[TurboFan] Brokerization of some literal bytecodes

The BytecodeGraphBuilder still looks at the heap. This CL mostly
eliminates heap lookups for:

* CreateArrayLiteral
* CreateObjectLiteral
* CreateRegExpLiteral

What remains is the lookup embedded in the creation of a VectorSlotPair,
which will be addressed in a subsequent change.

Bug: v8:7790
Change-Id: I5e4167f5542b84ed3684ad61f3dd1ef8ad84c96b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1745482
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63173}

src/compiler/bytecode-graph-builder.cc

@@ -2007,20 +2007,19 @@ void BytecodeGraphBuilder::VisitCreateRestParameter() {
 }
 
 void BytecodeGraphBuilder::VisitCreateRegExpLiteral() {
-  Handle<String> constant_pattern = Handle<String>::cast(
-      bytecode_iterator().GetConstantForIndexOperand(0, isolate()));
+  StringRef constant_pattern(
+      broker(), bytecode_iterator().GetConstantForIndexOperand(0, isolate()));
   int const slot_id = bytecode_iterator().GetIndexOperand(1);
   VectorSlotPair pair = CreateVectorSlotPair(slot_id);
   int literal_flags = bytecode_iterator().GetFlagOperand(2);
-  Node* literal = NewNode(
-      javascript()->CreateLiteralRegExp(constant_pattern, pair, literal_flags));
+  Node* literal = NewNode(javascript()->CreateLiteralRegExp(
+      constant_pattern.object(), pair, literal_flags));
   environment()->BindAccumulator(literal, Environment::kAttachFrameState);
 }
 
 void BytecodeGraphBuilder::VisitCreateArrayLiteral() {
-  Handle<ArrayBoilerplateDescription> array_boilerplate_description =
-      Handle<ArrayBoilerplateDescription>::cast(
-          bytecode_iterator().GetConstantForIndexOperand(0, isolate()));
+  ArrayBoilerplateDescriptionRef array_boilerplate_description(
+      broker(), bytecode_iterator().GetConstantForIndexOperand(0, isolate()));
   int const slot_id = bytecode_iterator().GetIndexOperand(1);
   VectorSlotPair pair = CreateVectorSlotPair(slot_id);
   int bytecode_flags = bytecode_iterator().GetFlagOperand(2);
@@ -2034,9 +2033,10 @@ void BytecodeGraphBuilder::VisitCreateArrayLiteral() {
   // TODO(mstarzinger): Thread through number of elements. The below number is
   // only an estimate and does not match {ArrayLiteral::values::length}.
   int number_of_elements =
-      array_boilerplate_description->constant_elements().length();
+      array_boilerplate_description.constants_elements_length();
   Node* literal = NewNode(javascript()->CreateLiteralArray(
-      array_boilerplate_description, pair, literal_flags, number_of_elements));
+      array_boilerplate_description.object(), pair, literal_flags,
+      number_of_elements));
   environment()->BindAccumulator(literal, Environment::kAttachFrameState);
 }
 
@@ -2054,9 +2054,8 @@ void BytecodeGraphBuilder::VisitCreateArrayFromIterable() {
 }
 
 void BytecodeGraphBuilder::VisitCreateObjectLiteral() {
-  Handle<ObjectBoilerplateDescription> constant_properties =
-      Handle<ObjectBoilerplateDescription>::cast(
-          bytecode_iterator().GetConstantForIndexOperand(0, isolate()));
+  ObjectBoilerplateDescriptionRef constant_properties(
+      broker(), bytecode_iterator().GetConstantForIndexOperand(0, isolate()));
   int const slot_id = bytecode_iterator().GetIndexOperand(1);
   VectorSlotPair pair = CreateVectorSlotPair(slot_id);
   int bytecode_flags = bytecode_iterator().GetFlagOperand(2);
@@ -2064,9 +2063,9 @@ void BytecodeGraphBuilder::VisitCreateObjectLiteral() {
       interpreter::CreateObjectLiteralFlags::FlagsBits::decode(bytecode_flags);
   // TODO(mstarzinger): Thread through number of properties. The below number is
   // only an estimate and does not match {ObjectLiteral::properties_count}.
-  int number_of_properties = constant_properties->size();
+  int number_of_properties = constant_properties.size();
   Node* literal = NewNode(javascript()->CreateLiteralObject(
-      constant_properties, pair, literal_flags, number_of_properties));
+      constant_properties.object(), pair, literal_flags, number_of_properties));
   environment()->BindAccumulator(literal, Environment::kAttachFrameState);
 }
 

src/compiler/heap-refs.h

@@ -75,6 +75,7 @@ enum class OddballType : uint8_t {
   /* Subtypes of HeapObject */     \
   V(AccessorInfo)                  \
   V(AllocationSite)                \
+  V(ArrayBoilerplateDescription)   \
   V(BigInt)                        \
   V(CallHandlerInfo)               \
   V(Cell)                          \
@@ -89,6 +90,7 @@ enum class OddballType : uint8_t {
   V(Map)                           \
   V(MutableHeapNumber)             \
   V(Name)                          \
+  V(ObjectBoilerplateDescription)  \
   V(PropertyCell)                  \
   V(SharedFunctionInfo)            \
   V(SourceTextModule)              \
@@ -614,6 +616,22 @@ class FixedArrayBaseRef : public HeapObjectRef {
   int length() const;
 };
 
+class ArrayBoilerplateDescriptionRef : public HeapObjectRef {
+ public:
+  using HeapObjectRef::HeapObjectRef;
+  Handle<ArrayBoilerplateDescription> object() const;
+
+  int constants_elements_length() const;
+};
+
+class ObjectBoilerplateDescriptionRef : public HeapObjectRef {
+ public:
+  using HeapObjectRef::HeapObjectRef;
+  Handle<ObjectBoilerplateDescription> object() const;
+
+  int size() const;
+};
+
 class FixedArrayRef : public FixedArrayBaseRef {
  public:
   using FixedArrayBaseRef::FixedArrayBaseRef;

src/compiler/js-heap-broker.cc

@@ -26,6 +26,7 @@
 #include "src/objects/js-array-buffer-inl.h"
 #include "src/objects/js-array-inl.h"
 #include "src/objects/js-regexp-inl.h"
+#include "src/objects/literal-objects-inl.h"
 #include "src/objects/module-inl.h"
 #include "src/objects/objects-inl.h"
 #include "src/objects/template-objects-inl.h"
@@ -450,6 +451,31 @@ void JSTypedArrayData::Serialize(JSHeapBroker* broker) {
   }
 }
 
+class ArrayBoilerplateDescriptionData : public HeapObjectData {
+ public:
+  ArrayBoilerplateDescriptionData(JSHeapBroker* broker, ObjectData** storage,
+                                  Handle<ArrayBoilerplateDescription> object)
+      : HeapObjectData(broker, storage, object),
+        constants_elements_length_(object->constant_elements().length()) {}
+
+  int constants_elements_length() const { return constants_elements_length_; }
+
+ private:
+  int const constants_elements_length_;
+};
+
+class ObjectBoilerplateDescriptionData : public HeapObjectData {
+ public:
+  ObjectBoilerplateDescriptionData(JSHeapBroker* broker, ObjectData** storage,
+                                   Handle<ObjectBoilerplateDescription> object)
+      : HeapObjectData(broker, storage, object), size_(object->size()) {}
+
+  int size() const { return size_; }
+
+ private:
+  int const size_;
+};
+
 class JSDataViewData : public JSObjectData {
  public:
   JSDataViewData(JSHeapBroker* broker, ObjectData** storage,
@@ -2825,6 +2851,22 @@ base::Optional<double> StringRef::ToNumber() {
   return data()->AsString()->to_number();
 }
 
+int ArrayBoilerplateDescriptionRef::constants_elements_length() const {
+  if (broker()->mode() == JSHeapBroker::kDisabled) {
+    AllowHandleDereference allow_handle_dereference;
+    return object()->constant_elements().length();
+  }
+  return data()->AsArrayBoilerplateDescription()->constants_elements_length();
+}
+
+int ObjectBoilerplateDescriptionRef::size() const {
+  if (broker()->mode() == JSHeapBroker::kDisabled) {
+    AllowHandleDereference allow_handle_dereference;
+    return object()->size();
+  }
+  return data()->AsObjectBoilerplateDescription()->size();
+}
+
 ObjectRef FixedArrayRef::get(int i) const {
   if (broker()->mode() == JSHeapBroker::kDisabled) {
     AllowHandleAllocation handle_allocation;

src/compiler/js-heap-copy-reducer.cc

@@ -86,13 +86,19 @@ Reduction JSHeapCopyReducer::Reduce(Node* node) {
     }
     case IrOpcode::kJSCreateLiteralArray:
     case IrOpcode::kJSCreateLiteralObject: {
-      CreateLiteralParameters const& p = CreateLiteralParametersOf(node->op());
+      if (!FLAG_concurrent_inlining) {
+        CreateLiteralParameters const& p =
+            CreateLiteralParametersOf(node->op());
         FeedbackVectorRef(broker(), p.feedback().vector()).SerializeSlots();
+      }
       break;
     }
     case IrOpcode::kJSCreateLiteralRegExp: {
-      CreateLiteralParameters const& p = CreateLiteralParametersOf(node->op());
+      if (!FLAG_concurrent_inlining) {
+        CreateLiteralParameters const& p =
+            CreateLiteralParametersOf(node->op());
         FeedbackVectorRef(broker(), p.feedback().vector()).SerializeSlots();
+      }
       break;
     }
     case IrOpcode::kJSCreateWithContext: {

src/compiler/serializer-for-background-compilation.cc

@@ -18,6 +18,7 @@
 #include "src/objects/code.h"
 #include "src/objects/js-array-inl.h"
 #include "src/objects/js-regexp-inl.h"
+#include "src/objects/literal-objects-inl.h"
 #include "src/objects/shared-function-info-inl.h"
 #include "src/zone/zone-containers.h"
 #include "src/zone/zone.h"
@@ -50,12 +51,9 @@ namespace compiler {
   V(CallRuntime)                  \
   V(CloneObject)                  \
   V(CreateArrayFromIterable)      \
-  V(CreateArrayLiteral)           \
   V(CreateEmptyArrayLiteral)      \
   V(CreateEmptyObjectLiteral)     \
   V(CreateMappedArguments)        \
-  V(CreateObjectLiteral)          \
-  V(CreateRegExpLiteral)          \
   V(CreateRestParameter)          \
   V(CreateUnmappedArguments)      \
   V(Dec)                          \
@@ -154,11 +152,14 @@ namespace compiler {
   V(CallWithSpread)                   \
   V(Construct)                        \
   V(ConstructWithSpread)              \
+  V(CreateArrayLiteral)               \
   V(CreateBlockContext)               \
   V(CreateCatchContext)               \
   V(CreateClosure)                    \
   V(CreateEvalContext)                \
   V(CreateFunctionContext)            \
+  V(CreateObjectLiteral)              \
+  V(CreateRegExpLiteral)              \
   V(CreateWithContext)                \
   V(GetIterator)                      \
   V(GetSuperConstructor)              \
@@ -1282,6 +1283,33 @@ void SerializerForBackgroundCompilation::VisitMov(
   environment()->register_hints(dst).Add(environment()->register_hints(src));
 }
 
+void SerializerForBackgroundCompilation::VisitCreateRegExpLiteral(
+    BytecodeArrayIterator* iterator) {
+  Handle<String> constant_pattern = Handle<String>::cast(
+      iterator->GetConstantForIndexOperand(0, broker()->isolate()));
+  StringRef description(broker(), constant_pattern);
+  environment()->accumulator_hints().Clear();
+}
+
+void SerializerForBackgroundCompilation::VisitCreateArrayLiteral(
+    BytecodeArrayIterator* iterator) {
+  Handle<ArrayBoilerplateDescription> array_boilerplate_description =
+      Handle<ArrayBoilerplateDescription>::cast(
+          iterator->GetConstantForIndexOperand(0, broker()->isolate()));
+  ArrayBoilerplateDescriptionRef description(broker(),
+                                             array_boilerplate_description);
+  environment()->accumulator_hints().Clear();
+}
+
+void SerializerForBackgroundCompilation::VisitCreateObjectLiteral(
+    BytecodeArrayIterator* iterator) {
+  Handle<ObjectBoilerplateDescription> constant_properties =
+      Handle<ObjectBoilerplateDescription>::cast(
+          iterator->GetConstantForIndexOperand(0, broker()->isolate()));
+  ObjectBoilerplateDescriptionRef description(broker(), constant_properties);
+  environment()->accumulator_hints().Clear();
+}
+
 void SerializerForBackgroundCompilation::VisitCreateFunctionContext(
     BytecodeArrayIterator* iterator) {
   ProcessCreateContext(iterator, 0);