[turbofan] Brokerize CompilationDependencies.

Bug: v8:7790
Change-Id: I747dccb8dcae74c5c0837c0cd7f3dd285a4bd9c0
Reviewed-on: https://chromium-review.googlesource.com/1140304Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54497}

src/compiler/access-info.cc

@@ -237,11 +237,11 @@ Handle<Cell> PropertyAccessInfo::export_cell() const {
   return Handle<Cell>::cast(constant_);
 }
 
-AccessInfoFactory::AccessInfoFactory(CompilationDependencies* dependencies,
-                                     const JSHeapBroker* js_heap_broker,
+AccessInfoFactory::AccessInfoFactory(const JSHeapBroker* js_heap_broker,
+                                     CompilationDependencies* dependencies,
                                      Handle<Context> native_context, Zone* zone)
-    : dependencies_(dependencies),
-      js_heap_broker_(js_heap_broker),
+    : js_heap_broker_(js_heap_broker),
+      dependencies_(dependencies),
       native_context_(native_context),
       isolate_(native_context->GetIsolate()),
       type_cache_(TypeCache::Get()),
@@ -396,7 +396,8 @@ bool AccessInfoFactory::ComputePropertyAccessInfo(
               // The field type was cleared by the GC, so we don't know anything
               // about the contents now.
             } else if (descriptors_field_type->IsClass()) {
-              dependencies()->DependOnFieldType(map, number);
+              dependencies()->DependOnFieldType(MapRef(js_heap_broker(), map),
+                                                number);
               // Remember the field map, and try to infer a useful type.
               field_type = Type::For(js_heap_broker(),
                                      descriptors_field_type->AsClass());
@@ -699,14 +700,15 @@ bool AccessInfoFactory::LookupTransition(Handle<Map> map, Handle<Name> name,
       // Store is not safe if the field type was cleared.
       return false;
     } else if (descriptors_field_type->IsClass()) {
-      dependencies()->DependOnFieldType(transition_map, number);
+      dependencies()->DependOnFieldType(
+          MapRef(js_heap_broker(), transition_map), number);
       // Remember the field map, and try to infer a useful type.
       field_type =
           Type::For(js_heap_broker(), descriptors_field_type->AsClass());
       field_map = descriptors_field_type->AsClass();
     }
   }
-  dependencies()->DependOnTransition(transition_map);
+  dependencies()->DependOnTransition(MapRef(js_heap_broker(), transition_map));
   // Transitioning stores are never stores to constant fields.
   *access_info = PropertyAccessInfo::DataField(
       PropertyConstness::kMutable, MapHandles{map}, field_index,

src/compiler/access-info.h

@@ -140,8 +140,9 @@ class PropertyAccessInfo final {
 // Factory class for {ElementAccessInfo}s and {PropertyAccessInfo}s.
 class AccessInfoFactory final {
  public:
-  AccessInfoFactory(CompilationDependencies* dependencies,
-                    const JSHeapBroker* js_heap_broker,
+  AccessInfoFactory(const JSHeapBroker* js_heap_broker,
+                    CompilationDependencies* dependencies,
+
                     Handle<Context> native_context, Zone* zone);
 
   bool ComputeElementAccessInfo(Handle<Map> map, AccessMode access_mode,
@@ -174,8 +175,8 @@ class AccessInfoFactory final {
   Handle<Context> native_context() const { return native_context_; }
   Zone* zone() const { return zone_; }
 
-  CompilationDependencies* const dependencies_;
   const JSHeapBroker* const js_heap_broker_;
+  CompilationDependencies* const dependencies_;
   Handle<Context> const native_context_;
   Isolate* const isolate_;
   TypeCache const& type_cache_;

src/compiler/compilation-dependencies.h

@@ -5,6 +5,7 @@
 #ifndef V8_COMPILER_COMPILATION_DEPENDENCIES_H_
 #define V8_COMPILER_COMPILATION_DEPENDENCIES_H_
 
+#include "src/compiler/js-heap-broker.h"
 #include "src/objects.h"
 #include "src/zone/zone-containers.h"
 
@@ -21,42 +22,42 @@ class V8_EXPORT_PRIVATE CompilationDependencies : public ZoneObject {
 
   // Return the initial map of {function} and record the assumption that it
   // stays the intial map.
-  Handle<Map> DependOnInitialMap(Handle<JSFunction> function);
+  MapRef DependOnInitialMap(const JSFunctionRef& function);
 
   // Record the assumption that {map} stays stable.
-  void DependOnStableMap(Handle<Map> map);
+  void DependOnStableMap(const MapRef& map);
 
   // Record the assumption that {target_map} can be transitioned to, i.e., that
   // it does not become deprecated.
-  void DependOnTransition(Handle<Map> target_map);
+  void DependOnTransition(const MapRef& target_map);
 
   // Return the pretenure mode of {site} and record the assumption that it does
   // not change.
-  PretenureFlag DependOnPretenureMode(Handle<AllocationSite> site);
+  PretenureFlag DependOnPretenureMode(const AllocationSiteRef& site);
 
   // Record the assumption that the field type of a field does not change. The
-  // field is identified by the argument(s).
-  void DependOnFieldType(Handle<Map> map, int descriptor);
-  void DependOnFieldType(const LookupIterator* it);
+  // field is identified by the arguments.
+  void DependOnFieldType(const MapRef& map, int descriptor);
 
   // Record the assumption that neither {cell}'s {CellType} changes, nor the
   // {IsReadOnly()} flag of {cell}'s {PropertyDetails}.
-  void DependOnGlobalProperty(Handle<PropertyCell> cell);
+  void DependOnGlobalProperty(const PropertyCellRef& cell);
 
   // Record the assumption that the protector remains valid.
-  void DependOnProtector(Handle<PropertyCell> cell);
+  void DependOnProtector(const PropertyCellRef& cell);
 
   // Record the assumption that {site}'s {ElementsKind} doesn't change.
-  void DependOnElementsKind(Handle<AllocationSite> site);
+  void DependOnElementsKind(const AllocationSiteRef& site);
 
   // Depend on the stability of (the maps of) all prototypes of every class in
   // {receiver_type} up to (and including) the {holder}.
+  // TODO(neis): Fully brokerize!
   void DependOnStablePrototypeChains(
-      Handle<Context> native_context,
+      const JSHeapBroker* broker, Handle<Context> native_context,
       std::vector<Handle<Map>> const& receiver_maps, Handle<JSObject> holder);
 
   // Like DependOnElementsKind but also applies to all nested allocation sites.
-  void DependOnElementsKinds(Handle<AllocationSite> site);
+  void DependOnElementsKinds(const AllocationSiteRef& site);
 
   // Exposed only for testing purposes.
   bool AreValid() const;
@@ -65,7 +66,6 @@ class V8_EXPORT_PRIVATE CompilationDependencies : public ZoneObject {
   class Dependency;
 
  private:
-  Isolate* isolate_;
   Zone* zone_;
   ZoneForwardList<Dependency*> dependencies_;
 };

src/compiler/js-create-lowering.cc

@@ -139,7 +139,7 @@ Reduction JSCreateLowering::ReduceJSCreate(Node* node) {
 
   // Add a dependency on the {initial_map} to make sure that this code is
   // deoptimized whenever the {initial_map} changes.
-  MapRef initial_map = original_constructor.DependOnInitialMap(dependencies());
+  MapRef initial_map = dependencies()->DependOnInitialMap(original_constructor);
 
   // Force completion of inobject slack tracking before
   // generating code to finalize the instance size.
@@ -425,7 +425,7 @@ Reduction JSCreateLowering::ReduceJSCreateGeneratorObject(Node* node) {
 
     // Add a dependency on the {initial_map} to make sure that this code is
     // deoptimized whenever the {initial_map} changes.
-    MapRef initial_map = js_function.DependOnInitialMap(dependencies());
+    MapRef initial_map = dependencies()->DependOnInitialMap(js_function);
     DCHECK(initial_map.instance_type() == JS_GENERATOR_OBJECT_TYPE ||
            initial_map.instance_type() == JS_ASYNC_GENERATOR_OBJECT_TYPE);
 
@@ -727,8 +727,8 @@ Reduction JSCreateLowering::ReduceJSCreateArray(Node* node) {
 
       // Add a dependency on the {initial_map} to make sure that this code is
       // deoptimized whenever the {initial_map} changes.
-      Handle<Map> initial_map =
-          dependencies()->DependOnInitialMap(original_constructor);
+      MapRef initial_map = dependencies()->DependOnInitialMap(
+          JSFunctionRef(js_heap_broker(), original_constructor));
 
       // Tells whether we are protected by either the {site} or a
       // protector cell to do certain speculative optimizations.
@@ -737,13 +737,16 @@ Reduction JSCreateLowering::ReduceJSCreateArray(Node* node) {
       // Check if we have a feedback {site} on the {node}.
       if (!site.is_null()) {
         ElementsKind elements_kind = site->GetElementsKind();
-        if (initial_map->elements_kind() != elements_kind) {
+        if (initial_map.elements_kind() != elements_kind) {
           initial_map =
-              Map::AsElementsKind(isolate(), initial_map, elements_kind);
+              MapRef(js_heap_broker(),
+                     Map::AsElementsKind(isolate(), initial_map.object<Map>(),
+                                         elements_kind));
         }
         can_inline_call = site->CanInlineCall();
-        pretenure = dependencies()->DependOnPretenureMode(site);
-        dependencies()->DependOnElementsKind(site);
+        auto site_ref = AllocationSiteRef(js_heap_broker(), site);
+        pretenure = dependencies()->DependOnPretenureMode(site_ref);
+        dependencies()->DependOnElementsKind(site_ref);
       } else {
         can_inline_call = isolate()->IsArrayConstructorIntact();
       }
@@ -751,31 +754,36 @@ Reduction JSCreateLowering::ReduceJSCreateArray(Node* node) {
       if (arity == 0) {
         Node* length = jsgraph()->ZeroConstant();
         int capacity = JSArray::kPreallocatedArrayElements;
-        return ReduceNewArray(node, length, capacity, initial_map, pretenure);
+        return ReduceNewArray(node, length, capacity, initial_map.object<Map>(),
+                              pretenure);
       } else if (arity == 1) {
         Node* length = NodeProperties::GetValueInput(node, 2);
         Type length_type = NodeProperties::GetType(length);
         if (!length_type.Maybe(Type::Number())) {
           // Handle the single argument case, where we know that the value
           // cannot be a valid Array length.
-          ElementsKind elements_kind = initial_map->elements_kind();
+          ElementsKind elements_kind = initial_map.elements_kind();
           elements_kind = GetMoreGeneralElementsKind(
               elements_kind, IsHoleyElementsKind(elements_kind)
                                  ? HOLEY_ELEMENTS
                                  : PACKED_ELEMENTS);
           initial_map =
-              Map::AsElementsKind(isolate(), initial_map, elements_kind);
-          return ReduceNewArray(node, std::vector<Node*>{length}, initial_map,
-                                pretenure);
+              MapRef(js_heap_broker(),
+                     Map::AsElementsKind(isolate(), initial_map.object<Map>(),
+                                         elements_kind));
+          return ReduceNewArray(node, std::vector<Node*>{length},
+                                initial_map.object<Map>(), pretenure);
         }
         if (length_type.Is(Type::SignedSmall()) && length_type.Min() >= 0 &&
             length_type.Max() <= kElementLoopUnrollLimit &&
             length_type.Min() == length_type.Max()) {
           int capacity = static_cast<int>(length_type.Max());
-          return ReduceNewArray(node, length, capacity, initial_map, pretenure);
+          return ReduceNewArray(node, length, capacity,
+                                initial_map.object<Map>(), pretenure);
         }
         if (length_type.Maybe(Type::UnsignedSmall()) && can_inline_call) {
-          return ReduceNewArray(node, length, initial_map, pretenure);
+          return ReduceNewArray(node, length, initial_map.object<Map>(),
+                                pretenure);
         }
       } else if (arity <= JSArray::kInitialMaxFastElementArray) {
         // Gather the values to store into the newly created array.
@@ -799,7 +807,7 @@ Reduction JSCreateLowering::ReduceJSCreateArray(Node* node) {
         }
 
         // Try to figure out the ideal elements kind statically.
-        ElementsKind elements_kind = initial_map->elements_kind();
+        ElementsKind elements_kind = initial_map.elements_kind();
         if (values_all_smis) {
           // Smis can be stored with any elements kind.
         } else if (values_all_numbers) {
@@ -821,9 +829,12 @@ Reduction JSCreateLowering::ReduceJSCreateArray(Node* node) {
           return NoChange();
         }
         initial_map =
-            Map::AsElementsKind(isolate(), initial_map, elements_kind);
+            MapRef(js_heap_broker(),
+                   Map::AsElementsKind(isolate(), initial_map.object<Map>(),
+                                       elements_kind));
 
-        return ReduceNewArray(node, values, initial_map, pretenure);
+        return ReduceNewArray(node, values, initial_map.object<Map>(),
+                              pretenure);
       }
     }
   }
@@ -1151,10 +1162,9 @@ Reduction JSCreateLowering::ReduceJSCreateLiteralArrayOrObject(Node* node) {
     if (site.IsFastLiteral()) {
       PretenureFlag pretenure = NOT_TENURED;
       if (FLAG_allocation_site_pretenuring) {
-        pretenure = dependencies()->DependOnPretenureMode(
-            site.object<AllocationSite>());
+        pretenure = dependencies()->DependOnPretenureMode(site);
       }
-      dependencies()->DependOnElementsKinds(site.object<AllocationSite>());
+      dependencies()->DependOnElementsKinds(site);
       JSObjectRef boilerplate = site.boilerplate();
       Node* value = effect =
           AllocateFastLiteral(effect, control, boilerplate, pretenure);
@@ -1176,8 +1186,10 @@ Reduction JSCreateLowering::ReduceJSCreateEmptyLiteralArray(Node* node) {
     Handle<Map> const initial_map(
         native_context()->GetInitialJSArrayMap(site->GetElementsKind()),
         isolate());
-    PretenureFlag const pretenure = dependencies()->DependOnPretenureMode(site);
-    dependencies()->DependOnElementsKind(site);
+    auto site_ref = AllocationSiteRef(js_heap_broker(), site);
+    PretenureFlag const pretenure =
+        dependencies()->DependOnPretenureMode(site_ref);
+    dependencies()->DependOnElementsKind(site_ref);
     Node* length = jsgraph()->ZeroConstant();
     return ReduceNewArray(node, length, 0, initial_map, pretenure);
   }

src/compiler/js-heap-broker.cc

@@ -156,15 +156,6 @@ bool JSFunctionRef::IsConstructor() const {
   return object<JSFunction>()->IsConstructor();
 }
 
-MapRef JSFunctionRef::DependOnInitialMap(
-    CompilationDependencies* dependencies) const {
-  AllowHandleAllocation handle_allocation;
-  AllowHandleDereference allow_handle_dereference;
-  Handle<Map> initial_map =
-      dependencies->DependOnInitialMap(object<JSFunction>());
-  return MapRef(broker(), initial_map);
-}
-
 void JSFunctionRef::EnsureHasInitialMap() const {
   AllowHandleAllocation handle_allocation;
   AllowHandleDereference allow_handle_dereference;
@@ -175,13 +166,6 @@ void JSFunctionRef::EnsureHasInitialMap() const {
   JSFunction::EnsureHasInitialMap(object<JSFunction>());
 }
 
-// TODO(neis): Remove.
-void MapRef::DependOnStableMap(CompilationDependencies* dependencies) const {
-  AllowHandleAllocation handle_allocation;
-  AllowHandleDereference allow_handle_dereference;
-  dependencies->DependOnStableMap(object<Map>());
-}
-
 SlackTrackingResult JSFunctionRef::FinishSlackTracking() const {
   AllowHandleDereference allow_handle_dereference;
   AllowHandleAllocation handle_allocation;
@@ -265,6 +249,24 @@ JSObjectRef AllocationSiteRef::boilerplate() const {
   return JSObjectRef(broker(), value);
 }
 
+ObjectRef AllocationSiteRef::nested_site() const {
+  AllowHandleAllocation handle_allocation;
+  AllowHandleDereference handle_dereference;
+  Handle<Object> obj(object<AllocationSite>()->nested_site(),
+                     broker()->isolate());
+  return ObjectRef(broker(), obj);
+}
+
+bool AllocationSiteRef::PointsToLiteral() const {
+  AllowHandleDereference handle_dereference;
+  return object<AllocationSite>()->PointsToLiteral();
+}
+
+ElementsKind AllocationSiteRef::GetElementsKind() const {
+  AllowHandleDereference handle_dereference;
+  return object<AllocationSite>()->GetElementsKind();
+}
+
 bool JSObjectRef::IsUnboxedDoubleField(FieldIndex index) const {
   AllowHandleDereference handle_dereference;
   return object<JSObject>()->IsUnboxedDoubleField(index);
@@ -283,6 +285,11 @@ ObjectRef JSObjectRef::RawFastPropertyAt(FieldIndex index) const {
                           broker()->isolate()));
 }
 
+ElementsKind JSObjectRef::GetElementsKind() {
+  AllowHandleDereference handle_dereference;
+  return object<JSObject>()->GetElementsKind();
+}
+
 FixedArrayBaseRef JSObjectRef::elements() const {
   AllowHandleAllocation handle_allocation;
   AllowHandleDereference handle_dereference;
@@ -405,6 +412,21 @@ void JSObjectRef::EnsureElementsTenured() {
   }
 }
 
+ElementsKind MapRef::elements_kind() const {
+  AllowHandleDereference allow_handle_dereference;
+  return object<Map>()->elements_kind();
+}
+
+bool MapRef::is_deprecated() const {
+  AllowHandleDereference allow_handle_dereference;
+  return object<Map>()->is_deprecated();
+}
+
+bool MapRef::CanBeDeprecated() const {
+  AllowHandleDereference allow_handle_dereference;
+  return object<Map>()->CanBeDeprecated();
+}
+
 int MapRef::GetInObjectProperties() const {
   AllowHandleDereference allow_handle_dereference;
   return object<Map>()->GetInObjectProperties();
@@ -491,6 +513,24 @@ bool MapRef::CanTransition() const {
   return object<Map>()->CanTransition();
 }
 
+MapRef MapRef::FindFieldOwner(int descriptor) const {
+  AllowHandleAllocation handle_allocation;
+  AllowHandleDereference allow_handle_dereference;
+  Handle<Map> owner(
+      object<Map>()->FindFieldOwner(broker()->isolate(), descriptor),
+      broker()->isolate());
+  return MapRef(broker(), owner);
+}
+
+FieldTypeRef MapRef::GetFieldType(int descriptor) const {
+  AllowHandleAllocation handle_allocation;
+  AllowHandleDereference allow_handle_dereference;
+  Handle<FieldType> field_type(
+      object<Map>()->instance_descriptors()->GetFieldType(descriptor),
+      broker()->isolate());
+  return FieldTypeRef(broker(), field_type);
+}
+
 ElementsKind JSArrayRef::GetElementsKind() const {
   AllowHandleDereference allow_handle_dereference;
   return object<JSArray>()->GetElementsKind();
@@ -791,6 +831,18 @@ CellRef ModuleRef::GetCell(int cell_index) {
                                   broker()->isolate()));
 }
 
+ObjectRef PropertyCellRef::value() const {
+  AllowHandleAllocation allow_handle_allocation;
+  AllowHandleDereference allow_handle_dereference;
+  return ObjectRef(
+      broker(), handle(object<PropertyCell>()->value(), broker()->isolate()));
+}
+
+PropertyDetails PropertyCellRef::property_details() const {
+  AllowHandleDereference allow_handle_dereference;
+  return object<PropertyCell>()->property_details();
+}
+
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8

src/compiler/js-heap-broker.h

@@ -81,6 +81,7 @@ class HeapObjectType {
   V(MutableHeapNumber)             \
   V(Name)                          \
   V(NativeContext)                 \
+  V(PropertyCell)                  \
   V(ScopeInfo)                     \
   V(ScriptContextTable)            \
   V(SharedFunctionInfo)            \
@@ -130,6 +131,11 @@ class ObjectRef {
   Handle<Object> object_;
 };
 
+class FieldTypeRef : public ObjectRef {
+ public:
+  using ObjectRef::ObjectRef;
+};
+
 class HeapObjectRef : public ObjectRef {
  public:
   using ObjectRef::ObjectRef;
@@ -141,6 +147,14 @@ class HeapObjectRef : public ObjectRef {
   bool IsExternalString() const;
 };
 
+class PropertyCellRef : public HeapObjectRef {
+ public:
+  using HeapObjectRef::HeapObjectRef;
+
+  ObjectRef value() const;
+  PropertyDetails property_details() const;
+};
+
 class JSObjectRef : public HeapObjectRef {
  public:
   using HeapObjectRef::HeapObjectRef;
@@ -151,6 +165,7 @@ class JSObjectRef : public HeapObjectRef {
 
   FixedArrayBaseRef elements() const;
   void EnsureElementsTenured();
+  ElementsKind GetElementsKind();
 };
 
 struct SlackTrackingResult {
@@ -170,9 +185,6 @@ class JSFunctionRef : public JSObjectRef {
   bool IsConstructor() const;
   bool has_initial_map() const;
   MapRef initial_map() const;
-
-  MapRef DependOnInitialMap(CompilationDependencies* dependencies) const;
-
   JSGlobalProxyRef global_proxy() const;
   SlackTrackingResult FinishSlackTracking() const;
   SharedFunctionInfoRef shared() const;
@@ -267,6 +279,9 @@ class AllocationSiteRef : public HeapObjectRef {
   JSObjectRef boilerplate() const;
   PretenureFlag GetPretenureMode() const;
   bool IsFastLiteral() const;
+  ObjectRef nested_site() const;
+  bool PointsToLiteral() const;
+  ElementsKind GetElementsKind() const;
 };
 
 class MapRef : public HeapObjectRef {
@@ -281,18 +296,21 @@ class MapRef : public HeapObjectRef {
   NameRef GetPropertyKey(int i) const;
   FieldIndex GetFieldIndexFor(int i) const;
   int GetInObjectPropertyOffset(int index) const;
+  ElementsKind elements_kind() const;
   ObjectRef constructor_or_backpointer() const;
-
   bool is_stable() const;
   bool has_prototype_slot() const;
+  bool is_deprecated() const;
+  bool CanBeDeprecated() const;
   bool CanTransition() const;
   bool IsInobjectSlackTrackingInProgress() const;
-
+  MapRef FindFieldOwner(int descriptor) const;
   bool is_dictionary_map() const;
   bool IsJSArrayMap() const;
   bool IsFixedCowArrayMap() const;
 
-  void DependOnStableMap(CompilationDependencies* dependencies) const;
+  // Concerning the underlying instance_descriptors:
+  FieldTypeRef GetFieldType(int descriptor) const;
 };
 
 class FixedArrayBaseRef : public HeapObjectRef {

src/compiler/pipeline.cc

@@ -135,7 +135,7 @@ class PipelineData {
     javascript_ = new (graph_zone_) JSOperatorBuilder(graph_zone_);
     jsgraph_ = new (graph_zone_)
         JSGraph(isolate_, graph_, common_, javascript_, simplified_, machine_);
-    js_heap_broker_ = new (graph_zone_) JSHeapBroker(isolate_);
+    js_heap_broker_ = new (codegen_zone_) JSHeapBroker(isolate_);
     dependencies_ =
         new (codegen_zone_) CompilationDependencies(isolate_, codegen_zone_);
   }
@@ -334,6 +334,7 @@ class PipelineData {
     codegen_zone_scope_.Destroy();
     codegen_zone_ = nullptr;
     dependencies_ = nullptr;
+    js_heap_broker_ = nullptr;
     frame_ = nullptr;
   }
 
@@ -447,7 +448,6 @@ class PipelineData {
   JSGraph* jsgraph_ = nullptr;
   MachineGraph* mcgraph_ = nullptr;
   Schedule* schedule_ = nullptr;
-  JSHeapBroker* js_heap_broker_ = nullptr;
 
   // All objects in the following group of fields are allocated in
   // instruction_zone_. They are all set to nullptr when the instruction_zone_
@@ -462,6 +462,7 @@ class PipelineData {
   ZoneStats::Scope codegen_zone_scope_;
   Zone* codegen_zone_;
   CompilationDependencies* dependencies_ = nullptr;
+  JSHeapBroker* js_heap_broker_ = nullptr;
   Frame* frame_ = nullptr;
 
   // All objects in the following group of fields are allocated in

src/compiler/property-access-builder.cc

@@ -136,7 +136,8 @@ void PropertyAccessBuilder::BuildCheckMaps(
     if (receiver_map->is_stable()) {
       for (Handle<Map> map : receiver_maps) {
         if (map.is_identical_to(receiver_map)) {
-          dependencies()->DependOnStableMap(receiver_map);
+          dependencies()->DependOnStableMap(
+              MapRef(js_heap_broker(), receiver_map));
           return;
         }
       }
@@ -206,7 +207,9 @@ Node* PropertyAccessBuilder::TryBuildLoadConstantDataField(
           // the field.
           DCHECK(access_info.IsDataConstantField());
           DCHECK(!it.is_dictionary_holder());
-          dependencies()->DependOnFieldType(&it);
+          MapRef map(js_heap_broker(),
+                     handle(it.GetHolder<HeapObject>()->map(), isolate()));
+          dependencies()->DependOnFieldType(map, it.GetFieldDescriptorIndex());
         }
         return value;
       }
@@ -264,7 +267,7 @@ Node* PropertyAccessBuilder::BuildLoadDataField(
     Handle<Map> field_map;
     if (access_info.field_map().ToHandle(&field_map)) {
       if (field_map->is_stable()) {
-        dependencies()->DependOnStableMap(field_map);
+        dependencies()->DependOnStableMap(MapRef(js_heap_broker(), field_map));
         field_access.map = field_map;
       }
     }

src/compiler/property-access-builder.h

@@ -19,14 +19,18 @@ class CommonOperatorBuilder;
 class CompilationDependencies;
 class Graph;
 class JSGraph;
+class JSHeapBroker;
 class Node;
 class PropertyAccessInfo;
 class SimplifiedOperatorBuilder;
 
 class PropertyAccessBuilder {
  public:
-  PropertyAccessBuilder(JSGraph* jsgraph, CompilationDependencies* dependencies)
-      : jsgraph_(jsgraph), dependencies_(dependencies) {}
+  PropertyAccessBuilder(JSGraph* jsgraph, const JSHeapBroker* js_heap_broker,
+                        CompilationDependencies* dependencies)
+      : jsgraph_(jsgraph),
+        js_heap_broker_(js_heap_broker),
+        dependencies_(dependencies) {}
 
   // Builds the appropriate string check if the maps are only string
   // maps.
@@ -50,6 +54,7 @@ class PropertyAccessBuilder {
 
  private:
   JSGraph* jsgraph() const { return jsgraph_; }
+  const JSHeapBroker* js_heap_broker() const { return js_heap_broker_; }
   CompilationDependencies* dependencies() const { return dependencies_; }
   Graph* graph() const;
   Isolate* isolate() const;
@@ -64,6 +69,7 @@ class PropertyAccessBuilder {
   Node* ResolveHolder(PropertyAccessInfo const& access_info, Node* receiver);
 
   JSGraph* jsgraph_;
+  const JSHeapBroker* js_heap_broker_;
   CompilationDependencies* dependencies_;
 };
 

src/compiler/typed-optimization.cc

@@ -153,7 +153,7 @@ Reduction TypedOptimization::ReduceCheckMaps(Node* node) {
       if (map_type.IsHeapConstant() &&
           map_type.AsHeapConstant()->Ref().equals(*object_map)) {
         if (object_map->CanTransition()) {
-          object_map->DependOnStableMap(dependencies());
+          dependencies()->DependOnStableMap(*object_map);
         }
         return Replace(effect);
       }
@@ -218,9 +218,7 @@ Reduction TypedOptimization::ReduceLoadField(Node* node) {
     base::Optional<MapRef> object_map =
         GetStableMapFromObjectType(js_heap_broker(), object_type);
     if (object_map.has_value()) {
-      if (object_map->CanTransition()) {
-        object_map->DependOnStableMap(dependencies());
-      }
+      dependencies()->DependOnStableMap(*object_map);
       Node* const value = jsgraph()->Constant(*object_map);
       ReplaceWithValue(node, value);
       return Replace(value);

src/objects-inl.h

@@ -1456,7 +1456,7 @@ ACCESSORS(PropertyCell, name, Name, kNameOffset)
 ACCESSORS(PropertyCell, value, Object, kValueOffset)
 ACCESSORS(PropertyCell, property_details_raw, Object, kDetailsOffset)
 
-PropertyDetails PropertyCell::property_details() {
+PropertyDetails PropertyCell::property_details() const {
   return PropertyDetails(Smi::cast(property_details_raw()));
 }
 

src/objects.h

@@ -3909,7 +3909,7 @@ class PropertyCell : public HeapObject {
   // property.
   DECL_ACCESSORS(dependent_code, DependentCode)
 
-  inline PropertyDetails property_details();
+  inline PropertyDetails property_details() const;
   inline void set_property_details(PropertyDetails details);
 
   PropertyCellConstantType GetConstantType();

test/cctest/test-field-type-tracking.cc

@@ -11,6 +11,7 @@
 
 #include "src/compilation-cache.h"
 #include "src/compiler/compilation-dependencies.h"
+#include "src/compiler/js-heap-broker.h"
 #include "src/execution.h"
 #include "src/field-type.h"
 #include "src/global-handles.h"
@@ -608,6 +609,7 @@ static void TestGeneralizeField(int detach_property_at_index,
                                 bool expected_deprecation,
                                 bool expected_field_type_dependency) {
   Isolate* isolate = CcTest::i_isolate();
+  JSHeapBroker broker(isolate);
   Handle<FieldType> any_type = FieldType::Any(isolate);
 
   CHECK(detach_property_at_index >= -1 &&
@@ -653,11 +655,12 @@ static void TestGeneralizeField(int detach_property_at_index,
   }
 
   // Create new maps by generalizing representation of propX field.
-  Handle<Map> field_owner(map->FindFieldOwner(isolate, property_index),
-                          isolate);
+  CanonicalHandleScope canonical(isolate);
   CompilationDependencies dependencies(isolate, &zone);
-  dependencies.DependOnFieldType(map, property_index);
+  dependencies.DependOnFieldType(MapRef(&broker, map), property_index);
 
+  Handle<Map> field_owner(map->FindFieldOwner(isolate, property_index),
+                          isolate);
   Handle<Map> new_map = Map::ReconfigureProperty(
       isolate, map, property_index, kData, NONE, to.representation, to.type);
 
@@ -986,6 +989,7 @@ TEST(GeneralizeFieldWithAccessorProperties) {
 static void TestReconfigureDataFieldAttribute_GeneralizeField(
     const CRFTData& from, const CRFTData& to, const CRFTData& expected) {
   Isolate* isolate = CcTest::i_isolate();
+  JSHeapBroker broker(isolate);
 
   Expectations expectations(isolate);
 
@@ -1023,8 +1027,9 @@ static void TestReconfigureDataFieldAttribute_GeneralizeField(
   CHECK(expectations2.Check(*map2));
 
   Zone zone(isolate->allocator(), ZONE_NAME);
+  CanonicalHandleScope canonical(isolate);
   CompilationDependencies dependencies(isolate, &zone);
-  dependencies.DependOnFieldType(map, kSplitProp);
+  dependencies.DependOnFieldType(MapRef(&broker, map), kSplitProp);
 
   // Reconfigure attributes of property |kSplitProp| of |map2| to NONE, which
   // should generalize representations in |map1|.
@@ -1068,6 +1073,7 @@ static void TestReconfigureDataFieldAttribute_GeneralizeFieldTrivial(
     const CRFTData& from, const CRFTData& to, const CRFTData& expected,
     bool expected_field_type_dependency = true) {
   Isolate* isolate = CcTest::i_isolate();
+  JSHeapBroker broker(isolate);
 
   Expectations expectations(isolate);
 
@@ -1105,8 +1111,9 @@ static void TestReconfigureDataFieldAttribute_GeneralizeFieldTrivial(
   CHECK(expectations2.Check(*map2));
 
   Zone zone(isolate->allocator(), ZONE_NAME);
+  CanonicalHandleScope canonical(isolate);
   CompilationDependencies dependencies(isolate, &zone);
-  dependencies.DependOnFieldType(map, kSplitProp);
+  dependencies.DependOnFieldType(MapRef(&broker, map), kSplitProp);
 
   // Reconfigure attributes of property |kSplitProp| of |map2| to NONE, which
   // should generalize representations in |map1|.
@@ -1746,6 +1753,7 @@ TEST(ReconfigureDataFieldAttribute_AccConstantToDataFieldAfterTargetMap) {
 static void TestReconfigureElementsKind_GeneralizeField(
     const CRFTData& from, const CRFTData& to, const CRFTData& expected) {
   Isolate* isolate = CcTest::i_isolate();
+  JSHeapBroker broker(isolate);
 
   Expectations expectations(isolate, PACKED_SMI_ELEMENTS);
 
@@ -1784,8 +1792,9 @@ static void TestReconfigureElementsKind_GeneralizeField(
   CHECK(expectations2.Check(*map2));
 
   Zone zone(isolate->allocator(), ZONE_NAME);
+  CanonicalHandleScope canonical(isolate);
   CompilationDependencies dependencies(isolate, &zone);
-  dependencies.DependOnFieldType(map, kDiffProp);
+  dependencies.DependOnFieldType(MapRef(&broker, map), kDiffProp);
 
   // Reconfigure elements kinds of |map2|, which should generalize
   // representations in |map|.
@@ -1839,6 +1848,7 @@ static void TestReconfigureElementsKind_GeneralizeField(
 static void TestReconfigureElementsKind_GeneralizeFieldTrivial(
     const CRFTData& from, const CRFTData& to, const CRFTData& expected) {
   Isolate* isolate = CcTest::i_isolate();
+  JSHeapBroker broker(isolate);
 
   Expectations expectations(isolate, PACKED_SMI_ELEMENTS);
 
@@ -1877,8 +1887,9 @@ static void TestReconfigureElementsKind_GeneralizeFieldTrivial(
   CHECK(expectations2.Check(*map2));
 
   Zone zone(isolate->allocator(), ZONE_NAME);
+  CanonicalHandleScope canonical(isolate);
   CompilationDependencies dependencies(isolate, &zone);
-  dependencies.DependOnFieldType(map, kDiffProp);
+  dependencies.DependOnFieldType(MapRef(&broker, map), kDiffProp);
 
   // Reconfigure elements kinds of |map2|, which should generalize
   // representations in |map|.