[turbofan] More brokerization in JSCreateLowering.

Brokerized ReduceJSCreateEmptyLiteralObject and added the scope
for ReduceJSCreateLiteralArrayOrObject.

Bug: v8:7790
Change-Id: Ife34a6b610678a3fe24152151cf343400ee515bd
Reviewed-on: https://chromium-review.googlesource.com/1140306
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54507}

src/compiler/js-create-lowering.cc

@@ -1149,6 +1149,7 @@ Reduction JSCreateLowering::ReduceJSCreatePromise(Node* node) {
 }
 
 Reduction JSCreateLowering::ReduceJSCreateLiteralArrayOrObject(Node* node) {
+  DisallowHeapAccess no_heap_access;
   DCHECK(node->opcode() == IrOpcode::kJSCreateLiteralArray ||
          node->opcode() == IrOpcode::kJSCreateLiteralObject);
   CreateLiteralParameters const& p = CreateLiteralParametersOf(node->op());
@@ -1197,15 +1198,16 @@ Reduction JSCreateLowering::ReduceJSCreateEmptyLiteralArray(Node* node) {
 }
 
 Reduction JSCreateLowering::ReduceJSCreateEmptyLiteralObject(Node* node) {
+  DisallowHeapAccess no_heap_access;
   DCHECK_EQ(IrOpcode::kJSCreateEmptyLiteralObject, node->opcode());
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
 
   // Retrieve the initial map for the object.
-  Handle<Map> map = factory()->ObjectLiteralMapFromCache(native_context(), 0);
-  DCHECK(!map->is_dictionary_map());
-  DCHECK(!map->IsInobjectSlackTrackingInProgress());
-  Node* js_object_map = jsgraph()->HeapConstant(map);
+  MapRef map = native_context_ref().ObjectLiteralMapFromCache();
+  DCHECK(!map.is_dictionary_map());
+  DCHECK(!map.IsInobjectSlackTrackingInProgress());
+  Node* js_object_map = jsgraph()->Constant(map);
 
   // Setup elements and properties.
   Node* elements = jsgraph()->EmptyFixedArrayConstant();
@@ -1213,13 +1215,12 @@ Reduction JSCreateLowering::ReduceJSCreateEmptyLiteralObject(Node* node) {
 
   // Perform the allocation of the actual JSArray object.
   AllocationBuilder a(jsgraph(), effect, control);
-  a.Allocate(map->instance_size());
+  a.Allocate(map.instance_size());
   a.Store(AccessBuilder::ForMap(), js_object_map);
   a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(), properties);
   a.Store(AccessBuilder::ForJSObjectElements(), elements);
-  for (int i = 0; i < map->GetInObjectProperties(); i++) {
-    a.Store(AccessBuilder::ForJSObjectInObjectProperty(
-                MapRef(js_heap_broker(), map), i),
+  for (int i = 0; i < map.GetInObjectProperties(); i++) {
+    a.Store(AccessBuilder::ForJSObjectInObjectProperty(map, i),
             jsgraph()->UndefinedConstant());
   }
 

src/compiler/js-heap-broker.cc

@@ -381,6 +381,8 @@ const int kMaxFastLiteralProperties = JSObject::kMaxInObjectProperties;
 // all limits to be considered for fast deep-copying and computes the total
 // size of all objects that are part of the graph.
 bool AllocationSiteRef::IsFastLiteral() const {
+  AllowHeapAllocation
+      allow_heap_allocation;  // This is needed for TryMigrateInstance.
   AllowHandleAllocation allow_handle_allocation;
   AllowHandleDereference allow_handle_dereference;
   int max_properties = kMaxFastLiteralProperties;
@@ -794,6 +796,15 @@ MapRef NativeContextRef::GetFunctionMapFromIndex(int index) const {
   return get(index).AsMap();
 }
 
+MapRef NativeContextRef::ObjectLiteralMapFromCache() const {
+  AllowHeapAllocation heap_allocation;
+  AllowHandleAllocation handle_allocation;
+  AllowHandleDereference allow_handle_dereference;
+  Factory* factory = broker()->isolate()->factory();
+  Handle<Map> map = factory->ObjectLiteralMapFromCache(object<Context>(), 0);
+  return MapRef(broker(), map);
+}
+
 bool ObjectRef::BooleanValue() {
   AllowHandleDereference allow_handle_dereference;
   return object<Object>()->BooleanValue(broker()->isolate());

src/compiler/js-heap-broker.h

@@ -245,6 +245,7 @@ class NativeContextRef : public ContextRef {
   MapRef promise_function_initial_map() const;
 
   MapRef GetFunctionMapFromIndex(int index) const;
+  MapRef ObjectLiteralMapFromCache() const;
 };
 
 class NameRef : public HeapObjectRef {