[factory] Further dehandlify factory

- Add private NewStructInternal
- Dehandlify JSObject initializers

Bug: v8:11263
Change-Id: I62d77ef32747c2042de707ba10fad20327af0930
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2729342Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73157}

src/heap/factory-base.cc

@@ -53,12 +53,18 @@ FactoryBase<LocalFactory>::NewHeapNumber<AllocationType::kOld>();
 template <typename Impl>
 Handle<Struct> FactoryBase<Impl>::NewStruct(InstanceType type,
                                             AllocationType allocation) {
+  return handle(NewStructInternal(type, allocation), isolate());
+}
+
+template <typename Impl>
+Struct FactoryBase<Impl>::NewStructInternal(InstanceType type,
+                                            AllocationType allocation) {
   Map map = Map::GetInstanceTypeMap(read_only_roots(), type);
   int size = map.instance_size();
   HeapObject result = AllocateRawWithImmortalMap(size, allocation, map);
   Struct str = Struct::cast(result);
   str.InitializeBody(size);
-  return handle(str, isolate());
+  return str;
 }
 
 template <typename Impl>

src/heap/factory-base.h

@@ -234,6 +234,9 @@ class EXPORT_TEMPLATE_DECLARE(V8_EXPORT_PRIVATE) FactoryBase
   HeapObject AllocateRawFixedArray(int length, AllocationType allocation);
   HeapObject AllocateRawWeakArrayList(int length, AllocationType allocation);
 
+  Struct NewStructInternal(InstanceType type,
+                           AllocationType allocation = AllocationType::kYoung);
+
   HeapObject AllocateRawWithImmortalMap(
       int size, AllocationType allocation, Map map,
       AllocationAlignment alignment = kWordAligned);

src/heap/factory.h

@@ -995,11 +995,9 @@ class V8_EXPORT_PRIVATE Factory : public FactoryBase<Factory> {
                                    AllocationSite allocation_site);
 
   // Initializes a JSObject based on its map.
-  void InitializeJSObjectFromMap(Handle<JSObject> obj,
-                                 Handle<Object> properties, Handle<Map> map);
+  void InitializeJSObjectFromMap(JSObject obj, Object properties, Map map);
   // Initializes JSObject body starting at given offset.
-  void InitializeJSObjectBody(Handle<JSObject> obj, Handle<Map> map,
-                              int start_offset);
+  void InitializeJSObjectBody(JSObject obj, Map map, int start_offset);
 
   Handle<WeakArrayList> NewUninitializedWeakArrayList(
       int capacity, AllocationType allocation = AllocationType::kYoung);

src/objects/map-inl.h

@@ -738,6 +738,7 @@ bool Map::IsInobjectSlackTrackingInProgress() const {
 }
 
 void Map::InobjectSlackTrackingStep(Isolate* isolate) {
+  DisallowGarbageCollection no_gc;
   // Slack tracking should only be performed on an initial map.
   DCHECK(GetBackPointer().IsUndefined());
   if (!IsInobjectSlackTrackingInProgress()) return;

src/objects/map.cc

@@ -632,6 +632,7 @@ void Map::ReplaceDescriptors(Isolate* isolate,
 }
 
 Map Map::FindRootMap(Isolate* isolate) const {
+  DisallowGarbageCollection no_gc;
   Map result = *this;
   while (true) {
     Object back = result.GetBackPointer(isolate);