[turbofan] Move AssumePrototypesStable out of PropertyAccessBuilder.

It doesn't depend on anything from PropertyAccessBuilder other than
CompilationDependencies. Move it there instead.

R=jarin@chromium.org

Bug: v8:7790
Change-Id: I0545a990829f4591ebf5089b6a9e8c1a96899b93
Reviewed-on: https://chromium-review.googlesource.com/1107797Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53903}

src/compilation-dependencies.cc

@@ -137,6 +137,21 @@ void CompilationDependencies::AssumePrototypeMapsStable(
   }
 }
 
+void CompilationDependencies::AssumePrototypesStable(
+    Handle<Context> native_context,
+    std::vector<Handle<Map>> const& receiver_maps, Handle<JSObject> holder) {
+  // Determine actual holder and perform prototype chain checks.
+  for (auto map : receiver_maps) {
+    // Perform the implicit ToObject for primitives here.
+    // Implemented according to ES6 section 7.3.2 GetV (V, P).
+    Handle<JSFunction> constructor;
+    if (Map::GetConstructorFunction(map, native_context)
+            .ToHandle(&constructor)) {
+      map = handle(constructor->initial_map(), holder->GetIsolate());
+    }
+    AssumePrototypeMapsStable(map, holder);
+  }
+}
 
 void CompilationDependencies::AssumeTransitionStable(
     Handle<AllocationSite> site) {

src/compilation-dependencies.h

@@ -46,6 +46,12 @@ class CompilationDependencies {
   }
   void AssumeTransitionStable(Handle<AllocationSite> site);
 
+  // Adds stability dependencies on all prototypes of every class in
+  // {receiver_type} up to (and including) the {holder}.
+  void AssumePrototypesStable(Handle<Context> native_context,
+                              std::vector<Handle<Map>> const& receiver_maps,
+                              Handle<JSObject> holder);
+
   void Commit(Handle<Code> code);
   void Rollback();
   void Abort() { aborted_ = true; }

src/compiler/js-call-reducer.cc

@@ -6832,8 +6832,8 @@ Reduction JSCallReducer::ReduceRegExpPrototypeTest(Node* node) {
   // Add proper dependencies on the {regexp}s [[Prototype]]s.
   Handle<JSObject> holder;
   if (ai_exec.holder().ToHandle(&holder)) {
-    access_builder.AssumePrototypesStable(native_context(),
-                                          ai_exec.receiver_maps(), holder);
+    dependencies()->AssumePrototypesStable(native_context(),
+                                           ai_exec.receiver_maps(), holder);
   }
 
   if (need_map_check) {

src/compiler/js-native-context-specialization.cc

@@ -207,7 +207,7 @@ Reduction JSNativeContextSpecialization::ReduceJSInstanceOf(Node* node) {
       // Determine actual holder and perform prototype chain checks.
       Handle<JSObject> holder;
       if (access_info.holder().ToHandle(&holder)) {
-        access_builder.AssumePrototypesStable(
+        dependencies()->AssumePrototypesStable(
             native_context().object<Context>(), access_info.receiver_maps(),
             holder);
       }
@@ -233,9 +233,9 @@ Reduction JSNativeContextSpecialization::ReduceJSInstanceOf(Node* node) {
     // Determine actual holder and perform prototype chain checks.
     Handle<JSObject> holder;
     if (access_info.holder().ToHandle(&holder)) {
-      access_builder.AssumePrototypesStable(native_context().object<Context>(),
-                                            access_info.receiver_maps(),
-                                            holder);
+      dependencies()->AssumePrototypesStable(native_context().object<Context>(),
+                                             access_info.receiver_maps(),
+                                             holder);
     } else {
       holder = receiver;
     }
@@ -500,8 +500,8 @@ Reduction JSNativeContextSpecialization::ReduceJSResolvePromise(Node* node) {
   // Add proper dependencies on the {resolution}s [[Prototype]]s.
   Handle<JSObject> holder;
   if (access_info.holder().ToHandle(&holder)) {
-    access_builder.AssumePrototypesStable(native_context().object<Context>(),
-                                          access_info.receiver_maps(), holder);
+    dependencies()->AssumePrototypesStable(native_context().object<Context>(),
+                                           access_info.receiver_maps(), holder);
   }
 
   // Simply fulfill the {promise} with the {resolution}.
@@ -1803,8 +1803,8 @@ JSNativeContextSpecialization::BuildPropertyLoad(
   Handle<JSObject> holder;
   PropertyAccessBuilder access_builder(jsgraph(), dependencies());
   if (access_info.holder().ToHandle(&holder)) {
-    access_builder.AssumePrototypesStable(native_context().object<Context>(),
-                                          access_info.receiver_maps(), holder);
+    dependencies()->AssumePrototypesStable(native_context().object<Context>(),
+                                           access_info.receiver_maps(), holder);
   }
 
   // Generate the actual property access.
@@ -1860,8 +1860,8 @@ JSNativeContextSpecialization::BuildPropertyStore(
   PropertyAccessBuilder access_builder(jsgraph(), dependencies());
   if (access_info.holder().ToHandle(&holder)) {
     DCHECK_NE(AccessMode::kStoreInLiteral, access_mode);
-    access_builder.AssumePrototypesStable(native_context().object<Context>(),
-                                          access_info.receiver_maps(), holder);
+    dependencies()->AssumePrototypesStable(native_context().object<Context>(),
+                                           access_info.receiver_maps(), holder);
   }
 
   DCHECK(!access_info.IsNotFound());

src/compiler/property-access-builder.cc

@@ -168,22 +168,6 @@ Node* PropertyAccessBuilder::BuildCheckValue(Node* receiver, Node** effect,
   return expected;
 }
 
-void PropertyAccessBuilder::AssumePrototypesStable(
-    Handle<Context> native_context,
-    std::vector<Handle<Map>> const& receiver_maps, Handle<JSObject> holder) {
-  // Determine actual holder and perform prototype chain checks.
-  for (auto map : receiver_maps) {
-    // Perform the implicit ToObject for primitives here.
-    // Implemented according to ES6 section 7.3.2 GetV (V, P).
-    Handle<JSFunction> constructor;
-    if (Map::GetConstructorFunction(map, native_context)
-            .ToHandle(&constructor)) {
-      map = handle(constructor->initial_map(), holder->GetIsolate());
-    }
-    dependencies()->AssumePrototypeMapsStable(map, holder);
-  }
-}
-
 Node* PropertyAccessBuilder::ResolveHolder(
     PropertyAccessInfo const& access_info, Node* receiver) {
   Handle<JSObject> holder;

src/compiler/property-access-builder.h

@@ -44,12 +44,6 @@ class PropertyAccessBuilder {
   Node* BuildCheckValue(Node* receiver, Node** effect, Node* control,
                         Handle<HeapObject> value);
 
-  // Adds stability dependencies on all prototypes of every class in
-  // {receiver_type} up to (and including) the {holder}.
-  void AssumePrototypesStable(Handle<Context> native_context,
-                              std::vector<Handle<Map>> const& receiver_maps,
-                              Handle<JSObject> holder);
-
   // Builds the actual load for data-field and data-constant-field
   // properties (without heap-object or map checks).
   Node* BuildLoadDataField(Handle<Name> name,