[turbofan] Introduce JSDataViewRef class.

... and use it in JSCallReducer.

Bug: v8:7790
Change-Id: If8ed329fef4a4de8938a2d7009cb94c0e85242f0
Reviewed-on: https://chromium-review.googlesource.com/c/1314568Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57214}

src/compiler/js-call-reducer.cc

@@ -6107,8 +6107,9 @@ Reduction JSCallReducer::ReducePromiseResolveTrampoline(Node* node) {
   DCHECK_NE(0, receiver_maps.size());
 
   // Only reduce when all {receiver_maps} are JSReceiver maps.
-  for (Handle<Map> receiver_map : receiver_maps) {
-    if (!receiver_map->IsJSReceiverMap()) return NoChange();
+  for (Handle<Map> map : receiver_maps) {
+    MapRef receiver_map(broker(), map);
+    if (!receiver_map.IsJSReceiverMap()) return NoChange();
   }
 
   // Morph the {node} into a JSPromiseResolve operation.
@@ -6813,18 +6814,18 @@ Reduction JSCallReducer::ReduceDataViewAccess(Node* node, DataViewAccess access,
     if (m.HasValue()) {
       // We only deal with DataViews here whose [[ByteLength]] is at least
       // {element_size}, as for all other DataViews it'll be out-of-bounds.
-      Handle<JSDataView> dataview = Handle<JSDataView>::cast(m.Value());
-      if (dataview->byte_length() < element_size) return NoChange();
+      JSDataViewRef dataview = m.Ref(broker()).AsJSDataView();
+      if (dataview.byte_length() < element_size) return NoChange();
 
       // Check that the {offset} is within range of the {byte_length}.
       Node* byte_length =
-          jsgraph()->Constant(dataview->byte_length() - (element_size - 1));
+          jsgraph()->Constant(dataview.byte_length() - (element_size - 1));
       offset = effect =
           graph()->NewNode(simplified()->CheckBounds(p.feedback()), offset,
                            byte_length, effect, control);
 
       // Load the [[ByteOffset]] from the {dataview}.
-      byte_offset = jsgraph()->Constant(dataview->byte_offset());
+      byte_offset = jsgraph()->Constant(dataview.byte_offset());
     } else {
       // We only deal with DataViews here that have Smi [[ByteLength]]s.
       Node* byte_length = effect =
@@ -7060,7 +7061,8 @@ Reduction JSCallReducer::ReduceRegExpPrototypeTest(Node* node) {
   }
 
   for (auto map : regexp_maps) {
-    if (map->instance_type() != JS_REGEXP_TYPE) return NoChange();
+    MapRef receiver_map(broker(), map);
+    if (receiver_map.instance_type() != JS_REGEXP_TYPE) return NoChange();
   }
 
   // Compute property access info for "exec" on {resolution}.

src/compiler/js-heap-broker.cc

@@ -271,6 +271,19 @@ void JSTypedArrayData::Serialize(JSHeapBroker* broker) {
   }
 }
 
+class JSDataViewData : public JSObjectData {
+ public:
+  JSDataViewData(JSHeapBroker* broker, ObjectData** storage,
+                 Handle<JSDataView> object);
+
+  size_t byte_length() const { return byte_length_; }
+  size_t byte_offset() const { return byte_offset_; }
+
+ private:
+  size_t const byte_length_;
+  size_t const byte_offset_;
+};
+
 class JSBoundFunctionData : public JSObjectData {
  public:
   JSBoundFunctionData(JSHeapBroker* broker, ObjectData** storage,
@@ -906,6 +919,12 @@ class FixedArrayData : public FixedArrayBaseData {
   ZoneVector<ObjectData*> contents_;
 };
 
+JSDataViewData::JSDataViewData(JSHeapBroker* broker, ObjectData** storage,
+                               Handle<JSDataView> object)
+    : JSObjectData(broker, storage, object),
+      byte_length_(object->byte_length()),
+      byte_offset_(object->byte_offset()) {}
+
 JSBoundFunctionData::JSBoundFunctionData(JSHeapBroker* broker,
                                          ObjectData** storage,
                                          Handle<JSBoundFunction> object)
@@ -2108,6 +2127,9 @@ BIMODAL_ACCESSOR(JSBoundFunction, Object, bound_target_function)
 BIMODAL_ACCESSOR(JSBoundFunction, Object, bound_this)
 BIMODAL_ACCESSOR(JSBoundFunction, FixedArray, bound_arguments)
 
+BIMODAL_ACCESSOR_C(JSDataView, size_t, byte_length)
+BIMODAL_ACCESSOR_C(JSDataView, size_t, byte_offset)
+
 BIMODAL_ACCESSOR_C(JSFunction, bool, has_prototype)
 BIMODAL_ACCESSOR_C(JSFunction, bool, has_initial_map)
 BIMODAL_ACCESSOR_C(JSFunction, bool, PrototypeRequiresRuntimeLookup)

src/compiler/js-heap-broker.h

@@ -21,6 +21,7 @@ class BytecodeArray;
 class FixedDoubleArray;
 class InternalizedString;
 class JSBoundFunction;
+class JSDataView;
 class JSGlobalProxy;
 class JSRegExp;
 class JSTypedArray;
@@ -45,6 +46,7 @@ enum class OddballType : uint8_t {
   /* Subtypes of JSObject */       \
   V(JSArray)                       \
   V(JSBoundFunction)               \
+  V(JSDataView)                    \
   V(JSFunction)                    \
   V(JSGlobalProxy)                 \
   V(JSRegExp)                      \
@@ -198,6 +200,15 @@ class JSObjectRef : public HeapObjectRef {
   base::Optional<MapRef> GetObjectCreateMap() const;
 };
 
+class JSDataViewRef : public JSObjectRef {
+ public:
+  using JSObjectRef::JSObjectRef;
+  Handle<JSDataView> object() const;
+
+  size_t byte_length() const;
+  size_t byte_offset() const;
+};
+
 class JSBoundFunctionRef : public JSObjectRef {
  public:
   using JSObjectRef::JSObjectRef;

src/compiler/node-properties.cc

@@ -537,7 +537,8 @@ bool NodeProperties::HasInstanceTypeWitness(JSHeapBroker* broker,
     case NodeProperties::kReliableReceiverMaps:
       DCHECK_NE(0, receiver_maps.size());
       for (size_t i = 0; i < receiver_maps.size(); ++i) {
-        if (receiver_maps[i]->instance_type() != instance_type) return false;
+        MapRef map(broker, receiver_maps[i]);
+        if (map.instance_type() != instance_type) return false;
       }
       return true;