[turbofan] Brokerize JSInliner

Bug: v8:7790
Change-Id: I9d1853a65ad5430e5bc38727ebf9fcd6aa40c819
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1599605
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61386}

src/compiler/js-create-lowering.cc

@@ -901,7 +901,7 @@ Reduction JSCreateLowering::ReduceJSCreateClosure(Node* node) {
   DCHECK_EQ(IrOpcode::kJSCreateClosure, node->opcode());
   CreateClosureParameters const& p = CreateClosureParametersOf(node->op());
   SharedFunctionInfoRef shared(broker(), p.shared_info());
-  HeapObjectRef feedback_cell(broker(), p.feedback_cell());
+  FeedbackCellRef feedback_cell(broker(), p.feedback_cell());
   HeapObjectRef code(broker(), p.code());
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);

src/compiler/js-heap-broker.cc

@@ -1107,6 +1107,22 @@ class DescriptorArrayData : public HeapObjectData {
   ZoneVector<PropertyDescriptor> contents_;
 };
 
+class FeedbackCellData : public HeapObjectData {
+ public:
+  FeedbackCellData(JSHeapBroker* broker, ObjectData** storage,
+                   Handle<FeedbackCell> object);
+
+  HeapObjectData* value() const { return value_; }
+
+ private:
+  HeapObjectData* const value_;
+};
+
+FeedbackCellData::FeedbackCellData(JSHeapBroker* broker, ObjectData** storage,
+                                   Handle<FeedbackCell> object)
+    : HeapObjectData(broker, storage, object),
+      value_(broker->GetOrCreateData(object->value())->AsHeapObject()) {}
+
 class FeedbackVectorData : public HeapObjectData {
  public:
   const ZoneVector<ObjectData*>& feedback() { return feedback_; }
@@ -2663,6 +2679,8 @@ BROKER_SFI_FIELDS(DEF_SFI_ACCESSOR)
 
 BIMODAL_ACCESSOR_C(String, int, length)
 
+BIMODAL_ACCESSOR(FeedbackCell, HeapObject, value)
+
 void* JSTypedArrayRef::elements_external_pointer() const {
   if (broker()->mode() == JSHeapBroker::kDisabled) {
     AllowHandleDereference allow_handle_dereference;

src/compiler/js-heap-broker.h

@@ -78,6 +78,7 @@ enum class OddballType : uint8_t {
   V(Cell)                          \
   V(Code)                          \
   V(DescriptorArray)               \
+  V(FeedbackCell)                  \
   V(FeedbackVector)                \
   V(FixedArrayBase)                \
   V(FunctionTemplateInfo)          \
@@ -405,6 +406,14 @@ class DescriptorArrayRef : public HeapObjectRef {
   Handle<DescriptorArray> object() const;
 };
 
+class FeedbackCellRef : public HeapObjectRef {
+ public:
+  using HeapObjectRef::HeapObjectRef;
+  Handle<FeedbackCell> object() const;
+
+  HeapObjectRef value() const;
+};
+
 class FeedbackVectorRef : public HeapObjectRef {
  public:
   using HeapObjectRef::HeapObjectRef;
@@ -595,7 +604,8 @@ class ScopeInfoRef : public HeapObjectRef {
   V(bool, construct_as_builtin)              \
   V(bool, HasBytecodeArray)                  \
   V(bool, is_safe_to_skip_arguments_adaptor) \
-  V(bool, IsInlineable)
+  V(bool, IsInlineable)                      \
+  V(bool, is_compiled)
 
 class V8_EXPORT_PRIVATE SharedFunctionInfoRef : public HeapObjectRef {
  public:

src/compiler/js-heap-copy-reducer.cc

@@ -64,7 +64,7 @@ Reduction JSHeapCopyReducer::Reduce(Node* node) {
     case IrOpcode::kJSCreateClosure: {
       CreateClosureParameters const& p = CreateClosureParametersOf(node->op());
       SharedFunctionInfoRef(broker(), p.shared_info());
-      HeapObjectRef(broker(), p.feedback_cell());
+      FeedbackCellRef(broker(), p.feedback_cell());
       HeapObjectRef(broker(), p.code());
       break;
     }

src/compiler/js-inlining.h

@@ -51,7 +51,6 @@ class JSInliner final : public AdvancedReducer {
   // TODO(neis): Make heap broker a component of JSGraph?
   JSHeapBroker* broker() const { return broker_; }
   Isolate* isolate() const { return jsgraph_->isolate(); }
-  Handle<Context> native_context() const;
 
   Zone* const local_zone_;
   OptimizedCompilationInfo* info_;
@@ -59,15 +58,13 @@ class JSInliner final : public AdvancedReducer {
   JSHeapBroker* const broker_;
   SourcePositionTable* const source_positions_;
 
-  bool DetermineCallTarget(Node* node,
-                           Handle<SharedFunctionInfo>& shared_info_out);
-  void DetermineCallContext(Node* node, Node*& context_out,
-                            Handle<FeedbackVector>& feedback_vector_out);
+  base::Optional<SharedFunctionInfoRef> DetermineCallTarget(Node* node);
+  FeedbackVectorRef DetermineCallContext(Node* node, Node*& context_out);
 
   Node* CreateArtificialFrameState(Node* node, Node* outer_frame_state,
                                    int parameter_count, BailoutId bailout_id,
                                    FrameStateType frame_state_type,
-                                   Handle<SharedFunctionInfo> shared,
+                                   SharedFunctionInfoRef shared,
                                    Node* context = nullptr);
 
   Reduction InlineCall(Node* call, Node* new_target, Node* context,

src/compiler/map-inference.cc

@@ -65,14 +65,19 @@ bool MapInference::AllOfInstanceTypes(std::function<bool(InstanceType)> f) {
 
 bool MapInference::AllOfInstanceTypesUnsafe(
     std::function<bool(InstanceType)> f) const {
+  // TODO(neis): Brokerize the MapInference.
+  AllowHandleDereference allow_handle_deref;
   CHECK(HaveMaps());
+
   return std::all_of(maps_.begin(), maps_.end(),
                      [f](Handle<Map> map) { return f(map->instance_type()); });
 }
 
 bool MapInference::AnyOfInstanceTypesUnsafe(
     std::function<bool(InstanceType)> f) const {
+  AllowHandleDereference allow_handle_deref;
   CHECK(HaveMaps());
+
   return std::any_of(maps_.begin(), maps_.end(),
                      [f](Handle<Map> map) { return f(map->instance_type()); });
 }

src/compiler/serializer-for-background-compilation.cc

@@ -438,7 +438,9 @@ void SerializerForBackgroundCompilation::VisitCreateClosure(
   Handle<FeedbackCell> feedback_cell =
       environment()->function().feedback_vector->GetClosureFeedbackCell(
           iterator->GetIndexOperand(1));
+  FeedbackCellRef feedback_cell_ref(broker(), feedback_cell);
   Handle<Object> cell_value(feedback_cell->value(), broker()->isolate());
+  ObjectRef cell_value_ref(broker(), cell_value);
 
   environment()->accumulator_hints().Clear();
   if (cell_value->IsFeedbackVector()) {

src/optimized-compilation-info.cc

@@ -239,7 +239,6 @@ OptimizedCompilationInfo::InlinedFunctionHolder::InlinedFunctionHolder(
     Handle<SharedFunctionInfo> inlined_shared_info,
     Handle<BytecodeArray> inlined_bytecode, SourcePosition pos)
     : shared_info(inlined_shared_info), bytecode_array(inlined_bytecode) {
-  DCHECK_EQ(shared_info->GetBytecodeArray(), *bytecode_array);
   position.position = pos;
   // initialized when generating the deoptimization literals
   position.inlined_function_id = DeoptimizationData::kNotInlinedIndex;