[turbofan] Heap broker for JSCreateLowering::ReduceJSCreateLiteralRegExp.

Bug: v8:7790
Change-Id: Ieeafcb7260ef577c3d64c029a50c2ed34b63fe1b
Reviewed-on: https://chromium-review.googlesource.com/1116555Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54054}

src/compiler/allocation-builder.h

@@ -18,8 +18,10 @@ namespace compiler {
 // allocated object and also provides helpers for commonly allocated objects.
 class AllocationBuilder final {
  public:
-  AllocationBuilder(JSGraph* jsgraph, Node* effect, Node* control)
+  AllocationBuilder(JSGraph* jsgraph, const JSHeapBroker* js_heap_broker,
+                    Node* effect, Node* control)
       : jsgraph_(jsgraph),
+        js_heap_broker_(js_heap_broker),
         allocation_(nullptr),
         effect_(effect),
         control_(control) {}
@@ -75,6 +77,10 @@ class AllocationBuilder final {
   void Store(const FieldAccess& access, Handle<Object> value) {
     Store(access, jsgraph()->Constant(value));
   }
+  // Compound store of a constant into a field.
+  void Store(const FieldAccess& access, const ObjectRef& value) {
+    Store(access, jsgraph()->Constant(js_heap_broker(), value));
+  }
 
   void FinishAndChange(Node* node) {
     NodeProperties::SetType(allocation_, NodeProperties::GetType(node));
@@ -90,6 +96,7 @@ class AllocationBuilder final {
 
  protected:
   JSGraph* jsgraph() { return jsgraph_; }
+  const JSHeapBroker* js_heap_broker() { return js_heap_broker_; }
   Isolate* isolate() const { return jsgraph_->isolate(); }
   Graph* graph() { return jsgraph_->graph(); }
   CommonOperatorBuilder* common() { return jsgraph_->common(); }
@@ -97,6 +104,7 @@ class AllocationBuilder final {
 
  private:
   JSGraph* const jsgraph_;
+  const JSHeapBroker* const js_heap_broker_;
   Node* allocation_;
   Node* effect_;
   Node* control_;

src/compiler/js-call-reducer.cc

@@ -1730,7 +1730,7 @@ Reduction JSCallReducer::ReduceArrayFilter(Node* node,
 
   Node* a;  // Construct the output array.
   {
-    AllocationBuilder ab(jsgraph(), effect, control);
+    AllocationBuilder ab(jsgraph(), js_heap_broker(), effect, control);
     ab.Allocate(initial_map->instance_size(), NOT_TENURED, Type::Array());
     ab.Store(AccessBuilder::ForMap(), initial_map);
     Node* empty_fixed_array = jsgraph()->EmptyFixedArrayConstant();

src/compiler/js-create-lowering.h

@@ -23,8 +23,6 @@ namespace compiler {
 // Forward declarations.
 class CommonOperatorBuilder;
 class JSGraph;
-class JSHeapBroker;
-class JSObjectRef;
 class JSOperatorBuilder;
 class MachineOperatorBuilder;
 class SimplifiedOperatorBuilder;
@@ -103,7 +101,7 @@ class V8_EXPORT_PRIVATE JSCreateLowering final
                                     JSObjectRef boilerplate,
                                     PretenureFlag pretenure);
   Node* AllocateLiteralRegExp(Node* effect, Node* control,
-                              Handle<JSRegExp> boilerplate);
+                              JSRegExpRef boilerplate);
 
   Reduction ReduceNewArrayToStubCall(Node* node, Handle<AllocationSite> site);
 

src/compiler/js-heap-broker.cc

@@ -4,6 +4,7 @@
 
 #include "src/compiler/js-heap-broker.h"
 #include "src/objects-inl.h"
+#include "src/objects/js-regexp-inl.h"
 
 namespace v8 {
 namespace internal {
@@ -397,6 +398,33 @@ ObjectRef JSArrayRef::length(const JSHeapBroker* broker) const {
   return ObjectRef(handle(object<JSArray>()->length(), broker->isolate()));
 }
 
+ObjectRef JSRegExpRef::raw_properties_or_hash(
+    const JSHeapBroker* broker) const {
+  AllowHandleDereference allow_handle_dereference;
+  return ObjectRef(
+      handle(object<JSRegExp>()->raw_properties_or_hash(), broker->isolate()));
+}
+
+ObjectRef JSRegExpRef::data(const JSHeapBroker* broker) const {
+  AllowHandleDereference allow_handle_dereference;
+  return ObjectRef(handle(object<JSRegExp>()->data(), broker->isolate()));
+}
+
+ObjectRef JSRegExpRef::source(const JSHeapBroker* broker) const {
+  AllowHandleDereference allow_handle_dereference;
+  return ObjectRef(handle(object<JSRegExp>()->source(), broker->isolate()));
+}
+
+ObjectRef JSRegExpRef::flags(const JSHeapBroker* broker) const {
+  AllowHandleDereference allow_handle_dereference;
+  return ObjectRef(handle(object<JSRegExp>()->flags(), broker->isolate()));
+}
+
+ObjectRef JSRegExpRef::last_index(const JSHeapBroker* broker) const {
+  AllowHandleDereference allow_handle_dereference;
+  return ObjectRef(handle(object<JSRegExp>()->last_index(), broker->isolate()));
+}
+
 int FixedArrayBaseRef::length() const {
   AllowHandleDereference allow_handle_dereference;
   return object<FixedArrayBase>()->length();

src/compiler/js-heap-broker.h

@@ -64,6 +64,7 @@ class HeapObjectType {
   V(JSArray)                     \
   V(JSFunction)                  \
   V(JSObject)                    \
+  V(JSRegExp)                    \
   V(MutableHeapNumber)           \
   V(Name)                        \
   V(NativeContext)               \
@@ -160,6 +161,17 @@ class JSFunctionRef : public JSObjectRef {
   BuiltinFunctionId GetBuiltinFunctionId() const;
 };
 
+class JSRegExpRef : public JSObjectRef {
+ public:
+  explicit JSRegExpRef(Handle<Object> object) : JSObjectRef(object) {}
+
+  ObjectRef raw_properties_or_hash(const JSHeapBroker* broker) const;
+  ObjectRef data(const JSHeapBroker* broker) const;
+  ObjectRef source(const JSHeapBroker* broker) const;
+  ObjectRef flags(const JSHeapBroker* broker) const;
+  ObjectRef last_index(const JSHeapBroker* broker) const;
+};
+
 class HeapNumberRef : public HeapObjectRef {
  public:
   explicit HeapNumberRef(Handle<Object> object);

src/compiler/js-native-context-specialization.cc

@@ -1913,7 +1913,7 @@ JSNativeContextSpecialization::BuildPropertyStore(
             !FLAG_unbox_double_fields) {
           if (access_info.HasTransitionMap()) {
             // Allocate a MutableHeapNumber for the new property.
-            AllocationBuilder a(jsgraph(), effect, control);
+            AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
             a.Allocate(HeapNumber::kSize, NOT_TENURED, Type::OtherInternal());
             a.Store(AccessBuilder::ForMap(),
                     factory()->mutable_heap_number_map());
@@ -2769,7 +2769,7 @@ Node* JSNativeContextSpecialization::BuildExtendPropertiesBackingStore(
                        new_length_and_hash, effect, control);
 
   // Allocate and initialize the new properties.
-  AllocationBuilder a(jsgraph(), effect, control);
+  AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
   a.Allocate(PropertyArray::SizeFor(new_length), NOT_TENURED,
              Type::OtherInternal());
   a.Store(AccessBuilder::ForMap(), jsgraph()->PropertyArrayMapConstant());