[turbofan] Introduce heap copying pass (under flag).

Bug: v8:7790
Change-Id: Ic39751e4509bc4d3280e1ae03162af5a97de7deb
Reviewed-on: https://chromium-review.googlesource.com/1146807
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54614}

BUILD.gn

@@ -1719,6 +1719,8 @@ v8_source_set("v8_base") {
     "src/compiler/js-graph.h",
     "src/compiler/js-heap-broker.cc",
     "src/compiler/js-heap-broker.h",
+    "src/compiler/js-heap-copy-reducer.cc",
+    "src/compiler/js-heap-copy-reducer.h",
     "src/compiler/js-inlining-heuristic.cc",
     "src/compiler/js-inlining-heuristic.h",
     "src/compiler/js-inlining.cc",

src/compiler/js-heap-copy-reducer.cc

@@ -0,0 +1,32 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/compiler/js-heap-copy-reducer.h"
+#include "src/compiler/common-operator.h"
+#include "src/compiler/js-heap-broker.h"
+
+namespace v8 {
+namespace internal {
+namespace compiler {
+
+JSHeapCopyReducer::JSHeapCopyReducer(JSHeapBroker* broker) : broker_(broker) {}
+
+JSHeapBroker* JSHeapCopyReducer::broker() { return broker_; }
+
+Reduction JSHeapCopyReducer::Reduce(Node* node) {
+  switch (node->opcode()) {
+    case IrOpcode::kHeapConstant: {
+      // Call the constructor to make sure the broker copies the data.
+      ObjectRef(broker(), HeapConstantOf(node->op()));
+      break;
+    }
+    default:
+      break;
+  }
+  return NoChange();
+}
+
+}  // namespace compiler
+}  // namespace internal
+}  // namespace v8

src/compiler/js-heap-copy-reducer.h

@@ -0,0 +1,38 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_COMPILER_JS_HEAP_COPY_REDUCER_H_
+#define V8_COMPILER_JS_HEAP_COPY_REDUCER_H_
+
+#include "src/compiler/graph-reducer.h"
+
+namespace v8 {
+namespace internal {
+namespace compiler {
+
+class JSHeapBroker;
+
+// The heap copy reducer makes sure that the relevant heap data referenced
+// by handles embedded in the graph is copied to the heap broker.
+// TODO(jarin) This is just a temporary solution until the graph uses only
+// ObjetRef-derived reference to refer to the heap data.
+class JSHeapCopyReducer : public Reducer {
+ public:
+  explicit JSHeapCopyReducer(JSHeapBroker* broker);
+
+  const char* reducer_name() const override { return "JSHeapCopyReducer"; }
+
+  Reduction Reduce(Node* node) override;
+
+ private:
+  JSHeapBroker* broker();
+
+  JSHeapBroker* broker_;
+};
+
+}  // namespace compiler
+}  // namespace internal
+}  // namespace v8
+
+#endif  // V8_COMPILER_JS_HEAP_COPY_REDUCER_H_

src/compiler/pipeline.cc

@@ -40,6 +40,7 @@
 #include "src/compiler/js-create-lowering.h"
 #include "src/compiler/js-generic-lowering.h"
 #include "src/compiler/js-heap-broker.h"
+#include "src/compiler/js-heap-copy-reducer.h"
 #include "src/compiler/js-inlining-heuristic.h"
 #include "src/compiler/js-intrinsic-lowering.h"
 #include "src/compiler/js-native-context-specialization.h"
@@ -1279,6 +1280,20 @@ struct UntyperPhase {
   }
 };
 
+struct CopyMetadataForConcurrentCompilePhase {
+  static const char* phase_name() {
+    return "copy metadata for concurrent compile";
+  }
+
+  void Run(PipelineData* data, Zone* temp_zone) {
+    GraphReducer graph_reducer(temp_zone, data->graph(),
+                               data->jsgraph()->Dead());
+    JSHeapCopyReducer heap_copy_reducer(data->js_heap_broker());
+    AddReducer(data, &graph_reducer, &heap_copy_reducer);
+    graph_reducer.ReduceGraph();
+  }
+};
+
 struct TypedLoweringPhase {
   static const char* phase_name() { return "typed lowering"; }
 
@@ -2015,15 +2030,19 @@ bool PipelineImpl::CreateGraph() {
     Run<TyperPhase>(&typer);
     RunPrintAndVerify(TyperPhase::phase_name());
 
+    // Do some hacky things to prepare for the optimization phase.
+    // (caching handles, etc.).
+    Run<ConcurrentOptimizationPrepPhase>();
+
+    if (FLAG_concurrent_compiler_frontend) {
+      Run<CopyMetadataForConcurrentCompilePhase>();
+    }
+
     // Lower JSOperators where we can determine types.
     Run<TypedLoweringPhase>();
     RunPrintAndVerify(TypedLoweringPhase::phase_name());
   }
 
-  // Do some hacky things to prepare for the optimization phase.
-  // (caching handles, etc.).
-  Run<ConcurrentOptimizationPrepPhase>();
-
   data->EndPhaseKind();
 
   return true;

src/flag-definitions.h

@@ -380,6 +380,8 @@ DEFINE_INT(concurrent_recompilation_delay, 0,
            "artificial compilation delay in ms")
 DEFINE_BOOL(block_concurrent_recompilation, false,
             "block queued jobs until released")
+DEFINE_BOOL(concurrent_compiler_frontend, false,
+            "run optimizing compiler's frontend phases on a separate thread")
 
 // Flags for stress-testing the compiler.
 DEFINE_INT(stress_runs, 0, "number of stress runs")