuntimeLookup)
+BIMODAL_ACCESSOR(JSFunction, Context, context)
 BIMODAL_ACCESSOR(JSFunction, NativeContext, native_context)
 BIMODAL_ACCESSOR(JSFunction, Map, initial_map)
 BIMODAL_ACCESSOR(JSFunction, Object, prototype)

src/compiler/js-heap-broker.h

@@ -208,6 +208,7 @@ class JSFunctionRef : public JSObjectRef {
   // The following are available only after calling Serialize().
   ObjectRef prototype() const;
   MapRef initial_map() const;
+  ContextRef context() const;
   NativeContextRef native_context() const;
   SharedFunctionInfoRef shared() const;
   int InitialMapInstanceSizeWithMinSlack() const;

src/heap-symbols.h

@@ -241,6 +241,8 @@
   V(_, raw_string, "raw")                                             \
   V(_, ReconfigureToDataProperty_string, "ReconfigureToDataProperty") \
   V(_, ReferenceError_string, "ReferenceError")                       \
+  V(_, ReflectGet_string, "Reflect.get")                              \
+  V(_, ReflectHas_string, "Reflect.has")                              \
   V(_, RegExp_string, "RegExp")                                       \
   V(_, regexp_to_string, "[object RegExp]")                           \
   V(_, reject_string, "reject")                                       \

tools/v8heapconst.py

@@ -296,41 +296,41 @@ KNOWN_MAPS = {
   ("RO_SPACE", 0x02699): (171, "Tuple2Map"),
   ("RO_SPACE", 0x02739): (173, "ArrayBoilerplateDescriptionMap"),
   ("RO_SPACE", 0x02a79): (161, "InterceptorInfoMap"),
-  ("RO_SPACE", 0x050d9): (153, "AccessCheckInfoMap"),
-  ("RO_SPACE", 0x05129): (154, "AccessorInfoMap"),
-  ("RO_SPACE", 0x05179): (155, "AccessorPairMap"),
-  ("RO_SPACE", 0x051c9): (156, "AliasedArgumentsEntryMap"),
-  ("RO_SPACE", 0x05219): (157, "AllocationMementoMap"),
-  ("RO_SPACE", 0x05269): (158, "AsyncGeneratorRequestMap"),
-  ("RO_SPACE", 0x052b9): (159, "DebugInfoMap"),
-  ("RO_SPACE", 0x05309): (160, "FunctionTemplateInfoMap"),
-  ("RO_SPACE", 0x05359): (162, "InterpreterDataMap"),
-  ("RO_SPACE", 0x053a9): (163, "ModuleInfoEntryMap"),
-  ("RO_SPACE", 0x053f9): (164, "ModuleMap"),
-  ("RO_SPACE", 0x05449): (165, "ObjectTemplateInfoMap"),
-  ("RO_SPACE", 0x05499): (166, "PromiseCapabilityMap"),
-  ("RO_SPACE", 0x054e9): (167, "PromiseReactionMap"),
-  ("RO_SPACE", 0x05539): (168, "PrototypeInfoMap"),
-  ("RO_SPACE", 0x05589): (169, "ScriptMap"),
-  ("RO_SPACE", 0x055d9): (170, "StackFrameInfoMap"),
-  ("RO_SPACE", 0x05629): (172, "Tuple3Map"),
-  ("RO_SPACE", 0x05679): (174, "WasmDebugInfoMap"),
-  ("RO_SPACE", 0x056c9): (175, "WasmExportedFunctionDataMap"),
-  ("RO_SPACE", 0x05719): (176, "CallableTaskMap"),
-  ("RO_SPACE", 0x05769): (177, "CallbackTaskMap"),
-  ("RO_SPACE", 0x057b9): (178, "PromiseFulfillReactionJobTaskMap"),
-  ("RO_SPACE", 0x05809): (179, "PromiseRejectReactionJobTaskMap"),
-  ("RO_SPACE", 0x05859): (180, "PromiseResolveThenableJobTaskMap"),
-  ("RO_SPACE", 0x058a9): (181, "MicrotaskQueueMap"),
-  ("RO_SPACE", 0x058f9): (182, "AllocationSiteWithWeakNextMap"),
-  ("RO_SPACE", 0x05949): (182, "AllocationSiteWithoutWeakNextMap"),
-  ("RO_SPACE", 0x05999): (214, "LoadHandler1Map"),
-  ("RO_SPACE", 0x059e9): (214, "LoadHandler2Map"),
-  ("RO_SPACE", 0x05a39): (214, "LoadHandler3Map"),
-  ("RO_SPACE", 0x05a89): (221, "StoreHandler0Map"),
-  ("RO_SPACE", 0x05ad9): (221, "StoreHandler1Map"),
-  ("RO_SPACE", 0x05b29): (221, "StoreHandler2Map"),
-  ("RO_SPACE", 0x05b79): (221, "StoreHandler3Map"),
+  ("RO_SPACE", 0x05119): (153, "AccessCheckInfoMap"),
+  ("RO_SPACE", 0x05169): (154, "AccessorInfoMap"),
+  ("RO_SPACE", 0x051b9): (155, "AccessorPairMap"),
+  ("RO_SPACE", 0x05209): (156, "AliasedArgumentsEntryMap"),
+  ("RO_SPACE", 0x05259): (157, "AllocationMementoMap"),
+  ("RO_SPACE", 0x052a9): (158, "AsyncGeneratorRequestMap"),
+  ("RO_SPACE", 0x052f9): (159, "DebugInfoMap"),
+  ("RO_SPACE", 0x05349): (160, "FunctionTemplateInfoMap"),
+  ("RO_SPACE", 0x05399): (162, "InterpreterDataMap"),
+  ("RO_SPACE", 0x053e9): (163, "ModuleInfoEntryMap"),
+  ("RO_SPACE", 0x05439): (164, "ModuleMap"),
+  ("RO_SPACE", 0x05489): (165, "ObjectTemplateInfoMap"),
+  ("RO_SPACE", 0x054d9): (166, "PromiseCapabilityMap"),
+  ("RO_SPACE", 0x05529): (167, "PromiseReactionMap"),
+  ("RO_SPACE", 0x05579): (168, "PrototypeInfoMap"),
+  ("RO_SPACE", 0x055c9): (169, "ScriptMap"),
+  ("RO_SPACE", 0x05619): (170, "StackFrameInfoMap"),
+  ("RO_SPACE", 0x05669): (172, "Tuple3Map"),
+  ("RO_SPACE", 0x056b9): (174, "WasmDebugInfoMap"),
+  ("RO_SPACE", 0x05709): (175, "WasmExportedFunctionDataMap"),
+  ("RO_SPACE", 0x05759): (176, "CallableTaskMap"),
+  ("RO_SPACE", 0x057a9): (177, "CallbackTaskMap"),
+  ("RO_SPACE", 0x057f9): (178, "PromiseFulfillReactionJobTaskMap"),
+  ("RO_SPACE", 0x05849): (179, "PromiseRejectReactionJobTaskMap"),
+  ("RO_SPACE", 0x05899): (180, "PromiseResolveThenableJobTaskMap"),
+  ("RO_SPACE", 0x058e9): (181, "MicrotaskQueueMap"),
+  ("RO_SPACE", 0x05939): (182, "AllocationSiteWithWeakNextMap"),
+  ("RO_SPACE", 0x05989): (182, "AllocationSiteWithoutWeakNextMap"),
+  ("RO_SPACE", 0x059d9): (214, "LoadHandler1Map"),
+  ("RO_SPACE", 0x05a29): (214, "LoadHandler2Map"),
+  ("RO_SPACE", 0x05a79): (214, "LoadHandler3Map"),
+  ("RO_SPACE", 0x05ac9): (221, "StoreHandler0Map"),
+  ("RO_SPACE", 0x05b19): (221, "StoreHandler1Map"),
+  ("RO_SPACE", 0x05b69): (221, "StoreHandler2Map"),
+  ("RO_SPACE", 0x05bb9): (221, "StoreHandler3Map"),
   ("MAP_SPACE", 0x00139): (1057, "ExternalMap"),
   ("MAP_SPACE", 0x00189): (1073, "JSMessageObjectMap"),
 }