[turbofan] Give each ObjectRef subclass its own object() getter.

This lets us remove the unsafe object<T>() getter. Bug: v8:7790 Change-Id: Ie438c68d4c96f1525eee5afd252523b222dc8f53 Reviewed-on: https://chromium-review.googlesource.com/c/1288411Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Reviewed-by: Maya Lekova <mslekova@chromium.org> Commit-Queue: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#56761}

[turbofan] Give each ObjectRef subclass its own object() getter.
This lets us remove the unsafe object<T>() getter. Bug: v8:7790 Change-Id: Ie438c68d4c96f1525eee5afd252523b222dc8f53 Reviewed-on: https://chromium-review.googlesource.com/c/1288411Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Reviewed-by: Maya Lekova <mslekova@chromium.org> Commit-Queue: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#56761}
a67e37e6 · Georg Neis · Commit Bot · 06d4d1e8 · a67e37e6 · a67e37e6
Commit a67e37e6 authored Oct 18, 2018 by Georg Neis Committed by Commit Bot Oct 18, 2018
8 changed files
--- a/src/compiler/compilation-dependencies.cc
+++ b/src/compiler/compilation-dependencies.cc
@@ -31,15 +31,15 @@ class InitialMapDependency final : public CompilationDependencies::Dependency {
  }
  bool IsValid() const override {
-    Handle<JSFunction> function = function_.object<JSFunction>();
+    Handle<JSFunction> function = function_.object();
    return function->has_initial_map() &&
-           function->initial_map() == *initial_map_.object<Map>();
+           function->initial_map() == *initial_map_.object();
  }
  void Install(const MaybeObjectHandle& code) override {
    SLOW_DCHECK(IsValid());
    DependentCode::InstallDependency(function_.isolate(), code,
-                                     initial_map_.object<Map>(),
+                                     initial_map_.object(),
                                     DependentCode::kInitialMapChangedGroup);
  }
@@ -62,7 +62,7 @@ class PrototypePropertyDependency final
  }
  bool IsValid() const override {
-    Handle<JSFunction> function = function_.object<JSFunction>();
+    Handle<JSFunction> function = function_.object();
    return function->has_prototype_slot() && function->has_prototype() &&
           !function->PrototypeRequiresRuntimeLookup() &&
           function->prototype() == *prototype_.object();
@@ -70,7 +70,7 @@ class PrototypePropertyDependency final
  void Install(const MaybeObjectHandle& code) override {
    SLOW_DCHECK(IsValid());
-    Handle<JSFunction> function = function_.object<JSFunction>();
+    Handle<JSFunction> function = function_.object();
    if (!function->has_initial_map()) JSFunction::EnsureHasInitialMap(function);
    Handle<Map> initial_map(function->initial_map(), function_.isolate());
    DependentCode::InstallDependency(function_.isolate(), code, initial_map,
@@ -88,11 +88,11 @@ class StableMapDependency final : public CompilationDependencies::Dependency {
    DCHECK(map_.is_stable());
  }
-  bool IsValid() const override { return map_.object<Map>()->is_stable(); }
+  bool IsValid() const override { return map_.object()->is_stable(); }
  void Install(const MaybeObjectHandle& code) override {
    SLOW_DCHECK(IsValid());
-    DependentCode::InstallDependency(map_.isolate(), code, map_.object<Map>(),
+    DependentCode::InstallDependency(map_.isolate(), code, map_.object(),
                                     DependentCode::kPrototypeCheckGroup);
  }
@@ -106,11 +106,11 @@ class TransitionDependency final : public CompilationDependencies::Dependency {
    DCHECK(!map_.is_deprecated());
  }
-  bool IsValid() const override { return !map_.object<Map>()->is_deprecated(); }
+  bool IsValid() const override { return !map_.object()->is_deprecated(); }
  void Install(const MaybeObjectHandle& code) override {
    SLOW_DCHECK(IsValid());
-    DependentCode::InstallDependency(map_.isolate(), code, map_.object<Map>(),
+    DependentCode::InstallDependency(map_.isolate(), code, map_.object(),
                                     DependentCode::kTransitionGroup);
  }
@@ -129,13 +129,13 @@ class PretenureModeDependency final
  }
  bool IsValid() const override {
-    return mode_ == site_.object<AllocationSite>()->GetPretenureMode();
+    return mode_ == site_.object()->GetPretenureMode();
  }
  void Install(const MaybeObjectHandle& code) override {
    SLOW_DCHECK(IsValid());
    DependentCode::InstallDependency(
-        site_.isolate(), code, site_.object<AllocationSite>(),
+        site_.isolate(), code, site_.object(),
        DependentCode::kAllocationSiteTenuringChangedGroup);
  }
@@ -157,15 +157,14 @@ class FieldTypeDependency final : public CompilationDependencies::Dependency {
  bool IsValid() const override {
    DisallowHeapAllocation no_heap_allocation;
-    Handle<Map> owner = owner_.object<Map>();
+    Handle<Map> owner = owner_.object();
-    Handle<FieldType> type = type_.object<FieldType>();
+    Handle<Object> type = type_.object();
    return *type == owner->instance_descriptors()->GetFieldType(descriptor_);
  }
  void Install(const MaybeObjectHandle& code) override {
    SLOW_DCHECK(IsValid());
-    DependentCode::InstallDependency(owner_.isolate(), code,
+    DependentCode::InstallDependency(owner_.isolate(), code, owner_.object(),
-                                     owner_.object<Map>(),
                                     DependentCode::kFieldOwnerGroup);
  }
@@ -188,15 +187,14 @@ class GlobalPropertyDependency final
  }
  bool IsValid() const override {
-    Handle<PropertyCell> cell = cell_.object<PropertyCell>();
+    Handle<PropertyCell> cell = cell_.object();
    return type_ == cell->property_details().cell_type() &&
           read_only_ == cell->property_details().IsReadOnly();
  }
  void Install(const MaybeObjectHandle& code) override {
    SLOW_DCHECK(IsValid());
-    DependentCode::InstallDependency(cell_.isolate(), code,
+    DependentCode::InstallDependency(cell_.isolate(), code, cell_.object(),
-                                     cell_.object<PropertyCell>(),
                                     DependentCode::kPropertyCellChangedGroup);
  }
@@ -213,14 +211,13 @@ class ProtectorDependency final : public CompilationDependencies::Dependency {
  }
  bool IsValid() const override {
-    Handle<PropertyCell> cell = cell_.object<PropertyCell>();
+    Handle<PropertyCell> cell = cell_.object();
    return cell->value() == Smi::FromInt(Isolate::kProtectorValid);
  }
  void Install(const MaybeObjectHandle& code) override {
    SLOW_DCHECK(IsValid());
-    DependentCode::InstallDependency(cell_.isolate(), code,
+    DependentCode::InstallDependency(cell_.isolate(), code, cell_.object(),
-                                     cell_.object<PropertyCell>(),
                                     DependentCode::kPropertyCellChangedGroup);
  }
@@ -242,7 +239,7 @@ class ElementsKindDependency final
  }
  bool IsValid() const override {
-    Handle<AllocationSite> site = site_.object<AllocationSite>();
+    Handle<AllocationSite> site = site_.object();
    ElementsKind kind = site->PointsToLiteral()
                            ? site->boilerplate()->GetElementsKind()
                            : site->GetElementsKind();
@@ -252,7 +249,7 @@ class ElementsKindDependency final
  void Install(const MaybeObjectHandle& code) override {
    SLOW_DCHECK(IsValid());
    DependentCode::InstallDependency(
-        site_.isolate(), code, site_.object<AllocationSite>(),
+        site_.isolate(), code, site_.object(),
        DependentCode::kAllocationSiteTransitionChangedGroup);
  }
@@ -271,17 +268,16 @@ class InitialMapInstanceSizePredictionDependency final
  bool IsValid() const override {
    // The dependency is valid if the prediction is the same as the current
    // slack tracking result.
-    if (!function_.object<JSFunction>()->has_initial_map()) return false;
+    if (!function_.object()->has_initial_map()) return false;
-    int instance_size =
+    int instance_size = function_.object()->ComputeInstanceSizeWithMinSlack(
-        function_.object<JSFunction>()->ComputeInstanceSizeWithMinSlack(
+        function_.isolate());
-            function_.isolate());
    return instance_size == instance_size_;
  }
  void Install(const MaybeObjectHandle& code) override {
    DCHECK(IsValid());
    // Finish the slack tracking.
-    function_.object<JSFunction>()->CompleteInobjectSlackTrackingIfActive();
+    function_.object()->CompleteInobjectSlackTrackingIfActive();
  }
 private:

--- a/src/compiler/js-create-lowering.cc
+++ b/src/compiler/js-create-lowering.cc
@@ -1652,7 +1652,7 @@ Node* JSCreateLowering::AllocateFastLiteral(Node* effect, Node* control,
    NameRef property_name = boilerplate_map.GetPropertyKey(i);
    FieldIndex index = boilerplate_map.GetFieldIndexFor(i);
    FieldAccess access = {
-        kTaggedBase,        index.offset(), property_name.object<Name>(),
+        kTaggedBase,        index.offset(), property_name.object(),
        MaybeHandle<Map>(), Type::Any(),    MachineType::AnyTagged(),
        kFullWriteBarrier};
    Node* value;
@@ -1739,7 +1739,7 @@ Node* JSCreateLowering::AllocateFastLiteralElements(Node* effect, Node* control,
      boilerplate.EnsureElementsTenured();
      boilerplate_elements = boilerplate.elements();
    }
-    return jsgraph()->HeapConstant(boilerplate_elements.object<HeapObject>());
+    return jsgraph()->HeapConstant(boilerplate_elements.object());
  }
  // Compute the elements to store first (might have effects).
@@ -1768,7 +1768,7 @@ Node* JSCreateLowering::AllocateFastLiteralElements(Node* effect, Node* control,
  // Allocate the backing store array and store the elements.
  AllocationBuilder builder(jsgraph(), effect, control);
-  builder.AllocateArray(elements_length, elements_map.object<Map>(), pretenure);
+  builder.AllocateArray(elements_length, elements_map.object(), pretenure);
  ElementAccess const access =
      (elements_map.instance_type() == FIXED_DOUBLE_ARRAY_TYPE)
          ? AccessBuilder::ForFixedDoubleArrayElement()

--- a/src/compiler/js-graph.cc
+++ b/src/compiler/js-graph.cc
@@ -73,24 +73,23 @@ Node* JSGraph::Constant(const ObjectRef& ref) {
  if (ref.IsHeapNumber()) {
    return Constant(ref.AsHeapNumber().value());
  } else if (oddball_type == OddballType::kUndefined) {
-    DCHECK(
+    DCHECK(ref.object().equals(isolate()->factory()->undefined_value()));
-        ref.object<Object>().equals(isolate()->factory()->undefined_value()));
    return UndefinedConstant();
  } else if (oddball_type == OddballType::kNull) {
-    DCHECK(ref.object<Object>().equals(isolate()->factory()->null_value()));
+    DCHECK(ref.object().equals(isolate()->factory()->null_value()));
    return NullConstant();
  } else if (oddball_type == OddballType::kHole) {
-    DCHECK(ref.object<Object>().equals(isolate()->factory()->the_hole_value()));
+    DCHECK(ref.object().equals(isolate()->factory()->the_hole_value()));
    return TheHoleConstant();
  } else if (oddball_type == OddballType::kBoolean) {
-    if (ref.object<Object>().equals(isolate()->factory()->true_value())) {
+    if (ref.object().equals(isolate()->factory()->true_value())) {
      return TrueConstant();
    } else {
-      DCHECK(ref.object<Object>().equals(isolate()->factory()->false_value()));
+      DCHECK(ref.object().equals(isolate()->factory()->false_value()));
      return FalseConstant();
    }
  } else {
-    return HeapConstant(ref.object<HeapObject>());
+    return HeapConstant(ref.AsHeapObject().object());
  }
 }

--- a/src/compiler/js-heap-broker.cc
+++ b/src/compiler/js-heap-broker.cc
@@ -791,7 +791,7 @@ void MapData::SerializeElementsKindGeneralizations(JSHeapBroker* broker) {
    ElementsKind to_kind = static_cast<ElementsKind>(i);
    if (IsMoreGeneralElementsKindTransition(from_kind, to_kind)) {
      Handle<Map> target =
-          Map::AsElementsKind(broker->isolate(), self.object<Map>(), to_kind);
+          Map::AsElementsKind(broker->isolate(), self.object(), to_kind);
      elements_kind_generalizations_.push_back(
          broker->GetOrCreateData(target)->AsMap());
    }
@@ -1388,8 +1388,8 @@ ContextRef ContextRef::previous() const {
  if (broker()->mode() == JSHeapBroker::kDisabled) {
    AllowHandleAllocation handle_allocation;
    AllowHandleDereference handle_dereference;
-    return ContextRef(
+    return ContextRef(broker(),
-        broker(), handle(object<Context>()->previous(), broker()->isolate()));
+                      handle(object()->previous(), broker()->isolate()));
  }
  return ContextRef(broker(), data()->AsContext()->previous());
 }
@@ -1398,7 +1398,7 @@ ContextRef ContextRef::previous() const {
 ObjectRef ContextRef::get(int index) const {
  AllowHandleAllocation handle_allocation;
  AllowHandleDereference handle_dereference;
-  Handle<Object> value(object<Context>()->get(index), broker()->isolate());
+  Handle<Object> value(object()->get(index), broker()->isolate());
  return ObjectRef(broker(), value);
 }
@@ -1553,7 +1553,7 @@ bool JSHeapBroker::IsArrayOrObjectPrototype(const JSObjectRef& object) const {
                                     Context::INITIAL_OBJECT_PROTOTYPE_INDEX);
  }
  CHECK(!array_and_object_prototypes_.empty());
-  return array_and_object_prototypes_.find(object.object<JSObject>()) !=
+  return array_and_object_prototypes_.find(object.object()) !=
         array_and_object_prototypes_.end();
 }
@@ -1702,7 +1702,7 @@ bool ObjectRef::IsSmi() const { return data()->is_smi(); }
 int ObjectRef::AsSmi() const {
  DCHECK(IsSmi());
  // Handle-dereference is always allowed for Handle<Smi>.
-  return object<Smi>()->value();
+  return Handle<Smi>::cast(object())->value();
 }
 base::Optional<MapRef> JSObjectRef::GetObjectCreateMap() const {
@@ -1711,7 +1711,7 @@ base::Optional<MapRef> JSObjectRef::GetObjectCreateMap() const {
    AllowHandleDereference allow_handle_dereference;
    AllowHeapAllocation heap_allocation;
    Handle<Map> instance_map;
-    if (Map::TryGetObjectCreateMap(broker()->isolate(), object<HeapObject>())
+    if (Map::TryGetObjectCreateMap(broker()->isolate(), object())
            .ToHandle(&instance_map)) {
      return MapRef(broker(), instance_map);
    } else {
@@ -1735,8 +1735,8 @@ base::Optional<MapRef> MapRef::AsElementsKind(ElementsKind kind) const {
    AllowHandleAllocation handle_allocation;
    AllowHeapAllocation heap_allocation;
    AllowHandleDereference allow_handle_dereference;
-    return MapRef(broker(), Map::AsElementsKind(broker()->isolate(),
+    return MapRef(broker(),
-                                                object<Map>(), kind));
+                  Map::AsElementsKind(broker()->isolate(), object(), kind));
  }
  if (kind == elements_kind()) return *this;
  const ZoneVector<MapData*>& elements_kind_generalizations =
@@ -1752,8 +1752,7 @@ int JSFunctionRef::InitialMapInstanceSizeWithMinSlack() const {
  if (broker()->mode() == JSHeapBroker::kDisabled) {
    AllowHandleDereference allow_handle_dereference;
    AllowHandleAllocation handle_allocation;
-    return object<JSFunction>()->ComputeInstanceSizeWithMinSlack(
+    return object()->ComputeInstanceSizeWithMinSlack(broker()->isolate());
-        broker()->isolate());
  }
  return data()->AsJSFunction()->initial_map_instance_size_with_min_slack();
 }
@@ -1765,9 +1764,9 @@ ScriptContextTableRef::lookup(const NameRef& name) const {
  AllowHandleDereference handle_dereference;
  if (!name.IsString()) return {};
  ScriptContextTable::LookupResult lookup_result;
-  auto table = object<ScriptContextTable>();
+  auto table = object();
  if (!ScriptContextTable::Lookup(broker()->isolate(), table,
-                                  name.object<String>(), &lookup_result)) {
+                                  name.AsString().object(), &lookup_result)) {
    return {};
  }
  Handle<Context> script_context = ScriptContextTable::GetContext(
@@ -1809,7 +1808,7 @@ ObjectRef FeedbackVectorRef::get(FeedbackSlot slot) const {
  if (broker()->mode() == JSHeapBroker::kDisabled) {
    AllowHandleAllocation handle_allocation;
    AllowHandleDereference handle_dereference;
-    Handle<Object> value(object<FeedbackVector>()->Get(slot)->cast<Object>(),
+    Handle<Object> value(object()->Get(slot)->cast<Object>(),
                         broker()->isolate());
    return ObjectRef(broker(), value);
  }
@@ -1820,7 +1819,7 @@ ObjectRef FeedbackVectorRef::get(FeedbackSlot slot) const {
 double JSObjectRef::RawFastDoublePropertyAt(FieldIndex index) const {
  if (broker()->mode() == JSHeapBroker::kDisabled) {
    AllowHandleDereference handle_dereference;
-    return object<JSObject>()->RawFastDoublePropertyAt(index);
+    return object()->RawFastDoublePropertyAt(index);
  }
  JSObjectData* object_data = data()->AsJSObject();
  CHECK(index.is_inobject());
@@ -1831,9 +1830,8 @@ ObjectRef JSObjectRef::RawFastPropertyAt(FieldIndex index) const {
  if (broker()->mode() == JSHeapBroker::kDisabled) {
    AllowHandleAllocation handle_allocation;
    AllowHandleDereference handle_dereference;
-    return ObjectRef(broker(),
+    return ObjectRef(broker(), handle(object()->RawFastPropertyAt(index),
-                     handle(object<JSObject>()->RawFastPropertyAt(index),
+                                      broker()->isolate()));
-                            broker()->isolate()));
  }
  JSObjectData* object_data = data()->AsJSObject();
  CHECK(index.is_inobject());
@@ -1848,7 +1846,7 @@ bool AllocationSiteRef::IsFastLiteral() const {
    AllowHandleAllocation allow_handle_allocation;
    AllowHandleDereference allow_handle_dereference;
    return IsInlinableFastLiteral(
-        handle(object<AllocationSite>()->boilerplate(), broker()->isolate()));
+        handle(object()->boilerplate(), broker()->isolate()));
  }
  return data()->AsAllocationSite()->IsFastLiteral();
 }
@@ -1859,8 +1857,7 @@ void JSObjectRef::EnsureElementsTenured() {
    AllowHandleDereference allow_handle_dereference;
    AllowHeapAllocation allow_heap_allocation;
-    Handle<FixedArrayBase> object_elements =
+    Handle<FixedArrayBase> object_elements = elements().object();
-        elements().object<FixedArrayBase>();
    if (Heap::InNewSpace(*object_elements)) {
      // If we would like to pretenure a fixed cow array, we must ensure that
      // the array is already in old space, otherwise we'll create too many
@@ -1868,7 +1865,7 @@ void JSObjectRef::EnsureElementsTenured() {
      object_elements =
          broker()->isolate()->factory()->CopyAndTenureFixedCOWArray(
              Handle<FixedArray>::cast(object_elements));
-      object<JSObject>()->set_elements(*object_elements);
+      object()->set_elements(*object_elements);
    }
    return;
  }
@@ -1878,7 +1875,7 @@ void JSObjectRef::EnsureElementsTenured() {
 FieldIndex MapRef::GetFieldIndexFor(int descriptor_index) const {
  if (broker()->mode() == JSHeapBroker::kDisabled) {
    AllowHandleDereference allow_handle_dereference;
-    return FieldIndex::ForDescriptor(*object<Map>(), descriptor_index);
+    return FieldIndex::ForDescriptor(*object(), descriptor_index);
  }
  DescriptorArrayData* descriptors = data()->AsMap()->instance_descriptors();
  return descriptors->contents().at(descriptor_index).field_index;
@@ -1887,7 +1884,7 @@ FieldIndex MapRef::GetFieldIndexFor(int descriptor_index) const {
 int MapRef::GetInObjectPropertyOffset(int i) const {
  if (broker()->mode() == JSHeapBroker::kDisabled) {
    AllowHandleDereference allow_handle_dereference;
-    return object<Map>()->GetInObjectPropertyOffset(i);
+    return object()->GetInObjectPropertyOffset(i);
  }
  return (GetInObjectPropertiesStartInWords() + i) * kPointerSize;
 }
@@ -1895,7 +1892,7 @@ int MapRef::GetInObjectPropertyOffset(int i) const {
 PropertyDetails MapRef::GetPropertyDetails(int descriptor_index) const {
  if (broker()->mode() == JSHeapBroker::kDisabled) {
    AllowHandleDereference allow_handle_dereference;
-    return object<Map>()->instance_descriptors()->GetDetails(descriptor_index);
+    return object()->instance_descriptors()->GetDetails(descriptor_index);
  }
  DescriptorArrayData* descriptors = data()->AsMap()->instance_descriptors();
  return descriptors->contents().at(descriptor_index).details;
@@ -1907,7 +1904,7 @@ NameRef MapRef::GetPropertyKey(int descriptor_index) const {
    AllowHandleDereference allow_handle_dereference;
    return NameRef(
        broker(),
-        handle(object<Map>()->instance_descriptors()->GetKey(descriptor_index),
+        handle(object()->instance_descriptors()->GetKey(descriptor_index),
               broker()->isolate()));
  }
  DescriptorArrayData* descriptors = data()->AsMap()->instance_descriptors();
@@ -1929,7 +1926,7 @@ MapRef MapRef::FindFieldOwner(int descriptor_index) const {
    AllowHandleAllocation handle_allocation;
    AllowHandleDereference allow_handle_dereference;
    Handle<Map> owner(
-        object<Map>()->FindFieldOwner(broker()->isolate(), descriptor_index),
+        object()->FindFieldOwner(broker()->isolate(), descriptor_index),
        broker()->isolate());
    return MapRef(broker(), owner);
  }
@@ -1943,7 +1940,7 @@ ObjectRef MapRef::GetFieldType(int descriptor_index) const {
    AllowHandleAllocation handle_allocation;
    AllowHandleDereference allow_handle_dereference;
    Handle<FieldType> field_type(
-        object<Map>()->instance_descriptors()->GetFieldType(descriptor_index),
+        object()->instance_descriptors()->GetFieldType(descriptor_index),
        broker()->isolate());
    return ObjectRef(broker(), field_type);
  }
@@ -1955,8 +1952,8 @@ ObjectRef MapRef::GetFieldType(int descriptor_index) const {
 bool MapRef::IsUnboxedDoubleField(int descriptor_index) const {
  if (broker()->mode() == JSHeapBroker::kDisabled) {
    AllowHandleDereference allow_handle_dereference;
-    return object<Map>()->IsUnboxedDoubleField(
+    return object()->IsUnboxedDoubleField(
-        FieldIndex::ForDescriptor(*object<Map>(), descriptor_index));
+        FieldIndex::ForDescriptor(*object(), descriptor_index));
  }
  DescriptorArrayData* descriptors = data()->AsMap()->instance_descriptors();
  return descriptors->contents().at(descriptor_index).is_unboxed_double_field;
@@ -1965,7 +1962,7 @@ bool MapRef::IsUnboxedDoubleField(int descriptor_index) const {
 uint16_t StringRef::GetFirstChar() {
  if (broker()->mode() == JSHeapBroker::kDisabled) {
    AllowHandleDereference allow_handle_dereference;
-    return object<String>()->Get(0);
+    return object()->Get(0);
  }
  return data()->AsString()->first_char();
 }
@@ -1977,8 +1974,8 @@ base::Optional<double> StringRef::ToNumber() {
    AllowHeapAllocation allow_heap_allocation;
    int flags = ALLOW_HEX | ALLOW_OCTAL | ALLOW_BINARY;
    return StringToDouble(broker()->isolate(),
-                          broker()->isolate()->unicode_cache(),
+                          broker()->isolate()->unicode_cache(), object(),
-                          object<String>(), flags);
+                          flags);
  }
  return data()->AsString()->to_number();
 }
@@ -1987,8 +1984,7 @@ ObjectRef FixedArrayRef::get(int i) const {
  if (broker()->mode() == JSHeapBroker::kDisabled) {
    AllowHandleAllocation handle_allocation;
    AllowHandleDereference allow_handle_dereference;
-    return ObjectRef(broker(),
+    return ObjectRef(broker(), handle(object()->get(i), broker()->isolate()));
-                     handle(object<FixedArray>()->get(i), broker()->isolate()));
  }
  return ObjectRef(broker(), data()->AsFixedArray()->Get(i));
 }
@@ -1996,7 +1992,7 @@ ObjectRef FixedArrayRef::get(int i) const {
 bool FixedDoubleArrayRef::is_the_hole(int i) const {
  if (broker()->mode() == JSHeapBroker::kDisabled) {
    AllowHandleDereference allow_handle_dereference;
-    return object<FixedDoubleArray>()->is_the_hole(i);
+    return object()->is_the_hole(i);
  }
  return data()->AsFixedDoubleArray()->Get(i).is_hole_nan();
 }
@@ -2004,7 +2000,7 @@ bool FixedDoubleArrayRef::is_the_hole(int i) const {
 double FixedDoubleArrayRef::get_scalar(int i) const {
  if (broker()->mode() == JSHeapBroker::kDisabled) {
    AllowHandleDereference allow_handle_dereference;
-    return object<FixedDoubleArray>()->get_scalar(i);
+    return object()->get_scalar(i);
  }
  CHECK(!data()->AsFixedDoubleArray()->Get(i).is_hole_nan());
  return data()->AsFixedDoubleArray()->Get(i).get_scalar();
@@ -2014,15 +2010,15 @@ double FixedDoubleArrayRef::get_scalar(int i) const {
  if (broker()->mode() == JSHeapBroker::kDisabled) {     \
    AllowHandleAllocation handle_allocation;             \
    AllowHandleDereference allow_handle_dereference;     \
-    return object<holder>()->name();                     \
+    return object()->name();                             \
  }
-#define IF_BROKER_DISABLED_ACCESS_HANDLE(holder, result, name)                 \
+#define IF_BROKER_DISABLED_ACCESS_HANDLE(holder, result, name)         \
-  if (broker()->mode() == JSHeapBroker::kDisabled) {                           \
+  if (broker()->mode() == JSHeapBroker::kDisabled) {                   \
-    AllowHandleAllocation handle_allocation;                                   \
+    AllowHandleAllocation handle_allocation;                           \
-    AllowHandleDereference allow_handle_dereference;                           \
+    AllowHandleDereference allow_handle_dereference;                   \
-    return result##Ref(broker(),                                               \
+    return result##Ref(broker(),                                       \
-                       handle(object<holder>()->name(), broker()->isolate())); \
+                       handle(object()->name(), broker()->isolate())); \
  }
 // Macros for definining a const getter that, depending on the broker mode,
@@ -2107,8 +2103,7 @@ BIMODAL_ACCESSOR_C(String, int, length)
 void* JSTypedArrayRef::elements_external_pointer() const {
  if (broker()->mode() == JSHeapBroker::kDisabled) {
    AllowHandleDereference allow_handle_dereference;
-    return FixedTypedArrayBase::cast(object<JSTypedArray>()->elements())
+    return FixedTypedArrayBase::cast(object()->elements())->external_pointer();
-        ->external_pointer();
  }
  return data()->AsJSTypedArray()->elements_external_pointer();
 }
@@ -2219,7 +2214,7 @@ base::Optional<JSFunctionRef> NativeContextRef::GetConstructorFunction(
 bool ObjectRef::BooleanValue() const {
  if (broker()->mode() == JSHeapBroker::kDisabled) {
    AllowHandleDereference allow_handle_dereference;
-    return object<Object>()->BooleanValue(broker()->isolate());
+    return object()->BooleanValue(broker()->isolate());
  }
  return IsSmi() ? (AsSmi() != 0) : data()->AsHeapObject()->boolean_value();
 }
@@ -2263,8 +2258,8 @@ CellRef ModuleRef::GetCell(int cell_index) const {
  if (broker()->mode() == JSHeapBroker::kDisabled) {
    AllowHandleAllocation handle_allocation;
    AllowHandleDereference allow_handle_dereference;
-    return CellRef(broker(), handle(object<Module>()->GetCell(cell_index),
+    return CellRef(broker(),
-                                    broker()->isolate()));
+                   handle(object()->GetCell(cell_index), broker()->isolate()));
  }
  return CellRef(broker(), data()->AsModule()->GetCell(cell_index));
 }
@@ -2345,8 +2340,8 @@ base::Optional<JSObjectRef> AllocationSiteRef::boilerplate() const {
  if (broker()->mode() == JSHeapBroker::kDisabled) {
    AllowHandleAllocation handle_allocation;
    AllowHandleDereference allow_handle_dereference;
-    return JSObjectRef(broker(), handle(object<AllocationSite>()->boilerplate(),
+    return JSObjectRef(broker(),
-                                        broker()->isolate()));
+                       handle(object()->boilerplate(), broker()->isolate()));
  }
  JSObjectData* boilerplate = data()->AsAllocationSite()->boilerplate();
  if (boilerplate) {
@@ -2364,8 +2359,8 @@ FixedArrayBaseRef JSObjectRef::elements() const {
  if (broker()->mode() == JSHeapBroker::kDisabled) {
    AllowHandleAllocation handle_allocation;
    AllowHandleDereference allow_handle_dereference;
-    return FixedArrayBaseRef(
+    return FixedArrayBaseRef(broker(),
-        broker(), handle(object<JSObject>()->elements(), broker()->isolate()));
+                             handle(object()->elements(), broker()->isolate()));
  }
  return FixedArrayBaseRef(broker(), data()->AsJSObject()->elements());
 }
@@ -2418,6 +2413,13 @@ ObjectRef JSRegExpRef::source() const {
 Handle<Object> ObjectRef::object() const { return data_->object(); }
+#define DEF_OBJECT_GETTER(T)                                            \
+  Handle<T> T##Ref::object() const {                                    \
+    return Handle<T>(reinterpret_cast<T**>(data_->object().address())); \
+  }
+HEAP_BROKER_OBJECT_LIST(DEF_OBJECT_GETTER)
+#undef DEF_OBJECT_GETTER
 JSHeapBroker* ObjectRef::broker() const { return broker_; }
 ObjectData* ObjectRef::data() const {

--- a/src/compiler/js-heap-broker.h
+++ b/src/compiler/js-heap-broker.h
@@ -16,6 +16,16 @@
 namespace v8 {
 namespace internal {
+class BytecodeArray;
+class FixedDoubleArray;
+class InternalizedString;
+class JSGlobalProxy;
+class JSRegExp;
+class JSTypedArray;
+class NativeContext;
+class ScriptContextTable;
 namespace compiler {
 enum class OddballType : uint8_t {
@@ -71,6 +81,7 @@ enum class OddballType : uint8_t {
 class CompilationDependencies;
 class JSHeapBroker;
 class ObjectData;
+class PerIsolateCompilerCache;
 #define FORWARD_DECL(Name) class Name##Ref;
 HEAP_BROKER_OBJECT_LIST(FORWARD_DECL)
 #undef FORWARD_DECL
@@ -79,18 +90,13 @@ class ObjectRef {
 public:
  ObjectRef(JSHeapBroker* broker, Handle<Object> object);
  ObjectRef(JSHeapBroker* broker, ObjectData* data)
-      : broker_(broker), data_(data) {
+      : data_(data), broker_(broker) {
    CHECK_NOT_NULL(data_);
  }
-  bool equals(const ObjectRef& other) const;
  Handle<Object> object() const;
-  // TODO(neis): Remove eventually.
-  template <typename T>
+  bool equals(const ObjectRef& other) const;
-  Handle<T> object() const {
-    return Handle<T>(reinterpret_cast<T**>(object().address()));
-  }
  bool IsSmi() const;
  int AsSmi() const;
@@ -111,10 +117,12 @@ class ObjectRef {
 protected:
  JSHeapBroker* broker() const;
  ObjectData* data() const;
+  ObjectData* data_;  // Should be used only by object() getters.
 private:
  JSHeapBroker* broker_;
-  ObjectData* data_;
+ protected:
 };
 // Temporary class that carries information from a Map. We'd like to remove
@@ -155,6 +163,7 @@ class HeapObjectType {
 class HeapObjectRef : public ObjectRef {
 public:
  using ObjectRef::ObjectRef;
+  Handle<HeapObject> object() const;
  MapRef map() const;
@@ -165,6 +174,7 @@ class HeapObjectRef : public ObjectRef {
 class PropertyCellRef : public HeapObjectRef {
 public:
  using HeapObjectRef::HeapObjectRef;
+  Handle<PropertyCell> object() const;
  PropertyDetails property_details() const;
  ObjectRef value() const;
@@ -173,6 +183,7 @@ class PropertyCellRef : public HeapObjectRef {
 class JSObjectRef : public HeapObjectRef {
 public:
  using HeapObjectRef::HeapObjectRef;
+  Handle<JSObject> object() const;
  double RawFastDoublePropertyAt(FieldIndex index) const;
  ObjectRef RawFastPropertyAt(FieldIndex index) const;
@@ -188,6 +199,7 @@ class JSObjectRef : public HeapObjectRef {
 class JSFunctionRef : public JSObjectRef {
 public:
  using JSObjectRef::JSObjectRef;
+  Handle<JSFunction> object() const;
  bool has_initial_map() const;
  bool has_prototype() const;
@@ -206,6 +218,7 @@ class JSFunctionRef : public JSObjectRef {
 class JSRegExpRef : public JSObjectRef {
 public:
  using JSObjectRef::JSObjectRef;
+  Handle<JSRegExp> object() const;
  ObjectRef raw_properties_or_hash() const;
  ObjectRef data() const;
@@ -217,6 +230,7 @@ class JSRegExpRef : public JSObjectRef {
 class HeapNumberRef : public HeapObjectRef {
 public:
  using HeapObjectRef::HeapObjectRef;
+  Handle<HeapNumber> object() const;
  double value() const;
 };
@@ -224,6 +238,7 @@ class HeapNumberRef : public HeapObjectRef {
 class MutableHeapNumberRef : public HeapObjectRef {
 public:
  using HeapObjectRef::HeapObjectRef;
+  Handle<MutableHeapNumber> object() const;
  double value() const;
 };
@@ -231,8 +246,9 @@ class MutableHeapNumberRef : public HeapObjectRef {
 class ContextRef : public HeapObjectRef {
 public:
  using HeapObjectRef::HeapObjectRef;
-  void Serialize();
+  Handle<Context> object() const;
+  void Serialize();
  ContextRef previous() const;
  ObjectRef get(int index) const;
 };
@@ -279,6 +295,8 @@ class ContextRef : public HeapObjectRef {
 class NativeContextRef : public ContextRef {
 public:
  using ContextRef::ContextRef;
+  Handle<NativeContext> object() const;
  void Serialize();
 #define DECL_ACCESSOR(type, name) type##Ref name() const;
@@ -293,11 +311,13 @@ class NativeContextRef : public ContextRef {
 class NameRef : public HeapObjectRef {
 public:
  using HeapObjectRef::HeapObjectRef;
+  Handle<Name> object() const;
 };
 class ScriptContextTableRef : public HeapObjectRef {
 public:
  using HeapObjectRef::HeapObjectRef;
+  Handle<ScriptContextTable> object() const;
  struct LookupResult {
    ContextRef context;
@@ -311,11 +331,13 @@ class ScriptContextTableRef : public HeapObjectRef {
 class DescriptorArrayRef : public HeapObjectRef {
 public:
  using HeapObjectRef::HeapObjectRef;
+  Handle<DescriptorArray> object() const;
 };
 class FeedbackVectorRef : public HeapObjectRef {
 public:
  using HeapObjectRef::HeapObjectRef;
+  Handle<FeedbackVector> object() const;
  ObjectRef get(FeedbackSlot slot) const;
@@ -325,6 +347,7 @@ class FeedbackVectorRef : public HeapObjectRef {
 class AllocationSiteRef : public HeapObjectRef {
 public:
  using HeapObjectRef::HeapObjectRef;
+  Handle<AllocationSite> object() const;
  bool PointsToLiteral() const;
  PretenureFlag GetPretenureMode() const;
@@ -346,6 +369,7 @@ class AllocationSiteRef : public HeapObjectRef {
 class MapRef : public HeapObjectRef {
 public:
  using HeapObjectRef::HeapObjectRef;
+  Handle<Map> object() const;
  int instance_size() const;
  InstanceType instance_type() const;
@@ -394,6 +418,7 @@ class MapRef : public HeapObjectRef {
 class FixedArrayBaseRef : public HeapObjectRef {
 public:
  using HeapObjectRef::HeapObjectRef;
+  Handle<FixedArrayBase> object() const;
  int length() const;
 };
@@ -401,6 +426,7 @@ class FixedArrayBaseRef : public HeapObjectRef {
 class FixedArrayRef : public FixedArrayBaseRef {
 public:
  using FixedArrayBaseRef::FixedArrayBaseRef;
+  Handle<FixedArray> object() const;
  ObjectRef get(int i) const;
 };
@@ -408,6 +434,7 @@ class FixedArrayRef : public FixedArrayBaseRef {
 class FixedDoubleArrayRef : public FixedArrayBaseRef {
 public:
  using FixedArrayBaseRef::FixedArrayBaseRef;
+  Handle<FixedDoubleArray> object() const;
  double get_scalar(int i) const;
  bool is_the_hole(int i) const;
@@ -416,6 +443,7 @@ class FixedDoubleArrayRef : public FixedArrayBaseRef {
 class BytecodeArrayRef : public FixedArrayBaseRef {
 public:
  using FixedArrayBaseRef::FixedArrayBaseRef;
+  Handle<BytecodeArray> object() const;
  int register_count() const;
 };
@@ -423,6 +451,7 @@ class BytecodeArrayRef : public FixedArrayBaseRef {
 class JSArrayRef : public JSObjectRef {
 public:
  using JSObjectRef::JSObjectRef;
+  Handle<JSArray> object() const;
  ObjectRef length() const;
 };
@@ -430,6 +459,7 @@ class JSArrayRef : public JSObjectRef {
 class ScopeInfoRef : public HeapObjectRef {
 public:
  using HeapObjectRef::HeapObjectRef;
+  Handle<ScopeInfo> object() const;
  int ContextLength() const;
 };
@@ -451,6 +481,7 @@ class ScopeInfoRef : public HeapObjectRef {
 class SharedFunctionInfoRef : public HeapObjectRef {
 public:
  using HeapObjectRef::HeapObjectRef;
+  Handle<SharedFunctionInfo> object() const;
  int builtin_id() const;
  BytecodeArrayRef GetBytecodeArray() const;
@@ -462,6 +493,7 @@ class SharedFunctionInfoRef : public HeapObjectRef {
 class StringRef : public NameRef {
 public:
  using NameRef::NameRef;
+  Handle<String> object() const;
  int length() const;
  uint16_t GetFirstChar();
@@ -473,6 +505,7 @@ class StringRef : public NameRef {
 class JSTypedArrayRef : public JSObjectRef {
 public:
  using JSObjectRef::JSObjectRef;
+  Handle<JSTypedArray> object() const;
  bool is_on_heap() const;
  size_t length_value() const;
@@ -486,6 +519,7 @@ class JSTypedArrayRef : public JSObjectRef {
 class ModuleRef : public HeapObjectRef {
 public:
  using HeapObjectRef::HeapObjectRef;
+  Handle<Module> object() const;
  void Serialize();
@@ -495,6 +529,7 @@ class ModuleRef : public HeapObjectRef {
 class CellRef : public HeapObjectRef {
 public:
  using HeapObjectRef::HeapObjectRef;
+  Handle<Cell> object() const;
  ObjectRef value() const;
 };
@@ -502,20 +537,21 @@ class CellRef : public HeapObjectRef {
 class JSGlobalProxyRef : public JSObjectRef {
 public:
  using JSObjectRef::JSObjectRef;
+  Handle<JSGlobalProxy> object() const;
 };
 class CodeRef : public HeapObjectRef {
 public:
  using HeapObjectRef::HeapObjectRef;
+  Handle<Code> object() const;
 };
 class InternalizedStringRef : public StringRef {
 public:
  using StringRef::StringRef;
+  Handle<InternalizedString> object() const;
 };
-class PerIsolateCompilerCache;
 class V8_EXPORT_PRIVATE JSHeapBroker : public NON_EXPORTED_BASE(ZoneObject) {
 public:
  JSHeapBroker(Isolate* isolate, Zone* broker_zone);

--- a/src/compiler/js-native-context-specialization.cc
+++ b/src/compiler/js-native-context-specialization.cc
@@ -190,7 +190,7 @@ JSNativeContextSpecialization::CreateDelayedStringConstant(Node* node) {
      if (matcher.HasValue() && matcher.Ref(broker()).IsString()) {
        StringRef s = matcher.Ref(broker()).AsString();
        return new (shared_zone())
-            StringLiteral(s.object<String>(), static_cast<size_t>(s.length()));
+            StringLiteral(s.object(), static_cast<size_t>(s.length()));
      } else {
        UNREACHABLE();
      }
@@ -403,9 +403,8 @@ Reduction JSNativeContextSpecialization::ReduceJSInstanceOf(Node* node) {
  // Compute property access info for @@hasInstance on {receiver}.
  PropertyAccessInfo access_info;
-  AccessInfoFactory access_info_factory(broker(), dependencies(),
+  AccessInfoFactory access_info_factory(
-                                        native_context().object<Context>(),
+      broker(), dependencies(), native_context().object(), graph()->zone());
-                                        graph()->zone());
  if (!access_info_factory.ComputePropertyAccessInfo(
          receiver_map, factory()->has_instance_symbol(), AccessMode::kLoad,
          &access_info)) {
@@ -695,9 +694,8 @@ Reduction JSNativeContextSpecialization::ReduceJSResolvePromise(Node* node) {
  // Compute property access info for "then" on {resolution}.
  PropertyAccessInfo access_info;
-  AccessInfoFactory access_info_factory(broker(), dependencies(),
+  AccessInfoFactory access_info_factory(
-                                        native_context().object<Context>(),
+      broker(), dependencies(), native_context().object(), graph()->zone());
-                                        graph()->zone());
  if (!access_info_factory.ComputePropertyAccessInfo(
          MapHandles(resolution_maps.begin(), resolution_maps.end()),
          factory()->then_string(), AccessMode::kLoad, &access_info)) {
@@ -852,7 +850,7 @@ Reduction JSNativeContextSpecialization::ReduceGlobalAccess(
            // mutated without the cell state being updated.
            if (property_cell_value_map.is_stable()) {
              dependencies()->DependOnStableMap(property_cell_value_map);
-              map = property_cell_value_map.object<Map>();
+              map = property_cell_value_map.object();
            }
          }
        }
@@ -968,7 +966,7 @@ Reduction JSNativeContextSpecialization::ReduceJSLoadGlobal(Node* node) {
  }
  // Lookup the {name} on the global object instead.
-  return ReduceGlobalAccess(node, nullptr, nullptr, name.object<Name>(),
+  return ReduceGlobalAccess(node, nullptr, nullptr, name.object(),
                            AccessMode::kLoad);
 }
@@ -997,7 +995,7 @@ Reduction JSNativeContextSpecialization::ReduceJSStoreGlobal(Node* node) {
  }
  // Lookup the {name} on the global object instead.
-  return ReduceGlobalAccess(node, nullptr, value, name.object<Name>(),
+  return ReduceGlobalAccess(node, nullptr, value, name.object(),
                            AccessMode::kStore);
 }
@@ -1025,7 +1023,7 @@ Reduction JSNativeContextSpecialization::ReduceNamedAccess(
      // Detached global proxies have |null| as their constructor.
      if (maybe_constructor->IsJSFunction() &&
          JSFunction::cast(maybe_constructor)->native_context() ==
-              *native_context().object<Context>()) {
+              *native_context().object()) {
        return ReduceGlobalAccess(node, receiver, value, name, access_mode,
                                  index);
      }
@@ -1033,9 +1031,8 @@ Reduction JSNativeContextSpecialization::ReduceNamedAccess(
  }
  // Compute property access infos for the receiver maps.
-  AccessInfoFactory access_info_factory(broker(), dependencies(),
+  AccessInfoFactory access_info_factory(
-                                        native_context().object<Context>(),
+      broker(), dependencies(), native_context().object(), graph()->zone());
-                                        graph()->zone());
  ZoneVector<PropertyAccessInfo> access_infos(zone());
  if (!access_info_factory.ComputePropertyAccessInfos(
          receiver_maps, name, access_mode, &access_infos)) {
@@ -1409,9 +1406,8 @@ Reduction JSNativeContextSpecialization::ReduceElementAccess(
  } else {
    // Retrieve the native context from the given {node}.
    // Compute element access infos for the receiver maps.
-    AccessInfoFactory access_info_factory(broker(), dependencies(),
+    AccessInfoFactory access_info_factory(
-                                          native_context().object<Context>(),
+        broker(), dependencies(), native_context().object(), graph()->zone());
-                                          graph()->zone());
    ZoneVector<ElementAccessInfo> access_infos(zone());
    if (!access_info_factory.ComputeElementAccessInfos(
            receiver_maps, access_mode, &access_infos)) {
@@ -2312,9 +2308,8 @@ Reduction JSNativeContextSpecialization::ReduceJSStoreDataPropertyInLiteral(
             isolate());
  PropertyAccessInfo access_info;
-  AccessInfoFactory access_info_factory(broker(), dependencies(),
+  AccessInfoFactory access_info_factory(
-                                        native_context().object<Context>(),
+      broker(), dependencies(), native_context().object(), graph()->zone());
-                                        graph()->zone());
  if (!access_info_factory.ComputePropertyAccessInfo(
          receiver_map, cached_name, AccessMode::kStoreInLiteral,
          &access_info)) {

--- a/src/compiler/node-properties.cc
+++ b/src/compiler/node-properties.cc
@@ -381,7 +381,7 @@ NodeProperties::InferReceiverMapsResult NodeProperties::InferReceiverMaps(
      if (receiver.map().is_stable()) {
        // The {receiver_map} is only reliable when we install a stability
        // code dependency.
-        *maps_return = ZoneHandleSet<Map>(receiver.map().object<Map>());
+        *maps_return = ZoneHandleSet<Map>(receiver.map().object());
        return kUnreliableReceiverMaps;
      }
    }
@@ -418,7 +418,7 @@ NodeProperties::InferReceiverMapsResult NodeProperties::InferReceiverMaps(
              MapRef initial_map = original_constructor.initial_map();
              if (initial_map.constructor_or_backpointer().equals(
                      mtarget.Ref(broker))) {
-                *maps_return = ZoneHandleSet<Map>(initial_map.object<Map>());
+                *maps_return = ZoneHandleSet<Map>(initial_map.object());
                return result;
              }
            }
@@ -438,7 +438,7 @@ NodeProperties::InferReceiverMapsResult NodeProperties::InferReceiverMaps(
            Node* const value = GetValueInput(effect, 1);
            HeapObjectMatcher m(value);
            if (m.HasValue()) {
-              *maps_return = ZoneHandleSet<Map>(m.Ref(broker).object<Map>());
+              *maps_return = ZoneHandleSet<Map>(m.Ref(broker).AsMap().object());
              return result;
            }
          }

--- a/src/compiler/types.cc
+++ b/src/compiler/types.cc
@@ -483,7 +483,7 @@ HeapConstantType::HeapConstantType(BitsetType::bitset bitset,
    : TypeBase(kHeapConstant), bitset_(bitset), heap_ref_(heap_ref) {}
 Handle<HeapObject> HeapConstantType::Value() const {
-  return heap_ref_.object<HeapObject>();
+  return heap_ref_.object();
 }
 // -----------------------------------------------------------------------------