[turbofan] Flatten cons strings before embedding them into optimized code.

Flatten ConsString objects in JSGraph, to make sure we consistently
flatten all cons strings no matter which pass creates them.

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1529053003

Cr-Commit-Position: refs/heads/master@{#32878}

src/compiler/js-context-specialization.cc

@@ -77,9 +77,6 @@ Reduction JSContextSpecialization::ReduceJSLoadContext(Node* node) {
   // Success. The context load can be replaced with the constant.
   // TODO(titzer): record the specialization for sharing code across multiple
   // contexts that have the same value in the corresponding context slot.
-  if (value->IsConsString()) {
-    value = String::Flatten(Handle<String>::cast(value), TENURED);
-  }
   Node* constant = jsgraph_->Constant(value);
   ReplaceWithValue(node, constant);
   return Replace(constant);

src/compiler/js-frame-specialization.cc

@@ -27,42 +27,44 @@ Reduction JSFrameSpecialization::Reduce(Node* node) {
 
 Reduction JSFrameSpecialization::ReduceOsrValue(Node* node) {
   DCHECK_EQ(IrOpcode::kOsrValue, node->opcode());
-  DisallowHeapAllocation no_gc;
-  Object* object;
+  Handle<Object> value;
   int const index = OpParameter<int>(node);
   int const parameters_count = frame()->ComputeParametersCount() + 1;
   if (index == Linkage::kOsrContextSpillSlotIndex) {
-    object = frame()->context();
+    value = handle(frame()->context(), isolate());
   } else if (index >= parameters_count) {
-    object = frame()->GetExpression(index - parameters_count);
+    value = handle(frame()->GetExpression(index - parameters_count), isolate());
   } else {
     // The OsrValue index 0 is the receiver.
-    object = index ? frame()->GetParameter(index - 1) : frame()->receiver();
+    value =
+        handle(index ? frame()->GetParameter(index - 1) : frame()->receiver(),
+               isolate());
   }
-  return Replace(jsgraph()->Constant(handle(object, isolate())));
+  return Replace(jsgraph()->Constant(value));
 }
 
 
 Reduction JSFrameSpecialization::ReduceParameter(Node* node) {
   DCHECK_EQ(IrOpcode::kParameter, node->opcode());
-  DisallowHeapAllocation no_gc;
-  Object* object;
+  Handle<Object> value;
   int const index = ParameterIndexOf(node->op());
   int const parameters_count = frame()->ComputeParametersCount() + 1;
   if (index == Linkage::kJSCallClosureParamIndex) {
     // The Parameter index references the closure.
-    object = frame()->function();
+    value = handle(frame()->function(), isolate());
   } else if (index == Linkage::GetJSCallArgCountParamIndex(parameters_count)) {
     // The Parameter index references the parameter count.
-    object = Smi::FromInt(parameters_count - 1);
+    value = handle(Smi::FromInt(parameters_count - 1), isolate());
   } else if (index == Linkage::GetJSCallContextParamIndex(parameters_count)) {
     // The Parameter index references the context.
-    object = frame()->context();
+    value = handle(frame()->context(), isolate());
   } else {
     // The Parameter index 0 is the receiver.
-    object = index ? frame()->GetParameter(index - 1) : frame()->receiver();
+    value =
+        handle(index ? frame()->GetParameter(index - 1) : frame()->receiver(),
+               isolate());
   }
-  return Replace(jsgraph()->Constant(handle(object, isolate())));
+  return Replace(jsgraph()->Constant(value));
 }
 
 

src/compiler/js-graph.cc

@@ -72,7 +72,9 @@ Node* JSGraph::NaNConstant() {
 
 
 Node* JSGraph::HeapConstant(Handle<HeapObject> value) {
-  // TODO(bmeurer): Flatten cons strings here before we canonicalize them?
+  if (value->IsConsString()) {
+    value = String::Flatten(Handle<String>::cast(value), TENURED);
+  }
   Node** loc = cache_.FindHeapConstant(value);
   if (*loc == nullptr) {
     *loc = graph()->NewNode(common()->HeapConstant(value));