[turbofan] Move serialization of ObjectCreate map into serializer

Also: add hint for "prototype" property. This makes us not miss
the ObjectCreate map in any of our tests.

Bug: v8:7790
Change-Id: Icc9f91ebaf466a1cdfba27526335b930c744b9c5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762519
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Auto-Submit: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63336}

src/compiler/js-heap-broker.cc

@@ -279,8 +279,12 @@ class JSObjectData : public JSReceiverData {
   FixedArrayBaseData* elements() const;
 
   void SerializeObjectCreateMap(JSHeapBroker* broker);
-  MapData* object_create_map() const {  // Can be nullptr.
-    CHECK(serialized_object_create_map_);
+
+  MapData* object_create_map(JSHeapBroker* broker) const {  // Can be nullptr.
+    if (!serialized_object_create_map_) {
+      DCHECK_NULL(object_create_map_);
+      TRACE_MISSING(broker, "object_create_map on " << this);
+    }
     return object_create_map_;
   }
 
@@ -2533,7 +2537,7 @@ base::Optional<MapRef> JSObjectRef::GetObjectCreateMap() const {
       return base::Optional<MapRef>();
     }
   }
-  MapData* map_data = data()->AsJSObject()->object_create_map();
+  MapData* map_data = data()->AsJSObject()->object_create_map(broker());
   return map_data != nullptr ? MapRef(broker(), map_data)
                              : base::Optional<MapRef>();
 }

src/compiler/js-heap-copy-reducer.cc

@@ -29,8 +29,10 @@ Reduction JSHeapCopyReducer::Reduce(Node* node) {
     case IrOpcode::kHeapConstant: {
       ObjectRef object(broker(), HeapConstantOf(node->op()));
       if (object.IsJSFunction()) object.AsJSFunction().Serialize();
-      if (object.IsJSObject()) object.AsJSObject().SerializeObjectCreateMap();
       if (!FLAG_concurrent_inlining) {
+        if (object.IsJSObject()) {
+          object.AsJSObject().SerializeObjectCreateMap();
+        }
         if (object.IsSourceTextModule()) {
           object.AsSourceTextModule().Serialize();
         }

src/compiler/serializer-for-background-compilation.cc

@@ -405,6 +405,7 @@ class SerializerForBackgroundCompilation {
   void ProcessModuleVariableAccess(
       interpreter::BytecodeArrayIterator* iterator);
 
+  void ProcessHintsForObjectCreate(Hints const& prototype);
   void ProcessMapHintsForPromises(Hints const& receiver_hints);
   void ProcessHintsForPromiseResolve(Hints const& resolution_hints);
   void ProcessHintsForHasInPrototypeChain(Hints const& instance_hints);
@@ -1787,6 +1788,14 @@ void SerializerForBackgroundCompilation::ProcessReceiverMapForApiCall(
   }
 }
 
+void SerializerForBackgroundCompilation::ProcessHintsForObjectCreate(
+    Hints const& prototype) {
+  for (Handle<Object> constant_handle : prototype.constants()) {
+    ObjectRef constant(broker(), constant_handle);
+    if (constant.IsJSObject()) constant.AsJSObject().SerializeObjectCreateMap();
+  }
+}
+
 void SerializerForBackgroundCompilation::ProcessBuiltinCall(
     Handle<SharedFunctionInfo> target, const HintsVector& arguments,
     SpeculationMode speculation_mode) {
@@ -1795,6 +1804,15 @@ void SerializerForBackgroundCompilation::ProcessBuiltinCall(
   const char* name = Builtins::name(builtin_id);
   TRACE_BROKER(broker(), "Serializing for call to builtin " << name);
   switch (builtin_id) {
+    case Builtins::kObjectCreate: {
+      if (arguments.size() >= 2) {
+        ProcessHintsForObjectCreate(arguments[1]);
+      } else {
+        ProcessHintsForObjectCreate(Hints::SingleConstant(
+            broker()->isolate()->factory()->undefined_value(), zone()));
+      }
+      break;
+    }
     case Builtins::kPromisePrototypeCatch: {
       // For JSCallReducer::ReducePromisePrototypeCatch.
       if (speculation_mode != SpeculationMode::kDisallowSpeculation) {
@@ -2465,8 +2483,9 @@ void SerializerForBackgroundCompilation::ProcessNamedAccess(
                                        new_accumulator_hints);
     }
     // For JSNativeContextSpecialization::ReduceNamedAccessFromNexus.
-    // TODO(neis): This should be done even if megamorphic.
     if (object.equals(global_proxy)) {
+      // TODO(neis): Record accumulator hint? Also for string.length and maybe
+      // more.
       global_proxy.GetPropertyCell(feedback.name(),
                                    SerializationPolicy::kSerializeIfNeeded);
     }
@@ -2474,7 +2493,11 @@ void SerializerForBackgroundCompilation::ProcessNamedAccess(
     if (access_mode == AccessMode::kLoad && object.IsJSFunction() &&
         feedback.name().equals(ObjectRef(
             broker(), broker()->isolate()->factory()->prototype_string()))) {
-      object.AsJSFunction().Serialize();
+      JSFunctionRef function = object.AsJSFunction();
+      function.Serialize();
+      if (new_accumulator_hints != nullptr && function.has_prototype()) {
+        new_accumulator_hints->AddConstant(function.prototype().object());
+      }
     }
   }
 }