[turbofan] Introduce JS heap broker.

As a first step towards moving accesses to the broker, this moves
heap accesses from BitsetType::Lub to the broker.

Bug: v8:7790
Change-Id: Ie240b84b979717caae42cb8aa06ee8d9877a446d
Reviewed-on: https://chromium-review.googlesource.com/1088695
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53571}

BUILD.gn

@@ -1693,6 +1693,8 @@ v8_source_set("v8_base") {
     "src/compiler/js-generic-lowering.h",
     "src/compiler/js-graph.cc",
     "src/compiler/js-graph.h",
+    "src/compiler/js-heap-broker.cc",
+    "src/compiler/js-heap-broker.h",
     "src/compiler/js-inlining-heuristic.cc",
     "src/compiler/js-inlining-heuristic.h",
     "src/compiler/js-inlining.cc",

src/compiler/access-info.cc

@@ -237,8 +237,10 @@ Handle<Cell> PropertyAccessInfo::export_cell() const {
 }
 
 AccessInfoFactory::AccessInfoFactory(CompilationDependencies* dependencies,
+                                     const JSHeapBroker* js_heap_broker,
                                      Handle<Context> native_context, Zone* zone)
     : dependencies_(dependencies),
+      js_heap_broker_(js_heap_broker),
       native_context_(native_context),
       isolate_(native_context->GetIsolate()),
       type_cache_(TypeCache::Get()),
@@ -398,8 +400,8 @@ bool AccessInfoFactory::ComputePropertyAccessInfo(
               dependencies()->AssumeFieldOwner(field_owner_map);
 
               // Remember the field map, and try to infer a useful type.
-              field_type =
-                  Type::For(isolate(), descriptors_field_type->AsClass());
+              field_type = Type::For(js_heap_broker(),
+                                     descriptors_field_type->AsClass());
               field_map = descriptors_field_type->AsClass();
             }
           }
@@ -704,7 +706,8 @@ bool AccessInfoFactory::LookupTransition(Handle<Map> map, Handle<Name> name,
       dependencies()->AssumeFieldOwner(field_owner_map);
 
       // Remember the field map, and try to infer a useful type.
-      field_type = Type::For(isolate(), descriptors_field_type->AsClass());
+      field_type =
+          Type::For(js_heap_broker(), descriptors_field_type->AsClass());
       field_map = descriptors_field_type->AsClass();
     }
   }

src/compiler/access-info.h

@@ -141,6 +141,7 @@ class PropertyAccessInfo final {
 class AccessInfoFactory final {
  public:
   AccessInfoFactory(CompilationDependencies* dependencies,
+                    const JSHeapBroker* js_heap_broker,
                     Handle<Context> native_context, Zone* zone);
 
   bool ComputeElementAccessInfo(Handle<Map> map, AccessMode access_mode,
@@ -167,12 +168,14 @@ class AccessInfoFactory final {
                         PropertyAccessInfo* access_info);
 
   CompilationDependencies* dependencies() const { return dependencies_; }
+  const JSHeapBroker* js_heap_broker() const { return js_heap_broker_; }
   Factory* factory() const;
   Isolate* isolate() const { return isolate_; }
   Handle<Context> native_context() const { return native_context_; }
   Zone* zone() const { return zone_; }
 
   CompilationDependencies* const dependencies_;
+  const JSHeapBroker* const js_heap_broker_;
   Handle<Context> const native_context_;
   Isolate* const isolate_;
   TypeCache const& type_cache_;

src/compiler/js-create-lowering.cc

@@ -776,7 +776,7 @@ Reduction JSCreateLowering::ReduceJSCreateArray(Node* node) {
   Node* new_target = NodeProperties::GetValueInput(node, 1);
   Type new_target_type =
       (target == new_target)
-          ? Type::HeapConstant(isolate(), constructor, zone())
+          ? Type::HeapConstant(js_heap_broker(), constructor, zone())
           : NodeProperties::GetType(new_target);
 
   // Extract original constructor function.
@@ -1789,7 +1789,7 @@ Node* JSCreateLowering::AllocateFastLiteral(
   // Actually allocate and initialize the object.
   AllocationBuilder builder(jsgraph(), effect, control);
   builder.Allocate(boilerplate_map->instance_size(), pretenure,
-                   Type::For(isolate(), boilerplate_map));
+                   Type::For(js_heap_broker(), boilerplate_map));
   builder.Store(AccessBuilder::ForMap(), boilerplate_map);
   builder.Store(AccessBuilder::ForJSObjectPropertiesOrHash(), properties);
   builder.Store(AccessBuilder::ForJSObjectElements(), elements);
@@ -1895,7 +1895,8 @@ Node* JSCreateLowering::AllocateLiteralRegExp(Node* effect, Node* control,
       JSRegExp::kSize + JSRegExp::kInObjectFieldCount * kPointerSize;
 
   AllocationBuilder builder(jsgraph(), effect, control);
-  builder.Allocate(size, pretenure, Type::For(isolate(), boilerplate_map));
+  builder.Allocate(size, pretenure,
+                   Type::For(js_heap_broker(), boilerplate_map));
   builder.Store(AccessBuilder::ForMap(), boilerplate_map);
   builder.Store(AccessBuilder::ForJSObjectPropertiesOrHash(),
                 handle(boilerplate->raw_properties_or_hash(), isolate()));

src/compiler/js-create-lowering.h

@@ -23,6 +23,7 @@ namespace compiler {
 // Forward declarations.
 class CommonOperatorBuilder;
 class JSGraph;
+class JSHeapBroker;
 class JSOperatorBuilder;
 class MachineOperatorBuilder;
 class SimplifiedOperatorBuilder;
@@ -33,11 +34,12 @@ class V8_EXPORT_PRIVATE JSCreateLowering final
     : public NON_EXPORTED_BASE(AdvancedReducer) {
  public:
   JSCreateLowering(Editor* editor, CompilationDependencies* dependencies,
-                   JSGraph* jsgraph,
+                   JSGraph* jsgraph, const JSHeapBroker* js_heap_broker,
                    Handle<Context> native_context, Zone* zone)
       : AdvancedReducer(editor),
         dependencies_(dependencies),
         jsgraph_(jsgraph),
+        js_heap_broker_(js_heap_broker),
         native_context_(native_context),
         zone_(zone) {}
   ~JSCreateLowering() final {}
@@ -114,10 +116,12 @@ class V8_EXPORT_PRIVATE JSCreateLowering final
   CommonOperatorBuilder* common() const;
   SimplifiedOperatorBuilder* simplified() const;
   CompilationDependencies* dependencies() const { return dependencies_; }
+  const JSHeapBroker* js_heap_broker() const { return js_heap_broker_; }
   Zone* zone() const { return zone_; }
 
   CompilationDependencies* const dependencies_;
   JSGraph* const jsgraph_;
+  const JSHeapBroker* const js_heap_broker_;
   Handle<Context> const native_context_;
   Zone* const zone_;
 };

src/compiler/js-heap-broker.cc

+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/compiler/js-heap-broker.h"
+#include "src/objects-inl.h"
+
+namespace v8 {
+namespace internal {
+namespace compiler {
+
+JSHeapBroker::JSHeapBroker(Isolate* isolate) : isolate_(isolate) {}
+
+HeapReferenceType JSHeapBroker::HeapReferenceTypeFromMap(Map* map) const {
+  AllowHandleDereference allow_handle_dereference;
+  Heap* heap = isolate_->heap();
+  HeapReferenceType::OddballType oddball_type = HeapReferenceType::kUnknown;
+  if (map->instance_type() == ODDBALL_TYPE) {
+    if (map == heap->undefined_map()) {
+      oddball_type = HeapReferenceType::kUndefined;
+    } else if (map == heap->null_map()) {
+      oddball_type = HeapReferenceType::kNull;
+    } else if (map == heap->boolean_map()) {
+      oddball_type = HeapReferenceType::kBoolean;
+    } else if (map == heap->the_hole_map()) {
+      oddball_type = HeapReferenceType::kHole;
+    } else {
+      DCHECK(map == heap->uninitialized_map() ||
+             map == heap->termination_exception_map() ||
+             map == heap->arguments_marker_map() ||
+             map == heap->optimized_out_map() ||
+             map == heap->stale_register_map());
+    }
+  }
+  HeapReferenceType::Flags flags(0);
+  if (map->is_undetectable()) flags |= HeapReferenceType::kUndetectable;
+  if (map->is_callable()) flags |= HeapReferenceType::kCallable;
+
+  return HeapReferenceType(map->instance_type(), flags, oddball_type);
+}
+
+HeapReferenceType JSHeapBroker::HeapReferenceTypeForObject(
+    Handle<HeapObject> object) const {
+  AllowHandleDereference allow_handle_dereference;
+  return HeapReferenceTypeFromMap(object->map());
+}
+
+}  // namespace compiler
+}  // namespace internal
+}  // namespace v8

src/compiler/js-heap-broker.h

+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_COMPILER_JS_HEAP_BROKER_H_
+#define V8_COMPILER_JS_HEAP_BROKER_H_
+
+#include "src/base/compiler-specific.h"
+#include "src/globals.h"
+#include "src/objects.h"
+
+namespace v8 {
+namespace internal {
+namespace compiler {
+
+class HeapReferenceType {
+ public:
+  enum OddballType : uint8_t { kUnknown, kBoolean, kUndefined, kNull, kHole };
+  enum Flag : uint8_t { kUndetectable = 1 << 0, kCallable = 1 << 1 };
+
+  typedef base::Flags<Flag> Flags;
+
+  HeapReferenceType(InstanceType instance_type, Flags flags,
+                    OddballType oddball_type = kUnknown)
+      : instance_type_(instance_type),
+        oddball_type_(oddball_type),
+        flags_(flags) {}
+
+  OddballType oddball_type() const { return oddball_type_; }
+  InstanceType instance_type() const { return instance_type_; }
+  Flags flags() const { return flags_; }
+
+  bool is_callable() const { return flags_ & kCallable; }
+  bool is_undetectable() const { return flags_ & kUndetectable; }
+
+ private:
+  InstanceType const instance_type_;
+  OddballType const oddball_type_;
+  Flags const flags_;
+};
+
+class V8_EXPORT_PRIVATE JSHeapBroker : public NON_EXPORTED_BASE(ZoneObject) {
+ public:
+  JSHeapBroker(Isolate* isolate);
+
+  HeapReferenceType HeapReferenceTypeFromMap(Handle<Map> map) const {
+    return HeapReferenceTypeFromMap(*map);
+  }
+
+  HeapReferenceType HeapReferenceTypeForObject(Handle<HeapObject> object) const;
+
+ private:
+  HeapReferenceType HeapReferenceTypeFromMap(Map* map) const;
+
+  Isolate* const isolate_;
+};
+
+}  // namespace compiler
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_COMPILER_JS_HEAP_BROKER_H_

src/compiler/js-native-context-specialization.cc

@@ -58,11 +58,12 @@ struct JSNativeContextSpecialization::ScriptContextTableLookupResult {
 };
 
 JSNativeContextSpecialization::JSNativeContextSpecialization(
-    Editor* editor, JSGraph* jsgraph, Flags flags,
-    Handle<Context> native_context, CompilationDependencies* dependencies,
-    Zone* zone)
+    Editor* editor, JSGraph* jsgraph, const JSHeapBroker* js_heap_broker,
+    Flags flags, Handle<Context> native_context,
+    CompilationDependencies* dependencies, Zone* zone)
     : AdvancedReducer(editor),
       jsgraph_(jsgraph),
+      js_heap_broker_(js_heap_broker),
       flags_(flags),
       global_object_(native_context->global_object()),
       global_proxy_(JSGlobalProxy::cast(native_context->global_proxy())),
@@ -190,8 +191,8 @@ Reduction JSNativeContextSpecialization::ReduceJSInstanceOf(Node* node) {
 
   // Compute property access info for @@hasInstance on {receiver}.
   PropertyAccessInfo access_info;
-  AccessInfoFactory access_info_factory(dependencies(), native_context(),
-                                        graph()->zone());
+  AccessInfoFactory access_info_factory(dependencies(), js_heap_broker(),
+                                        native_context(), graph()->zone());
   if (!access_info_factory.ComputePropertyAccessInfo(
           receiver_map, factory()->has_instance_symbol(), AccessMode::kLoad,
           &access_info)) {
@@ -477,8 +478,8 @@ Reduction JSNativeContextSpecialization::ReduceJSResolvePromise(Node* node) {
 
   // Compute property access info for "then" on {resolution}.
   PropertyAccessInfo access_info;
-  AccessInfoFactory access_info_factory(dependencies(), native_context(),
-                                        graph()->zone());
+  AccessInfoFactory access_info_factory(dependencies(), js_heap_broker(),
+                                        native_context(), graph()->zone());
   if (!access_info_factory.ComputePropertyAccessInfo(
           MapHandles(resolution_maps.begin(), resolution_maps.end()),
           factory()->then_string(), AccessMode::kLoad, &access_info)) {
@@ -625,7 +626,7 @@ Reduction JSNativeContextSpecialization::ReduceGlobalAccess(
                 Handle<HeapObject>::cast(property_cell_value)->map(),
                 isolate());
             property_cell_value_type =
-                Type::For(isolate(), property_cell_value_map);
+                Type::For(js_heap_broker(), property_cell_value_map);
             representation = MachineRepresentation::kTaggedPointer;
 
             // We can only use the property cell value map for map check
@@ -798,8 +799,8 @@ Reduction JSNativeContextSpecialization::ReduceNamedAccess(
   }
 
   // Compute property access infos for the receiver maps.
-  AccessInfoFactory access_info_factory(dependencies(), native_context(),
-                                        graph()->zone());
+  AccessInfoFactory access_info_factory(dependencies(), js_heap_broker(),
+                                        native_context(), graph()->zone());
   ZoneVector<PropertyAccessInfo> access_infos(zone());
   if (!access_info_factory.ComputePropertyAccessInfos(
           receiver_maps, name, access_mode, &access_infos)) {
@@ -1162,8 +1163,8 @@ Reduction JSNativeContextSpecialization::ReduceElementAccess(
   } else {
     // Retrieve the native context from the given {node}.
     // Compute element access infos for the receiver maps.
-    AccessInfoFactory access_info_factory(dependencies(), native_context(),
-                                          graph()->zone());
+    AccessInfoFactory access_info_factory(dependencies(), js_heap_broker(),
+                                          native_context(), graph()->zone());
     ZoneVector<ElementAccessInfo> access_infos(zone());
     if (!access_info_factory.ComputeElementAccessInfos(
             receiver_maps, access_mode, &access_infos)) {
@@ -2061,8 +2062,8 @@ Reduction JSNativeContextSpecialization::ReduceJSStoreDataPropertyInLiteral(
       Name::cast(nexus.GetFeedbackExtra()->ToStrongHeapObject()), isolate());
 
   PropertyAccessInfo access_info;
-  AccessInfoFactory access_info_factory(dependencies(), native_context(),
-                                        graph()->zone());
+  AccessInfoFactory access_info_factory(dependencies(), js_heap_broker(),
+                                        native_context(), graph()->zone());
   if (!access_info_factory.ComputePropertyAccessInfo(
           receiver_map, cached_name, AccessMode::kStoreInLiteral,
           &access_info)) {

src/compiler/js-native-context-specialization.h

@@ -25,6 +25,7 @@ enum class AccessMode;
 class CommonOperatorBuilder;
 class ElementAccessInfo;
 class JSGraph;
+class JSHeapBroker;
 class JSOperatorBuilder;
 class MachineOperatorBuilder;
 class PropertyAccessInfo;
@@ -45,7 +46,8 @@ class JSNativeContextSpecialization final : public AdvancedReducer {
   };
   typedef base::Flags<Flag> Flags;
 
-  JSNativeContextSpecialization(Editor* editor, JSGraph* jsgraph, Flags flags,
+  JSNativeContextSpecialization(Editor* editor, JSGraph* jsgraph,
+                                const JSHeapBroker* js_heap_broker, Flags flags,
                                 Handle<Context> native_context,
                                 CompilationDependencies* dependencies,
                                 Zone* zone);
@@ -214,6 +216,8 @@ class JSNativeContextSpecialization final : public AdvancedReducer {
 
   Graph* graph() const;
   JSGraph* jsgraph() const { return jsgraph_; }
+
+  const JSHeapBroker* js_heap_broker() const { return js_heap_broker_; }
   Isolate* isolate() const;
   Factory* factory() const;
   CommonOperatorBuilder* common() const;
@@ -227,6 +231,7 @@ class JSNativeContextSpecialization final : public AdvancedReducer {
   Zone* zone() const { return zone_; }
 
   JSGraph* const jsgraph_;
+  const JSHeapBroker* const js_heap_broker_;
   Flags const flags_;
   Handle<JSGlobalObject> global_object_;
   Handle<JSGlobalProxy> global_proxy_;

src/compiler/js-typed-lowering.cc

@@ -405,11 +405,12 @@ class JSBinopReduction final {
 // - immediately put in type bounds for all new nodes
 // - relax effects from generic but not-side-effecting operations
 
-JSTypedLowering::JSTypedLowering(Editor* editor, JSGraph* jsgraph, Zone* zone)
+JSTypedLowering::JSTypedLowering(Editor* editor, JSGraph* jsgraph,
+                                 const JSHeapBroker* js_heap_broker, Zone* zone)
     : AdvancedReducer(editor),
       jsgraph_(jsgraph),
       empty_string_type_(Type::HeapConstant(
-          isolate(), factory()->empty_string(), graph()->zone())),
+          js_heap_broker, factory()->empty_string(), graph()->zone())),
       pointer_comparable_type_(
           Type::Union(Type::Oddball(),
                       Type::Union(Type::SymbolOrReceiver(), empty_string_type_,

src/compiler/js-typed-lowering.h

@@ -31,7 +31,8 @@ enum Signedness { kSigned, kUnsigned };
 class V8_EXPORT_PRIVATE JSTypedLowering final
     : public NON_EXPORTED_BASE(AdvancedReducer) {
  public:
-  JSTypedLowering(Editor* editor, JSGraph* jsgraph, Zone* zone);
+  JSTypedLowering(Editor* editor, JSGraph* jsgraph,
+                  const JSHeapBroker* js_heap_broker, Zone* zone);
   ~JSTypedLowering() final {}
 
   const char* reducer_name() const override { return "JSTypedLowering"; }

src/compiler/operation-typer.cc

@@ -16,25 +16,29 @@ namespace v8 {
 namespace internal {
 namespace compiler {
 
-OperationTyper::OperationTyper(Isolate* isolate, Zone* zone)
+OperationTyper::OperationTyper(Isolate* isolate,
+                               const JSHeapBroker* js_heap_broker, Zone* zone)
     : zone_(zone), cache_(TypeCache::Get()) {
   Factory* factory = isolate->factory();
-  infinity_ = Type::NewConstant(isolate, factory->infinity_value(), zone);
+  infinity_ =
+      Type::NewConstant(js_heap_broker, factory->infinity_value(), zone);
   minus_infinity_ =
-      Type::NewConstant(isolate, factory->minus_infinity_value(), zone);
+      Type::NewConstant(js_heap_broker, factory->minus_infinity_value(), zone);
   Type truncating_to_zero = Type::MinusZeroOrNaN();
   DCHECK(!truncating_to_zero.Maybe(Type::Integral32()));
 
   singleton_empty_string_ =
-      Type::HeapConstant(isolate, factory->empty_string(), zone);
+      Type::HeapConstant(js_heap_broker, factory->empty_string(), zone);
   singleton_NaN_string_ =
-      Type::HeapConstant(isolate, factory->NaN_string(), zone);
+      Type::HeapConstant(js_heap_broker, factory->NaN_string(), zone);
   singleton_zero_string_ =
-      Type::HeapConstant(isolate, factory->zero_string(), zone);
-  singleton_false_ = Type::HeapConstant(isolate, factory->false_value(), zone);
-  singleton_true_ = Type::HeapConstant(isolate, factory->true_value(), zone);
+      Type::HeapConstant(js_heap_broker, factory->zero_string(), zone);
+  singleton_false_ =
+      Type::HeapConstant(js_heap_broker, factory->false_value(), zone);
+  singleton_true_ =
+      Type::HeapConstant(js_heap_broker, factory->true_value(), zone);
   singleton_the_hole_ =
-      Type::HeapConstant(isolate, factory->the_hole_value(), zone);
+      Type::HeapConstant(js_heap_broker, factory->the_hole_value(), zone);
   signed32ish_ = Type::Union(Type::Signed32(), truncating_to_zero, zone);
   unsigned32ish_ = Type::Union(Type::Unsigned32(), truncating_to_zero, zone);
 

src/compiler/operation-typer.h

@@ -27,7 +27,8 @@ class TypeCache;
 
 class V8_EXPORT_PRIVATE OperationTyper {
  public:
-  OperationTyper(Isolate* isolate, Zone* zone);
+  OperationTyper(Isolate* isolate, const JSHeapBroker* js_heap_broker,
+                 Zone* zone);
 
   // Typing Phi.
   Type Merge(Type left, Type right);

src/compiler/pipeline.cc

@@ -37,6 +37,7 @@
 #include "src/compiler/js-context-specialization.h"
 #include "src/compiler/js-create-lowering.h"
 #include "src/compiler/js-generic-lowering.h"
+#include "src/compiler/js-heap-broker.h"
 #include "src/compiler/js-inlining-heuristic.h"
 #include "src/compiler/js-intrinsic-lowering.h"
 #include "src/compiler/js-native-context-specialization.h"
@@ -130,6 +131,7 @@ class PipelineData {
     javascript_ = new (graph_zone_) JSOperatorBuilder(graph_zone_);
     jsgraph_ = new (graph_zone_)
         JSGraph(isolate_, graph_, common_, javascript_, simplified_, machine_);
+    js_heap_broker_ = new (graph_zone_) JSHeapBroker(isolate_);
   }
 
   // For WebAssembly compile entry point.
@@ -246,6 +248,8 @@ class PipelineData {
     return handle(info()->global_object(), isolate());
   }
 
+  JSHeapBroker* js_heap_broker() const { return js_heap_broker_; }
+
   Schedule* schedule() const { return schedule_; }
   void set_schedule(Schedule* schedule) {
     DCHECK(!schedule_);
@@ -416,6 +420,7 @@ class PipelineData {
   JSGraph* jsgraph_ = nullptr;
   MachineGraph* mcgraph_ = nullptr;
   Schedule* schedule_ = nullptr;
+  JSHeapBroker* js_heap_broker_ = nullptr;
 
   // All objects in the following group of fields are allocated in
   // instruction_zone_. They are all set to nullptr when the instruction_zone_
@@ -1160,8 +1165,8 @@ struct InliningPhase {
       flags |= JSNativeContextSpecialization::kBailoutOnUninitialized;
     }
     JSNativeContextSpecialization native_context_specialization(
-        &graph_reducer, data->jsgraph(), flags, data->native_context(),
-        data->info()->dependencies(), temp_zone);
+        &graph_reducer, data->jsgraph(), data->js_heap_broker(), flags,
+        data->native_context(), data->info()->dependencies(), temp_zone);
     JSInliningHeuristic inlining(
         &graph_reducer, data->info()->is_inlining_enabled()
                             ? JSInliningHeuristic::kGeneralInlining
@@ -1234,12 +1239,14 @@ struct TypedLoweringPhase {
                                               data->common(), temp_zone);
     JSCreateLowering create_lowering(
         &graph_reducer, data->info()->dependencies(), data->jsgraph(),
-        data->native_context(), temp_zone);
-    JSTypedLowering typed_lowering(&graph_reducer, data->jsgraph(), temp_zone);
+        data->js_heap_broker(), data->native_context(), temp_zone);
+    JSTypedLowering typed_lowering(&graph_reducer, data->jsgraph(),
+                                   data->js_heap_broker(), temp_zone);
     ConstantFoldingReducer constant_folding_reducer(&graph_reducer,
                                                     data->jsgraph());
     TypedOptimization typed_optimization(
-        &graph_reducer, data->info()->dependencies(), data->jsgraph());
+        &graph_reducer, data->info()->dependencies(), data->jsgraph(),
+        data->js_heap_broker());
     SimplifiedOperatorReducer simple_reducer(&graph_reducer, data->jsgraph());
     CheckpointElimination checkpoint_elimination(&graph_reducer);
     CommonOperatorReducer common_reducer(data->isolate(), &graph_reducer,
@@ -1279,8 +1286,9 @@ struct SimplifiedLoweringPhase {
   static const char* phase_name() { return "simplified lowering"; }
 
   void Run(PipelineData* data, Zone* temp_zone) {
-    SimplifiedLowering lowering(data->jsgraph(), temp_zone,
-                                data->source_positions(), data->node_origins(),
+    SimplifiedLowering lowering(data->jsgraph(), data->js_heap_broker(),
+                                temp_zone, data->source_positions(),
+                                data->node_origins(),
                                 data->info()->GetPoisoningMitigationLevel());
     lowering.LowerAllNodes();
   }
@@ -1326,12 +1334,12 @@ struct ConcurrentOptimizationPrepPhase {
     // This is needed for escape analysis.
     NodeProperties::SetType(
         data->jsgraph()->FalseConstant(),
-        Type::HeapConstant(data->isolate(),
+        Type::HeapConstant(data->js_heap_broker(),
                            data->isolate()->factory()->false_value(),
                            data->jsgraph()->zone()));
     NodeProperties::SetType(
         data->jsgraph()->TrueConstant(),
-        Type::HeapConstant(data->isolate(),
+        Type::HeapConstant(data->js_heap_broker(),
                            data->isolate()->factory()->true_value(),
                            data->jsgraph()->zone()));
   }
@@ -1475,8 +1483,8 @@ struct LoadEliminationPhase {
                                          data->machine(), temp_zone);
     ConstantFoldingReducer constant_folding_reducer(&graph_reducer,
                                                     data->jsgraph());
-    TypeNarrowingReducer type_narrowing_reducer(&graph_reducer,
-                                                data->jsgraph());
+    TypeNarrowingReducer type_narrowing_reducer(&graph_reducer, data->jsgraph(),
+                                                data->js_heap_broker());
     AddReducer(data, &graph_reducer, &branch_condition_elimination);
     AddReducer(data, &graph_reducer, &dead_code_elimination);
     AddReducer(data, &graph_reducer, &redundancy_elimination);
@@ -1909,7 +1917,7 @@ bool PipelineImpl::CreateGraph() {
     // Type the graph and keep the Typer running on newly created nodes within
     // this scope; the Typer is automatically unlinked from the Graph once we
     // leave this scope below.
-    Typer typer(isolate(), flags, data->graph());
+    Typer typer(isolate(), data->js_heap_broker(), flags, data->graph());
     Run<TyperPhase>(&typer);
     RunPrintAndVerify(TyperPhase::phase_name());
 

src/compiler/simplified-lowering.cc

@@ -286,8 +286,8 @@ class RepresentationSelector {
     bool weakened_ = false;
   };
 
-  RepresentationSelector(JSGraph* jsgraph, Zone* zone,
-                         RepresentationChanger* changer,
+  RepresentationSelector(JSGraph* jsgraph, const JSHeapBroker* js_heap_broker,
+                         Zone* zone, RepresentationChanger* changer,
                          SourcePositionTable* source_positions,
                          NodeOriginTable* node_origins)
       : jsgraph_(jsgraph),
@@ -306,7 +306,7 @@ class RepresentationSelector {
         source_positions_(source_positions),
         node_origins_(node_origins),
         type_cache_(TypeCache::Get()),
-        op_typer_(jsgraph->isolate(), graph_zone()) {
+        op_typer_(jsgraph->isolate(), js_heap_broker, graph_zone()) {
   }
 
   // Forward propagation of types from type feedback.
@@ -3252,11 +3252,14 @@ class RepresentationSelector {
   Zone* graph_zone() { return jsgraph_->zone(); }
 };
 
-SimplifiedLowering::SimplifiedLowering(JSGraph* jsgraph, Zone* zone,
+SimplifiedLowering::SimplifiedLowering(JSGraph* jsgraph,
+                                       const JSHeapBroker* js_heap_broker,
+                                       Zone* zone,
                                        SourcePositionTable* source_positions,
                                        NodeOriginTable* node_origins,
                                        PoisoningMitigationLevel poisoning_level)
     : jsgraph_(jsgraph),
+      js_heap_broker_(js_heap_broker),
       zone_(zone),
       type_cache_(TypeCache::Get()),
       source_positions_(source_positions),
@@ -3265,8 +3268,8 @@ SimplifiedLowering::SimplifiedLowering(JSGraph* jsgraph, Zone* zone,
 
 void SimplifiedLowering::LowerAllNodes() {
   RepresentationChanger changer(jsgraph(), jsgraph()->isolate());
-  RepresentationSelector selector(jsgraph(), zone_, &changer, source_positions_,
-                                  node_origins_);
+  RepresentationSelector selector(jsgraph(), js_heap_broker_, zone_, &changer,
+                                  source_positions_, node_origins_);
   selector.Run(this);
 }
 

src/compiler/simplified-lowering.h

@@ -23,8 +23,8 @@ class TypeCache;
 
 class V8_EXPORT_PRIVATE SimplifiedLowering final {
  public:
-  SimplifiedLowering(JSGraph* jsgraph, Zone* zone,
-                     SourcePositionTable* source_position,
+  SimplifiedLowering(JSGraph* jsgraph, const JSHeapBroker* js_heap_broker,
+                     Zone* zone, SourcePositionTable* source_position,
                      NodeOriginTable* node_origins,
                      PoisoningMitigationLevel poisoning_level);
   ~SimplifiedLowering() {}
@@ -48,6 +48,7 @@ class V8_EXPORT_PRIVATE SimplifiedLowering final {
 
  private:
   JSGraph* const jsgraph_;
+  const JSHeapBroker* js_heap_broker_;
   Zone* const zone_;
   TypeCache const& type_cache_;
   SetOncePointer<Node> to_number_code_;

src/compiler/type-narrowing-reducer.cc

@@ -11,10 +11,11 @@ namespace v8 {
 namespace internal {
 namespace compiler {
 
-TypeNarrowingReducer::TypeNarrowingReducer(Editor* editor, JSGraph* jsgraph)
+TypeNarrowingReducer::TypeNarrowingReducer(Editor* editor, JSGraph* jsgraph,
+                                           const JSHeapBroker* js_heap_broker)
     : AdvancedReducer(editor),
       jsgraph_(jsgraph),
-      op_typer_(jsgraph->isolate(), zone()) {}
+      op_typer_(jsgraph->isolate(), js_heap_broker, zone()) {}
 
 TypeNarrowingReducer::~TypeNarrowingReducer() {}
 
@@ -29,13 +30,10 @@ Reduction TypeNarrowingReducer::Reduce(Node* node) {
       Type right_type = NodeProperties::GetType(node->InputAt(1));
       if (left_type.Is(Type::PlainNumber()) &&
           right_type.Is(Type::PlainNumber())) {
-        Factory* const factory = jsgraph()->isolate()->factory();
         if (left_type.Max() < right_type.Min()) {
-          new_type = Type::HeapConstant(jsgraph()->isolate(),
-                                        factory->true_value(), zone());
+          new_type = op_typer_.singleton_true();
         } else if (left_type.Min() >= right_type.Max()) {
-          new_type = Type::HeapConstant(jsgraph()->isolate(),
-                                        factory->false_value(), zone());
+          new_type = op_typer_.singleton_false();
         }
       }
       break;

src/compiler/type-narrowing-reducer.h

@@ -19,7 +19,8 @@ class JSGraph;
 class V8_EXPORT_PRIVATE TypeNarrowingReducer final
     : public NON_EXPORTED_BASE(AdvancedReducer) {
  public:
-  TypeNarrowingReducer(Editor* editor, JSGraph* jsgraph);
+  TypeNarrowingReducer(Editor* editor, JSGraph* jsgraph,
+                       const JSHeapBroker* js_heap_broker);
   ~TypeNarrowingReducer() final;
 
   const char* reducer_name() const override { return "TypeNarrowingReducer"; }

src/compiler/typed-optimization.cc

@@ -18,14 +18,15 @@ namespace compiler {
 
 TypedOptimization::TypedOptimization(Editor* editor,
                                      CompilationDependencies* dependencies,
-                                     JSGraph* jsgraph)
+                                     JSGraph* jsgraph,
+                                     const JSHeapBroker* js_heap_broker)
     : AdvancedReducer(editor),
       dependencies_(dependencies),
       jsgraph_(jsgraph),
-      true_type_(Type::HeapConstant(jsgraph->isolate(), factory()->true_value(),
+      true_type_(Type::HeapConstant(js_heap_broker, factory()->true_value(),
                                     graph()->zone())),
-      false_type_(Type::HeapConstant(
-          jsgraph->isolate(), factory()->false_value(), graph()->zone())),
+      false_type_(Type::HeapConstant(js_heap_broker, factory()->false_value(),
+                                     graph()->zone())),
       type_cache_(TypeCache::Get()) {}
 
 TypedOptimization::~TypedOptimization() {}

src/compiler/typed-optimization.h

@@ -28,7 +28,7 @@ class V8_EXPORT_PRIVATE TypedOptimization final
     : public NON_EXPORTED_BASE(AdvancedReducer) {
  public:
   TypedOptimization(Editor* editor, CompilationDependencies* dependencies,
-                    JSGraph* jsgraph);
+                    JSGraph* jsgraph, const JSHeapBroker* js_heap_broker);
   ~TypedOptimization();
 
   const char* reducer_name() const override { return "TypedOptimization"; }

src/compiler/typer.cc

@@ -33,13 +33,14 @@ class Typer::Decorator final : public GraphDecorator {
   Typer* const typer_;
 };
 
-Typer::Typer(Isolate* isolate, Flags flags, Graph* graph)
-    : isolate_(isolate),
-      flags_(flags),
+Typer::Typer(Isolate* isolate, const JSHeapBroker* js_heap_broker, Flags flags,
+             Graph* graph)
+    : flags_(flags),
       graph_(graph),
       decorator_(nullptr),
       cache_(TypeCache::Get()),
-      operation_typer_(isolate, zone()) {
+      js_heap_broker_(js_heap_broker),
+      operation_typer_(isolate, js_heap_broker, zone()) {
   singleton_false_ = operation_typer_.singleton_false();
   singleton_true_ = operation_typer_.singleton_true();
 
@@ -227,7 +228,6 @@ class Typer::Visitor : public Reducer {
   Type Weaken(Node* node, Type current_type, Type previous_type);
 
   Zone* zone() { return typer_->zone(); }
-  Isolate* isolate() { return typer_->isolate(); }
   Graph* graph() { return typer_->graph(); }
 
   void SetWeakened(NodeId node_id) { weakened_nodes_.insert(node_id); }
@@ -2178,7 +2178,7 @@ Type Typer::Visitor::TypeRuntimeAbort(Node* node) { UNREACHABLE(); }
 // Heap constants.
 
 Type Typer::Visitor::TypeConstant(Handle<Object> value) {
-  return Type::NewConstant(isolate(), value, zone());
+  return Type::NewConstant(typer_->js_heap_broker(), value, zone());
 }
 
 }  // namespace compiler

src/compiler/typer.h

@@ -25,7 +25,8 @@ class V8_EXPORT_PRIVATE Typer {
   };
   typedef base::Flags<Flag> Flags;
 
-  Typer(Isolate* isolate, Flags flags, Graph* graph);
+  Typer(Isolate* isolate, const JSHeapBroker* js_heap_broker, Flags flags,
+        Graph* graph);
   ~Typer();
 
   void Run();
@@ -40,14 +41,14 @@ class V8_EXPORT_PRIVATE Typer {
   Flags flags() const { return flags_; }
   Graph* graph() const { return graph_; }
   Zone* zone() const { return graph()->zone(); }
-  Isolate* isolate() const { return isolate_; }
   OperationTyper* operation_typer() { return &operation_typer_; }
+  const JSHeapBroker* js_heap_broker() const { return js_heap_broker_; }
 
-  Isolate* const isolate_;
   Flags const flags_;
   Graph* const graph_;
   Decorator* decorator_;
   TypeCache const& cache_;
+  const JSHeapBroker* js_heap_broker_;
   OperationTyper operation_typer_;
 
   Type singleton_false_;

src/compiler/types.cc

@@ -132,10 +132,8 @@ Type::bitset Type::BitsetLub() const {
   UNREACHABLE();
 }
 
-Type::bitset BitsetType::Lub(Isolate* isolate, i::Map* map) {
-  DisallowHeapAllocation no_allocation;
-  Heap* heap = isolate->heap();
-  switch (map->instance_type()) {
+Type::bitset BitsetType::Lub(HeapReferenceType const& type) {
+  switch (type.instance_type()) {
     case CONS_STRING_TYPE:
     case CONS_ONE_BYTE_STRING_TYPE:
     case THIN_STRING_TYPE:
@@ -165,16 +163,19 @@ Type::bitset BitsetType::Lub(Isolate* isolate, i::Map* map) {
     case BIGINT_TYPE:
       return kBigInt;
     case ODDBALL_TYPE: {
-      if (map == heap->undefined_map()) return kUndefined;
-      if (map == heap->null_map()) return kNull;
-      if (map == heap->boolean_map()) return kBoolean;
-      if (map == heap->the_hole_map()) return kHole;
-      DCHECK(map == heap->uninitialized_map() ||
-             map == heap->termination_exception_map() ||
-             map == heap->arguments_marker_map() ||
-             map == heap->optimized_out_map() ||
-             map == heap->stale_register_map());
-      return kOtherInternal;
+      switch (type.oddball_type()) {
+        case HeapReferenceType::kHole:
+          return kHole;
+        case HeapReferenceType::kBoolean:
+          return kBoolean;
+        case HeapReferenceType::kNull:
+          return kNull;
+        case HeapReferenceType::kUndefined:
+          return kUndefined;
+        case HeapReferenceType::kUnknown:
+          return kOtherInternal;
+      }
+      UNREACHABLE();
     }
     case HEAP_NUMBER_TYPE:
       return kNumber;
@@ -185,15 +186,15 @@ Type::bitset BitsetType::Lub(Isolate* isolate, i::Map* map) {
     case JS_GLOBAL_PROXY_TYPE:
     case JS_API_OBJECT_TYPE:
     case JS_SPECIAL_API_OBJECT_TYPE:
-      if (map->is_undetectable()) {
+      if (type.is_undetectable()) {
         // Currently we assume that every undetectable receiver is also
         // callable, which is what we need to support document.all.  We
         // could add another Type bit to support other use cases in the
         // future if necessary.
-        DCHECK(map->is_callable());
+        DCHECK(type.is_callable());
         return kOtherUndetectable;
       }
-      if (map->is_callable()) {
+      if (type.is_callable()) {
         return kOtherCallable;
       }
       return kOtherObject;
@@ -232,18 +233,18 @@ Type::bitset BitsetType::Lub(Isolate* isolate, i::Map* map) {
     case WASM_INSTANCE_TYPE:
     case WASM_MEMORY_TYPE:
     case WASM_TABLE_TYPE:
-      DCHECK(!map->is_callable());
-      DCHECK(!map->is_undetectable());
+      DCHECK(!type.is_callable());
+      DCHECK(!type.is_undetectable());
       return kOtherObject;
     case JS_BOUND_FUNCTION_TYPE:
-      DCHECK(!map->is_undetectable());
+      DCHECK(!type.is_undetectable());
       return kBoundFunction;
     case JS_FUNCTION_TYPE:
-      DCHECK(!map->is_undetectable());
+      DCHECK(!type.is_undetectable());
       return kFunction;
     case JS_PROXY_TYPE:
-      DCHECK(!map->is_undetectable());
-      if (map->is_callable()) return kCallableProxy;
+      DCHECK(!type.is_undetectable());
+      if (type.is_callable()) return kCallableProxy;
       return kOtherProxy;
     case MAP_TYPE:
     case ALLOCATION_SITE_TYPE:
@@ -329,12 +330,13 @@ Type::bitset BitsetType::Lub(Isolate* isolate, i::Map* map) {
   UNREACHABLE();
 }
 
-Type::bitset BitsetType::Lub(Isolate* isolate, i::Object* value) {
+Type::bitset BitsetType::Lub(const JSHeapBroker* js_heap_broker,
+                             Handle<HeapObject> value) {
   DisallowHeapAllocation no_allocation;
   if (value->IsNumber()) {
     return Lub(value->Number());
   }
-  return Lub(isolate, i::HeapObject::cast(value)->map());
+  return Lub(js_heap_broker->HeapReferenceTypeForObject(value));
 }
 
 Type::bitset BitsetType::Lub(double value) {
@@ -811,14 +813,14 @@ Type Type::NewConstant(double value, Zone* zone) {
   return OtherNumberConstant(value, zone);
 }
 
-Type Type::NewConstant(Isolate* isolate, i::Handle<i::Object> value,
-                       Zone* zone) {
+Type Type::NewConstant(const JSHeapBroker* js_heap_broker,
+                       Handle<i::Object> value, Zone* zone) {
   if (value->IsNumber()) {
     return NewConstant(value->Number(), zone);
   } else if (value->IsString() && !value->IsInternalizedString()) {
     return Type::String();
   }
-  return HeapConstant(isolate, i::Handle<i::HeapObject>::cast(value), zone);
+  return HeapConstant(js_heap_broker, Handle<HeapObject>::cast(value), zone);
 }
 
 Type Type::Union(Type type1, Type type2, Zone* zone) {
@@ -1044,9 +1046,9 @@ Type Type::OtherNumberConstant(double value, Zone* zone) {
 }
 
 // static
-Type Type::HeapConstant(Isolate* isolate, i::Handle<i::HeapObject> value,
-                        Zone* zone) {
-  return FromTypeBase(HeapConstantType::New(isolate, value, zone));
+Type Type::HeapConstant(const JSHeapBroker* js_heap_broker,
+                        Handle<HeapObject> value, Zone* zone) {
+  return FromTypeBase(HeapConstantType::New(js_heap_broker, value, zone));
 }
 
 // static

src/compiler/types.h

@@ -6,6 +6,7 @@
 #define V8_COMPILER_TYPES_H_
 
 #include "src/base/compiler-specific.h"
+#include "src/compiler/js-heap-broker.h"
 #include "src/conversions.h"
 #include "src/globals.h"
 #include "src/handles.h"
@@ -250,8 +251,9 @@ class V8_EXPORT_PRIVATE BitsetType {
   static double Max(bitset);
 
   static bitset Glb(double min, double max);
-  static bitset Lub(Isolate* isolate, i::Map* map);
-  static bitset Lub(Isolate* isolate, i::Object* value);
+  static bitset Lub(HeapReferenceType const& type);
+  static bitset Lub(const JSHeapBroker* js_heap_broker,
+                    Handle<HeapObject> value);
   static bitset Lub(double value);
   static bitset Lub(double min, double max);
   static bitset ExpandInternals(bitset bits);
@@ -361,27 +363,24 @@ class V8_EXPORT_PRIVATE Type {
   static Type UnsignedSmall() { return NewBitset(BitsetType::UnsignedSmall()); }
 
   static Type OtherNumberConstant(double value, Zone* zone);
-  static Type HeapConstant(Isolate* isolate, i::Handle<i::HeapObject> value,
-                           Zone* zone);
+  static Type HeapConstant(const JSHeapBroker* js_heap_broker,
+                           Handle<HeapObject> value, Zone* zone);
   static Type Range(double min, double max, Zone* zone);
   static Type Range(RangeType::Limits lims, Zone* zone);
   static Type Tuple(Type first, Type second, Type third, Zone* zone);
   static Type Union(int length, Zone* zone);
 
   // NewConstant is a factory that returns Constant, Range or Number.
-  static Type NewConstant(Isolate* isolate, i::Handle<i::Object> value,
-                          Zone* zone);
+  static Type NewConstant(const JSHeapBroker* js_heap_broker,
+                          Handle<i::Object> value, Zone* zone);
   static Type NewConstant(double value, Zone* zone);
 
   static Type Union(Type type1, Type type2, Zone* zone);
   static Type Intersect(Type type1, Type type2, Zone* zone);
 
-  static Type For(Isolate* isolate, i::Map* map) {
-    return NewBitset(
-        BitsetType::ExpandInternals(BitsetType::Lub(isolate, map)));
-  }
-  static Type For(Isolate* isolate, i::Handle<i::Map> map) {
-    return For(isolate, *map);
+  static Type For(const JSHeapBroker* js_heap_broker, Handle<i::Map> map) {
+    HeapReferenceType type = js_heap_broker->HeapReferenceTypeFromMap(map);
+    return NewBitset(BitsetType::ExpandInternals(BitsetType::Lub(type)));
   }
 
   // Predicates.
@@ -543,9 +542,9 @@ class V8_EXPORT_PRIVATE HeapConstantType : public NON_EXPORTED_BASE(TypeBase) {
   friend class Type;
   friend class BitsetType;
 
-  static HeapConstantType* New(Isolate* isolate, i::Handle<i::HeapObject> value,
-                               Zone* zone) {
-    BitsetType::bitset bitset = BitsetType::Lub(isolate, *value);
+  static HeapConstantType* New(const JSHeapBroker* js_heap_broker,
+                               i::Handle<i::HeapObject> value, Zone* zone) {
+    BitsetType::bitset bitset = BitsetType::Lub(js_heap_broker, value);
     return new (zone->New(sizeof(HeapConstantType)))
         HeapConstantType(bitset, value);
   }

test/cctest/compiler/test-js-typed-lowering.cc

@@ -23,6 +23,7 @@ class JSTypedLoweringTester : public HandleAndZoneScope {
  public:
   explicit JSTypedLoweringTester(int num_parameters = 0)
       : isolate(main_isolate()),
+        js_heap_broker(isolate),
         binop(nullptr),
         unop(nullptr),
         javascript(main_zone()),
@@ -30,7 +31,7 @@ class JSTypedLoweringTester : public HandleAndZoneScope {
         simplified(main_zone()),
         common(main_zone()),
         graph(main_zone()),
-        typer(main_isolate(), Typer::kNoFlags, &graph),
+        typer(main_isolate(), &js_heap_broker, Typer::kNoFlags, &graph),
         context_node(nullptr) {
     graph.SetStart(graph.NewNode(common.Start(num_parameters)));
     graph.SetEnd(graph.NewNode(common.End(1), graph.start()));
@@ -38,6 +39,7 @@ class JSTypedLoweringTester : public HandleAndZoneScope {
   }
 
   Isolate* isolate;
+  JSHeapBroker js_heap_broker;
   const Operator* binop;
   const Operator* unop;
   JSOperatorBuilder javascript;
@@ -86,7 +88,8 @@ class JSTypedLoweringTester : public HandleAndZoneScope {
                     &machine);
     // TODO(titzer): mock the GraphReducer here for better unit testing.
     GraphReducer graph_reducer(main_zone(), &graph);
-    JSTypedLowering reducer(&graph_reducer, &jsgraph, main_zone());
+    JSTypedLowering reducer(&graph_reducer, &jsgraph, &js_heap_broker,
+                            main_zone());
     Reduction reduction = reducer.Reduce(node);
     if (reduction.Changed()) return reduction.replacement();
     return node;

test/cctest/types-fuzz.h

@@ -40,7 +40,7 @@ namespace compiler {
 class Types {
  public:
   Types(Zone* zone, Isolate* isolate, v8::base::RandomNumberGenerator* rng)
-      : zone_(zone), isolate_(isolate), rng_(rng) {
+      : zone_(zone), js_heap_broker_(isolate), rng_(rng) {
 #define DECLARE_TYPE(name, value) \
   name = Type::name();            \
   types.push_back(name);
@@ -65,13 +65,14 @@ class Types {
     object2 = isolate->factory()->NewJSObjectFromMap(object_map);
     array = isolate->factory()->NewJSArray(20);
     uninitialized = isolate->factory()->uninitialized_value();
-    SmiConstant = Type::NewConstant(isolate, smi, zone);
-    Signed32Constant = Type::NewConstant(isolate, signed32, zone);
+    SmiConstant = Type::NewConstant(js_heap_broker(), smi, zone);
+    Signed32Constant = Type::NewConstant(js_heap_broker(), signed32, zone);
 
-    ObjectConstant1 = Type::HeapConstant(isolate, object1, zone);
-    ObjectConstant2 = Type::HeapConstant(isolate, object2, zone);
-    ArrayConstant = Type::HeapConstant(isolate, array, zone);
-    UninitializedConstant = Type::HeapConstant(isolate, uninitialized, zone);
+    ObjectConstant1 = Type::HeapConstant(js_heap_broker(), object1, zone);
+    ObjectConstant2 = Type::HeapConstant(js_heap_broker(), object2, zone);
+    ArrayConstant = Type::HeapConstant(js_heap_broker(), array, zone);
+    UninitializedConstant =
+        Type::HeapConstant(js_heap_broker(), uninitialized, zone);
 
     values.push_back(smi);
     values.push_back(boxed_smi);
@@ -84,7 +85,7 @@ class Types {
     values.push_back(float2);
     values.push_back(float3);
     for (ValueVector::iterator it = values.begin(); it != values.end(); ++it) {
-      types.push_back(Type::NewConstant(isolate, *it, zone));
+      types.push_back(Type::NewConstant(js_heap_broker(), *it, zone));
     }
 
     integers.push_back(isolate->factory()->NewNumber(-V8_INFINITY));
@@ -120,7 +121,7 @@ class Types {
 
 #define DECLARE_TYPE(name, value) Type name;
   PROPER_BITSET_TYPE_LIST(DECLARE_TYPE)
-  #undef DECLARE_TYPE
+#undef DECLARE_TYPE
 
   Type SignedSmall;
   Type UnsignedSmall;
@@ -142,11 +143,11 @@ class Types {
   ValueVector integers;  // "Integer" values used for range limits.
 
   Type NewConstant(Handle<i::Object> value) {
-    return Type::NewConstant(isolate_, value, zone_);
+    return Type::NewConstant(js_heap_broker(), value, zone_);
   }
 
   Type HeapConstant(Handle<i::HeapObject> value) {
-    return Type::HeapConstant(isolate_, value, zone_);
+    return Type::HeapConstant(js_heap_broker(), value, zone_);
   }
 
   Type Range(double min, double max) { return Type::Range(min, max, zone_); }
@@ -184,7 +185,7 @@ class Types {
       }
       case 1: {  // constant
         int i = rng_->NextInt(static_cast<int>(values.size()));
-        return Type::NewConstant(isolate_, values[i], zone_);
+        return Type::NewConstant(js_heap_broker(), values[i], zone_);
       }
       case 2: {  // range
         int i = rng_->NextInt(static_cast<int>(integers.size()));
@@ -208,10 +209,11 @@ class Types {
   }
 
   Zone* zone() { return zone_; }
+  const JSHeapBroker* js_heap_broker() const { return &js_heap_broker_; }
 
  private:
   Zone* zone_;
-  Isolate* isolate_;
+  JSHeapBroker js_heap_broker_;
   v8::base::RandomNumberGenerator* rng_;
 };
 

test/unittests/compiler/constant-folding-reducer-unittest.cc

@@ -62,7 +62,10 @@ const double kIntegerValues[] = {-V8_INFINITY, INT_MIN, -1000.0,  -42.0,
 class ConstantFoldingReducerTest : public TypedGraphTest {
  public:
   ConstantFoldingReducerTest()
-      : TypedGraphTest(3), simplified_(zone()), deps_(isolate(), zone()) {}
+      : TypedGraphTest(3),
+        js_heap_broker_(isolate()),
+        simplified_(zone()),
+        deps_(isolate(), zone()) {}
   ~ConstantFoldingReducerTest() override {}
 
  protected:
@@ -78,16 +81,18 @@ class ConstantFoldingReducerTest : public TypedGraphTest {
   }
 
   SimplifiedOperatorBuilder* simplified() { return &simplified_; }
+  const JSHeapBroker* js_heap_broker() const { return &js_heap_broker_; }
 
  private:
+  JSHeapBroker js_heap_broker_;
   SimplifiedOperatorBuilder simplified_;
   CompilationDependencies deps_;
 };
 
 TEST_F(ConstantFoldingReducerTest, ParameterWithMinusZero) {
   {
-    Reduction r = Reduce(Parameter(
-        Type::NewConstant(isolate(), factory()->minus_zero_value(), zone())));
+    Reduction r = Reduce(Parameter(Type::NewConstant(
+        js_heap_broker(), factory()->minus_zero_value(), zone())));
     ASSERT_TRUE(r.Changed());
     EXPECT_THAT(r.replacement(), IsNumberConstant(-0.0));
   }
@@ -99,7 +104,7 @@ TEST_F(ConstantFoldingReducerTest, ParameterWithMinusZero) {
   {
     Reduction r = Reduce(Parameter(Type::Union(
         Type::MinusZero(),
-        Type::NewConstant(isolate(), factory()->NewNumber(0), zone()),
+        Type::NewConstant(js_heap_broker(), factory()->NewNumber(0), zone()),
         zone())));
     EXPECT_FALSE(r.Changed());
   }
@@ -108,7 +113,8 @@ TEST_F(ConstantFoldingReducerTest, ParameterWithMinusZero) {
 TEST_F(ConstantFoldingReducerTest, ParameterWithNull) {
   Handle<HeapObject> null = factory()->null_value();
   {
-    Reduction r = Reduce(Parameter(Type::NewConstant(isolate(), null, zone())));
+    Reduction r =
+        Reduce(Parameter(Type::NewConstant(js_heap_broker(), null, zone())));
     ASSERT_TRUE(r.Changed());
     EXPECT_THAT(r.replacement(), IsHeapConstant(null));
   }
@@ -125,14 +131,14 @@ TEST_F(ConstantFoldingReducerTest, ParameterWithNaN) {
                           std::numeric_limits<double>::signaling_NaN()};
   TRACED_FOREACH(double, nan, kNaNs) {
     Handle<Object> constant = factory()->NewNumber(nan);
-    Reduction r =
-        Reduce(Parameter(Type::NewConstant(isolate(), constant, zone())));
+    Reduction r = Reduce(
+        Parameter(Type::NewConstant(js_heap_broker(), constant, zone())));
     ASSERT_TRUE(r.Changed());
     EXPECT_THAT(r.replacement(), IsNumberConstant(IsNaN()));
   }
   {
     Reduction r = Reduce(Parameter(
-        Type::NewConstant(isolate(), factory()->nan_value(), zone())));
+        Type::NewConstant(js_heap_broker(), factory()->nan_value(), zone())));
     ASSERT_TRUE(r.Changed());
     EXPECT_THAT(r.replacement(), IsNumberConstant(IsNaN()));
   }
@@ -146,8 +152,8 @@ TEST_F(ConstantFoldingReducerTest, ParameterWithNaN) {
 TEST_F(ConstantFoldingReducerTest, ParameterWithPlainNumber) {
   TRACED_FOREACH(double, value, kFloat64Values) {
     Handle<Object> constant = factory()->NewNumber(value);
-    Reduction r =
-        Reduce(Parameter(Type::NewConstant(isolate(), constant, zone())));
+    Reduction r = Reduce(
+        Parameter(Type::NewConstant(js_heap_broker(), constant, zone())));
     ASSERT_TRUE(r.Changed());
     EXPECT_THAT(r.replacement(), IsNumberConstant(value));
   }
@@ -166,8 +172,8 @@ TEST_F(ConstantFoldingReducerTest, ParameterWithUndefined) {
     EXPECT_THAT(r.replacement(), IsHeapConstant(undefined));
   }
   {
-    Reduction r =
-        Reduce(Parameter(Type::NewConstant(isolate(), undefined, zone())));
+    Reduction r = Reduce(
+        Parameter(Type::NewConstant(js_heap_broker(), undefined, zone())));
     ASSERT_TRUE(r.Changed());
     EXPECT_THAT(r.replacement(), IsHeapConstant(undefined));
   }
@@ -188,10 +194,10 @@ TEST_F(ConstantFoldingReducerTest, ToBooleanWithFalsish) {
                       Type::Undefined(),
                       Type::Union(
                           Type::Undetectable(),
-                          Type::Union(
-                              Type::NewConstant(
-                                  isolate(), factory()->false_value(), zone()),
-                              Type::Range(0.0, 0.0, zone()), zone()),
+                          Type::Union(Type::NewConstant(
+                                          js_heap_broker(),
+                                          factory()->false_value(), zone()),
+                                      Type::Range(0.0, 0.0, zone()), zone()),
                           zone()),
                       zone()),
                   zone()),
@@ -206,7 +212,7 @@ TEST_F(ConstantFoldingReducerTest, ToBooleanWithFalsish) {
 TEST_F(ConstantFoldingReducerTest, ToBooleanWithTruish) {
   Node* input = Parameter(
       Type::Union(
-          Type::NewConstant(isolate(), factory()->true_value(), zone()),
+          Type::NewConstant(js_heap_broker(), factory()->true_value(), zone()),
           Type::Union(Type::DetectableReceiver(), Type::Symbol(), zone()),
           zone()),
       0);

test/unittests/compiler/graph-unittest.cc

@@ -18,6 +18,7 @@ GraphTest::GraphTest(int num_parameters)
       TestWithIsolateAndZone(),
       common_(zone()),
       graph_(zone()),
+      js_heap_broker_(isolate()),
       source_positions_(&graph_),
       node_origins_(&graph_) {
   graph()->SetStart(graph()->NewNode(common()->Start(num_parameters)));
@@ -60,7 +61,7 @@ Node* GraphTest::NumberConstant(volatile double value) {
 
 Node* GraphTest::HeapConstant(const Handle<HeapObject>& value) {
   Node* node = graph()->NewNode(common()->HeapConstant(value));
-  Type type = Type::NewConstant(isolate(), value, zone());
+  Type type = Type::NewConstant(js_heap_broker(), value, zone());
   NodeProperties::SetType(node, type);
   return node;
 }
@@ -110,7 +111,8 @@ Matcher<Node*> GraphTest::IsUndefinedConstant() {
 }
 
 TypedGraphTest::TypedGraphTest(int num_parameters)
-    : GraphTest(num_parameters), typer_(isolate(), Typer::kNoFlags, graph()) {}
+    : GraphTest(num_parameters),
+      typer_(isolate(), js_heap_broker(), Typer::kNoFlags, graph()) {}
 
 TypedGraphTest::~TypedGraphTest() {}
 

test/unittests/compiler/graph-unittest.h

@@ -62,10 +62,12 @@ class GraphTest : public virtual TestWithNativeContext,
   Graph* graph() { return &graph_; }
   SourcePositionTable* source_positions() { return &source_positions_; }
   NodeOriginTable* node_origins() { return &node_origins_; }
+  const JSHeapBroker* js_heap_broker() { return &js_heap_broker_; }
 
  private:
   CommonOperatorBuilder common_;
   Graph graph_;
+  JSHeapBroker js_heap_broker_;
   SourcePositionTable source_positions_;
   NodeOriginTable node_origins_;
 };

test/unittests/compiler/js-create-lowering-unittest.cc

@@ -41,8 +41,8 @@ class JSCreateLoweringTest : public TypedGraphTest {
                     &machine);
     // TODO(titzer): mock the GraphReducer here for better unit testing.
     GraphReducer graph_reducer(zone(), graph());
-    JSCreateLowering reducer(&graph_reducer, &deps_, &jsgraph, native_context(),
-                             zone());
+    JSCreateLowering reducer(&graph_reducer, &deps_, &jsgraph, js_heap_broker(),
+                             native_context(), zone());
     return reducer.Reduce(node);
   }
 
@@ -70,8 +70,8 @@ class JSCreateLoweringTest : public TypedGraphTest {
 
 TEST_F(JSCreateLoweringTest, JSCreate) {
   Handle<JSFunction> function = isolate()->object_function();
-  Node* const target =
-      Parameter(Type::HeapConstant(isolate(), function, graph()->zone()));
+  Node* const target = Parameter(
+      Type::HeapConstant(js_heap_broker(), function, graph()->zone()));
   Node* const context = Parameter(Type::Any());
   Node* const effect = graph()->start();
   Node* const control = graph()->start();

test/unittests/compiler/js-typed-lowering-unittest.cc

@@ -48,7 +48,7 @@ class JSTypedLoweringTest : public TypedGraphTest {
                     &machine);
     // TODO(titzer): mock the GraphReducer here for better unit testing.
     GraphReducer graph_reducer(zone(), graph());
-    JSTypedLowering reducer(&graph_reducer, &jsgraph, zone());
+    JSTypedLowering reducer(&graph_reducer, &jsgraph, js_heap_broker(), zone());
     return reducer.Reduce(node);
   }
 

test/unittests/compiler/simplified-lowering-unittest.cc

@@ -42,12 +42,12 @@ class SimplifiedLoweringTest : public GraphTest {
     {
       // Simplified lowering needs to run w/o the typer decorator so make sure
       // the object is not live at the same time.
-      Typer typer(isolate(), Typer::kNoFlags, graph());
+      Typer typer(isolate(), js_heap_broker(), Typer::kNoFlags, graph());
       typer.Run();
     }
 
-    SimplifiedLowering lowering(jsgraph(), zone(), source_positions(),
-                                node_origins(),
+    SimplifiedLowering lowering(jsgraph(), js_heap_broker(), zone(),
+                                source_positions(), node_origins(),
                                 PoisoningMitigationLevel::kDontPoison);
     lowering.LowerAllNodes();
   }

test/unittests/compiler/typed-optimization-unittest.cc

@@ -38,7 +38,8 @@ class TypedOptimizationTest : public TypedGraphTest {
                     &machine);
     // TODO(titzer): mock the GraphReducer here for better unit testing.
     GraphReducer graph_reducer(zone(), graph());
-    TypedOptimization reducer(&graph_reducer, &deps_, &jsgraph);
+    TypedOptimization reducer(&graph_reducer, &deps_, &jsgraph,
+                              js_heap_broker());
     return reducer.Reduce(node);
   }
 

test/unittests/compiler/typer-unittest.cc

@@ -22,7 +22,8 @@ class TyperTest : public TypedGraphTest {
  public:
   TyperTest()
       : TypedGraphTest(3),
-        operation_typer_(isolate(), zone()),
+        js_heap_broker_(isolate()),
+        operation_typer_(isolate(), &js_heap_broker_, zone()),
         types_(zone(), isolate(), random_number_generator()),
         javascript_(zone()),
         simplified_(zone()) {
@@ -55,6 +56,7 @@ class TyperTest : public TypedGraphTest {
 
   const int kRepetitions = 50;
 
+  JSHeapBroker js_heap_broker_;
   OperationTyper operation_typer_;
   Types types_;
   JSOperatorBuilder javascript_;
@@ -174,8 +176,8 @@ class TyperTest : public TypedGraphTest {
             for (int x2 = rmin; x2 < rmin + width; x2++) {
               double result_value = opfun(x1, x2);
               Type result_type = Type::NewConstant(
-                  isolate(), isolate()->factory()->NewNumber(result_value),
-                  zone());
+                  &js_heap_broker_,
+                  isolate()->factory()->NewNumber(result_value), zone());
               EXPECT_TRUE(result_type.Is(expected_type));
             }
           }
@@ -196,21 +198,23 @@ class TyperTest : public TypedGraphTest {
         double x2 = RandomInt(r2.AsRange());
         double result_value = opfun(x1, x2);
         Type result_type = Type::NewConstant(
-            isolate(), isolate()->factory()->NewNumber(result_value), zone());
+            &js_heap_broker_, isolate()->factory()->NewNumber(result_value),
+            zone());
         EXPECT_TRUE(result_type.Is(expected_type));
       }
     }
     // Test extreme cases.
     double x1 = +1e-308;
     double x2 = -1e-308;
-    Type r1 = Type::NewConstant(isolate(), isolate()->factory()->NewNumber(x1),
-                                zone());
-    Type r2 = Type::NewConstant(isolate(), isolate()->factory()->NewNumber(x2),
-                                zone());
+    Type r1 = Type::NewConstant(&js_heap_broker_,
+                                isolate()->factory()->NewNumber(x1), zone());
+    Type r2 = Type::NewConstant(&js_heap_broker_,
+                                isolate()->factory()->NewNumber(x2), zone());
     Type expected_type = TypeBinaryOp(op, r1, r2);
     double result_value = opfun(x1, x2);
     Type result_type = Type::NewConstant(
-        isolate(), isolate()->factory()->NewNumber(result_value), zone());
+        &js_heap_broker_, isolate()->factory()->NewNumber(result_value),
+        zone());
     EXPECT_TRUE(result_type.Is(expected_type));
   }
 
@@ -225,7 +229,7 @@ class TyperTest : public TypedGraphTest {
         double x2 = RandomInt(r2.AsRange());
         bool result_value = opfun(x1, x2);
         Type result_type = Type::NewConstant(
-            isolate(),
+            &js_heap_broker_,
             result_value ? isolate()->factory()->true_value()
                          : isolate()->factory()->false_value(),
             zone());
@@ -245,7 +249,8 @@ class TyperTest : public TypedGraphTest {
         int32_t x2 = static_cast<int32_t>(RandomInt(r2.AsRange()));
         double result_value = opfun(x1, x2);
         Type result_type = Type::NewConstant(
-            isolate(), isolate()->factory()->NewNumber(result_value), zone());
+            &js_heap_broker_, isolate()->factory()->NewNumber(result_value),
+            zone());
         EXPECT_TRUE(result_type.Is(expected_type));
       }
     }