[turbofan] Extend list of operators that only produce HeapObjects

Change-Id: If8763d2a46a13e75722f2f5314ba50dc9df281e0
Reviewed-on: https://chromium-review.googlesource.com/c/1396089Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58565}

src/compiler/opcodes.h

@@ -134,28 +134,28 @@
   V(JSNegate)
 
 #define JS_CREATE_OP_LIST(V)     \
+  V(JSCloneObject)               \
   V(JSCreate)                    \
   V(JSCreateArguments)           \
   V(JSCreateArray)               \
+  V(JSCreateArrayFromIterable)   \
   V(JSCreateArrayIterator)       \
   V(JSCreateAsyncFunctionObject) \
   V(JSCreateBoundFunction)       \
   V(JSCreateClosure)             \
   V(JSCreateCollectionIterator)  \
+  V(JSCreateEmptyLiteralArray)   \
+  V(JSCreateEmptyLiteralObject)  \
   V(JSCreateGeneratorObject)     \
   V(JSCreateIterResultObject)    \
-  V(JSCreateStringIterator)      \
   V(JSCreateKeyValueArray)       \
-  V(JSCreateObject)              \
-  V(JSCreatePromise)             \
-  V(JSCreateTypedArray)          \
   V(JSCreateLiteralArray)        \
-  V(JSCreateEmptyLiteralArray)   \
-  V(JSCreateArrayFromIterable)   \
   V(JSCreateLiteralObject)       \
-  V(JSCreateEmptyLiteralObject)  \
-  V(JSCloneObject)               \
-  V(JSCreateLiteralRegExp)
+  V(JSCreateLiteralRegExp)       \
+  V(JSCreateObject)              \
+  V(JSCreatePromise)             \
+  V(JSCreateStringIterator)      \
+  V(JSCreateTypedArray)
 
 #define JS_OBJECT_OP_LIST(V)      \
   JS_CREATE_OP_LIST(V)            \

src/compiler/property-access-builder.cc

@@ -83,27 +83,37 @@ bool NeedsCheckHeapObject(Node* receiver) {
   switch (receiver->opcode()) {
     case IrOpcode::kConvertReceiver:
     case IrOpcode::kHeapConstant:
+    case IrOpcode::kJSCloneObject:
+    case IrOpcode::kJSConstruct:
+    case IrOpcode::kJSConstructForwardVarargs:
+    case IrOpcode::kJSConstructWithArrayLike:
+    case IrOpcode::kJSConstructWithSpread:
     case IrOpcode::kJSCreate:
     case IrOpcode::kJSCreateArguments:
     case IrOpcode::kJSCreateArray:
+    case IrOpcode::kJSCreateArrayFromIterable:
+    case IrOpcode::kJSCreateArrayIterator:
+    case IrOpcode::kJSCreateAsyncFunctionObject:
+    case IrOpcode::kJSCreateBoundFunction:
     case IrOpcode::kJSCreateClosure:
+    case IrOpcode::kJSCreateCollectionIterator:
+    case IrOpcode::kJSCreateEmptyLiteralArray:
+    case IrOpcode::kJSCreateEmptyLiteralObject:
+    case IrOpcode::kJSCreateGeneratorObject:
     case IrOpcode::kJSCreateIterResultObject:
+    case IrOpcode::kJSCreateKeyValueArray:
     case IrOpcode::kJSCreateLiteralArray:
-    case IrOpcode::kJSCreateEmptyLiteralArray:
-    case IrOpcode::kJSCreateArrayFromIterable:
     case IrOpcode::kJSCreateLiteralObject:
-    case IrOpcode::kJSCreateEmptyLiteralObject:
     case IrOpcode::kJSCreateLiteralRegExp:
-    case IrOpcode::kJSCreateGeneratorObject:
-    case IrOpcode::kJSConstructForwardVarargs:
-    case IrOpcode::kJSConstruct:
-    case IrOpcode::kJSConstructWithArrayLike:
-    case IrOpcode::kJSConstructWithSpread:
+    case IrOpcode::kJSCreateObject:
+    case IrOpcode::kJSCreatePromise:
+    case IrOpcode::kJSCreateStringIterator:
+    case IrOpcode::kJSCreateTypedArray:
+    case IrOpcode::kJSGetSuperConstructor:
     case IrOpcode::kJSToName:
-    case IrOpcode::kJSToString:
     case IrOpcode::kJSToObject:
+    case IrOpcode::kJSToString:
     case IrOpcode::kTypeOf:
-    case IrOpcode::kJSGetSuperConstructor:
       return false;
     case IrOpcode::kPhi: {
       Node* control = NodeProperties::GetControlInput(receiver);