[turbofan] Serialize more Map fields.

... as well as ScopeInfo::ContextLength.

Bug: v8:7790
Change-Id: I3ca8b6f252d96b21d0990f8fc08e076eeeea4176
Reviewed-on: https://chromium-review.googlesource.com/1226973
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55939}

src/compiler/js-create-lowering.cc

@@ -129,10 +129,10 @@ Reduction JSCreateLowering::ReduceJSCreate(Node* node) {
 
   JSFunctionRef constructor =
       target_type.AsHeapConstant()->Ref().AsJSFunction();
-  if (!constructor.IsConstructor()) return NoChange();
+  if (!constructor.map().is_constructor()) return NoChange();
   JSFunctionRef original_constructor =
       new_target_type.AsHeapConstant()->Ref().AsJSFunction();
-  if (!original_constructor.IsConstructor()) return NoChange();
+  if (!original_constructor.map().is_constructor()) return NoChange();
 
   // Check if we can inline the allocation.
   if (!IsAllocationInlineable(constructor, original_constructor)) {
@@ -711,8 +711,8 @@ Reduction JSCreateLowering::ReduceJSCreateArray(Node* node) {
       new_target_type.AsHeapConstant()->Ref().IsJSFunction()) {
     JSFunctionRef original_constructor =
         new_target_type.AsHeapConstant()->Ref().AsJSFunction();
-    DCHECK(constructor.IsConstructor());
-    DCHECK(original_constructor.IsConstructor());
+    DCHECK(constructor.map().is_constructor());
+    DCHECK(original_constructor.map().is_constructor());
 
     // Check if we can inline the allocation.
     if (IsAllocationInlineable(constructor, original_constructor)) {
@@ -1721,7 +1721,7 @@ Node* JSCreateLowering::AllocateFastLiteral(Node* effect, Node* control,
   builder.Store(AccessBuilder::ForMap(), boilerplate_map);
   builder.Store(AccessBuilder::ForJSObjectPropertiesOrHash(), properties);
   builder.Store(AccessBuilder::ForJSObjectElements(), elements);
-  if (boilerplate_map.IsJSArrayMap()) {
+  if (boilerplate.IsJSArray()) {
     JSArrayRef boilerplate_array = boilerplate.AsJSArray();
     builder.Store(
         AccessBuilder::ForJSArrayLength(boilerplate_array.GetElementsKind()),

src/compiler/js-heap-broker.h

@@ -179,7 +179,6 @@ class JSFunctionRef : public JSObjectRef {
 
   bool has_initial_map() const;
   bool has_prototype() const;
-  bool IsConstructor() const;
   bool PrototypeRequiresRuntimeLookup() const;
 
   void Serialize();
@@ -322,13 +321,13 @@ class MapRef : public HeapObjectRef {
   int GetInObjectPropertyOffset(int index) const;
   ElementsKind elements_kind() const;
   bool is_stable() const;
+  bool is_constructor() const;
   bool has_prototype_slot() const;
   bool is_deprecated() const;
   bool CanBeDeprecated() const;
   bool CanTransition() const;
   bool IsInobjectSlackTrackingInProgress() const;
   bool is_dictionary_map() const;
-  bool IsJSArrayMap() const;
   bool IsFixedCowArrayMap() const;
 
   ObjectRef constructor_or_backpointer() const;

src/compiler/js-typed-lowering.cc

@@ -1509,7 +1509,7 @@ Reduction JSTypedLowering::ReduceJSConstructForwardVarargs(Node* node) {
       target_type.AsHeapConstant()->Ref().IsJSFunction()) {
     // Only optimize [[Construct]] here if {function} is a Constructor.
     JSFunctionRef function = target_type.AsHeapConstant()->Ref().AsJSFunction();
-    if (!function.IsConstructor()) return NoChange();
+    if (!function.map().is_constructor()) return NoChange();
     // Patch {node} to an indirect call via ConstructFunctionForwardVarargs.
     Callable callable = CodeFactory::ConstructFunctionForwardVarargs(isolate());
     node->RemoveInput(arity + 1);
@@ -1545,7 +1545,7 @@ Reduction JSTypedLowering::ReduceJSConstruct(Node* node) {
     SharedFunctionInfoRef shared = function.shared();
 
     // Only optimize [[Construct]] here if {function} is a Constructor.
-    if (!function.IsConstructor()) return NoChange();
+    if (!function.map().is_constructor()) return NoChange();
 
     CallDescriptor::Flags flags = CallDescriptor::kNeedsFrameState;
 

src/objects/scope-info.cc

@@ -369,7 +369,6 @@ Handle<ScopeInfo> ScopeInfo::CreateForEmptyFunction(Isolate* isolate) {
 // static
 Handle<ScopeInfo> ScopeInfo::CreateForBootstrapping(Isolate* isolate,
                                                     ScopeType type) {
-  DCHECK(isolate->bootstrapper()->IsActive());
   DCHECK(type == SCRIPT_SCOPE || type == FUNCTION_SCOPE);
 
   const int parameter_count = 0;

src/objects/scope-info.h

@@ -177,7 +177,8 @@ class ScopeInfo : public FixedArray {
                                   MaybeHandle<ScopeInfo> outer_scope);
   static Handle<ScopeInfo> CreateForWithScope(
       Isolate* isolate, MaybeHandle<ScopeInfo> outer_scope);
-  static Handle<ScopeInfo> CreateForEmptyFunction(Isolate* isolate);
+  V8_EXPORT_PRIVATE static Handle<ScopeInfo> CreateForEmptyFunction(
+      Isolate* isolate);
   static Handle<ScopeInfo> CreateGlobalThisBinding(Isolate* isolate);
 
   // Serializes empty scope info.

test/unittests/compiler/js-create-lowering-unittest.cc

@@ -176,7 +176,7 @@ TEST_F(JSCreateLoweringTest, JSCreateFunctionContextViaInlinedAllocation) {
 // JSCreateWithContext
 
 TEST_F(JSCreateLoweringTest, JSCreateWithContext) {
-  Handle<ScopeInfo> scope_info(factory()->NewScopeInfo(1));
+  Handle<ScopeInfo> scope_info = ScopeInfo::CreateForEmptyFunction(isolate());
   Node* const object = Parameter(Type::Receiver());
   Node* const context = Parameter(Type::Any());
   Node* const effect = graph()->start();
@@ -196,7 +196,7 @@ TEST_F(JSCreateLoweringTest, JSCreateWithContext) {
 // JSCreateCatchContext
 
 TEST_F(JSCreateLoweringTest, JSCreateCatchContext) {
-  Handle<ScopeInfo> scope_info(factory()->NewScopeInfo(1));
+  Handle<ScopeInfo> scope_info = ScopeInfo::CreateForEmptyFunction(isolate());
   Node* const exception = Parameter(Type::Receiver());
   Node* const context = Parameter(Type::Any());
   Node* const effect = graph()->start();