Reland "[turbofan] More brokerization in JSCreateLowering."

This is a reland of 7f67cbd4

Original change's description:
> [turbofan] More brokerization in JSCreateLowering.
> 
> Brokerized ReduceJSCreateEmptyLiteralObject and added the scope
> for ReduceJSCreateLiteralArrayOrObject.
> 
> Bug: v8:7790
> Change-Id: Ife34a6b610678a3fe24152151cf343400ee515bd
> Reviewed-on: https://chromium-review.googlesource.com/1140306
> Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#54507}

Bug: v8:7790
Change-Id: Ia79ff9ef49c727155a9c476268234e56d2cc9fcb
Reviewed-on: https://chromium-review.googlesource.com/1142984
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54538}

src/compiler/js-create-lowering.cc

@@ -1133,6 +1133,7 @@ Reduction JSCreateLowering::ReduceJSCreatePromise(Node* node) {
 }
 
 Reduction JSCreateLowering::ReduceJSCreateLiteralArrayOrObject(Node* node) {
+  DisallowHeapAccess no_heap_access;
   DCHECK(node->opcode() == IrOpcode::kJSCreateLiteralArray ||
          node->opcode() == IrOpcode::kJSCreateLiteralObject);
   CreateLiteralParameters const& p = CreateLiteralParametersOf(node->op());
@@ -1182,15 +1183,16 @@ Reduction JSCreateLowering::ReduceJSCreateEmptyLiteralArray(Node* node) {
 }
 
 Reduction JSCreateLowering::ReduceJSCreateEmptyLiteralObject(Node* node) {
+  DisallowHeapAccess no_heap_access;
   DCHECK_EQ(IrOpcode::kJSCreateEmptyLiteralObject, node->opcode());
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
 
   // Retrieve the initial map for the object.
-  Handle<Map> map = factory()->ObjectLiteralMapFromCache(native_context(), 0);
-  DCHECK(!map->is_dictionary_map());
-  DCHECK(!map->IsInobjectSlackTrackingInProgress());
-  Node* js_object_map = jsgraph()->HeapConstant(map);
+  MapRef map = native_context_ref().ObjectLiteralMapFromCache();
+  DCHECK(!map.is_dictionary_map());
+  DCHECK(!map.IsInobjectSlackTrackingInProgress());
+  Node* js_object_map = jsgraph()->Constant(map);
 
   // Setup elements and properties.
   Node* elements = jsgraph()->EmptyFixedArrayConstant();
@@ -1198,13 +1200,12 @@ Reduction JSCreateLowering::ReduceJSCreateEmptyLiteralObject(Node* node) {
 
   // Perform the allocation of the actual JSArray object.
   AllocationBuilder a(jsgraph(), effect, control);
-  a.Allocate(map->instance_size());
+  a.Allocate(map.instance_size());
   a.Store(AccessBuilder::ForMap(), js_object_map);
   a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(), properties);
   a.Store(AccessBuilder::ForJSObjectElements(), elements);
-  for (int i = 0; i < map->GetInObjectProperties(); i++) {
-    a.Store(AccessBuilder::ForJSObjectInObjectProperty(
-                MapRef(js_heap_broker(), map), i),
+  for (int i = 0; i < map.GetInObjectProperties(); i++) {
+    a.Store(AccessBuilder::ForJSObjectInObjectProperty(map, i),
             jsgraph()->UndefinedConstant());
   }
 

src/compiler/js-heap-broker.cc

@@ -396,6 +396,8 @@ const int kMaxFastLiteralProperties = JSObject::kMaxInObjectProperties;
 // all limits to be considered for fast deep-copying and computes the total
 // size of all objects that are part of the graph.
 bool AllocationSiteRef::IsFastLiteral() const {
+  AllowHeapAllocation
+      allow_heap_allocation;  // This is needed for TryMigrateInstance.
   AllowHandleAllocation allow_handle_allocation;
   AllowHandleDereference allow_handle_dereference;
   int max_properties = kMaxFastLiteralProperties;
@@ -415,6 +417,8 @@ void JSObjectRef::EnsureElementsTenured() {
   // the compilation job starts.
   AllowHandleAllocation allow_handle_allocation;
   AllowHandleDereference allow_handle_dereference;
+  AllowHeapAllocation allow_heap_allocation;
+
   Handle<FixedArrayBase> object_elements = elements().object<FixedArrayBase>();
   if (Heap::InNewSpace(*object_elements)) {
     // If we would like to pretenure a fixed cow array, we must ensure that
@@ -816,6 +820,15 @@ MapRef NativeContextRef::GetFunctionMapFromIndex(int index) const {
   return get(index).AsMap();
 }
 
+MapRef NativeContextRef::ObjectLiteralMapFromCache() const {
+  AllowHeapAllocation heap_allocation;
+  AllowHandleAllocation handle_allocation;
+  AllowHandleDereference allow_handle_dereference;
+  Factory* factory = broker()->isolate()->factory();
+  Handle<Map> map = factory->ObjectLiteralMapFromCache(object<Context>(), 0);
+  return MapRef(broker(), map);
+}
+
 bool ObjectRef::BooleanValue() {
   AllowHandleDereference allow_handle_dereference;
   return object<Object>()->BooleanValue(broker()->isolate());

src/compiler/js-heap-broker.h

@@ -247,6 +247,7 @@ class NativeContextRef : public ContextRef {
   JSFunctionRef array_function() const;
 
   MapRef GetFunctionMapFromIndex(int index) const;
+  MapRef ObjectLiteralMapFromCache() const;
 };
 
 class NameRef : public HeapObjectRef {