[turbofan] More JSCallReducer brokerization.

Bug: v8:7790
Change-Id: Ida292949c2a7f39726941ac4540569bf82487a3b
Reviewed-on: https://chromium-review.googlesource.com/c/1314334Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57209}

src/compiler/js-call-reducer.cc

@@ -577,15 +577,16 @@ Reduction JSCallReducer::ReduceObjectGetPrototype(Node* node, Node* object) {
   NodeProperties::InferReceiverMapsResult result =
       NodeProperties::InferReceiverMaps(broker(), object, effect, &object_maps);
   if (result != NodeProperties::kNoReceiverMaps) {
-    Handle<Map> candidate_map = object_maps[0];
-    Handle<Object> candidate_prototype(candidate_map->prototype(), isolate());
+    MapRef candidate_map(broker(), object_maps[0]);
+    candidate_map.SerializePrototype();
+    ObjectRef candidate_prototype = candidate_map.prototype();
 
     // Check if we can constant-fold the {candidate_prototype}.
     for (size_t i = 0; i < object_maps.size(); ++i) {
-      Handle<Map> object_map = object_maps[i];
-      if (object_map->IsSpecialReceiverMap() ||
-          object_map->has_hidden_prototype() ||
-          object_map->prototype() != *candidate_prototype) {
+      MapRef object_map(broker(), object_maps[i]);
+      if (IsSpecialReceiverInstanceType(object_map.instance_type()) ||
+          object_map.has_hidden_prototype() ||
+          object_map.prototype().equals(candidate_prototype)) {
         // We exclude special receivers, like JSProxy or API objects that
         // might require access checks here; we also don't want to deal
         // with hidden prototypes at this point.
@@ -593,9 +594,9 @@ Reduction JSCallReducer::ReduceObjectGetPrototype(Node* node, Node* object) {
       }
       // The above check also excludes maps for primitive values, which is
       // important because we are not applying [[ToObject]] here as expected.
-      DCHECK(!object_map->IsPrimitiveMap() && object_map->IsJSReceiverMap());
+      DCHECK(!object_map.IsPrimitiveMap() && object_map.IsJSReceiverMap());
       if (result == NodeProperties::kUnreliableReceiverMaps &&
-          !object_map->is_stable()) {
+          !object_map.is_stable()) {
         return NoChange();
       }
     }
@@ -3058,10 +3059,15 @@ Reduction JSCallReducer::ReduceCallOrConstructWithArrayLikeOrSpread(
   Node* frame_state = NodeProperties::GetFrameStateInput(arguments_list);
   FrameStateInfo state_info = FrameStateInfoOf(frame_state->op());
   int start_index = 0;
-  // Determine the formal parameter count;
-  Handle<SharedFunctionInfo> shared;
-  if (!state_info.shared_info().ToHandle(&shared)) return NoChange();
-  int formal_parameter_count = shared->internal_formal_parameter_count();
+
+  int formal_parameter_count;
+  {
+    Handle<SharedFunctionInfo> shared;
+    if (!state_info.shared_info().ToHandle(&shared)) return NoChange();
+    formal_parameter_count = SharedFunctionInfoRef(broker(), shared)
+                                 .internal_formal_parameter_count();
+  }
+
   if (type == CreateArgumentsType::kMappedArguments) {
     // Mapped arguments (sloppy mode) that are aliased can only be handled
     // here if there's no side-effect between the {node} and the {arg_array}.

src/compiler/js-heap-broker.cc

@@ -2079,6 +2079,8 @@ BIMODAL_ACCESSOR_B(Map, bit_field3, is_deprecated, Map::IsDeprecatedBit)
 BIMODAL_ACCESSOR_B(Map, bit_field3, is_dictionary_map, Map::IsDictionaryMapBit)
 BIMODAL_ACCESSOR_B(Map, bit_field3, NumberOfOwnDescriptors,
                    Map::NumberOfOwnDescriptorsBits)
+BIMODAL_ACCESSOR_B(Map, bit_field3, has_hidden_prototype,
+                   Map::HasHiddenPrototypeBit)
 BIMODAL_ACCESSOR_B(Map, bit_field, has_prototype_slot, Map::HasPrototypeSlotBit)
 BIMODAL_ACCESSOR_B(Map, bit_field, is_access_check_needed,
                    Map::IsAccessCheckNeededBit)

src/compiler/js-heap-broker.h

@@ -400,6 +400,7 @@ class MapRef : public HeapObjectRef {
   bool IsPrimitiveMap() const;
   bool is_undetectable() const;
   bool is_callable() const;
+  bool has_hidden_prototype() const;
 
 #define DEF_TESTER(Type, ...) bool Is##Type##Map() const;
   INSTANCE_TYPE_CHECKERS(DEF_TESTER)