[turbofan] Brokerize simplified operator reducer.

R=jarin@chromium.org

Bug: v8:7790
Change-Id: I4d9c561720005f7b667085c7dcf4e777e65d1e05
Reviewed-on: https://chromium-review.googlesource.com/1128891Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54340}

src/compiler/js-heap-broker.cc

@@ -629,6 +629,11 @@ MapRef NativeContextRef::GetFunctionMapFromIndex(const JSHeapBroker* broker,
   return get(broker, index).AsMap();
 }
 
+bool ObjectRef::BooleanValue(const JSHeapBroker* broker) {
+  AllowHandleDereference allow_handle_dereference;
+  return object<Object>()->BooleanValue(broker->isolate());
+}
+
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8

src/compiler/js-heap-broker.h

@@ -93,8 +93,6 @@ class ObjectRef {
 
   OddballType oddball_type(const JSHeapBroker* broker) const;
 
-  StringRef TypeOf(const JSHeapBroker* broker) const;
-
   bool IsSmi() const;
   int AsSmi() const;
 
@@ -108,6 +106,9 @@ class ObjectRef {
   HEAP_BROKER_OBJECT_LIST(HEAP_AS_METHOD_DECL)
 #undef HEAP_AS_METHOD_DECL
 
+  StringRef TypeOf(const JSHeapBroker* broker) const;
+  bool BooleanValue(const JSHeapBroker* broker);
+
  private:
   Handle<Object> object_;
 };

src/compiler/pipeline.cc

@@ -1281,7 +1281,8 @@ struct TypedLoweringPhase {
     TypedOptimization typed_optimization(&graph_reducer, data->dependencies(),
                                          data->jsgraph(),
                                          data->js_heap_broker());
-    SimplifiedOperatorReducer simple_reducer(&graph_reducer, data->jsgraph());
+    SimplifiedOperatorReducer simple_reducer(&graph_reducer, data->jsgraph(),
+                                             data->js_heap_broker());
     CheckpointElimination checkpoint_elimination(&graph_reducer);
     CommonOperatorReducer common_reducer(data->isolate(), &graph_reducer,
                                          data->graph(), data->common(),
@@ -1399,7 +1400,8 @@ struct EarlyOptimizationPhase {
                                data->jsgraph()->Dead());
     DeadCodeElimination dead_code_elimination(&graph_reducer, data->graph(),
                                               data->common(), temp_zone);
-    SimplifiedOperatorReducer simple_reducer(&graph_reducer, data->jsgraph());
+    SimplifiedOperatorReducer simple_reducer(&graph_reducer, data->jsgraph(),
+                                             data->js_heap_broker());
     RedundancyElimination redundancy_elimination(&graph_reducer, temp_zone);
     ValueNumberingReducer value_numbering(temp_zone, data->graph()->zone());
     MachineOperatorReducer machine_reducer(data->jsgraph());

src/compiler/simplified-operator-reducer.cc

@@ -32,16 +32,24 @@ Decision DecideObjectIsSmi(Node* const input) {
 
 }  // namespace
 
-SimplifiedOperatorReducer::SimplifiedOperatorReducer(Editor* editor,
-                                                     JSGraph* jsgraph)
-    : AdvancedReducer(editor), jsgraph_(jsgraph) {}
+SimplifiedOperatorReducer::SimplifiedOperatorReducer(
+    Editor* editor, JSGraph* jsgraph, const JSHeapBroker* js_heap_broker)
+    : AdvancedReducer(editor),
+      jsgraph_(jsgraph),
+      js_heap_broker_(js_heap_broker) {}
 
 SimplifiedOperatorReducer::~SimplifiedOperatorReducer() {}
 
 
 Reduction SimplifiedOperatorReducer::Reduce(Node* node) {
+  DisallowHeapAllocation no_heap_allocation;
+  DisallowHandleAllocation no_handle_allocation;
+  DisallowHandleDereference no_handle_dereference;
+  DisallowCodeDependencyChange no_dependency_change;
+
   switch (node->opcode()) {
     case IrOpcode::kBooleanNot: {
+      // TODO(neis): Provide HeapObjectRefMatcher?
       HeapObjectMatcher m(node->InputAt(0));
       if (m.Is(factory()->true_value())) return ReplaceBoolean(false);
       if (m.Is(factory()->false_value())) return ReplaceBoolean(true);
@@ -57,7 +65,10 @@ Reduction SimplifiedOperatorReducer::Reduce(Node* node) {
     }
     case IrOpcode::kChangeTaggedToBit: {
       HeapObjectMatcher m(node->InputAt(0));
-      if (m.HasValue()) return ReplaceInt32(m.Value()->BooleanValue(isolate()));
+      if (m.HasValue()) {
+        HeapObjectRef object(m.Value());
+        return ReplaceInt32(object.BooleanValue(js_heap_broker()));
+      }
       if (m.IsChangeBitToTagged()) return Replace(m.InputAt(0));
       break;
     }

src/compiler/simplified-operator-reducer.h

@@ -26,7 +26,8 @@ class SimplifiedOperatorBuilder;
 class V8_EXPORT_PRIVATE SimplifiedOperatorReducer final
     : public NON_EXPORTED_BASE(AdvancedReducer) {
  public:
-  SimplifiedOperatorReducer(Editor* editor, JSGraph* jsgraph);
+  SimplifiedOperatorReducer(Editor* editor, JSGraph* jsgraph,
+                            const JSHeapBroker* js_heap_broker);
   ~SimplifiedOperatorReducer() final;
 
   const char* reducer_name() const override {
@@ -51,11 +52,14 @@ class V8_EXPORT_PRIVATE SimplifiedOperatorReducer final
   Factory* factory() const;
   Graph* graph() const;
   Isolate* isolate() const;
-  JSGraph* jsgraph() const { return jsgraph_; }
   MachineOperatorBuilder* machine() const;
   SimplifiedOperatorBuilder* simplified() const;
 
+  JSGraph* jsgraph() const { return jsgraph_; }
+  const JSHeapBroker* js_heap_broker() const { return js_heap_broker_; }
+
   JSGraph* const jsgraph_;
+  const JSHeapBroker* const js_heap_broker_;
 
   DISALLOW_COPY_AND_ASSIGN(SimplifiedOperatorReducer);
 };

test/unittests/compiler/simplified-operator-reducer-unittest.cc

@@ -29,12 +29,14 @@ class SimplifiedOperatorReducerTest : public GraphTest {
 
  protected:
   Reduction Reduce(Node* node) {
+    JSHeapBroker js_heap_broker(isolate());
     MachineOperatorBuilder machine(zone());
     JSOperatorBuilder javascript(zone());
     JSGraph jsgraph(isolate(), graph(), common(), &javascript, simplified(),
                     &machine);
     GraphReducer graph_reducer(zone(), graph());
-    SimplifiedOperatorReducer reducer(&graph_reducer, &jsgraph);
+    SimplifiedOperatorReducer reducer(&graph_reducer, &jsgraph,
+                                      &js_heap_broker);
     return reducer.Reduce(node);
   }