[turbofan] Brokerize ReduceJSCreateArray

Bug: v8:7790
Change-Id: I12c159ade57a0974c6adc5b277a0b5fd74fd4dfb
Reviewed-on: https://chromium-review.googlesource.com/1140313
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54516}

src/compiler/js-create-lowering.h

@@ -68,12 +68,12 @@ class V8_EXPORT_PRIVATE JSCreateLowering final
   Reduction ReduceJSCreateCatchContext(Node* node);
   Reduction ReduceJSCreateBlockContext(Node* node);
   Reduction ReduceJSCreateGeneratorObject(Node* node);
-  Reduction ReduceNewArray(Node* node, Node* length, Handle<Map> initial_map,
+  Reduction ReduceNewArray(Node* node, Node* length, MapRef initial_map,
                            PretenureFlag pretenure);
   Reduction ReduceNewArray(Node* node, Node* length, int capacity,
-                           Handle<Map> initial_map, PretenureFlag pretenure);
+                           MapRef initial_map, PretenureFlag pretenure);
   Reduction ReduceNewArray(Node* node, std::vector<Node*> values,
-                           Handle<Map> initial_map, PretenureFlag pretenure);
+                           MapRef initial_map, PretenureFlag pretenure);
   Reduction ReduceJSCreateObject(Node* node);
 
   Node* AllocateArguments(Node* effect, Node* control, Node* frame_state);
@@ -104,7 +104,8 @@ class V8_EXPORT_PRIVATE JSCreateLowering final
   Node* AllocateLiteralRegExp(Node* effect, Node* control,
                               JSRegExpRef boilerplate);
 
-  Reduction ReduceNewArrayToStubCall(Node* node, Handle<AllocationSite> site);
+  Reduction ReduceNewArrayToStubCall(Node* node,
+                                     base::Optional<AllocationSiteRef> site);
 
   Factory* factory() const;
   Graph* graph() const;

src/compiler/js-heap-broker.cc

@@ -166,6 +166,16 @@ void JSFunctionRef::EnsureHasInitialMap() const {
   JSFunction::EnsureHasInitialMap(object<JSFunction>());
 }
 
+// TODO(mslekova): Pre-compute these on the main thread.
+MapRef MapRef::AsElementsKind(ElementsKind kind,
+                              const JSHeapBroker* broker) const {
+  AllowHandleAllocation handle_allocation;
+  AllowHeapAllocation heap_allocation;
+  AllowHandleDereference allow_handle_dereference;
+  return MapRef(broker,
+                Map::AsElementsKind(broker->isolate(), object<Map>(), kind));
+}
+
 SlackTrackingResult JSFunctionRef::FinishSlackTracking() const {
   AllowHandleDereference allow_handle_dereference;
   AllowHandleAllocation handle_allocation;
@@ -267,6 +277,11 @@ ElementsKind AllocationSiteRef::GetElementsKind() const {
   return object<AllocationSite>()->GetElementsKind();
 }
 
+bool AllocationSiteRef::CanInlineCall() const {
+  AllowHandleDereference handle_dereference;
+  return object<AllocationSite>()->CanInlineCall();
+}
+
 bool JSObjectRef::IsUnboxedDoubleField(FieldIndex index) const {
   AllowHandleDereference handle_dereference;
   return object<JSObject>()->IsUnboxedDoubleField(index);
@@ -414,11 +429,6 @@ void JSObjectRef::EnsureElementsTenured() {
   }
 }
 
-ElementsKind MapRef::elements_kind() const {
-  AllowHandleDereference allow_handle_dereference;
-  return object<Map>()->elements_kind();
-}
-
 bool MapRef::is_deprecated() const {
   AllowHandleDereference allow_handle_dereference;
   return object<Map>()->is_deprecated();
@@ -461,6 +471,11 @@ ObjectRef MapRef::constructor_or_backpointer() const {
                                     broker()->isolate()));
 }
 
+ElementsKind MapRef::elements_kind() const {
+  AllowHandleDereference allow_handle_dereference;
+  return object<Map>()->elements_kind();
+}
+
 int MapRef::instance_size() const {
   AllowHandleDereference allow_handle_dereference;
   return object<Map>()->instance_size();
@@ -790,6 +805,13 @@ MapRef NativeContextRef::promise_function_initial_map() const {
                        broker()->isolate()));
 }
 
+JSFunctionRef NativeContextRef::array_function() const {
+  AllowHandleAllocation handle_allocation;
+  AllowHandleDereference allow_handle_dereference;
+  return JSFunctionRef(broker(), handle(object<Context>()->array_function(),
+                                        broker()->isolate()));
+}
+
 MapRef NativeContextRef::GetFunctionMapFromIndex(int index) const {
   DCHECK_LE(index, Context::LAST_FUNCTION_MAP_INDEX);
   DCHECK_GE(index, Context::FIRST_FUNCTION_MAP_INDEX);

src/compiler/js-heap-broker.h

@@ -185,6 +185,7 @@ class JSFunctionRef : public JSObjectRef {
   bool IsConstructor() const;
   bool has_initial_map() const;
   MapRef initial_map() const;
+
   JSGlobalProxyRef global_proxy() const;
   SlackTrackingResult FinishSlackTracking() const;
   SharedFunctionInfoRef shared() const;
@@ -243,6 +244,7 @@ class NativeContextRef : public ContextRef {
   MapRef iterator_result_map() const;
   MapRef string_iterator_map() const;
   MapRef promise_function_initial_map() const;
+  JSFunctionRef array_function() const;
 
   MapRef GetFunctionMapFromIndex(int index) const;
   MapRef ObjectLiteralMapFromCache() const;
@@ -283,6 +285,7 @@ class AllocationSiteRef : public HeapObjectRef {
   ObjectRef nested_site() const;
   bool PointsToLiteral() const;
   ElementsKind GetElementsKind() const;
+  bool CanInlineCall() const;
 };
 
 class MapRef : public HeapObjectRef {
@@ -297,8 +300,11 @@ class MapRef : public HeapObjectRef {
   NameRef GetPropertyKey(int i) const;
   FieldIndex GetFieldIndexFor(int i) const;
   int GetInObjectPropertyOffset(int index) const;
-  ElementsKind elements_kind() const;
   ObjectRef constructor_or_backpointer() const;
+  ElementsKind elements_kind() const;
+
+  MapRef AsElementsKind(ElementsKind kind, const JSHeapBroker* broker) const;
+
   bool is_stable() const;
   bool has_prototype_slot() const;
   bool is_deprecated() const;

src/compiler/types.cc

@@ -1067,6 +1067,11 @@ Type Type::HeapConstant(const JSHeapBroker* js_heap_broker,
       HeapConstantType::New(HeapObjectRef(js_heap_broker, value), zone));
 }
 
+// static
+Type Type::HeapConstant(const HeapObjectRef& value, Zone* zone) {
+  return HeapConstantType::New(value, zone);
+}
+
 // static
 Type Type::Range(double min, double max, Zone* zone) {
   return FromTypeBase(RangeType::New(min, max, zone));

src/compiler/types.h

@@ -363,6 +363,7 @@ class V8_EXPORT_PRIVATE Type {
   static Type OtherNumberConstant(double value, Zone* zone);
   static Type HeapConstant(const JSHeapBroker* js_heap_broker,
                            Handle<i::Object> value, Zone* zone);
+  static Type HeapConstant(const HeapObjectRef& value, Zone* zone);
   static Type Range(double min, double max, Zone* zone);
   static Type Range(RangeType::Limits lims, Zone* zone);
   static Type Tuple(Type first, Type second, Type third, Zone* zone);