[TurboFan] Move SFI and BytecodeArray to kNeverSerialized

This CL moves SharedFunctionInfo and BytecodeArray to the
kNeverSerialized classes, making them directly accessible from the
background thread.

To resolve the dependence on HeapNumber and BigInt objects stored in
the BytecodeArray's constant pool, this CL introduces a new
ObjectDataKind::kPossiblyBackgroundSerializedHeapObject, which allows
for objects to be serialized lazily from the background thread where
we know that this is safe (e.g. because they are constant). BigInt and
HeapNumber are the first members of this new group of objects.

Bug: v8:7790
Change-Id: I1d962d1cb7c36cc3f5baeb9603d5298f32af3363
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2567705Reviewed-by: Georg Neis (ooo until January 5) <neis@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71716}

src/compiler/bytecode-graph-builder.cc

@@ -1525,8 +1525,9 @@ void BytecodeGraphBuilder::VisitLdaSmi() {
 }
 
 void BytecodeGraphBuilder::VisitLdaConstant() {
-  ObjectRef object(
-      broker(), bytecode_iterator().GetConstantForIndexOperand(0, isolate()));
+  ObjectRef object(broker(),
+                   bytecode_iterator().GetConstantForIndexOperand(0, isolate()),
+                   ObjectRef::BackgroundSerialization::kAllowed);
   Node* node = jsgraph()->Constant(object);
   environment()->BindAccumulator(node);
 }

src/compiler/heap-refs.h

@@ -63,6 +63,8 @@ enum class OddballType : uint8_t {
   V(ScopeInfo)                                      \
   /* Subtypes of String */                          \
   V(InternalizedString)                             \
+  /* Subtypes of FixedArrayBase */                  \
+  V(BytecodeArray)                                  \
   /* Subtypes of Name */                            \
   V(Symbol)                                         \
   /* Subtypes of HeapObject */                      \
@@ -70,8 +72,21 @@ enum class OddballType : uint8_t {
   V(ArrayBoilerplateDescription)                    \
   V(CallHandlerInfo)                                \
   V(Cell)                                           \
+  V(SharedFunctionInfo)                             \
   V(TemplateObjectDescription)
 
+// This list is sorted such that subtypes appear before their supertypes.
+// DO NOT VIOLATE THIS PROPERTY!
+// Classes in this list behave like serialized classes, but they allow lazy
+// serialization from background threads where this is safe (e.g. for objects
+// that are immutable and fully initialized once visible). Pass
+// ObjectRef::BackgroundSerialization::kAllowed to the ObjectRef constructor
+// for objects where serialization from the background thread is safe.
+#define HEAP_BROKER_POSSIBLY_BACKGROUND_SERIALIZED_OBJECT_LIST(V) \
+  /* Subtypes of HeapObject */                                    \
+  V(BigInt)                                                       \
+  V(HeapNumber)
+
 // This list is sorted such that subtypes appear before their supertypes.
 // DO NOT VIOLATE THIS PROPERTY!
 #define HEAP_BROKER_SERIALIZED_OBJECT_LIST(V) \
@@ -90,7 +105,6 @@ enum class OddballType : uint8_t {
   V(Context)                                  \
   V(ScriptContextTable)                       \
   /* Subtypes of FixedArrayBase */            \
-  V(BytecodeArray)                            \
   V(FixedArray)                               \
   V(FixedDoubleArray)                         \
   /* Subtypes of Name */                      \
@@ -99,19 +113,16 @@ enum class OddballType : uint8_t {
   V(JSObject)                                 \
   /* Subtypes of HeapObject */                \
   V(AllocationSite)                           \
-  V(BigInt)                                   \
   V(Code)                                     \
   V(DescriptorArray)                          \
   V(FeedbackCell)                             \
   V(FeedbackVector)                           \
   V(FixedArrayBase)                           \
   V(FunctionTemplateInfo)                     \
-  V(HeapNumber)                               \
   V(JSReceiver)                               \
   V(Map)                                      \
   V(Name)                                     \
   V(PropertyCell)                             \
-  V(SharedFunctionInfo)                       \
   V(SourceTextModule)                         \
   /* Subtypes of Object */                    \
   V(HeapObject)
@@ -124,18 +135,25 @@ class PerIsolateCompilerCache;
 class PropertyAccessInfo;
 #define FORWARD_DECL(Name) class Name##Ref;
 HEAP_BROKER_SERIALIZED_OBJECT_LIST(FORWARD_DECL)
+HEAP_BROKER_POSSIBLY_BACKGROUND_SERIALIZED_OBJECT_LIST(FORWARD_DECL)
 HEAP_BROKER_NEVER_SERIALIZED_OBJECT_LIST(FORWARD_DECL)
 #undef FORWARD_DECL
 
 class V8_EXPORT_PRIVATE ObjectRef {
  public:
+  enum class BackgroundSerialization {
+    kDisallowed,
+    kAllowed,
+  };
+
   ObjectRef(JSHeapBroker* broker, Handle<Object> object,
+            BackgroundSerialization background_serialization =
+                BackgroundSerialization::kDisallowed,
             bool check_type = true);
   ObjectRef(JSHeapBroker* broker, ObjectData* data, bool check_type = true)
       : data_(data), broker_(broker) {
     CHECK_NOT_NULL(data_);
   }
-
   Handle<Object> object() const;
 
   bool equals(const ObjectRef& other) const;
@@ -146,11 +164,13 @@ class V8_EXPORT_PRIVATE ObjectRef {
 
 #define HEAP_IS_METHOD_DECL(Name) bool Is##Name() const;
   HEAP_BROKER_SERIALIZED_OBJECT_LIST(HEAP_IS_METHOD_DECL)
+  HEAP_BROKER_POSSIBLY_BACKGROUND_SERIALIZED_OBJECT_LIST(HEAP_IS_METHOD_DECL)
   HEAP_BROKER_NEVER_SERIALIZED_OBJECT_LIST(HEAP_IS_METHOD_DECL)
 #undef HEAP_IS_METHOD_DECL
 
 #define HEAP_AS_METHOD_DECL(Name) Name##Ref As##Name() const;
   HEAP_BROKER_SERIALIZED_OBJECT_LIST(HEAP_AS_METHOD_DECL)
+  HEAP_BROKER_POSSIBLY_BACKGROUND_SERIALIZED_OBJECT_LIST(HEAP_AS_METHOD_DECL)
   HEAP_BROKER_NEVER_SERIALIZED_OBJECT_LIST(HEAP_AS_METHOD_DECL)
 #undef HEAP_AS_METHOD_DECL
 
@@ -241,8 +261,10 @@ class HeapObjectType {
 // the outermost Ref class in the inheritance chain only.
 #define DEFINE_REF_CONSTRUCTOR(name, base)                                  \
   name##Ref(JSHeapBroker* broker, Handle<Object> object,                    \
+            BackgroundSerialization background_serialization =              \
+                BackgroundSerialization::kDisallowed,                       \
             bool check_type = true)                                         \
-      : base(broker, object, false) {                                       \
+      : base(broker, object, background_serialization, false) {             \
     if (check_type) {                                                       \
       CHECK(Is##name());                                                    \
     }                                                                       \

src/compiler/js-graph.cc

@@ -48,11 +48,12 @@ Node* JSGraph::CEntryStubConstant(int result_size, SaveFPRegsMode save_doubles,
 
 Node* JSGraph::Constant(const ObjectRef& ref) {
   if (ref.IsSmi()) return Constant(ref.AsSmi());
-  OddballType oddball_type =
-      ref.AsHeapObject().GetHeapObjectType().oddball_type();
   if (ref.IsHeapNumber()) {
     return Constant(ref.AsHeapNumber().value());
-  } else if (oddball_type == OddballType::kUndefined) {
+  }
+  OddballType oddball_type =
+      ref.AsHeapObject().GetHeapObjectType().oddball_type();
+  if (oddball_type == OddballType::kUndefined) {
     DCHECK(ref.object().equals(isolate()->factory()->undefined_value()));
     return UndefinedConstant();
   } else if (oddball_type == OddballType::kNull) {

src/compiler/js-heap-broker.h

@@ -149,9 +149,14 @@ class V8_EXPORT_PRIVATE JSHeapBroker {
   Handle<Object> GetRootHandle(Object object);
 
   // Never returns nullptr.
-  ObjectData* GetOrCreateData(Handle<Object>);
+  ObjectData* GetOrCreateData(
+      Handle<Object>,
+      ObjectRef::BackgroundSerialization background_serialization =
+          ObjectRef::BackgroundSerialization::kDisallowed);
   // Like the previous but wraps argument in handle first (for convenience).
-  ObjectData* GetOrCreateData(Object);
+  ObjectData* GetOrCreateData(
+      Object, ObjectRef::BackgroundSerialization background_serialization =
+                  ObjectRef::BackgroundSerialization::kDisallowed);
 
   // Check if {object} is any native context's %ArrayPrototype% or
   // %ObjectPrototype%.

src/compiler/serializer-for-background-compilation.cc

@@ -1529,10 +1529,14 @@ void SerializerForBackgroundCompilation::VisitInvokeIntrinsic(
 
 void SerializerForBackgroundCompilation::VisitLdaConstant(
     BytecodeArrayIterator* iterator) {
-  ObjectRef object(
-      broker(), iterator->GetConstantForIndexOperand(0, broker()->isolate()));
-  environment()->accumulator_hints() =
-      Hints::SingleConstant(object.object(), zone());
+  Handle<Object> constant =
+      iterator->GetConstantForIndexOperand(0, broker()->isolate());
+  // TODO(v8:7790): FixedArrays still need to be serialized until they are
+  // moved to kNeverSerialized.
+  if (!FLAG_turbo_direct_heap_access || constant->IsFixedArray()) {
+    ObjectRef(broker(), constant);
+  }
+  environment()->accumulator_hints() = Hints::SingleConstant(constant, zone());
 }
 
 void SerializerForBackgroundCompilation::VisitPushContext(