[turbofan] Allocation-free typed array names

Bug: v8:7790

Change-Id: Ibdfe1c1a1ad2eb082583285493227fb833be4690
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2093501
Auto-Submit: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66629}

src/compiler/js-call-reducer.cc

@@ -6529,13 +6529,8 @@ Reduction JSCallReducer::ReduceTypedArrayPrototypeToStringTag(Node* node) {
         jsgraph()->Constant(TYPE##_ELEMENTS -                          \
                             FIRST_FIXED_TYPED_ARRAY_ELEMENTS_KIND));   \
     control = graph()->NewNode(common()->Branch(), check, control);    \
-    if (should_disallow_heap_access()) {                               \
-      values.push_back(jsgraph()->Constant(                            \
-          broker()->GetTypedArrayStringTag(TYPE##_ELEMENTS)));         \
-    } else {                                                           \
-      values.push_back(jsgraph()->HeapConstant(                        \
-          factory()->InternalizeUtf8String(#Type "Array")));           \
-    }                                                                  \
+    values.push_back(jsgraph()->Constant(                              \
+        broker()->GetTypedArrayStringTag(TYPE##_ELEMENTS)));           \
     effects.push_back(effect);                                         \
     controls.push_back(graph()->NewNode(common()->IfTrue(), control)); \
     control = graph()->NewNode(common()->IfFalse(), control);          \

src/compiler/js-heap-broker.cc

@@ -2530,23 +2530,17 @@ void JSHeapBroker::CollectArrayAndObjectPrototypes() {
   CHECK(!array_and_object_prototypes_.empty());
 }
 
-void JSHeapBroker::SerializeTypedArrayStringTags() {
-#define TYPED_ARRAY_STRING_TAG(Type, type, TYPE, ctype)              \
-  do {                                                               \
-    ObjectData* data = GetOrCreateData(                              \
-        isolate()->factory()->InternalizeUtf8String(#Type "Array")); \
-    typed_array_string_tags_.push_back(data);                        \
-  } while (false);
-
-  TYPED_ARRAYS(TYPED_ARRAY_STRING_TAG)
-#undef TYPED_ARRAY_STRING_TAG
-}
-
 StringRef JSHeapBroker::GetTypedArrayStringTag(ElementsKind kind) {
   DCHECK(IsTypedArrayElementsKind(kind));
-  size_t idx = kind - FIRST_FIXED_TYPED_ARRAY_ELEMENTS_KIND;
-  CHECK_LT(idx, typed_array_string_tags_.size());
-  return StringRef(this, typed_array_string_tags_[idx]);
+  switch (kind) {
+#define TYPED_ARRAY_STRING_TAG(Type, type, TYPE, ctype) \
+  case ElementsKind::TYPE##_ELEMENTS:                   \
+    return StringRef(this, isolate()->factory()->Type##Array_string());
+    TYPED_ARRAYS(TYPED_ARRAY_STRING_TAG)
+#undef TYPED_ARRAY_STRING_TAG
+    default:
+      UNREACHABLE();
+  }
 }
 
 bool JSHeapBroker::ShouldBeSerializedForCompilation(
@@ -2613,7 +2607,6 @@ void JSHeapBroker::InitializeAndStartSerializing(
   target_native_context().Serialize();
 
   CollectArrayAndObjectPrototypes();
-  SerializeTypedArrayStringTags();
 
   // Serialize Cells
   Factory* const f = isolate()->factory();

src/compiler/js-heap-broker.h

@@ -228,7 +228,6 @@ class V8_EXPORT_PRIVATE JSHeapBroker {
       FeedbackSource const& source);
 
   void CollectArrayAndObjectPrototypes();
-  void SerializeTypedArrayStringTags();
 
   PerIsolateCompilerCache* compiler_cache() const { return compiler_cache_; }