[compiler] Use MakeRef for a few types

This is part of a CL series that establishes MakeRef/TryMakeRef as
the bottleneck for Ref construction. We do this by converting direct
constructor uses to (Try)MakeRef calls, and then marking the ctor
as protected.

Bug: v8:7790
Change-Id: I36c07f69378f3a630462c216ef5da284cfd3972f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2871449
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74367}

src/compiler/compilation-dependencies.cc

@@ -580,38 +580,38 @@ bool CompilationDependencies::DependOnProtector(const PropertyCellRef& cell) {
 }
 
 bool CompilationDependencies::DependOnArrayBufferDetachingProtector() {
-  return DependOnProtector(PropertyCellRef(
+  return DependOnProtector(MakeRef(
       broker_,
       broker_->isolate()->factory()->array_buffer_detaching_protector()));
 }
 
 bool CompilationDependencies::DependOnArrayIteratorProtector() {
-  return DependOnProtector(PropertyCellRef(
+  return DependOnProtector(MakeRef(
       broker_, broker_->isolate()->factory()->array_iterator_protector()));
 }
 
 bool CompilationDependencies::DependOnArraySpeciesProtector() {
-  return DependOnProtector(PropertyCellRef(
+  return DependOnProtector(MakeRef(
       broker_, broker_->isolate()->factory()->array_species_protector()));
 }
 
 bool CompilationDependencies::DependOnNoElementsProtector() {
-  return DependOnProtector(PropertyCellRef(
-      broker_, broker_->isolate()->factory()->no_elements_protector()));
+  return DependOnProtector(
+      MakeRef(broker_, broker_->isolate()->factory()->no_elements_protector()));
 }
 
 bool CompilationDependencies::DependOnPromiseHookProtector() {
-  return DependOnProtector(PropertyCellRef(
+  return DependOnProtector(MakeRef(
       broker_, broker_->isolate()->factory()->promise_hook_protector()));
 }
 
 bool CompilationDependencies::DependOnPromiseSpeciesProtector() {
-  return DependOnProtector(PropertyCellRef(
+  return DependOnProtector(MakeRef(
       broker_, broker_->isolate()->factory()->promise_species_protector()));
 }
 
 bool CompilationDependencies::DependOnPromiseThenProtector() {
-  return DependOnProtector(PropertyCellRef(
+  return DependOnProtector(MakeRef(
       broker_, broker_->isolate()->factory()->promise_then_protector()));
 }
 

src/compiler/heap-refs.cc

@@ -2120,7 +2120,7 @@ base::Optional<PropertyCellRef> GetPropertyCellFromHeap(JSHeapBroker* broker,
   it.TryLookupCachedProperty();
   if (it.state() == LookupIterator::DATA &&
       it.GetHolder<JSObject>()->IsJSGlobalObject()) {
-    return PropertyCellRef(broker, it.GetPropertyCell());
+    return MakeRef(broker, it.GetPropertyCell());
   }
   return base::nullopt;
 }
@@ -3235,8 +3235,9 @@ int BytecodeArrayRef::handler_table_size() const {
 
 #define IF_ACCESS_FROM_HEAP(result, name)                                      \
   if (data_->should_access_heap()) {                                           \
-    return result##Ref(broker(),                                               \
-                       broker()->CanonicalPersistentHandle(object()->name())); \
+    return MakeRef(                                                            \
+        broker(), Handle<result>::cast(                                        \
+                      broker()->CanonicalPersistentHandle(object()->name()))); \
   }
 
 // Macros for definining a const getter that, depending on the data kind,
@@ -3265,8 +3266,9 @@ int BytecodeArrayRef::handler_table_size() const {
 // kSerialized only for methods that we identified to be safe.
 #define IF_ACCESS_FROM_HEAP_WITH_FLAG(result, name)                            \
   if (data_->should_access_heap() || broker()->is_concurrent_inlining()) {     \
-    return result##Ref(broker(),                                               \
-                       broker()->CanonicalPersistentHandle(object()->name())); \
+    return MakeRef(                                                            \
+        broker(), Handle<result>::cast(                                        \
+                      broker()->CanonicalPersistentHandle(object()->name()))); \
   }
 #define IF_ACCESS_FROM_HEAP_WITH_FLAG_C(name)                              \
   if (data_->should_access_heap() || broker()->is_concurrent_inlining()) { \
@@ -3385,8 +3387,9 @@ base::Optional<CallHandlerInfoRef> FunctionTemplateInfoRef::call_code() const {
   if (data_->should_access_heap()) {
     HeapObject call_code = object()->call_code(kAcquireLoad);
     if (call_code.IsUndefined()) return base::nullopt;
-    return CallHandlerInfoRef(broker(),
-                              broker()->CanonicalPersistentHandle(call_code));
+    return MakeRef(broker(),
+                   Handle<CallHandlerInfo>::cast(
+                       broker()->CanonicalPersistentHandle(call_code)));
   }
   ObjectData* call_code = data()->AsFunctionTemplateInfo()->call_code();
   if (!call_code) return base::nullopt;
@@ -3497,7 +3500,7 @@ HolderLookupResult FunctionTemplateInfoRef::LookupHolderOfExpectedType(
 
   switch (result.lookup) {
     case CallOptimization::kHolderFound: {
-      result.holder = JSObjectRef(broker(), holder);
+      result.holder = MakeRef(broker(), holder);
       fti_data->known_receivers().insert({receiver_map.data(), result});
       break;
     }
@@ -3525,8 +3528,8 @@ BytecodeArrayRef SharedFunctionInfoRef::GetBytecodeArray() const {
     } else {
       bytecode_array = object()->GetBytecodeArray(broker()->isolate());
     }
-    return BytecodeArrayRef(
-        broker(), broker()->CanonicalPersistentHandle(bytecode_array));
+    return MakeRef(broker(),
+                   broker()->CanonicalPersistentHandle(bytecode_array));
   }
   return BytecodeArrayRef(
       broker(), ObjectRef ::data()->AsSharedFunctionInfo()->GetBytecodeArray());
@@ -3574,10 +3577,9 @@ base::Optional<ObjectRef> MapRef::GetStrongValue(
 
 DescriptorArrayRef MapRef::instance_descriptors() const {
   if (data_->should_access_heap() || broker()->is_concurrent_inlining()) {
-    return DescriptorArrayRef(
-        broker(),
-        broker()->CanonicalPersistentHandle(
-            object()->instance_descriptors(broker()->isolate(), kRelaxedLoad)));
+    return MakeRef(broker(), broker()->CanonicalPersistentHandle(
+                                 object()->instance_descriptors(
+                                     broker()->isolate(), kRelaxedLoad)));
   }
 
   return DescriptorArrayRef(broker(), data()->AsMap()->instance_descriptors());
@@ -3640,9 +3642,9 @@ HeapObjectRef JSTypedArrayRef::buffer() const {
     // Safe to read concurrently because:
     // - immutable after initialization.
     // - host object seen by serializer.
-    Handle<JSArrayBuffer> value =
+    Handle<HeapObject> value =
         broker()->CanonicalPersistentHandle(object()->buffer());
-    return JSObjectRef{broker(), value};
+    return MakeRef(broker(), value);
   }
   return HeapObjectRef{broker(), data()->AsJSTypedArray()->buffer()};
 }
@@ -3743,17 +3745,16 @@ bool NativeContextRef::is_unserialized_heap_object() const {
 
 ScopeInfoRef NativeContextRef::scope_info() const {
   if (data_->should_access_heap()) {
-    return ScopeInfoRef(
-        broker(), broker()->CanonicalPersistentHandle(object()->scope_info()));
+    return MakeRef(broker(),
+                   broker()->CanonicalPersistentHandle(object()->scope_info()));
   }
   return ScopeInfoRef(broker(), data()->AsNativeContext()->scope_info());
 }
 
 SharedFunctionInfoRef FeedbackVectorRef::shared_function_info() const {
   if (data_->should_access_heap()) {
-    return SharedFunctionInfoRef(
-        broker(),
-        broker()->CanonicalPersistentHandle(object()->shared_function_info()));
+    return MakeRef(broker(), broker()->CanonicalPersistentHandle(
+                                 object()->shared_function_info()));
   }
 
   return SharedFunctionInfoRef(
@@ -4007,7 +4008,7 @@ base::Optional<ObjectRef> JSArrayRef::GetOwnCowElement(
 
 base::Optional<CellRef> SourceTextModuleRef::GetCell(int cell_index) const {
   if (data_->should_access_heap() || broker()->is_concurrent_inlining()) {
-    return CellRef(broker(), broker()->CanonicalPersistentHandle(
+    return MakeRef(broker(), broker()->CanonicalPersistentHandle(
                                  object()->GetCell(cell_index)));
   }
   ObjectData* cell =
@@ -4018,7 +4019,7 @@ base::Optional<CellRef> SourceTextModuleRef::GetCell(int cell_index) const {
 
 ObjectRef SourceTextModuleRef::import_meta() const {
   if (data_->should_access_heap()) {
-    return ObjectRef(
+    return MakeRef(
         broker(), broker()->CanonicalPersistentHandle(object()->import_meta()));
   }
   return ObjectRef(broker(),
@@ -4084,8 +4085,8 @@ HeapObjectType HeapObjectRef::GetHeapObjectType() const {
 }
 base::Optional<JSObjectRef> AllocationSiteRef::boilerplate() const {
   if (data_->should_access_heap()) {
-    return JSObjectRef(broker(), broker()->CanonicalPersistentHandle(
-                                     object()->boilerplate(kAcquireLoad)));
+    return MakeRef(broker(), broker()->CanonicalPersistentHandle(
+                                 object()->boilerplate(kAcquireLoad)));
   }
   ObjectData* boilerplate = data()->AsAllocationSite()->boilerplate();
   if (boilerplate) {
@@ -4101,8 +4102,8 @@ ElementsKind JSObjectRef::GetElementsKind() const {
 
 base::Optional<FixedArrayBaseRef> JSObjectRef::elements() const {
   if (data_->should_access_heap()) {
-    return FixedArrayBaseRef(
-        broker(), broker()->CanonicalPersistentHandle(object()->elements()));
+    return MakeRef(broker(),
+                   broker()->CanonicalPersistentHandle(object()->elements()));
   }
   const JSObjectData* d = data()->AsJSObject();
   if (!d->serialized_elements()) {
@@ -4128,8 +4129,8 @@ PropertyDetails DescriptorArrayRef::GetPropertyDetails(
 NameRef DescriptorArrayRef::GetPropertyKey(
     InternalIndex descriptor_index) const {
   if (data_->should_access_heap()) {
-    NameRef result(broker(), broker()->CanonicalPersistentHandle(
-                                 object()->GetKey(descriptor_index)));
+    NameRef result = MakeRef(broker(), broker()->CanonicalPersistentHandle(
+                                           object()->GetKey(descriptor_index)));
     CHECK(result.IsUniqueName());
     return result;
   }
@@ -4407,8 +4408,8 @@ int SharedFunctionInfoRef::context_header_size() const {
 
 ScopeInfoRef SharedFunctionInfoRef::scope_info() const {
   if (data_->should_access_heap()) {
-    return ScopeInfoRef(
-        broker(), broker()->CanonicalPersistentHandle(object()->scope_info()));
+    return MakeRef(broker(),
+                   broker()->CanonicalPersistentHandle(object()->scope_info()));
   }
   return ScopeInfoRef(broker(), data()->AsSharedFunctionInfo()->scope_info());
 }
@@ -4493,8 +4494,9 @@ void JSTypedArrayRef::Serialize() {
     static_assert(
         std::is_base_of<JSObject, decltype(object()->buffer())>::value, "");
     STATIC_ASSERT(IsSerializedRef<JSObject>());
-    JSObjectRef data_ref{
-        broker(), broker()->CanonicalPersistentHandle(object()->buffer())};
+    MakeRef(broker(),
+            Handle<JSObject>::cast(
+                broker()->CanonicalPersistentHandle(object()->buffer())));
   } else {
     CHECK_EQ(broker()->mode(), JSHeapBroker::kSerializing);
     data()->AsJSTypedArray()->Serialize(broker());

src/compiler/js-call-reducer.cc

@@ -2644,8 +2644,8 @@ Reduction JSCallReducer::ReduceFunctionPrototypeBind(Node* node) {
       return inference.NoChange();
     }
     ReadOnlyRoots roots(isolate());
-    StringRef length_string(broker(), roots.length_string_handle());
-    StringRef name_string(broker(), roots.name_string_handle());
+    StringRef length_string = MakeRef(broker(), roots.length_string_handle());
+    StringRef name_string = MakeRef(broker(), roots.name_string_handle());
 
     base::Optional<ObjectRef> length_value(
         receiver_map.GetStrongValue(kLengthIndex));
@@ -4182,7 +4182,7 @@ Reduction JSCallReducer::ReduceJSCall(Node* node) {
     CreateClosureParameters const& p = JSCreateClosureNode{target}.Parameters();
     return ReduceJSCall(node, SharedFunctionInfoRef(broker(), p.shared_info()));
   } else if (target->opcode() == IrOpcode::kCheckClosure) {
-    FeedbackCellRef cell(broker(), FeedbackCellOf(target->op()));
+    FeedbackCellRef cell = MakeRef(broker(), FeedbackCellOf(target->op()));
     if (cell.shared_function_info().has_value()) {
       return ReduceJSCall(node, *cell.shared_function_info());
     } else {
@@ -4266,8 +4266,8 @@ Reduction JSCallReducer::ReduceJSCall(Node* node) {
     // Try to further reduce the JSCall {node}.
     return Changed(node).FollowedBy(ReduceJSCall(node));
   } else if (feedback_target.has_value() && feedback_target->IsFeedbackCell()) {
-    FeedbackCellRef feedback_cell(
-        broker(), feedback_target.value().AsFeedbackCell().object());
+    FeedbackCellRef feedback_cell =
+        MakeRef(broker(), feedback_target.value().AsFeedbackCell().object());
     if (feedback_cell.value().has_value()) {
       // Check that {target} is a closure with given {feedback_cell},
       // which uniquely identifies a given function inside a native context.
@@ -7741,7 +7741,7 @@ Reduction JSCallReducer::ReduceRegExpPrototypeTest(Node* node) {
     for (auto map : regexp_maps) {
       MapRef map_ref(broker(), map);
       PropertyAccessInfo access_info = broker()->GetPropertyAccessInfo(
-          map_ref, NameRef(broker(), isolate()->factory()->exec_string()),
+          map_ref, MakeRef(broker(), isolate()->factory()->exec_string()),
           AccessMode::kLoad, dependencies());
       access_infos.push_back(access_info);
     }
@@ -7763,7 +7763,7 @@ Reduction JSCallReducer::ReduceRegExpPrototypeTest(Node* node) {
     // Do not reduce if the exec method is not on the prototype chain.
     if (!ai_exec.holder().ToHandle(&holder)) return inference.NoChange();
 
-    JSObjectRef holder_ref(broker(), holder);
+    JSObjectRef holder_ref = MakeRef(broker(), holder);
 
     // Bail out if the exec method is not the original one.
     base::Optional<ObjectRef> constant = holder_ref.GetOwnFastDataProperty(
@@ -7776,7 +7776,7 @@ Reduction JSCallReducer::ReduceRegExpPrototypeTest(Node* node) {
     // Add proper dependencies on the {regexp}s [[Prototype]]s.
     dependencies()->DependOnStablePrototypeChains(
         ai_exec.lookup_start_object_maps(), kStartAtPrototype,
-        JSObjectRef(broker(), holder));
+        MakeRef(broker(), holder));
   } else {
     // TODO(v8:11457) Support dictionary mode protoypes here.
     return inference.NoChange();

src/compiler/js-context-specialization.cc

@@ -40,7 +40,7 @@ Reduction JSContextSpecialization::ReduceParameter(Node* node) {
     // Constant-fold the function parameter {node}.
     Handle<JSFunction> function;
     if (closure().ToHandle(&function)) {
-      Node* value = jsgraph()->Constant(JSFunctionRef(broker_, function));
+      Node* value = jsgraph()->Constant(MakeRef(broker_, function));
       return Replace(value);
     }
   }
@@ -103,7 +103,7 @@ base::Optional<ContextRef> GetSpecializationContext(
     Maybe<OuterContext> maybe_outer) {
   switch (node->opcode()) {
     case IrOpcode::kHeapConstant: {
-      HeapObjectRef object(broker, HeapConstantOf(node->op()));
+      HeapObjectRef object = MakeRef(broker, HeapConstantOf(node->op()));
       if (object.IsContext()) return object.AsContext();
       break;
     }
@@ -112,7 +112,7 @@ base::Optional<ContextRef> GetSpecializationContext(
       if (maybe_outer.To(&outer) && IsContextParameter(node) &&
           *distance >= outer.distance) {
         *distance -= outer.distance;
-        return ContextRef(broker, outer.context);
+        return MakeRef(broker, outer.context);
       }
       break;
     }
@@ -231,7 +231,7 @@ base::Optional<ContextRef> GetModuleContext(JSHeapBroker* broker, Node* node,
 
   switch (context->opcode()) {
     case IrOpcode::kHeapConstant: {
-      HeapObjectRef object(broker, HeapConstantOf(context->op()));
+      HeapObjectRef object = MakeRef(broker, HeapConstantOf(context->op()));
       if (object.IsContext()) {
         return find_context(object.AsContext());
       }
@@ -240,7 +240,7 @@ base::Optional<ContextRef> GetModuleContext(JSHeapBroker* broker, Node* node,
     case IrOpcode::kParameter: {
       OuterContext outer;
       if (maybe_context.To(&outer) && IsContextParameter(context)) {
-        return find_context(ContextRef(broker, outer.context));
+        return find_context(MakeRef(broker, outer.context));
       }
       break;
     }

src/compiler/js-create-lowering.cc

@@ -622,7 +622,7 @@ Reduction JSCreateLowering::ReduceJSCreateArray(Node* node) {
   {
     Handle<AllocationSite> site;
     if (p.site().ToHandle(&site)) {
-      site_ref = AllocationSiteRef(broker(), site);
+      site_ref = MakeRef(broker(), site);
     }
   }
   AllocationType allocation = AllocationType::kYoung;
@@ -650,8 +650,8 @@ Reduction JSCreateLowering::ReduceJSCreateArray(Node* node) {
     allocation = dependencies()->DependOnPretenureMode(*site_ref);
     dependencies()->DependOnElementsKind(*site_ref);
   } else {
-    PropertyCellRef array_constructor_protector(
-        broker(), factory()->array_constructor_protector());
+    PropertyCellRef array_constructor_protector =
+        MakeRef(broker(), factory()->array_constructor_protector());
     array_constructor_protector.SerializeAsProtector();
     can_inline_call = array_constructor_protector.value().AsSmi() ==
                       Protectors::kProtectorValid;
@@ -922,7 +922,7 @@ Reduction JSCreateLowering::ReduceJSCreateClosure(Node* node) {
   CreateClosureParameters const& p = n.Parameters();
   SharedFunctionInfoRef shared(broker(), p.shared_info());
   FeedbackCellRef feedback_cell = n.GetFeedbackCellRefChecked(broker());
-  HeapObjectRef code(broker(), p.code());
+  HeapObjectRef code = MakeRef(broker(), p.code());
   Effect effect = n.effect();
   Control control = n.control();
   Node* context = n.context();
@@ -1212,7 +1212,7 @@ Reduction JSCreateLowering::ReduceJSCreateFunctionContext(Node* node) {
   DCHECK_EQ(IrOpcode::kJSCreateFunctionContext, node->opcode());
   const CreateFunctionContextParameters& parameters =
       CreateFunctionContextParametersOf(node->op());
-  ScopeInfoRef scope_info(broker(), parameters.scope_info());
+  ScopeInfoRef scope_info = MakeRef(broker(), parameters.scope_info());
   int slot_count = parameters.slot_count();
   ScopeType scope_type = parameters.scope_type();
 
@@ -1252,7 +1252,7 @@ Reduction JSCreateLowering::ReduceJSCreateFunctionContext(Node* node) {
 
 Reduction JSCreateLowering::ReduceJSCreateWithContext(Node* node) {
   DCHECK_EQ(IrOpcode::kJSCreateWithContext, node->opcode());
-  ScopeInfoRef scope_info(broker(), ScopeInfoOf(node->op()));
+  ScopeInfoRef scope_info = MakeRef(broker(), ScopeInfoOf(node->op()));
   Node* extension = NodeProperties::GetValueInput(node, 0);
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
@@ -1273,7 +1273,7 @@ Reduction JSCreateLowering::ReduceJSCreateWithContext(Node* node) {
 
 Reduction JSCreateLowering::ReduceJSCreateCatchContext(Node* node) {
   DCHECK_EQ(IrOpcode::kJSCreateCatchContext, node->opcode());
-  ScopeInfoRef scope_info(broker(), ScopeInfoOf(node->op()));
+  ScopeInfoRef scope_info = MakeRef(broker(), ScopeInfoOf(node->op()));
   Node* exception = NodeProperties::GetValueInput(node, 0);
   Node* effect = NodeProperties::GetEffectInput(node);
   Node* control = NodeProperties::GetControlInput(node);
@@ -1294,7 +1294,7 @@ Reduction JSCreateLowering::ReduceJSCreateCatchContext(Node* node) {
 
 Reduction JSCreateLowering::ReduceJSCreateBlockContext(Node* node) {
   DCHECK_EQ(IrOpcode::kJSCreateBlockContext, node->opcode());
-  ScopeInfoRef scope_info(broker(), ScopeInfoOf(node->op()));
+  ScopeInfoRef scope_info = MakeRef(broker(), ScopeInfoOf(node->op()));
   int const context_length = scope_info.ContextLength();
 
   // Use inline allocation for block contexts up to a size limit.

src/compiler/js-generic-lowering.cc

@@ -717,7 +717,7 @@ void JSGenericLowering::LowerJSGetTemplateObject(Node* node) {
   JSGetTemplateObjectNode n(node);
   GetTemplateObjectParameters const& p = n.Parameters();
   SharedFunctionInfoRef shared(broker(), p.shared());
-  TemplateObjectDescriptionRef description(broker(), p.description());
+  TemplateObjectDescriptionRef description = MakeRef(broker(), p.description());
 
   DCHECK_EQ(node->op()->ControlInputCount(), 1);
   node->RemoveInput(NodeProperties::FirstControlIndex(node));

src/compiler/js-heap-broker.cc

@@ -14,6 +14,7 @@
 #include "src/ic/handler-configuration.h"
 #include "src/init/bootstrapper.h"
 #include "src/objects/feedback-cell.h"
+#include "src/objects/js-array-inl.h"
 #include "src/objects/objects-inl.h"
 #include "src/objects/oddball.h"
 #include "src/objects/property-cell.h"
@@ -142,7 +143,7 @@ void JSHeapBroker::SetTargetNativeContextRef(
           target_native_context_->object().equals(native_context) &&
           target_native_context_->is_unserialized_heap_object()));
   target_native_context_ =
-      NativeContextRef(this, CanonicalPersistentHandle(*native_context));
+      MakeRef(this, CanonicalPersistentHandle(*native_context));
 }
 
 void JSHeapBroker::CollectArrayAndObjectPrototypes() {
@@ -169,7 +170,7 @@ StringRef JSHeapBroker::GetTypedArrayStringTag(ElementsKind kind) {
   switch (kind) {
 #define TYPED_ARRAY_STRING_TAG(Type, type, TYPE, ctype) \
   case ElementsKind::TYPE##_ELEMENTS:                   \
-    return StringRef(this, isolate()->factory()->Type##Array_string());
+    return MakeRef(this, isolate()->factory()->Type##Array_string());
     TYPED_ARRAYS(TYPED_ARRAY_STRING_TAG)
 #undef TYPED_ARRAY_STRING_TAG
     default:
@@ -691,12 +692,12 @@ ProcessedFeedback const& JSHeapBroker::ReadFeedbackForGlobalAccess(
         isolate(), target_native_context().script_context_table().object(),
         script_context_index);
     {
-      ObjectRef contents(this,
-                         handle(context->get(context_slot_index), isolate()));
+      ObjectRef contents =
+          MakeRef(this, handle(context->get(context_slot_index), isolate()));
       CHECK(!contents.equals(
-          ObjectRef(this, isolate()->factory()->the_hole_value())));
+          MakeRef<Object>(this, isolate()->factory()->the_hole_value())));
     }
-    ContextRef context_ref(this, context);
+    ContextRef context_ref = MakeRef(this, context);
     if (immutable) {
       context_ref.get(context_slot_index,
                       SerializationPolicy::kSerializeIfNeeded);
@@ -708,11 +709,11 @@ ProcessedFeedback const& JSHeapBroker::ReadFeedbackForGlobalAccess(
   CHECK(feedback_value->IsPropertyCell());
   // The wanted name belongs (or did belong) to a property on the global
   // object and the feedback is the cell holding its value.
-  PropertyCellRef cell(this, Handle<PropertyCell>::cast(feedback_value));
-  ObjectRef(
-      this,
-      CanonicalPersistentHandle(
-          Handle<PropertyCell>::cast(feedback_value)->value(kAcquireLoad)));
+  PropertyCellRef cell =
+      MakeRef(this, Handle<PropertyCell>::cast(feedback_value));
+  MakeRef(this,
+          CanonicalPersistentHandle(
+              Handle<PropertyCell>::cast(feedback_value)->value(kAcquireLoad)));
   return *zone()->New<GlobalAccessFeedback>(cell, nexus.kind());
 }
 
@@ -753,7 +754,7 @@ ProcessedFeedback const& JSHeapBroker::ReadFeedbackForInstanceOf(
     MaybeHandle<JSObject> maybe_constructor = nexus.GetConstructorFeedback();
     Handle<JSObject> constructor;
     if (maybe_constructor.ToHandle(&constructor)) {
-      optional_constructor = JSObjectRef(this, constructor);
+      optional_constructor = MakeRef(this, constructor);
     }
   }
   return *zone()->New<InstanceOfFeedback>(optional_constructor, nexus.kind());
@@ -769,7 +770,8 @@ ProcessedFeedback const& JSHeapBroker::ReadFeedbackForArrayOrObjectLiteral(
     return NewInsufficientFeedback(nexus.kind());
   }
 
-  AllocationSiteRef site(this, handle(object, isolate()));
+  AllocationSiteRef site =
+      MakeRef(this, handle(AllocationSite::cast(object), isolate()));
   if (site.IsFastLiteral()) {
     site.SerializeBoilerplate();
   }
@@ -787,7 +789,8 @@ ProcessedFeedback const& JSHeapBroker::ReadFeedbackForRegExpLiteral(
     return NewInsufficientFeedback(nexus.kind());
   }
 
-  RegExpBoilerplateDescriptionRef boilerplate(this, handle(object, isolate()));
+  RegExpBoilerplateDescriptionRef boilerplate = MakeRef(
+      this, handle(RegExpBoilerplateDescription::cast(object), isolate()));
   boilerplate.Serialize();
   return *zone()->New<RegExpLiteralFeedback>(boilerplate, nexus.kind());
 }
@@ -802,7 +805,7 @@ ProcessedFeedback const& JSHeapBroker::ReadFeedbackForTemplateObject(
     return NewInsufficientFeedback(nexus.kind());
   }
 
-  JSArrayRef array(this, handle(object, isolate()));
+  JSArrayRef array = MakeRef(this, handle(JSArray::cast(object), isolate()));
   return *zone()->New<TemplateObjectFeedback>(array, nexus.kind());
 }
 
@@ -822,7 +825,7 @@ ProcessedFeedback const& JSHeapBroker::ReadFeedbackForCall(
     MaybeObject maybe_target = nexus.GetFeedback();
     HeapObject target_object;
     if (maybe_target->GetHeapObject(&target_object)) {
-      target_ref = HeapObjectRef(this, handle(target_object, isolate()));
+      target_ref = MakeRef(this, handle(target_object, isolate()));
     }
   }
   float frequency = nexus.ComputeCallFrequency();
@@ -1060,7 +1063,7 @@ base::Optional<NameRef> JSHeapBroker::GetNameFeedback(
     FeedbackNexus const& nexus) {
   Name raw_name = nexus.GetName();
   if (raw_name.is_null()) return base::nullopt;
-  return NameRef(this, handle(raw_name, isolate()));
+  return MakeRef(this, handle(raw_name, isolate()));
 }
 
 PropertyAccessInfo JSHeapBroker::GetPropertyAccessInfo(

src/compiler/js-heap-broker.h

@@ -579,7 +579,9 @@ template <class T,
           typename = std::enable_if_t<std::is_convertible<T*, Object*>::value>>
 base::Optional<typename ref_traits<T>::ref_type> TryMakeRef(
     JSHeapBroker* broker, Handle<T> object) {
-  return TryMakeRef(broker, *object);
+  ObjectData* data = broker->TryGetOrCreateData(object);
+  if (data == nullptr) return {};
+  return {typename ref_traits<T>::ref_type(broker, data)};
 }
 
 template <class T,
@@ -592,7 +594,7 @@ template <class T,
           typename = std::enable_if_t<std::is_convertible<T*, Object*>::value>>
 typename ref_traits<T>::ref_type MakeRef(JSHeapBroker* broker,
                                          Handle<T> object) {
-  return MakeRef(broker, *object);
+  return TryMakeRef(broker, object).value();
 }
 
 }  // namespace compiler

src/compiler/js-heap-copy-reducer.cc

@@ -28,7 +28,7 @@ JSHeapBroker* JSHeapCopyReducer::broker() { return broker_; }
 Reduction JSHeapCopyReducer::Reduce(Node* node) {
   switch (node->opcode()) {
     case IrOpcode::kCheckClosure: {
-      FeedbackCellRef cell(broker(), FeedbackCellOf(node->op()));
+      FeedbackCellRef cell = MakeRef(broker(), FeedbackCellOf(node->op()));
       base::Optional<FeedbackVectorRef> feedback_vector = cell.value();
       if (feedback_vector.has_value()) {
         feedback_vector->Serialize();
@@ -36,7 +36,7 @@ Reduction JSHeapCopyReducer::Reduce(Node* node) {
       break;
     }
     case IrOpcode::kHeapConstant: {
-      ObjectRef object(broker(), HeapConstantOf(node->op()));
+      ObjectRef object = MakeRef(broker(), HeapConstantOf(node->op()));
       if (object.IsJSFunction()) object.AsJSFunction().Serialize();
       if (object.IsJSObject()) {
         object.AsJSObject().SerializeObjectCreateMap();
@@ -49,7 +49,7 @@ Reduction JSHeapCopyReducer::Reduce(Node* node) {
     case IrOpcode::kJSCreateArray: {
       CreateArrayParameters const& p = CreateArrayParametersOf(node->op());
       Handle<AllocationSite> site;
-      if (p.site().ToHandle(&site)) AllocationSiteRef(broker(), site);
+      if (p.site().ToHandle(&site)) MakeRef(broker(), site);
       break;
     }
     case IrOpcode::kJSCreateArguments: {
@@ -60,23 +60,23 @@ Reduction JSHeapCopyReducer::Reduce(Node* node) {
       break;
     }
     case IrOpcode::kJSCreateBlockContext: {
-      ScopeInfoRef(broker(), ScopeInfoOf(node->op()));
+      MakeRef(broker(), ScopeInfoOf(node->op()));
       break;
     }
     case IrOpcode::kJSCreateBoundFunction: {
       CreateBoundFunctionParameters const& p =
           CreateBoundFunctionParametersOf(node->op());
-      MapRef(broker(), p.map());
+      MakeRef(broker(), p.map());
       break;
     }
     case IrOpcode::kJSCreateCatchContext: {
-      ScopeInfoRef(broker(), ScopeInfoOf(node->op()));
+      MakeRef(broker(), ScopeInfoOf(node->op()));
       break;
     }
     case IrOpcode::kJSCreateClosure: {
       CreateClosureParameters const& p = CreateClosureParametersOf(node->op());
-      SharedFunctionInfoRef(broker(), p.shared_info());
-      HeapObjectRef(broker(), p.code());
+      MakeRef(broker(), p.shared_info());
+      MakeRef(broker(), p.code());
       break;
     }
     case IrOpcode::kJSCreateEmptyLiteralArray: {
@@ -133,7 +133,7 @@ Reduction JSHeapCopyReducer::Reduce(Node* node) {
     case IrOpcode::kJSCreateFunctionContext: {
       CreateFunctionContextParameters const& p =
           CreateFunctionContextParametersOf(node->op());
-      ScopeInfoRef(broker(), p.scope_info());
+      MakeRef(broker(), p.scope_info());
       break;
     }
     case IrOpcode::kJSCreateLiteralArray:
@@ -154,18 +154,18 @@ Reduction JSHeapCopyReducer::Reduce(Node* node) {
     case IrOpcode::kJSGetTemplateObject: {
       GetTemplateObjectParameters const& p =
           GetTemplateObjectParametersOf(node->op());
-      SharedFunctionInfoRef(broker(), p.shared());
-      TemplateObjectDescriptionRef(broker(), p.description());
+      MakeRef(broker(), p.shared());
+      MakeRef(broker(), p.description());
       broker()->ProcessFeedbackForTemplateObject(p.feedback());
       break;
     }
     case IrOpcode::kJSCreateWithContext: {
-      ScopeInfoRef(broker(), ScopeInfoOf(node->op()));
+      MakeRef(broker(), ScopeInfoOf(node->op()));
       break;
     }
     case IrOpcode::kJSLoadNamed: {
       NamedAccess const& p = NamedAccessOf(node->op());
-      NameRef name(broker(), p.name());
+      NameRef name = MakeRef(broker(), p.name());
       if (p.feedback().IsValid()) {
         broker()->ProcessFeedbackForPropertyAccess(p.feedback(),
                                                    AccessMode::kLoad, name);
@@ -174,7 +174,7 @@ Reduction JSHeapCopyReducer::Reduce(Node* node) {
     }
     case IrOpcode::kJSLoadNamedFromSuper: {
       NamedAccess const& p = NamedAccessOf(node->op());
-      NameRef name(broker(), p.name());
+      NameRef name = MakeRef(broker(), p.name());
       if (p.feedback().IsValid()) {
         broker()->ProcessFeedbackForPropertyAccess(p.feedback(),
                                                    AccessMode::kLoad, name);
@@ -183,7 +183,7 @@ Reduction JSHeapCopyReducer::Reduce(Node* node) {
     }
     case IrOpcode::kJSStoreNamed: {
       NamedAccess const& p = NamedAccessOf(node->op());
-      NameRef name(broker(), p.name());
+      MakeRef(broker(), p.name());
       break;
     }
     case IrOpcode::kStoreField:
@@ -191,32 +191,32 @@ Reduction JSHeapCopyReducer::Reduce(Node* node) {
       FieldAccess access = FieldAccessOf(node->op());
       Handle<Map> map_handle;
       if (access.map.ToHandle(&map_handle)) {
-        MapRef(broker(), map_handle);
+        MakeRef(broker(), map_handle);
       }
       Handle<Name> name_handle;
       if (access.name.ToHandle(&name_handle)) {
-        NameRef(broker(), name_handle);
+        MakeRef(broker(), name_handle);
       }
       break;
     }
     case IrOpcode::kMapGuard: {
       ZoneHandleSet<Map> const& maps = MapGuardMapsOf(node->op());
       for (Handle<Map> map : maps) {
-        MapRef(broker(), map);
+        MakeRef(broker(), map);
       }
       break;
     }
     case IrOpcode::kCheckMaps: {
       ZoneHandleSet<Map> const& maps = CheckMapsParametersOf(node->op()).maps();
       for (Handle<Map> map : maps) {
-        MapRef(broker(), map);
+        MakeRef(broker(), map);
       }
       break;
     }
     case IrOpcode::kCompareMaps: {
       ZoneHandleSet<Map> const& maps = CompareMapsParametersOf(node->op());
       for (Handle<Map> map : maps) {
-        MapRef(broker(), map);
+        MakeRef(broker(), map);
       }
       break;
     }

src/compiler/js-inlining-heuristic.cc

@@ -110,7 +110,7 @@ JSInliningHeuristic::Candidate JSInliningHeuristic::CollectFunctions(
   }
   if (m.IsCheckClosure()) {
     DCHECK(!out.functions[0].has_value());
-    FeedbackCellRef feedback_cell(broker(), FeedbackCellOf(m.op()));
+    FeedbackCellRef feedback_cell = MakeRef(broker(), FeedbackCellOf(m.op()));
     SharedFunctionInfoRef shared_info = *feedback_cell.shared_function_info();
     out.shared_info = shared_info;
     if (CanConsiderForInlining(broker(), shared_info, *feedback_cell.value())) {

src/compiler/js-inlining.cc

@@ -335,7 +335,7 @@ base::Optional<SharedFunctionInfoRef> JSInliner::DetermineCallTarget(
     FeedbackCellRef cell = n.GetFeedbackCellRefChecked(broker());
     return cell.shared_function_info();
   } else if (match.IsCheckClosure()) {
-    FeedbackCellRef cell(broker(), FeedbackCellOf(match.op()));
+    FeedbackCellRef cell = MakeRef(broker(), FeedbackCellOf(match.op()));
     return cell.shared_function_info();
   }
 
@@ -373,7 +373,7 @@ FeedbackCellRef JSInliner::DetermineCallContext(Node* node,
     *context_out = NodeProperties::GetContextInput(match.node());
     return cell;
   } else if (match.IsCheckClosure()) {
-    FeedbackCellRef cell(broker(), FeedbackCellOf(match.op()));
+    FeedbackCellRef cell = MakeRef(broker(), FeedbackCellOf(match.op()));
 
     Node* effect = NodeProperties::GetEffectInput(node);
     Node* control = NodeProperties::GetControlInput(node);

src/compiler/js-native-context-specialization.cc

@@ -412,14 +412,14 @@ Reduction JSNativeContextSpecialization::ReduceJSInstanceOf(Node* node) {
     return NoChange();
   }
 
-  JSObjectRef receiver_ref(broker(), receiver);
+  JSObjectRef receiver_ref = MakeRef(broker(), receiver);
   MapRef receiver_map = receiver_ref.map();
 
   PropertyAccessInfo access_info = PropertyAccessInfo::Invalid(graph()->zone());
   if (broker()->is_concurrent_inlining()) {
     access_info = broker()->GetPropertyAccessInfo(
         receiver_map,
-        NameRef(broker(), isolate()->factory()->has_instance_symbol()),
+        MakeRef(broker(), isolate()->factory()->has_instance_symbol()),
         AccessMode::kLoad, dependencies());
   } else {
     AccessInfoFactory access_info_factory(broker(), dependencies(),
@@ -462,7 +462,7 @@ Reduction JSNativeContextSpecialization::ReduceJSInstanceOf(Node* node) {
     Handle<JSObject> holder;
     bool found_on_proto = access_info.holder().ToHandle(&holder);
     JSObjectRef holder_ref =
-        found_on_proto ? JSObjectRef(broker(), holder) : receiver_ref;
+        found_on_proto ? MakeRef(broker(), holder) : receiver_ref;
     base::Optional<ObjectRef> constant = holder_ref.GetOwnFastDataProperty(
         access_info.field_representation(), access_info.field_index());
     if (!constant.has_value() || !constant->IsHeapObject() ||
@@ -472,7 +472,7 @@ Reduction JSNativeContextSpecialization::ReduceJSInstanceOf(Node* node) {
     if (found_on_proto) {
       dependencies()->DependOnStablePrototypeChains(
           access_info.lookup_start_object_maps(), kStartAtPrototype,
-          JSObjectRef(broker(), holder));
+          MakeRef(broker(), holder));
     }
 
     // Check that {constructor} is actually {receiver}.
@@ -743,7 +743,7 @@ Reduction JSNativeContextSpecialization::ReduceJSResolvePromise(Node* node) {
     for (auto map : resolution_maps) {
       MapRef map_ref(broker(), map);
       access_infos.push_back(broker()->GetPropertyAccessInfo(
-          map_ref, NameRef(broker(), isolate()->factory()->then_string()),
+          map_ref, MakeRef(broker(), isolate()->factory()->then_string()),
           AccessMode::kLoad, dependencies()));
     }
   }
@@ -870,7 +870,7 @@ Reduction JSNativeContextSpecialization::ReduceGlobalAccess(
         simplified()->CheckMaps(
             CheckMapsFlag::kNone,
             ZoneHandleSet<Map>(
-                HeapObjectRef(broker(), global_proxy()).map().object())),
+                MakeRef(broker(), global_proxy()).map().object())),
         lookup_start_object, effect, control);
   }
 
@@ -1040,7 +1040,7 @@ Reduction JSNativeContextSpecialization::ReduceJSLoadGlobal(Node* node) {
     return Replace(value);
   } else if (feedback.IsPropertyCell()) {
     return ReduceGlobalAccess(node, nullptr, nullptr, nullptr,
-                              NameRef(broker(), p.name()), AccessMode::kLoad,
+                              MakeRef(broker(), p.name()), AccessMode::kLoad,
                               nullptr, feedback.property_cell());
   } else {
     DCHECK(feedback.IsMegamorphic());
@@ -1071,7 +1071,7 @@ Reduction JSNativeContextSpecialization::ReduceJSStoreGlobal(Node* node) {
     return Replace(value);
   } else if (feedback.IsPropertyCell()) {
     return ReduceGlobalAccess(node, nullptr, nullptr, value,
-                              NameRef(broker(), p.name()), AccessMode::kStore,
+                              MakeRef(broker(), p.name()), AccessMode::kStore,
                               nullptr, feedback.property_cell());
   } else {
     DCHECK(feedback.IsMegamorphic());
@@ -1473,7 +1473,7 @@ Reduction JSNativeContextSpecialization::ReduceJSLoadNamed(Node* node) {
   JSLoadNamedNode n(node);
   NamedAccess const& p = n.Parameters();
   Node* const receiver = n.object();
-  NameRef name(broker(), p.name());
+  NameRef name = MakeRef(broker(), p.name());
 
   // Check if we have a constant receiver.
   HeapObjectMatcher m(receiver);
@@ -1516,7 +1516,7 @@ Reduction JSNativeContextSpecialization::ReduceJSLoadNamedFromSuper(
     Node* node) {
   JSLoadNamedFromSuperNode n(node);
   NamedAccess const& p = n.Parameters();
-  NameRef name(broker(), p.name());
+  NameRef name = MakeRef(broker(), p.name());
 
   if (!p.feedback().IsValid()) return NoChange();
   return ReducePropertyAccess(node, nullptr, name, jsgraph()->Dead(),
@@ -1611,7 +1611,7 @@ Reduction JSNativeContextSpecialization::ReduceJSStoreNamed(Node* node) {
   JSStoreNamedNode n(node);
   NamedAccess const& p = n.Parameters();
   if (!p.feedback().IsValid()) return NoChange();
-  return ReducePropertyAccess(node, nullptr, NameRef(broker(), p.name()),
+  return ReducePropertyAccess(node, nullptr, MakeRef(broker(), p.name()),
                               n.value(), FeedbackSource(p.feedback()),
                               AccessMode::kStore);
 }
@@ -1620,7 +1620,7 @@ Reduction JSNativeContextSpecialization::ReduceJSStoreNamedOwn(Node* node) {
   JSStoreNamedOwnNode n(node);
   StoreNamedOwnParameters const& p = n.Parameters();
   if (!p.feedback().IsValid()) return NoChange();
-  return ReducePropertyAccess(node, nullptr, NameRef(broker(), p.name()),
+  return ReducePropertyAccess(node, nullptr, MakeRef(broker(), p.name()),
                               n.value(), FeedbackSource(p.feedback()),
                               AccessMode::kStoreInLiteral);
 }
@@ -2234,7 +2234,7 @@ Node* JSNativeContextSpecialization::InlinePropertyGetterCall(
     // For fast mode holders we recorded dependencies in BuildPropertyLoad.
     for (const Handle<Map> map : access_info.lookup_start_object_maps()) {
       dependencies()->DependOnConstantInDictionaryPrototypeChain(
-          MapRef{broker(), map}, NameRef{broker(), access_info.name()},
+          MakeRef(broker(), map), MakeRef(broker(), access_info.name()),
           constant, PropertyKind::kAccessor);
     }
   }
@@ -2367,7 +2367,7 @@ JSNativeContextSpecialization::BuildPropertyLoad(
       !access_info.HasDictionaryHolder()) {
     dependencies()->DependOnStablePrototypeChains(
         access_info.lookup_start_object_maps(), kStartAtPrototype,
-        JSObjectRef(broker(), holder));
+        MakeRef(broker(), holder));
   }
 
   // Generate the actual property access.
@@ -2418,7 +2418,7 @@ JSNativeContextSpecialization::BuildPropertyTest(
   if (access_info.holder().ToHandle(&holder)) {
     dependencies()->DependOnStablePrototypeChains(
         access_info.lookup_start_object_maps(), kStartAtPrototype,
-        JSObjectRef(broker(), holder));
+        MakeRef(broker(), holder));
   }
 
   Node* value = access_info.IsNotFound() ? jsgraph()->FalseConstant()
@@ -2462,7 +2462,7 @@ JSNativeContextSpecialization::BuildPropertyStore(
     DCHECK_NE(AccessMode::kStoreInLiteral, access_mode);
     dependencies()->DependOnStablePrototypeChains(
         access_info.lookup_start_object_maps(), kStartAtPrototype,
-        JSObjectRef(broker(), holder));
+        MakeRef(broker(), holder));
   }
 
   DCHECK(!access_info.IsNotFound());

src/compiler/js-operator.cc

@@ -8,6 +8,7 @@
 
 #include "src/base/lazy-instance.h"
 #include "src/compiler/js-graph.h"
+#include "src/compiler/js-heap-broker.h"
 #include "src/compiler/node-matchers.h"
 #include "src/compiler/operator.h"
 #include "src/handles/handles-inl.h"
@@ -41,7 +42,7 @@ FeedbackCellRef JSCreateClosureNode::GetFeedbackCellRefChecked(
     JSHeapBroker* broker) const {
   HeapObjectMatcher m(feedback_cell());
   CHECK(m.HasResolvedValue());
-  return FeedbackCellRef(broker, m.ResolvedValue());
+  return MakeRef(broker, Handle<FeedbackCell>::cast(m.ResolvedValue()));
 }
 
 std::ostream& operator<<(std::ostream& os, CallFrequency const& f) {

src/compiler/js-typed-lowering.cc

@@ -593,8 +593,8 @@ Reduction JSTypedLowering::ReduceJSAdd(Node* node) {
     Node* length =
         graph()->NewNode(simplified()->NumberAdd(), left_length, right_length);
 
-    PropertyCellRef string_length_protector(
-        broker(), factory()->string_length_protector());
+    PropertyCellRef string_length_protector =
+        MakeRef(broker(), factory()->string_length_protector());
     string_length_protector.SerializeAsProtector();
 
     if (string_length_protector.value().AsSmi() ==
@@ -1172,8 +1172,8 @@ Reduction JSTypedLowering::ReduceJSLoadNamed(Node* node) {
   JSLoadNamedNode n(node);
   Node* receiver = n.object();
   Type receiver_type = NodeProperties::GetType(receiver);
-  NameRef name(broker(), NamedAccessOf(node->op()).name());
-  NameRef length_str(broker(), factory()->length_string());
+  NameRef name = MakeRef(broker(), NamedAccessOf(node->op()).name());
+  NameRef length_str = MakeRef(broker(), factory()->length_string());
   // Optimize "length" property of strings.
   if (name.equals(length_str) && receiver_type.Is(Type::String())) {
     Node* value = graph()->NewNode(simplified()->StringLength(), receiver);
@@ -1715,7 +1715,7 @@ Reduction JSTypedLowering::ReduceJSCall(Node* node) {
         JSCreateClosureNode{target}.Parameters();
     shared = SharedFunctionInfoRef(broker(), ccp.shared_info());
   } else if (target->opcode() == IrOpcode::kCheckClosure) {
-    FeedbackCellRef cell(broker(), FeedbackCellOf(target->op()));
+    FeedbackCellRef cell = MakeRef(broker(), FeedbackCellOf(target->op()));
     base::Optional<FeedbackVectorRef> feedback_vector = cell.value();
     if (feedback_vector.has_value()) {
       shared = feedback_vector->shared_function_info();

src/compiler/node-matchers.h

@@ -238,7 +238,7 @@ struct HeapObjectMatcherImpl final
   }
 
   HeapObjectRef Ref(JSHeapBroker* broker) const {
-    return HeapObjectRef(broker, this->ResolvedValue());
+    return MakeRef(broker, this->ResolvedValue());
   }
 };
 

src/compiler/pipeline.cc

@@ -1340,7 +1340,7 @@ struct GraphBuilderPhase {
       flags |= BytecodeGraphBuilderFlag::kBailoutOnUninitialized;
     }
 
-    JSFunctionRef closure(data->broker(), data->info()->closure());
+    JSFunctionRef closure = MakeRef(data->broker(), data->info()->closure());
     CallFrequency frequency(1.0f);
     BuildGraphFromBytecode(
         data->broker(), temp_zone, closure.shared(),
@@ -1550,8 +1550,8 @@ struct SerializationPhase {
         data->zone_stats(), data->broker(), data->dependencies(),
         data->info()->closure(), flags, data->info()->osr_offset());
     if (data->specialization_context().IsJust()) {
-      ContextRef(data->broker(),
-                 data->specialization_context().FromJust().context);
+      MakeRef(data->broker(),
+              data->specialization_context().FromJust().context);
     }
     if (FLAG_turbo_concurrent_get_property_access_info) {
       data->broker()->ClearCachedPropertyAccessInfos();

src/compiler/property-access-builder.cc

@@ -153,7 +153,8 @@ Node* PropertyAccessBuilder::FoldLoadDictPrototypeConstant(
   DCHECK(V8_DICT_PROPERTY_CONST_TRACKING_BOOL);
   DCHECK(access_info.IsDictionaryProtoDataConstant());
 
-  JSObjectRef holder(broker(), access_info.holder().ToHandleChecked());
+  JSObjectRef holder =
+      MakeRef(broker(), access_info.holder().ToHandleChecked());
   base::Optional<ObjectRef> value =
       holder.GetOwnDictionaryProperty(access_info.dictionary_index());
 
@@ -171,7 +172,7 @@ Node* PropertyAccessBuilder::FoldLoadDictPrototypeConstant(
       DCHECK(map->IsJSObjectMap());
     }
     dependencies()->DependOnConstantInDictionaryPrototypeChain(
-        MapRef{broker(), map}, NameRef{broker(), access_info.name()},
+        MakeRef(broker(), map), MakeRef(broker(), access_info.name()),
         value.value(), PropertyKind::kData);
   }
 
@@ -206,7 +207,7 @@ Node* PropertyAccessBuilder::TryFoldLoadConstantDataField(
     holder = m.Ref(broker()).AsJSObject().object();
   }
 
-  JSObjectRef holder_ref(broker(), holder);
+  JSObjectRef holder_ref = MakeRef(broker(), holder);
   base::Optional<ObjectRef> value = holder_ref.GetOwnFastDataProperty(
       access_info.field_representation(), access_info.field_index());
   if (!value.has_value()) {

test/cctest/compiler/serializer-tester.cc

@@ -49,7 +49,7 @@ SerializerTester::SerializerTester(const char* source)
   // Update handle to the corresponding serialized Handle in the broker.
   function =
       broker_->FindCanonicalPersistentHandleForTesting<JSFunction>(*function);
-  function_ = JSFunctionRef(broker(), function);
+  function_ = MakeRef(broker(), function);
 }
 
 TEST(SerializeEmptyFunction) {
@@ -90,7 +90,7 @@ void CheckForSerializedInlinee(const char* source, int argc = 0,
   Handle<FeedbackVector> fv(
       tester.broker()->FindCanonicalPersistentHandleForTesting<FeedbackVector>(
           g_func->feedback_vector()));
-  FeedbackVectorRef g_fv(tester.broker(), fv);
+  FeedbackVectorRef g_fv = MakeRef(tester.broker(), fv);
   CHECK(tester.broker()->IsSerializedForCompilation(g_sfi, g_fv));
 }