[turbofan] Give each ObjectRef subclass its own object() getter.

This lets us remove the unsafe object<T>() getter.

Bug: v8:7790
Change-Id: Ie438c68d4c96f1525eee5afd252523b222dc8f53
Reviewed-on: https://chromium-review.googlesource.com/c/1288411Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56761}

src/compiler/compilation-dependencies.cc

@@ -31,15 +31,15 @@ class InitialMapDependency final : public CompilationDependencies::Dependency {
   }
 
   bool IsValid() const override {
-    Handle<JSFunction> function = function_.object<JSFunction>();
+    Handle<JSFunction> function = function_.object();
     return function->has_initial_map() &&
-           function->initial_map() == *initial_map_.object<Map>();
+           function->initial_map() == *initial_map_.object();
   }
 
   void Install(const MaybeObjectHandle& code) override {
     SLOW_DCHECK(IsValid());
     DependentCode::InstallDependency(function_.isolate(), code,
-                                     initial_map_.object<Map>(),
+                                     initial_map_.object(),
                                      DependentCode::kInitialMapChangedGroup);
   }
 
@@ -62,7 +62,7 @@ class PrototypePropertyDependency final
   }
 
   bool IsValid() const override {
-    Handle<JSFunction> function = function_.object<JSFunction>();
+    Handle<JSFunction> function = function_.object();
     return function->has_prototype_slot() && function->has_prototype() &&
            !function->PrototypeRequiresRuntimeLookup() &&
            function->prototype() == *prototype_.object();
@@ -70,7 +70,7 @@ class PrototypePropertyDependency final
 
   void Install(const MaybeObjectHandle& code) override {
     SLOW_DCHECK(IsValid());
-    Handle<JSFunction> function = function_.object<JSFunction>();
+    Handle<JSFunction> function = function_.object();
     if (!function->has_initial_map()) JSFunction::EnsureHasInitialMap(function);
     Handle<Map> initial_map(function->initial_map(), function_.isolate());
     DependentCode::InstallDependency(function_.isolate(), code, initial_map,
@@ -88,11 +88,11 @@ class StableMapDependency final : public CompilationDependencies::Dependency {
     DCHECK(map_.is_stable());
   }
 
-  bool IsValid() const override { return map_.object<Map>()->is_stable(); }
+  bool IsValid() const override { return map_.object()->is_stable(); }
 
   void Install(const MaybeObjectHandle& code) override {
     SLOW_DCHECK(IsValid());
-    DependentCode::InstallDependency(map_.isolate(), code, map_.object<Map>(),
+    DependentCode::InstallDependency(map_.isolate(), code, map_.object(),
                                      DependentCode::kPrototypeCheckGroup);
   }
 
@@ -106,11 +106,11 @@ class TransitionDependency final : public CompilationDependencies::Dependency {
     DCHECK(!map_.is_deprecated());
   }
 
-  bool IsValid() const override { return !map_.object<Map>()->is_deprecated(); }
+  bool IsValid() const override { return !map_.object()->is_deprecated(); }
 
   void Install(const MaybeObjectHandle& code) override {
     SLOW_DCHECK(IsValid());
-    DependentCode::InstallDependency(map_.isolate(), code, map_.object<Map>(),
+    DependentCode::InstallDependency(map_.isolate(), code, map_.object(),
                                      DependentCode::kTransitionGroup);
   }
 
@@ -129,13 +129,13 @@ class PretenureModeDependency final
   }
 
   bool IsValid() const override {
-    return mode_ == site_.object<AllocationSite>()->GetPretenureMode();
+    return mode_ == site_.object()->GetPretenureMode();
   }
 
   void Install(const MaybeObjectHandle& code) override {
     SLOW_DCHECK(IsValid());
     DependentCode::InstallDependency(
-        site_.isolate(), code, site_.object<AllocationSite>(),
+        site_.isolate(), code, site_.object(),
         DependentCode::kAllocationSiteTenuringChangedGroup);
   }
 
@@ -157,15 +157,14 @@ class FieldTypeDependency final : public CompilationDependencies::Dependency {
 
   bool IsValid() const override {
     DisallowHeapAllocation no_heap_allocation;
-    Handle<Map> owner = owner_.object<Map>();
-    Handle<FieldType> type = type_.object<FieldType>();
+    Handle<Map> owner = owner_.object();
+    Handle<Object> type = type_.object();
     return *type == owner->instance_descriptors()->GetFieldType(descriptor_);
   }
 
   void Install(const MaybeObjectHandle& code) override {
     SLOW_DCHECK(IsValid());
-    DependentCode::InstallDependency(owner_.isolate(), code,
-                                     owner_.object<Map>(),
+    DependentCode::InstallDependency(owner_.isolate(), code, owner_.object(),
                                      DependentCode::kFieldOwnerGroup);
   }
 
@@ -188,15 +187,14 @@ class GlobalPropertyDependency final
   }
 
   bool IsValid() const override {
-    Handle<PropertyCell> cell = cell_.object<PropertyCell>();
+    Handle<PropertyCell> cell = cell_.object();
     return type_ == cell->property_details().cell_type() &&
            read_only_ == cell->property_details().IsReadOnly();
   }
 
   void Install(const MaybeObjectHandle& code) override {
     SLOW_DCHECK(IsValid());
-    DependentCode::InstallDependency(cell_.isolate(), code,
-                                     cell_.object<PropertyCell>(),
+    DependentCode::InstallDependency(cell_.isolate(), code, cell_.object(),
                                      DependentCode::kPropertyCellChangedGroup);
   }
 
@@ -213,14 +211,13 @@ class ProtectorDependency final : public CompilationDependencies::Dependency {
   }
 
   bool IsValid() const override {
-    Handle<PropertyCell> cell = cell_.object<PropertyCell>();
+    Handle<PropertyCell> cell = cell_.object();
     return cell->value() == Smi::FromInt(Isolate::kProtectorValid);
   }
 
   void Install(const MaybeObjectHandle& code) override {
     SLOW_DCHECK(IsValid());
-    DependentCode::InstallDependency(cell_.isolate(), code,
-                                     cell_.object<PropertyCell>(),
+    DependentCode::InstallDependency(cell_.isolate(), code, cell_.object(),
                                      DependentCode::kPropertyCellChangedGroup);
   }
 
@@ -242,7 +239,7 @@ class ElementsKindDependency final
   }
 
   bool IsValid() const override {
-    Handle<AllocationSite> site = site_.object<AllocationSite>();
+    Handle<AllocationSite> site = site_.object();
     ElementsKind kind = site->PointsToLiteral()
                             ? site->boilerplate()->GetElementsKind()
                             : site->GetElementsKind();
@@ -252,7 +249,7 @@ class ElementsKindDependency final
   void Install(const MaybeObjectHandle& code) override {
     SLOW_DCHECK(IsValid());
     DependentCode::InstallDependency(
-        site_.isolate(), code, site_.object<AllocationSite>(),
+        site_.isolate(), code, site_.object(),
         DependentCode::kAllocationSiteTransitionChangedGroup);
   }
 
@@ -271,17 +268,16 @@ class InitialMapInstanceSizePredictionDependency final
   bool IsValid() const override {
     // The dependency is valid if the prediction is the same as the current
     // slack tracking result.
-    if (!function_.object<JSFunction>()->has_initial_map()) return false;
-    int instance_size =
-        function_.object<JSFunction>()->ComputeInstanceSizeWithMinSlack(
-            function_.isolate());
+    if (!function_.object()->has_initial_map()) return false;
+    int instance_size = function_.object()->ComputeInstanceSizeWithMinSlack(
+        function_.isolate());
     return instance_size == instance_size_;
   }
 
   void Install(const MaybeObjectHandle& code) override {
     DCHECK(IsValid());
     // Finish the slack tracking.
-    function_.object<JSFunction>()->CompleteInobjectSlackTrackingIfActive();
+    function_.object()->CompleteInobjectSlackTrackingIfActive();
   }
 
  private:

src/compiler/js-create-lowering.cc

@@ -1652,7 +1652,7 @@ Node* JSCreateLowering::AllocateFastLiteral(Node* effect, Node* control,
     NameRef property_name = boilerplate_map.GetPropertyKey(i);
     FieldIndex index = boilerplate_map.GetFieldIndexFor(i);
     FieldAccess access = {
-        kTaggedBase,        index.offset(), property_name.object<Name>(),
+        kTaggedBase,        index.offset(), property_name.object(),
         MaybeHandle<Map>(), Type::Any(),    MachineType::AnyTagged(),
         kFullWriteBarrier};
     Node* value;
@@ -1739,7 +1739,7 @@ Node* JSCreateLowering::AllocateFastLiteralElements(Node* effect, Node* control,
       boilerplate.EnsureElementsTenured();
       boilerplate_elements = boilerplate.elements();
     }
-    return jsgraph()->HeapConstant(boilerplate_elements.object<HeapObject>());
+    return jsgraph()->HeapConstant(boilerplate_elements.object());
   }
 
   // Compute the elements to store first (might have effects).
@@ -1768,7 +1768,7 @@ Node* JSCreateLowering::AllocateFastLiteralElements(Node* effect, Node* control,
 
   // Allocate the backing store array and store the elements.
   AllocationBuilder builder(jsgraph(), effect, control);
-  builder.AllocateArray(elements_length, elements_map.object<Map>(), pretenure);
+  builder.AllocateArray(elements_length, elements_map.object(), pretenure);
   ElementAccess const access =
       (elements_map.instance_type() == FIXED_DOUBLE_ARRAY_TYPE)
           ? AccessBuilder::ForFixedDoubleArrayElement()

src/compiler/js-graph.cc

@@ -73,24 +73,23 @@ Node* JSGraph::Constant(const ObjectRef& ref) {
   if (ref.IsHeapNumber()) {
     return Constant(ref.AsHeapNumber().value());
   } else if (oddball_type == OddballType::kUndefined) {
-    DCHECK(
-        ref.object<Object>().equals(isolate()->factory()->undefined_value()));
+    DCHECK(ref.object().equals(isolate()->factory()->undefined_value()));
     return UndefinedConstant();
   } else if (oddball_type == OddballType::kNull) {
-    DCHECK(ref.object<Object>().equals(isolate()->factory()->null_value()));
+    DCHECK(ref.object().equals(isolate()->factory()->null_value()));
     return NullConstant();
   } else if (oddball_type == OddballType::kHole) {
-    DCHECK(ref.object<Object>().equals(isolate()->factory()->the_hole_value()));
+    DCHECK(ref.object().equals(isolate()->factory()->the_hole_value()));
     return TheHoleConstant();
   } else if (oddball_type == OddballType::kBoolean) {
-    if (ref.object<Object>().equals(isolate()->factory()->true_value())) {
+    if (ref.object().equals(isolate()->factory()->true_value())) {
       return TrueConstant();
     } else {
-      DCHECK(ref.object<Object>().equals(isolate()->factory()->false_value()));
+      DCHECK(ref.object().equals(isolate()->factory()->false_value()));
       return FalseConstant();
     }
   } else {
-    return HeapConstant(ref.object<HeapObject>());
+    return HeapConstant(ref.AsHeapObject().object());
   }
 }
 

src/compiler/js-heap-broker.h

@@ -16,6 +16,16 @@
 
 namespace v8 {
 namespace internal {
+
+class BytecodeArray;
+class FixedDoubleArray;
+class InternalizedString;
+class JSGlobalProxy;
+class JSRegExp;
+class JSTypedArray;
+class NativeContext;
+class ScriptContextTable;
+
 namespace compiler {
 
 enum class OddballType : uint8_t {
@@ -71,6 +81,7 @@ enum class OddballType : uint8_t {
 class CompilationDependencies;
 class JSHeapBroker;
 class ObjectData;
+class PerIsolateCompilerCache;
 #define FORWARD_DECL(Name) class Name##Ref;
 HEAP_BROKER_OBJECT_LIST(FORWARD_DECL)
 #undef FORWARD_DECL
@@ -79,18 +90,13 @@ class ObjectRef {
  public:
   ObjectRef(JSHeapBroker* broker, Handle<Object> object);
   ObjectRef(JSHeapBroker* broker, ObjectData* data)
-      : broker_(broker), data_(data) {
+      : data_(data), broker_(broker) {
     CHECK_NOT_NULL(data_);
   }
 
-  bool equals(const ObjectRef& other) const;
-
   Handle<Object> object() const;
-  // TODO(neis): Remove eventually.
-  template <typename T>
-  Handle<T> object() const {
-    return Handle<T>(reinterpret_cast<T**>(object().address()));
-  }
+
+  bool equals(const ObjectRef& other) const;
 
   bool IsSmi() const;
   int AsSmi() const;
@@ -111,10 +117,12 @@ class ObjectRef {
  protected:
   JSHeapBroker* broker() const;
   ObjectData* data() const;
+  ObjectData* data_;  // Should be used only by object() getters.
 
  private:
   JSHeapBroker* broker_;
-  ObjectData* data_;
+
+ protected:
 };
 
 // Temporary class that carries information from a Map. We'd like to remove
@@ -155,6 +163,7 @@ class HeapObjectType {
 class HeapObjectRef : public ObjectRef {
  public:
   using ObjectRef::ObjectRef;
+  Handle<HeapObject> object() const;
 
   MapRef map() const;
 
@@ -165,6 +174,7 @@ class HeapObjectRef : public ObjectRef {
 class PropertyCellRef : public HeapObjectRef {
  public:
   using HeapObjectRef::HeapObjectRef;
+  Handle<PropertyCell> object() const;
 
   PropertyDetails property_details() const;
   ObjectRef value() const;
@@ -173,6 +183,7 @@ class PropertyCellRef : public HeapObjectRef {
 class JSObjectRef : public HeapObjectRef {
  public:
   using HeapObjectRef::HeapObjectRef;
+  Handle<JSObject> object() const;
 
   double RawFastDoublePropertyAt(FieldIndex index) const;
   ObjectRef RawFastPropertyAt(FieldIndex index) const;
@@ -188,6 +199,7 @@ class JSObjectRef : public HeapObjectRef {
 class JSFunctionRef : public JSObjectRef {
  public:
   using JSObjectRef::JSObjectRef;
+  Handle<JSFunction> object() const;
 
   bool has_initial_map() const;
   bool has_prototype() const;
@@ -206,6 +218,7 @@ class JSFunctionRef : public JSObjectRef {
 class JSRegExpRef : public JSObjectRef {
  public:
   using JSObjectRef::JSObjectRef;
+  Handle<JSRegExp> object() const;
 
   ObjectRef raw_properties_or_hash() const;
   ObjectRef data() const;
@@ -217,6 +230,7 @@ class JSRegExpRef : public JSObjectRef {
 class HeapNumberRef : public HeapObjectRef {
  public:
   using HeapObjectRef::HeapObjectRef;
+  Handle<HeapNumber> object() const;
 
   double value() const;
 };
@@ -224,6 +238,7 @@ class HeapNumberRef : public HeapObjectRef {
 class MutableHeapNumberRef : public HeapObjectRef {
  public:
   using HeapObjectRef::HeapObjectRef;
+  Handle<MutableHeapNumber> object() const;
 
   double value() const;
 };
@@ -231,8 +246,9 @@ class MutableHeapNumberRef : public HeapObjectRef {
 class ContextRef : public HeapObjectRef {
  public:
   using HeapObjectRef::HeapObjectRef;
-  void Serialize();
+  Handle<Context> object() const;
 
+  void Serialize();
   ContextRef previous() const;
   ObjectRef get(int index) const;
 };
@@ -279,6 +295,8 @@ class ContextRef : public HeapObjectRef {
 class NativeContextRef : public ContextRef {
  public:
   using ContextRef::ContextRef;
+  Handle<NativeContext> object() const;
+
   void Serialize();
 
 #define DECL_ACCESSOR(type, name) type##Ref name() const;
@@ -293,11 +311,13 @@ class NativeContextRef : public ContextRef {
 class NameRef : public HeapObjectRef {
  public:
   using HeapObjectRef::HeapObjectRef;
+  Handle<Name> object() const;
 };
 
 class ScriptContextTableRef : public HeapObjectRef {
  public:
   using HeapObjectRef::HeapObjectRef;
+  Handle<ScriptContextTable> object() const;
 
   struct LookupResult {
     ContextRef context;
@@ -311,11 +331,13 @@ class ScriptContextTableRef : public HeapObjectRef {
 class DescriptorArrayRef : public HeapObjectRef {
  public:
   using HeapObjectRef::HeapObjectRef;
+  Handle<DescriptorArray> object() const;
 };
 
 class FeedbackVectorRef : public HeapObjectRef {
  public:
   using HeapObjectRef::HeapObjectRef;
+  Handle<FeedbackVector> object() const;
 
   ObjectRef get(FeedbackSlot slot) const;
 
@@ -325,6 +347,7 @@ class FeedbackVectorRef : public HeapObjectRef {
 class AllocationSiteRef : public HeapObjectRef {
  public:
   using HeapObjectRef::HeapObjectRef;
+  Handle<AllocationSite> object() const;
 
   bool PointsToLiteral() const;
   PretenureFlag GetPretenureMode() const;
@@ -346,6 +369,7 @@ class AllocationSiteRef : public HeapObjectRef {
 class MapRef : public HeapObjectRef {
  public:
   using HeapObjectRef::HeapObjectRef;
+  Handle<Map> object() const;
 
   int instance_size() const;
   InstanceType instance_type() const;
@@ -394,6 +418,7 @@ class MapRef : public HeapObjectRef {
 class FixedArrayBaseRef : public HeapObjectRef {
  public:
   using HeapObjectRef::HeapObjectRef;
+  Handle<FixedArrayBase> object() const;
 
   int length() const;
 };
@@ -401,6 +426,7 @@ class FixedArrayBaseRef : public HeapObjectRef {
 class FixedArrayRef : public FixedArrayBaseRef {
  public:
   using FixedArrayBaseRef::FixedArrayBaseRef;
+  Handle<FixedArray> object() const;
 
   ObjectRef get(int i) const;
 };
@@ -408,6 +434,7 @@ class FixedArrayRef : public FixedArrayBaseRef {
 class FixedDoubleArrayRef : public FixedArrayBaseRef {
  public:
   using FixedArrayBaseRef::FixedArrayBaseRef;
+  Handle<FixedDoubleArray> object() const;
 
   double get_scalar(int i) const;
   bool is_the_hole(int i) const;
@@ -416,6 +443,7 @@ class FixedDoubleArrayRef : public FixedArrayBaseRef {
 class BytecodeArrayRef : public FixedArrayBaseRef {
  public:
   using FixedArrayBaseRef::FixedArrayBaseRef;
+  Handle<BytecodeArray> object() const;
 
   int register_count() const;
 };
@@ -423,6 +451,7 @@ class BytecodeArrayRef : public FixedArrayBaseRef {
 class JSArrayRef : public JSObjectRef {
  public:
   using JSObjectRef::JSObjectRef;
+  Handle<JSArray> object() const;
 
   ObjectRef length() const;
 };
@@ -430,6 +459,7 @@ class JSArrayRef : public JSObjectRef {
 class ScopeInfoRef : public HeapObjectRef {
  public:
   using HeapObjectRef::HeapObjectRef;
+  Handle<ScopeInfo> object() const;
 
   int ContextLength() const;
 };
@@ -451,6 +481,7 @@ class ScopeInfoRef : public HeapObjectRef {
 class SharedFunctionInfoRef : public HeapObjectRef {
  public:
   using HeapObjectRef::HeapObjectRef;
+  Handle<SharedFunctionInfo> object() const;
 
   int builtin_id() const;
   BytecodeArrayRef GetBytecodeArray() const;
@@ -462,6 +493,7 @@ class SharedFunctionInfoRef : public HeapObjectRef {
 class StringRef : public NameRef {
  public:
   using NameRef::NameRef;
+  Handle<String> object() const;
 
   int length() const;
   uint16_t GetFirstChar();
@@ -473,6 +505,7 @@ class StringRef : public NameRef {
 class JSTypedArrayRef : public JSObjectRef {
  public:
   using JSObjectRef::JSObjectRef;
+  Handle<JSTypedArray> object() const;
 
   bool is_on_heap() const;
   size_t length_value() const;
@@ -486,6 +519,7 @@ class JSTypedArrayRef : public JSObjectRef {
 class ModuleRef : public HeapObjectRef {
  public:
   using HeapObjectRef::HeapObjectRef;
+  Handle<Module> object() const;
 
   void Serialize();
 
@@ -495,6 +529,7 @@ class ModuleRef : public HeapObjectRef {
 class CellRef : public HeapObjectRef {
  public:
   using HeapObjectRef::HeapObjectRef;
+  Handle<Cell> object() const;
 
   ObjectRef value() const;
 };
@@ -502,20 +537,21 @@ class CellRef : public HeapObjectRef {
 class JSGlobalProxyRef : public JSObjectRef {
  public:
   using JSObjectRef::JSObjectRef;
+  Handle<JSGlobalProxy> object() const;
 };
 
 class CodeRef : public HeapObjectRef {
  public:
   using HeapObjectRef::HeapObjectRef;
+  Handle<Code> object() const;
 };
 
 class InternalizedStringRef : public StringRef {
  public:
   using StringRef::StringRef;
+  Handle<InternalizedString> object() const;
 };
 
-class PerIsolateCompilerCache;
-
 class V8_EXPORT_PRIVATE JSHeapBroker : public NON_EXPORTED_BASE(ZoneObject) {
  public:
   JSHeapBroker(Isolate* isolate, Zone* broker_zone);

src/compiler/js-native-context-specialization.cc

@@ -190,7 +190,7 @@ JSNativeContextSpecialization::CreateDelayedStringConstant(Node* node) {
       if (matcher.HasValue() && matcher.Ref(broker()).IsString()) {
         StringRef s = matcher.Ref(broker()).AsString();
         return new (shared_zone())
-            StringLiteral(s.object<String>(), static_cast<size_t>(s.length()));
+            StringLiteral(s.object(), static_cast<size_t>(s.length()));
       } else {
         UNREACHABLE();
       }
@@ -403,9 +403,8 @@ Reduction JSNativeContextSpecialization::ReduceJSInstanceOf(Node* node) {
 
   // Compute property access info for @@hasInstance on {receiver}.
   PropertyAccessInfo access_info;
-  AccessInfoFactory access_info_factory(broker(), dependencies(),
-                                        native_context().object<Context>(),
-                                        graph()->zone());
+  AccessInfoFactory access_info_factory(
+      broker(), dependencies(), native_context().object(), graph()->zone());
   if (!access_info_factory.ComputePropertyAccessInfo(
           receiver_map, factory()->has_instance_symbol(), AccessMode::kLoad,
           &access_info)) {
@@ -695,9 +694,8 @@ Reduction JSNativeContextSpecialization::ReduceJSResolvePromise(Node* node) {
 
   // Compute property access info for "then" on {resolution}.
   PropertyAccessInfo access_info;
-  AccessInfoFactory access_info_factory(broker(), dependencies(),
-                                        native_context().object<Context>(),
-                                        graph()->zone());
+  AccessInfoFactory access_info_factory(
+      broker(), dependencies(), native_context().object(), graph()->zone());
   if (!access_info_factory.ComputePropertyAccessInfo(
           MapHandles(resolution_maps.begin(), resolution_maps.end()),
           factory()->then_string(), AccessMode::kLoad, &access_info)) {
@@ -852,7 +850,7 @@ Reduction JSNativeContextSpecialization::ReduceGlobalAccess(
             // mutated without the cell state being updated.
             if (property_cell_value_map.is_stable()) {
               dependencies()->DependOnStableMap(property_cell_value_map);
-              map = property_cell_value_map.object<Map>();
+              map = property_cell_value_map.object();
             }
           }
         }
@@ -968,7 +966,7 @@ Reduction JSNativeContextSpecialization::ReduceJSLoadGlobal(Node* node) {
   }
 
   // Lookup the {name} on the global object instead.
-  return ReduceGlobalAccess(node, nullptr, nullptr, name.object<Name>(),
+  return ReduceGlobalAccess(node, nullptr, nullptr, name.object(),
                             AccessMode::kLoad);
 }
 
@@ -997,7 +995,7 @@ Reduction JSNativeContextSpecialization::ReduceJSStoreGlobal(Node* node) {
   }
 
   // Lookup the {name} on the global object instead.
-  return ReduceGlobalAccess(node, nullptr, value, name.object<Name>(),
+  return ReduceGlobalAccess(node, nullptr, value, name.object(),
                             AccessMode::kStore);
 }
 
@@ -1025,7 +1023,7 @@ Reduction JSNativeContextSpecialization::ReduceNamedAccess(
       // Detached global proxies have |null| as their constructor.
       if (maybe_constructor->IsJSFunction() &&
           JSFunction::cast(maybe_constructor)->native_context() ==
-              *native_context().object<Context>()) {
+              *native_context().object()) {
         return ReduceGlobalAccess(node, receiver, value, name, access_mode,
                                   index);
       }
@@ -1033,9 +1031,8 @@ Reduction JSNativeContextSpecialization::ReduceNamedAccess(
   }
 
   // Compute property access infos for the receiver maps.
-  AccessInfoFactory access_info_factory(broker(), dependencies(),
-                                        native_context().object<Context>(),
-                                        graph()->zone());
+  AccessInfoFactory access_info_factory(
+      broker(), dependencies(), native_context().object(), graph()->zone());
   ZoneVector<PropertyAccessInfo> access_infos(zone());
   if (!access_info_factory.ComputePropertyAccessInfos(
           receiver_maps, name, access_mode, &access_infos)) {
@@ -1409,9 +1406,8 @@ Reduction JSNativeContextSpecialization::ReduceElementAccess(
   } else {
     // Retrieve the native context from the given {node}.
     // Compute element access infos for the receiver maps.
-    AccessInfoFactory access_info_factory(broker(), dependencies(),
-                                          native_context().object<Context>(),
-                                          graph()->zone());
+    AccessInfoFactory access_info_factory(
+        broker(), dependencies(), native_context().object(), graph()->zone());
     ZoneVector<ElementAccessInfo> access_infos(zone());
     if (!access_info_factory.ComputeElementAccessInfos(
             receiver_maps, access_mode, &access_infos)) {
@@ -2312,9 +2308,8 @@ Reduction JSNativeContextSpecialization::ReduceJSStoreDataPropertyInLiteral(
              isolate());
 
   PropertyAccessInfo access_info;
-  AccessInfoFactory access_info_factory(broker(), dependencies(),
-                                        native_context().object<Context>(),
-                                        graph()->zone());
+  AccessInfoFactory access_info_factory(
+      broker(), dependencies(), native_context().object(), graph()->zone());
   if (!access_info_factory.ComputePropertyAccessInfo(
           receiver_map, cached_name, AccessMode::kStoreInLiteral,
           &access_info)) {

src/compiler/node-properties.cc

@@ -381,7 +381,7 @@ NodeProperties::InferReceiverMapsResult NodeProperties::InferReceiverMaps(
       if (receiver.map().is_stable()) {
         // The {receiver_map} is only reliable when we install a stability
         // code dependency.
-        *maps_return = ZoneHandleSet<Map>(receiver.map().object<Map>());
+        *maps_return = ZoneHandleSet<Map>(receiver.map().object());
         return kUnreliableReceiverMaps;
       }
     }
@@ -418,7 +418,7 @@ NodeProperties::InferReceiverMapsResult NodeProperties::InferReceiverMaps(
               MapRef initial_map = original_constructor.initial_map();
               if (initial_map.constructor_or_backpointer().equals(
                       mtarget.Ref(broker))) {
-                *maps_return = ZoneHandleSet<Map>(initial_map.object<Map>());
+                *maps_return = ZoneHandleSet<Map>(initial_map.object());
                 return result;
               }
             }
@@ -438,7 +438,7 @@ NodeProperties::InferReceiverMapsResult NodeProperties::InferReceiverMaps(
             Node* const value = GetValueInput(effect, 1);
             HeapObjectMatcher m(value);
             if (m.HasValue()) {
-              *maps_return = ZoneHandleSet<Map>(m.Ref(broker).object<Map>());
+              *maps_return = ZoneHandleSet<Map>(m.Ref(broker).AsMap().object());
               return result;
             }
           }

src/compiler/types.cc

@@ -483,7 +483,7 @@ HeapConstantType::HeapConstantType(BitsetType::bitset bitset,
     : TypeBase(kHeapConstant), bitset_(bitset), heap_ref_(heap_ref) {}
 
 Handle<HeapObject> HeapConstantType::Value() const {
-  return heap_ref_.object<HeapObject>();
+  return heap_ref_.object();
 }
 
 // -----------------------------------------------------------------------------