[turbofan] Encapsulate some heap accesses.

This encapuslates some of the heap accesses done by
JSNativeContextSpecialization::ReduceJSLoadGlobal and
JSNativeContextSpecialization::ReduceJSStoreGlobal.

Bug: v8:7790
Change-Id: Ib6c63903809927d6094af22519285cb9d0bbff7a
Reviewed-on: https://chromium-review.googlesource.com/1106141Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53845}

src/compiler/js-graph.h

@@ -56,6 +56,7 @@ class V8_EXPORT_PRIVATE JSGraph : public MachineGraph {
   Node* Constant(Handle<Object> value);
 
   // Like above, but doesn't access the heap directly.
+  // TODO(neis): Make the broker a member of JSGraph.
   Node* Constant(const JSHeapBroker* broker, const ObjectRef& value);
 
   // Creates a NumberConstant node, usually canonicalized.

src/compiler/js-heap-broker.cc

@@ -29,6 +29,11 @@ ContextRef::ContextRef(Handle<Object> object) : HeapObjectRef(object) {
   SLOW_DCHECK(object->IsContext());
 }
 
+NativeContextRef::NativeContextRef(Handle<Object> object) : ContextRef(object) {
+  AllowHandleDereference handle_dereference;
+  SLOW_DCHECK(object->IsNativeContext());
+}
+
 bool ObjectRef::IsSmi() const {
   AllowHandleDereference allow_handle_dereference;
   return object_->IsSmi();
@@ -49,8 +54,7 @@ base::Optional<ContextRef> ContextRef::previous(
   return ContextRef(handle(previous, broker->isolate()));
 }
 
-base::Optional<ObjectRef> ContextRef::get(const JSHeapBroker* broker,
-                                          int index) const {
+ObjectRef ContextRef::get(const JSHeapBroker* broker, int index) const {
   AllowHandleAllocation handle_allocation;
   AllowHandleDereference handle_dereference;
   Handle<Object> value(object<Context>()->get(index), broker->isolate());
@@ -131,6 +135,42 @@ BuiltinFunctionId JSFunctionRef::GetBuiltinFunctionId() const {
   return object<JSFunction>()->shared()->builtin_function_id();
 }
 
+NameRef::NameRef(Handle<Object> object) : HeapObjectRef(object) {
+  AllowHandleDereference handle_dereference;
+  SLOW_DCHECK(object->IsName());
+}
+
+ScriptContextTableRef::ScriptContextTableRef(Handle<Object> object)
+    : HeapObjectRef(object) {
+  AllowHandleDereference handle_dereference;
+  SLOW_DCHECK(object->IsScriptContextTable());
+}
+
+base::Optional<ScriptContextTableRef::LookupResult>
+ScriptContextTableRef::lookup(const NameRef& name) const {
+  AllowHandleDereference handle_dereference;
+  if (!name.IsString()) return {};
+  ScriptContextTable::LookupResult lookup_result;
+  auto table = object<ScriptContextTable>();
+  if (!ScriptContextTable::Lookup(table, name.object<String>(),
+                                  &lookup_result)) {
+    return {};
+  }
+  Handle<Context> script_context =
+      ScriptContextTable::GetContext(table, lookup_result.context_index);
+  LookupResult result{ContextRef(script_context),
+                      lookup_result.mode == VariableMode::kConst,
+                      lookup_result.slot_index};
+  return result;
+}
+
+ScriptContextTableRef NativeContextRef::script_context_table(
+    const JSHeapBroker* broker) const {
+  AllowHandleDereference handle_dereference;
+  return ScriptContextTableRef(
+      handle(object<Context>()->script_context_table(), broker->isolate()));
+}
+
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8

src/compiler/js-heap-broker.h

@@ -53,7 +53,11 @@ class HeapObjectType {
 #define HEAP_BROKER_DATA_LIST(V) \
   V(Context)                     \
   V(HeapNumber)                  \
-  V(JSFunction)
+  V(HeapObject)                  \
+  V(JSFunction)                  \
+  V(Name)                        \
+  V(NativeContext)               \
+  V(ScriptContextTable)
 
 #define HEAP_BROKER_KIND_LIST(V) \
   HEAP_BROKER_DATA_LIST(V)       \
@@ -97,6 +101,9 @@ class HeapObjectRef : public ObjectRef {
  public:
   explicit HeapObjectRef(Handle<Object> object);
   HeapObjectType type(const JSHeapBroker* broker) const;
+  HeapObjectType::OddballType oddball_type(const JSHeapBroker* broker) const {
+    return type(broker).oddball_type();
+  }
 
  private:
   friend class JSHeapBroker;
@@ -139,7 +146,31 @@ class ContextRef : public HeapObjectRef {
  public:
   explicit ContextRef(Handle<Object> object);
   base::Optional<ContextRef> previous(const JSHeapBroker* broker) const;
-  base::Optional<ObjectRef> get(const JSHeapBroker* broker, int index) const;
+  ObjectRef get(const JSHeapBroker* broker, int index) const;
+};
+
+class NativeContextRef : public ContextRef {
+ public:
+  explicit NativeContextRef(Handle<Object> object);
+  ScriptContextTableRef script_context_table(const JSHeapBroker* broker) const;
+};
+
+class NameRef : public HeapObjectRef {
+ public:
+  explicit NameRef(Handle<Object> object);
+};
+
+class ScriptContextTableRef : public HeapObjectRef {
+ public:
+  explicit ScriptContextTableRef(Handle<Object> object);
+
+  struct LookupResult {
+    ContextRef context;
+    bool immutable;
+    int index;
+  };
+
+  base::Optional<LookupResult> lookup(const NameRef& name) const;
 };
 
 }  // namespace compiler

src/compiler/js-native-context-specialization.h

@@ -226,7 +226,7 @@ class JSNativeContextSpecialization final : public AdvancedReducer {
   Flags flags() const { return flags_; }
   Handle<JSGlobalObject> global_object() const { return global_object_; }
   Handle<JSGlobalProxy> global_proxy() const { return global_proxy_; }
-  Handle<Context> native_context() const { return native_context_; }
+  const NativeContextRef& native_context() const { return native_context_; }
   CompilationDependencies* dependencies() const { return dependencies_; }
   Zone* zone() const { return zone_; }
 
@@ -235,7 +235,7 @@ class JSNativeContextSpecialization final : public AdvancedReducer {
   Flags const flags_;
   Handle<JSGlobalObject> global_object_;
   Handle<JSGlobalProxy> global_proxy_;
-  Handle<Context> native_context_;
+  NativeContextRef native_context_;
   CompilationDependencies* const dependencies_;
   Zone* const zone_;
   TypeCache const& type_cache_;