[turbofan] Serialize PropertyCell fields.

Bug: v8:7790
Change-Id: I993d04e6ca6b8986749bb3782113ef928952995b
Reviewed-on: https://chromium-review.googlesource.com/1226975
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55945}

src/compiler/js-heap-broker.cc

@@ -69,10 +69,35 @@ class HeapObjectData : public ObjectData {
 class PropertyCellData : public HeapObjectData {
  public:
   PropertyCellData(JSHeapBroker* broker, Handle<PropertyCell> object,
-                   HeapObjectType type)
-      : HeapObjectData(broker, object, type) {}
+                   HeapObjectType type);
+
+  PropertyDetails property_details() const { return property_details_; }
+
+  void Serialize();
+  ObjectData* value() { return value_; }
+
+ private:
+  PropertyDetails const property_details_;
+
+  bool serialized_ = false;
+  ObjectData* value_ = nullptr;
 };
 
+PropertyCellData::PropertyCellData(JSHeapBroker* broker,
+                                   Handle<PropertyCell> object,
+                                   HeapObjectType type)
+    : HeapObjectData(broker, object, type),
+      property_details_(object->property_details()) {}
+
+void PropertyCellData::Serialize() {
+  if (serialized_) return;
+  serialized_ = true;
+
+  auto cell = Handle<PropertyCell>::cast(object());
+  DCHECK_NULL(value_);
+  value_ = broker()->GetOrCreateData(cell->value());
+}
+
 class JSObjectField {
  public:
   bool IsDouble() const { return object_ == nullptr; }
@@ -1280,6 +1305,19 @@ void JSHeapBroker::SerializeStandardObjects() {
   GetOrCreateData(f->undefined_value());
   GetOrCreateData(f->with_context_map());
 
+  // Property cells
+  GetOrCreateData(f->array_buffer_neutering_protector())
+      ->AsPropertyCell()
+      ->Serialize();
+  GetOrCreateData(f->array_iterator_protector())->AsPropertyCell()->Serialize();
+  GetOrCreateData(f->array_species_protector())->AsPropertyCell()->Serialize();
+  GetOrCreateData(f->no_elements_protector())->AsPropertyCell()->Serialize();
+  GetOrCreateData(f->promise_hook_protector())->AsPropertyCell()->Serialize();
+  GetOrCreateData(f->promise_species_protector())
+      ->AsPropertyCell()
+      ->Serialize();
+  GetOrCreateData(f->promise_then_protector())->AsPropertyCell()->Serialize();
+
   // Builtins
   {
     Builtins::Name builtins[] = {
@@ -1794,8 +1832,8 @@ BIMODAL_ACCESSOR(Map, Object, constructor_or_backpointer)
 BROKER_NATIVE_CONTEXT_FIELDS(DEF_NATIVE_CONTEXT_ACCESSOR)
 #undef DEF_NATIVE_CONTEXT_ACCESSOR
 
-HANDLE_ACCESSOR(PropertyCell, Object, value)
-HANDLE_ACCESSOR_C(PropertyCell, PropertyDetails, property_details)
+BIMODAL_ACCESSOR(PropertyCell, Object, value)
+BIMODAL_ACCESSOR_C(PropertyCell, PropertyDetails, property_details)
 
 BIMODAL_ACCESSOR_C(SharedFunctionInfo, int, builtin_id)
 BIMODAL_ACCESSOR(SharedFunctionInfo, BytecodeArray, GetBytecodeArray)

src/compiler/js-heap-broker.h

@@ -154,8 +154,8 @@ class PropertyCellRef : public HeapObjectRef {
  public:
   using HeapObjectRef::HeapObjectRef;
 
-  ObjectRef value() const;
   PropertyDetails property_details() const;
+  ObjectRef value() const;
 };
 
 class JSObjectRef : public HeapObjectRef {

test/unittests/compiler/js-call-reducer-unittest.cc

@@ -21,10 +21,11 @@ namespace compiler {
 class JSCallReducerTest : public TypedGraphTest {
  public:
   JSCallReducerTest()
-      : TypedGraphTest(3),
-        javascript_(zone()),
-        deps_(isolate(), zone()),
-        js_heap_broker(isolate(), zone()) {}
+      : TypedGraphTest(3), javascript_(zone()), deps_(isolate(), zone()) {
+    if (FLAG_concurrent_compiler_frontend) {
+      js_heap_broker()->SerializeStandardObjects();
+    }
+  }
   ~JSCallReducerTest() override {}
 
  protected:
@@ -36,7 +37,7 @@ class JSCallReducerTest : public TypedGraphTest {
     // TODO(titzer): mock the GraphReducer here for better unit testing.
     GraphReducer graph_reducer(zone(), graph());
 
-    JSCallReducer reducer(&graph_reducer, &jsgraph, &js_heap_broker,
+    JSCallReducer reducer(&graph_reducer, &jsgraph, js_heap_broker(),
                           JSCallReducer::kNoFlags, native_context(), &deps_);
     return reducer.Reduce(node);
   }
@@ -133,7 +134,6 @@ class JSCallReducerTest : public TypedGraphTest {
  private:
   JSOperatorBuilder javascript_;
   CompilationDependencies deps_;
-  JSHeapBroker js_heap_broker;
 
   static bool old_flag_lazy_;
   static bool old_flag_lazy_handler_;