[turbofan] Serialize feedback vector.

R=jarin@chromium.org

Bug: v8:7790
Change-Id: Id73084879bb0d03327e871bdd063353495c07a5b
Reviewed-on: https://chromium-review.googlesource.com/1180894
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55236}

src/compiler/js-heap-broker.cc

@@ -324,7 +324,32 @@ void MapData::SerializeElementsKindGeneralizations() {
   }
 }
 
-class FeedbackVectorData : public HeapObjectData {};
+class FeedbackVectorData : public HeapObjectData {
+ public:
+  const ZoneVector<ObjectData*>& feedback() { return feedback_; }
+
+  FeedbackVectorData(JSHeapBroker* broker_, Handle<FeedbackVector> object_,
+                     HeapObjectType type_);
+
+ private:
+  ZoneVector<ObjectData*> feedback_;
+};
+
+FeedbackVectorData::FeedbackVectorData(JSHeapBroker* broker_,
+                                       Handle<FeedbackVector> object_,
+                                       HeapObjectType type_)
+    : HeapObjectData(broker_, object_, type_), feedback_(broker_->zone()) {
+  feedback_.reserve(object_->length());
+  for (int i = 0; i < object_->length(); ++i) {
+    MaybeObject* value = object_->get(i);
+    feedback_.push_back(value->IsObject()
+                            ? broker->GetOrCreateData(
+                                  handle(value->ToObject(), broker->isolate()))
+                            : nullptr);
+  }
+  DCHECK_EQ(object_->length(), feedback_.size());
+}
+
 class FixedArrayBaseData : public HeapObjectData {};
 class FixedArrayData : public FixedArrayBaseData {};
 class FixedDoubleArrayData : public FixedArrayBaseData {};
@@ -373,6 +398,9 @@ HeapObjectData* HeapObjectData::Serialize(JSHeapBroker* broker,
   if (object->IsJSFunction()) {
     result = new (broker->zone())
         JSFunctionData(broker, Handle<JSFunction>::cast(object), type);
+  } else if (object->IsAllocationSite()) {
+    result = new (broker->zone())
+        AllocationSiteData(broker, Handle<AllocationSite>::cast(object), type);
   } else if (object->IsNativeContext()) {
     result = new (broker->zone())
         NativeContextData(broker, Handle<Context>::cast(object), type);
@@ -388,9 +416,9 @@ HeapObjectData* HeapObjectData::Serialize(JSHeapBroker* broker,
   } else if (object->IsName()) {
     result =
         new (broker->zone()) NameData(broker, Handle<Name>::cast(object), type);
-  } else if (object->IsAllocationSite()) {
+  } else if (object->IsFeedbackVector()) {
     result = new (broker->zone())
-        AllocationSiteData(broker, Handle<AllocationSite>::cast(object), type);
+        FeedbackVectorData(broker, Handle<FeedbackVector>::cast(object), type);
   } else {
     result = new (broker->zone()) HeapObjectData(broker, object, type);
   }
@@ -651,11 +679,15 @@ OddballType ObjectRef::oddball_type() const {
 }
 
 ObjectRef FeedbackVectorRef::get(FeedbackSlot slot) const {
-  AllowHandleAllocation handle_allocation;
-  AllowHandleDereference handle_dereference;
-  Handle<Object> value(object<FeedbackVector>()->Get(slot)->ToObject(),
-                       broker()->isolate());
-  return ObjectRef(broker(), value);
+  if (broker()->mode() == JSHeapBroker::kDisabled) {
+    AllowHandleAllocation handle_allocation;
+    AllowHandleDereference handle_dereference;
+    Handle<Object> value(object<FeedbackVector>()->Get(slot)->ToObject(),
+                         broker()->isolate());
+    return ObjectRef(broker(), value);
+  }
+  int i = FeedbackVector::GetIndex(slot);
+  return ObjectRef(data()->AsFeedbackVector()->feedback().at(i));
 }
 
 bool JSObjectRef::IsUnboxedDoubleField(FieldIndex index) const {

src/compiler/js-heap-copy-reducer.cc

@@ -28,17 +28,6 @@ Reduction JSHeapCopyReducer::Reduce(Node* node) {
       ObjectRef(broker(), HeapConstantOf(node->op()));
       break;
     }
-    case IrOpcode::kJSCreateLiteralArray:
-    case IrOpcode::kJSCreateLiteralObject: {
-      // TODO(neis, jarin) Force serialization of the entire feedback vector
-      // rather than just the one element.
-      CreateLiteralParameters const& p = CreateLiteralParametersOf(node->op());
-      Handle<Object> feedback(
-          p.feedback().vector()->Get(p.feedback().slot())->ToObject(),
-          broker()->isolate());
-      ObjectRef(broker(), feedback);
-      break;
-    }
     case IrOpcode::kJSCreateArray: {
       CreateArrayParameters const& p = CreateArrayParametersOf(node->op());
       Handle<AllocationSite> site;
@@ -56,12 +45,29 @@ Reduction JSHeapCopyReducer::Reduce(Node* node) {
       HeapObjectRef(broker(), p.code());
       break;
     }
+    case IrOpcode::kJSCreateEmptyLiteralArray: {
+      // TODO(neis, jarin) Force serialization of the entire feedback vector
+      // rather than just the one element.
+      FeedbackParameter const& p = FeedbackParameterOf(node->op());
+      FeedbackVectorRef(broker(), p.feedback().vector());
+      Handle<Object> feedback(
+          p.feedback().vector()->Get(p.feedback().slot())->ToObject(),
+          broker()->isolate());
+      ObjectRef(broker(), feedback);
+      break;
+    }
     case IrOpcode::kJSCreateFunctionContext: {
       CreateFunctionContextParameters const& p =
           CreateFunctionContextParametersOf(node->op());
       ScopeInfoRef(broker(), p.scope_info());
       break;
     }
+    case IrOpcode::kJSCreateLiteralArray:
+    case IrOpcode::kJSCreateLiteralObject: {
+      CreateLiteralParameters const& p = CreateLiteralParametersOf(node->op());
+      ObjectRef(broker(), p.feedback().vector());
+      break;
+    }
     case IrOpcode::kJSLoadNamed:
     case IrOpcode::kJSStoreNamed: {
       NamedAccess const& p = NamedAccessOf(node->op());