AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[turbofan] Make the JSHeapBroker a member of ObjectRef.

Browse Source 
This makes it more convenient to work with brokerized data.

Bug: v8:7790
Change-Id: I7ffb4054b809c10c67787b2fb89a05e8ce8f4575
Reviewed-on: https://chromium-review.googlesource.com/1138248
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54480}
This commit is contained in:
Georg Neis 2018-07-16 19:26:37 +02:00 committed by Commit Bot
parent b95def3488
commit 56d21252c9
17 changed files with 418 additions and 456 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/compiler/allocation-builder.h
View File

@ -18,10 +18,8 @@ namespace compiler {
// allocated object and also provides helpers for commonly allocated objects.
class AllocationBuilder final {
public:
AllocationBuilder(JSGraph* jsgraph, const JSHeapBroker* js_heap_broker,
Node* effect, Node* control)
AllocationBuilder(JSGraph* jsgraph, Node* effect, Node* control)
: jsgraph_(jsgraph),
js_heap_broker_(js_heap_broker),
allocation_(nullptr),
effect_(effect),
control_(control) {}
@ -79,7 +77,7 @@ class AllocationBuilder final {
}
// Compound store of a constant into a field.
void Store(const FieldAccess& access, const ObjectRef& value) {
Store(access, jsgraph()->Constant(js_heap_broker(), value));
Store(access, jsgraph()->Constant(value));
}
void FinishAndChange(Node* node) {
@ -96,7 +94,6 @@ class AllocationBuilder final {
protected:
JSGraph* jsgraph() { return jsgraph_; }
const JSHeapBroker* js_heap_broker() { return js_heap_broker_; }
Isolate* isolate() const { return jsgraph_->isolate(); }
Graph* graph() { return jsgraph_->graph(); }
CommonOperatorBuilder* common() { return jsgraph_->common(); }
@ -104,7 +101,6 @@ class AllocationBuilder final {
private:
JSGraph* const jsgraph_;
const JSHeapBroker* const js_heap_broker_;
Node* allocation_;
Node* effect_;
Node* control_;

4
src/compiler/common-operator-reducer.cc
View File

@ -27,8 +27,8 @@ Decision DecideCondition(const JSHeapBroker* broker, Node* const cond) {
}
case IrOpcode::kHeapConstant: {
HeapObjectMatcher mcond(cond);
ObjectRef object(mcond.Value());
return object.BooleanValue(broker) ? Decision::kTrue : Decision::kFalse;
return mcond.Ref(broker).BooleanValue() ? Decision::kTrue
: Decision::kFalse;
}
default:
return Decision::kUnknown;

7
src/compiler/constant-folding-reducer.cc
View File

@ -37,12 +37,11 @@ Reduction ConstantFoldingReducer::Reduce(Node* node) {
if (!upper.IsNone()) {
Node* replacement = nullptr;
if (upper.IsHeapConstant()) {
replacement = jsgraph()->Constant(js_heap_broker(),
upper.AsHeapConstant()->Ref());
replacement = jsgraph()->Constant(upper.AsHeapConstant()->Ref());
} else if (upper.Is(Type::MinusZero())) {
Factory* factory = jsgraph()->isolate()->factory();
ObjectRef minus_zero(factory->minus_zero_value());
replacement = jsgraph()->Constant(js_heap_broker(), minus_zero);
ObjectRef minus_zero(js_heap_broker(), factory->minus_zero_value());
replacement = jsgraph()->Constant(minus_zero);
} else if (upper.Is(Type::NaN())) {
replacement = jsgraph()->NaNConstant();
} else if (upper.Is(Type::Null())) {

8
src/compiler/js-call-reducer.cc
View File

@ -1730,7 +1730,7 @@ Reduction JSCallReducer::ReduceArrayFilter(Node* node,
Node* a; // Construct the output array.
{
AllocationBuilder ab(jsgraph(), js_heap_broker(), effect, control);
AllocationBuilder ab(jsgraph(), effect, control);
ab.Allocate(initial_map->instance_size(), NOT_TENURED, Type::Array());
ab.Store(AccessBuilder::ForMap(), initial_map);
Node* empty_fixed_array = jsgraph()->EmptyFixedArrayConstant();
@ -1739,9 +1739,9 @@ Reduction JSCallReducer::ReduceArrayFilter(Node* node,
ab.Store(AccessBuilder::ForJSArrayLength(packed_kind),
jsgraph()->ZeroConstant());
for (int i = 0; i < initial_map->GetInObjectProperties(); ++i) {
ab.Store(
AccessBuilder::ForJSObjectInObjectProperty(MapRef(initial_map), i),
jsgraph()->UndefinedConstant());
ab.Store(AccessBuilder::ForJSObjectInObjectProperty(
MapRef(js_heap_broker(), initial_map), i),
jsgraph()->UndefinedConstant());
}
a = effect = ab.Finish();
}

24
src/compiler/js-context-specialization.cc
View File

@ -105,7 +105,7 @@ base::Optional<ContextRef> GetSpecializationContext(
Maybe<OuterContext> maybe_outer) {
switch (node->opcode()) {
case IrOpcode::kHeapConstant: {
HeapObjectRef object(HeapConstantOf(node->op()));
HeapObjectRef object(broker, HeapConstantOf(node->op()));
if (object.IsContext()) return object.AsContext();
break;
}
@ -114,7 +114,7 @@ base::Optional<ContextRef> GetSpecializationContext(
if (maybe_outer.To(&outer) && IsContextParameter(node) &&
*distance >= outer.distance) {
*distance -= outer.distance;
return ContextRef(outer.context);
return ContextRef(broker, outer.context);
}
break;
}
@ -146,28 +146,26 @@ Reduction JSContextSpecialization::ReduceJSLoadContext(Node* node) {
// Now walk up the concrete context chain for the remaining depth.
ContextRef concrete = maybe_concrete.value();
for (; depth > 0; --depth) {
concrete = concrete.previous(js_heap_broker()).value();
concrete = concrete.previous().value();
}
if (!access.immutable()) {
// We found the requested context object but since the context slot is
// mutable we can only partially reduce the load.
return SimplifyJSLoadContext(
node, jsgraph()->Constant(js_heap_broker(), concrete), depth);
return SimplifyJSLoadContext(node, jsgraph()->Constant(concrete), depth);
}
// This will hold the final value, if we can figure it out.
base::Optional<ObjectRef> maybe_value;
maybe_value =
concrete.get(js_heap_broker(), static_cast<int>(access.index()));
maybe_value = concrete.get(static_cast<int>(access.index()));
if (maybe_value.has_value() && !maybe_value->IsSmi()) {
// Even though the context slot is immutable, the context might have escaped
// before the function to which it belongs has initialized the slot.
// We must be conservative and check if the value in the slot is currently
// the hole or undefined. Only if it is neither of these, can we be sure
// that it won't change anymore.
OddballType oddball_type = maybe_value->oddball_type(js_heap_broker());
OddballType oddball_type = maybe_value->oddball_type();
if (oddball_type == OddballType::kUndefined ||
oddball_type == OddballType::kHole) {
maybe_value.reset();
@ -175,15 +173,14 @@ Reduction JSContextSpecialization::ReduceJSLoadContext(Node* node) {
}
if (!maybe_value.has_value()) {
return SimplifyJSLoadContext(
node, jsgraph()->Constant(js_heap_broker(), concrete), depth);
return SimplifyJSLoadContext(node, jsgraph()->Constant(concrete), depth);
}
// Success. The context load can be replaced with the constant.
// TODO(titzer): record the specialization for sharing code across
// multiple contexts that have the same value in the corresponding context
// slot.
Node* constant = jsgraph_->Constant(js_heap_broker(), *maybe_value);
Node* constant = jsgraph_->Constant(*maybe_value);
ReplaceWithValue(node, constant);
return Replace(constant);
}
@ -210,11 +207,10 @@ Reduction JSContextSpecialization::ReduceJSStoreContext(Node* node) {
// Now walk up the concrete context chain for the remaining depth.
ContextRef concrete = maybe_concrete.value();
for (; depth > 0; --depth) {
concrete = concrete.previous(js_heap_broker()).value();
concrete = concrete.previous().value();
}
return SimplifyJSStoreContext(
node, jsgraph()->Constant(js_heap_broker(), concrete), depth);
return SimplifyJSStoreContext(node, jsgraph()->Constant(concrete), depth);
}

268
src/compiler/js-create-lowering.cc
View File

@ -42,13 +42,10 @@ Node* GetArgumentsFrameState(Node* frame_state) {
// Checks whether allocation using the given target and new.target can be
// inlined.
bool IsAllocationInlineable(const JSFunctionRef& target,
const JSFunctionRef& new_target,
const JSHeapBroker* broker) {
const JSFunctionRef& new_target) {
return new_target.has_initial_map() &&
!new_target.initial_map(broker).is_dictionary_map() &&
new_target.initial_map(broker)
.constructor_or_backpointer(broker)
.equals(target);
!new_target.initial_map().is_dictionary_map() &&
new_target.initial_map().constructor_or_backpointer().equals(target);
}
// When initializing arrays, we'll unfold the loop if the number of
@ -136,15 +133,13 @@ Reduction JSCreateLowering::ReduceJSCreate(Node* node) {
if (!original_constructor.IsConstructor()) return NoChange();
// Check if we can inline the allocation.
if (!IsAllocationInlineable(constructor, original_constructor,
js_heap_broker())) {
if (!IsAllocationInlineable(constructor, original_constructor)) {
return NoChange();
}
// Add a dependency on the {initial_map} to make sure that this code is
// deoptimized whenever the {initial_map} changes.
MapRef initial_map =
original_constructor.DependOnInitialMap(js_heap_broker(), dependencies());
MapRef initial_map = original_constructor.DependOnInitialMap(dependencies());
// Force completion of inobject slack tracking before
// generating code to finalize the instance size.
@ -153,7 +148,7 @@ Reduction JSCreateLowering::ReduceJSCreate(Node* node) {
// Emit code to allocate the JSObject instance for the
// {original_constructor}.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
AllocationBuilder a(jsgraph(), effect, control);
a.Allocate(slack_tracking_result.instance_size);
a.Store(AccessBuilder::ForMap(), initial_map);
a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(),
@ -178,7 +173,8 @@ Reduction JSCreateLowering::ReduceJSCreateArguments(Node* node) {
Node* const outer_state = frame_state->InputAt(kFrameStateOuterStateInput);
Node* const control = graph()->start();
FrameStateInfo state_info = FrameStateInfoOf(frame_state->op());
SharedFunctionInfoRef shared(state_info.shared_info().ToHandleChecked());
SharedFunctionInfoRef shared(js_heap_broker(),
state_info.shared_info().ToHandleChecked());
// Use the ArgumentsAccessStub for materializing both mapped and unmapped
// arguments object, but only for non-inlined (i.e. outermost) frames.
@ -203,13 +199,11 @@ Reduction JSCreateLowering::ReduceJSCreateArguments(Node* node) {
&has_aliased_arguments);
// Load the arguments object map.
Node* const arguments_map = jsgraph()->Constant(
js_heap_broker(),
has_aliased_arguments
? native_context_ref().fast_aliased_arguments_map(
js_heap_broker())
: native_context_ref().sloppy_arguments_map(js_heap_broker()));
? native_context_ref().fast_aliased_arguments_map()
: native_context_ref().sloppy_arguments_map());
// Actually allocate and initialize the arguments object.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
AllocationBuilder a(jsgraph(), effect, control);
Node* properties = jsgraph()->EmptyFixedArrayConstant();
STATIC_ASSERT(JSSloppyArgumentsObject::kSize == 5 * kPointerSize);
a.Allocate(JSSloppyArgumentsObject::kSize);
@ -235,11 +229,10 @@ Reduction JSCreateLowering::ReduceJSCreateArguments(Node* node) {
graph()->NewNode(simplified()->NewArgumentsElements(0),
arguments_frame, arguments_length, effect);
// Load the arguments object map.
Node* const arguments_map = jsgraph()->Constant(
js_heap_broker(),
native_context_ref().strict_arguments_map(js_heap_broker()));
Node* const arguments_map =
jsgraph()->Constant(native_context_ref().strict_arguments_map());
// Actually allocate and initialize the arguments object.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
AllocationBuilder a(jsgraph(), effect, control);
Node* properties = jsgraph()->EmptyFixedArrayConstant();
STATIC_ASSERT(JSStrictArgumentsObject::kSize == 4 * kPointerSize);
a.Allocate(JSStrictArgumentsObject::kSize);
@ -267,11 +260,9 @@ Reduction JSCreateLowering::ReduceJSCreateArguments(Node* node) {
arguments_frame, rest_length, effect);
// Load the JSArray object map.
Node* const jsarray_map = jsgraph()->Constant(
js_heap_broker(),
native_context_ref().js_array_fast_elements_map_index(
js_heap_broker()));
native_context_ref().js_array_fast_elements_map_index());
// Actually allocate and initialize the jsarray.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
AllocationBuilder a(jsgraph(), effect, control);
Node* properties = jsgraph()->EmptyFixedArrayConstant();
STATIC_ASSERT(JSArray::kSize == 4 * kPointerSize);
a.Allocate(JSArray::kSize);
@ -313,13 +304,11 @@ Reduction JSCreateLowering::ReduceJSCreateArguments(Node* node) {
effect = elements->op()->EffectOutputCount() > 0 ? elements : effect;
// Load the arguments object map.
Node* const arguments_map = jsgraph()->Constant(
js_heap_broker(),
has_aliased_arguments
? native_context_ref().fast_aliased_arguments_map(
js_heap_broker())
: native_context_ref().sloppy_arguments_map(js_heap_broker()));
? native_context_ref().fast_aliased_arguments_map()
: native_context_ref().sloppy_arguments_map());
// Actually allocate and initialize the arguments object.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
AllocationBuilder a(jsgraph(), effect, control);
Node* properties = jsgraph()->EmptyFixedArrayConstant();
int length = args_state_info.parameter_count() - 1; // Minus receiver.
STATIC_ASSERT(JSSloppyArgumentsObject::kSize == 5 * kPointerSize);
@ -352,11 +341,10 @@ Reduction JSCreateLowering::ReduceJSCreateArguments(Node* node) {
Node* const elements = AllocateArguments(effect, control, args_state);
effect = elements->op()->EffectOutputCount() > 0 ? elements : effect;
// Load the arguments object map.
Node* const arguments_map = jsgraph()->Constant(
js_heap_broker(),
native_context_ref().strict_arguments_map(js_heap_broker()));
Node* const arguments_map =
jsgraph()->Constant(native_context_ref().strict_arguments_map());
// Actually allocate and initialize the arguments object.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
AllocationBuilder a(jsgraph(), effect, control);
Node* properties = jsgraph()->EmptyFixedArrayConstant();
int length = args_state_info.parameter_count() - 1; // Minus receiver.
STATIC_ASSERT(JSStrictArgumentsObject::kSize == 4 * kPointerSize);
@ -391,11 +379,9 @@ Reduction JSCreateLowering::ReduceJSCreateArguments(Node* node) {
effect = elements->op()->EffectOutputCount() > 0 ? elements : effect;
// Load the JSArray object map.
Node* const jsarray_map = jsgraph()->Constant(
js_heap_broker(),
native_context_ref().js_array_fast_elements_map_index(
js_heap_broker()));
native_context_ref().js_array_fast_elements_map_index());
// Actually allocate and initialize the jsarray.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
AllocationBuilder a(jsgraph(), effect, control);
Node* properties = jsgraph()->EmptyFixedArrayConstant();
// -1 to minus receiver
@ -439,18 +425,17 @@ Reduction JSCreateLowering::ReduceJSCreateGeneratorObject(Node* node) {
// Add a dependency on the {initial_map} to make sure that this code is
// deoptimized whenever the {initial_map} changes.
MapRef initial_map(
js_function.DependOnInitialMap(js_heap_broker(), dependencies()));
MapRef initial_map = js_function.DependOnInitialMap(dependencies());
DCHECK(initial_map.instance_type() == JS_GENERATOR_OBJECT_TYPE ||
initial_map.instance_type() == JS_ASYNC_GENERATOR_OBJECT_TYPE);
// Allocate a register file.
SharedFunctionInfoRef shared(js_function.shared(js_heap_broker()));
SharedFunctionInfoRef shared = js_function.shared();
DCHECK(shared.HasBytecodeArray());
int parameter_count_no_receiver = shared.internal_formal_parameter_count();
int size =
parameter_count_no_receiver + shared.GetBytecodeArrayRegisterCount();
AllocationBuilder ab(jsgraph(), js_heap_broker(), effect, control);
AllocationBuilder ab(jsgraph(), effect, control);
ab.AllocateArray(size, factory()->fixed_array_map());
for (int i = 0; i < size; ++i) {
ab.Store(AccessBuilder::ForFixedArraySlot(i),
@ -459,7 +444,7 @@ Reduction JSCreateLowering::ReduceJSCreateGeneratorObject(Node* node) {
Node* parameters_and_registers = effect = ab.Finish();
// Emit code to allocate the JS[Async]GeneratorObject instance.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
AllocationBuilder a(jsgraph(), effect, control);
a.Allocate(slack_tracking_result.instance_size);
Node* empty_fixed_array = jsgraph()->EmptyFixedArrayConstant();
Node* undefined = jsgraph()->UndefinedConstant();
@ -528,7 +513,7 @@ Reduction JSCreateLowering::ReduceNewArray(Node* node, Node* length,
Node* properties = jsgraph()->EmptyFixedArrayConstant();
// Perform the allocation of the actual JSArray object.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
AllocationBuilder a(jsgraph(), effect, control);
a.Allocate(initial_map->instance_size(), pretenure);
a.Store(AccessBuilder::ForMap(), initial_map);
a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(), properties);
@ -536,7 +521,8 @@ Reduction JSCreateLowering::ReduceNewArray(Node* node, Node* length,
a.Store(AccessBuilder::ForJSArrayLength(initial_map->elements_kind()),
length);
for (int i = 0; i < initial_map->GetInObjectProperties(); ++i) {
a.Store(AccessBuilder::ForJSObjectInObjectProperty(MapRef(initial_map), i),
a.Store(AccessBuilder::ForJSObjectInObjectProperty(
MapRef(js_heap_broker(), initial_map), i),
jsgraph()->UndefinedConstant());
}
RelaxControls(node);
@ -574,14 +560,15 @@ Reduction JSCreateLowering::ReduceNewArray(Node* node, Node* length,
Node* properties = jsgraph()->EmptyFixedArrayConstant();
// Perform the allocation of the actual JSArray object.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
AllocationBuilder a(jsgraph(), effect, control);
a.Allocate(initial_map->instance_size(), pretenure);
a.Store(AccessBuilder::ForMap(), initial_map);
a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(), properties);
a.Store(AccessBuilder::ForJSObjectElements(), elements);
a.Store(AccessBuilder::ForJSArrayLength(elements_kind), length);
for (int i = 0; i < initial_map->GetInObjectProperties(); ++i) {
a.Store(AccessBuilder::ForJSObjectInObjectProperty(MapRef(initial_map), i),
a.Store(AccessBuilder::ForJSObjectInObjectProperty(
MapRef(js_heap_broker(), initial_map), i),
jsgraph()->UndefinedConstant());
}
RelaxControls(node);
@ -630,14 +617,15 @@ Reduction JSCreateLowering::ReduceNewArray(Node* node,
Node* length = jsgraph()->Constant(static_cast<int>(values.size()));
// Perform the allocation of the actual JSArray object.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
AllocationBuilder a(jsgraph(), effect, control);
a.Allocate(initial_map->instance_size(), pretenure);
a.Store(AccessBuilder::ForMap(), initial_map);
a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(), properties);
a.Store(AccessBuilder::ForJSObjectElements(), elements);
a.Store(AccessBuilder::ForJSArrayLength(elements_kind), length);
for (int i = 0; i < initial_map->GetInObjectProperties(); ++i) {
a.Store(AccessBuilder::ForJSObjectInObjectProperty(MapRef(initial_map), i),
a.Store(AccessBuilder::ForJSObjectInObjectProperty(
MapRef(js_heap_broker(), initial_map), i),
jsgraph()->UndefinedConstant());
}
RelaxControls(node);
@ -730,9 +718,9 @@ Reduction JSCreateLowering::ReduceJSCreateArray(Node* node) {
DCHECK(original_constructor->IsConstructor());
// Check if we can inline the allocation.
if (IsAllocationInlineable(JSFunctionRef(constructor),
JSFunctionRef(original_constructor),
js_heap_broker())) {
if (IsAllocationInlineable(
JSFunctionRef(js_heap_broker(), constructor),
JSFunctionRef(js_heap_broker(), original_constructor))) {
// Force completion of inobject slack tracking before
// generating code to finalize the instance size.
original_constructor->CompleteInobjectSlackTrackingIfActive();
@ -856,10 +844,10 @@ Reduction JSCreateLowering::ReduceJSCreateArrayIterator(Node* node) {
Node* control = NodeProperties::GetControlInput(node);
// Create the JSArrayIterator result.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
AllocationBuilder a(jsgraph(), effect, control);
a.Allocate(JSArrayIterator::kSize, NOT_TENURED, Type::OtherObject());
a.Store(AccessBuilder::ForMap(),
native_context_ref().initial_array_iterator_map(js_heap_broker()));
native_context_ref().initial_array_iterator_map());
a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(),
jsgraph()->EmptyFixedArrayConstant());
a.Store(AccessBuilder::ForJSObjectElements(),
@ -877,7 +865,6 @@ Reduction JSCreateLowering::ReduceJSCreateArrayIterator(Node* node) {
namespace {
MapRef MapForCollectionIterationKind(const NativeContextRef& native_context,
const JSHeapBroker* broker,
CollectionKind collection_kind,
IterationKind iteration_kind) {
switch (collection_kind) {
@ -886,19 +873,19 @@ MapRef MapForCollectionIterationKind(const NativeContextRef& native_context,
case IterationKind::kKeys:
UNREACHABLE();
case IterationKind::kValues:
return native_context.set_value_iterator_map(broker);
return native_context.set_value_iterator_map();
case IterationKind::kEntries:
return native_context.set_key_value_iterator_map(broker);
return native_context.set_key_value_iterator_map();
}
break;
case CollectionKind::kMap:
switch (iteration_kind) {
case IterationKind::kKeys:
return native_context.map_key_iterator_map(broker);
return native_context.map_key_iterator_map();
case IterationKind::kValues:
return native_context.map_value_iterator_map(broker);
return native_context.map_value_iterator_map();
case IterationKind::kEntries:
return native_context.map_key_value_iterator_map(broker);
return native_context.map_key_value_iterator_map();
}
break;
}
@ -922,12 +909,11 @@ Reduction JSCreateLowering::ReduceJSCreateCollectionIterator(Node* node) {
iterated_object, effect, control);
// Create the JSArrayIterator result.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
AllocationBuilder a(jsgraph(), effect, control);
a.Allocate(JSCollectionIterator::kSize, NOT_TENURED, Type::OtherObject());
a.Store(
AccessBuilder::ForMap(),
MapForCollectionIterationKind(native_context_ref(), js_heap_broker(),
p.collection_kind(), p.iteration_kind()));
a.Store(AccessBuilder::ForMap(),
MapForCollectionIterationKind(
native_context_ref(), p.collection_kind(), p.iteration_kind()));
a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(),
jsgraph()->EmptyFixedArrayConstant());
a.Store(AccessBuilder::ForJSObjectElements(),
@ -946,7 +932,7 @@ Reduction JSCreateLowering::ReduceJSCreateBoundFunction(Node* node) {
CreateBoundFunctionParameters const& p =
CreateBoundFunctionParametersOf(node->op());
int const arity = static_cast<int>(p.arity());
MapRef const map(p.map());
MapRef const map(js_heap_broker(), p.map());
Node* bound_target_function = NodeProperties::GetValueInput(node, 0);
Node* bound_this = NodeProperties::GetValueInput(node, 1);
Node* effect = NodeProperties::GetEffectInput(node);
@ -955,7 +941,7 @@ Reduction JSCreateLowering::ReduceJSCreateBoundFunction(Node* node) {
// Create the [[BoundArguments]] for the result.
Node* bound_arguments = jsgraph()->EmptyFixedArrayConstant();
if (arity > 0) {
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
AllocationBuilder a(jsgraph(), effect, control);
a.AllocateArray(arity, factory()->fixed_array_map());
for (int i = 0; i < arity; ++i) {
a.Store(AccessBuilder::ForFixedArraySlot(i),
@ -965,7 +951,7 @@ Reduction JSCreateLowering::ReduceJSCreateBoundFunction(Node* node) {
}
// Create the JSBoundFunction result.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
AllocationBuilder a(jsgraph(), effect, control);
a.Allocate(JSBoundFunction::kSize, NOT_TENURED, Type::BoundFunction());
a.Store(AccessBuilder::ForMap(), map);
a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(),
@ -985,9 +971,9 @@ Reduction JSCreateLowering::ReduceJSCreateClosure(Node* node) {
DisallowHeapAccess no_heap_access;
DCHECK_EQ(IrOpcode::kJSCreateClosure, node->opcode());
CreateClosureParameters const& p = CreateClosureParametersOf(node->op());
SharedFunctionInfoRef shared(p.shared_info());
HeapObjectRef feedback_cell(p.feedback_cell());
HeapObjectRef code(p.code());
SharedFunctionInfoRef shared(js_heap_broker(), p.shared_info());
HeapObjectRef feedback_cell(js_heap_broker(), p.feedback_cell());
HeapObjectRef code(js_heap_broker(), p.code());
Node* effect = NodeProperties::GetEffectInput(node);
Node* control = NodeProperties::GetControlInput(node);
Node* context = NodeProperties::GetContextInput(node);
@ -995,13 +981,13 @@ Reduction JSCreateLowering::ReduceJSCreateClosure(Node* node) {
// Use inline allocation of closures only for instantiation sites that have
// seen more than one instantiation, this simplifies the generated code and
// also serves as a heuristic of which allocation sites benefit from it.
if (!feedback_cell.map(js_heap_broker())
.equals(MapRef(factory()->many_closures_cell_map()))) {
if (!feedback_cell.map().equals(
MapRef(js_heap_broker(), factory()->many_closures_cell_map()))) {
return NoChange();
}
MapRef function_map = native_context_ref().GetFunctionMapFromIndex(
js_heap_broker(), shared.function_map_index());
MapRef function_map =
native_context_ref().GetFunctionMapFromIndex(shared.function_map_index());
DCHECK(!function_map.IsInobjectSlackTrackingInProgress());
DCHECK(!function_map.is_dictionary_map());
@ -1018,7 +1004,7 @@ Reduction JSCreateLowering::ReduceJSCreateClosure(Node* node) {
// Emit code to allocate the JSFunction instance.
STATIC_ASSERT(JSFunction::kSizeWithoutPrototype == 7 * kPointerSize);
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
AllocationBuilder a(jsgraph(), effect, control);
a.Allocate(function_map.instance_size(), pretenure, Type::Function());
a.Store(AccessBuilder::ForMap(), function_map);
a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(),
@ -1054,7 +1040,7 @@ Reduction JSCreateLowering::ReduceJSCreateIterResultObject(Node* node) {
handle(native_context()->iterator_result_map(), isolate()));
// Emit code to allocate the JSIteratorResult instance.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, graph()->start());
AllocationBuilder a(jsgraph(), effect, graph()->start());
a.Allocate(JSIteratorResult::kSize);
a.Store(AccessBuilder::ForMap(), iterator_result_map);
a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(),
@ -1076,7 +1062,7 @@ Reduction JSCreateLowering::ReduceJSCreateStringIterator(Node* node) {
Node* map = jsgraph()->HeapConstant(
handle(native_context()->string_iterator_map(), isolate()));
// Allocate new iterator and attach the iterator to this string.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, graph()->start());
AllocationBuilder a(jsgraph(), effect, graph()->start());
a.Allocate(JSStringIterator::kSize, NOT_TENURED, Type::OtherObject());
a.Store(AccessBuilder::ForMap(), map);
a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(),
@ -1101,7 +1087,7 @@ Reduction JSCreateLowering::ReduceJSCreateKeyValueArray(Node* node) {
Node* properties = jsgraph()->EmptyFixedArrayConstant();
Node* length = jsgraph()->Constant(2);
AllocationBuilder aa(jsgraph(), js_heap_broker(), effect, graph()->start());
AllocationBuilder aa(jsgraph(), effect, graph()->start());
aa.AllocateArray(2, factory()->fixed_array_map());
aa.Store(AccessBuilder::ForFixedArrayElement(PACKED_ELEMENTS),
jsgraph()->ZeroConstant(), key);
@ -1109,7 +1095,7 @@ Reduction JSCreateLowering::ReduceJSCreateKeyValueArray(Node* node) {
jsgraph()->OneConstant(), value);
Node* elements = aa.Finish();
AllocationBuilder a(jsgraph(), js_heap_broker(), elements, graph()->start());
AllocationBuilder a(jsgraph(), elements, graph()->start());
a.Allocate(JSArray::kSize);
a.Store(AccessBuilder::ForMap(), array_map);
a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(), properties);
@ -1127,7 +1113,7 @@ Reduction JSCreateLowering::ReduceJSCreatePromise(Node* node) {
Handle<Map> promise_map(native_context()->promise_function()->initial_map(),
isolate());
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, graph()->start());
AllocationBuilder a(jsgraph(), effect, graph()->start());
a.Allocate(promise_map->instance_size());
a.Store(AccessBuilder::ForMap(), promise_map);
a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(),
@ -1156,19 +1142,18 @@ Reduction JSCreateLowering::ReduceJSCreateLiteralArrayOrObject(Node* node) {
Node* effect = NodeProperties::GetEffectInput(node);
Node* control = NodeProperties::GetControlInput(node);
FeedbackVectorRef feedback_vector(p.feedback().vector());
ObjectRef feedback =
feedback_vector.get(js_heap_broker(), p.feedback().slot());
FeedbackVectorRef feedback_vector(js_heap_broker(), p.feedback().vector());
ObjectRef feedback = feedback_vector.get(p.feedback().slot());
if (feedback.IsAllocationSite()) {
AllocationSiteRef site = feedback.AsAllocationSite();
if (site.IsFastLiteral(js_heap_broker())) {
if (site.IsFastLiteral()) {
PretenureFlag pretenure = NOT_TENURED;
if (FLAG_allocation_site_pretenuring) {
pretenure = dependencies()->DependOnPretenureMode(
site.object<AllocationSite>());
}
dependencies()->DependOnElementsKinds(site.object<AllocationSite>());
JSObjectRef boilerplate = site.boilerplate(js_heap_broker());
JSObjectRef boilerplate = site.boilerplate();
Node* value = effect =
AllocateFastLiteral(effect, control, boilerplate, pretenure);
ReplaceWithValue(node, value, effect, control);
@ -1213,13 +1198,14 @@ Reduction JSCreateLowering::ReduceJSCreateEmptyLiteralObject(Node* node) {
Node* properties = jsgraph()->EmptyFixedArrayConstant();
// Perform the allocation of the actual JSArray object.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
AllocationBuilder a(jsgraph(), effect, control);
a.Allocate(map->instance_size());
a.Store(AccessBuilder::ForMap(), js_object_map);
a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(), properties);
a.Store(AccessBuilder::ForJSObjectElements(), elements);
for (int i = 0; i < map->GetInObjectProperties(); i++) {
a.Store(AccessBuilder::ForJSObjectInObjectProperty(MapRef(map), i),
a.Store(AccessBuilder::ForJSObjectInObjectProperty(
MapRef(js_heap_broker(), map), i),
jsgraph()->UndefinedConstant());
}
@ -1235,9 +1221,8 @@ Reduction JSCreateLowering::ReduceJSCreateLiteralRegExp(Node* node) {
Node* effect = NodeProperties::GetEffectInput(node);
Node* control = NodeProperties::GetControlInput(node);
FeedbackVectorRef feedback_vector(p.feedback().vector());
ObjectRef feedback =
feedback_vector.get(js_heap_broker(), p.feedback().slot());
FeedbackVectorRef feedback_vector(js_heap_broker(), p.feedback().vector());
ObjectRef feedback = feedback_vector.get(p.feedback().slot());
if (feedback.IsJSRegExp()) {
JSRegExpRef boilerplate = feedback.AsJSRegExp();
Node* value = effect = AllocateLiteralRegExp(effect, control, boilerplate);
@ -1252,7 +1237,7 @@ Reduction JSCreateLowering::ReduceJSCreateFunctionContext(Node* node) {
DCHECK_EQ(IrOpcode::kJSCreateFunctionContext, node->opcode());
const CreateFunctionContextParameters& parameters =
CreateFunctionContextParametersOf(node->op());
ScopeInfoRef scope_info(parameters.scope_info());
ScopeInfoRef scope_info(js_heap_broker(), parameters.scope_info());
int slot_count = parameters.slot_count();
ScopeType scope_type = parameters.scope_type();
@ -1263,7 +1248,7 @@ Reduction JSCreateLowering::ReduceJSCreateFunctionContext(Node* node) {
Node* control = NodeProperties::GetControlInput(node);
Node* context = NodeProperties::GetContextInput(node);
Node* extension = jsgraph()->TheHoleConstant();
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
AllocationBuilder a(jsgraph(), effect, control);
STATIC_ASSERT(Context::MIN_CONTEXT_SLOTS == 4); // Ensure fully covered.
int context_length = slot_count + Context::MIN_CONTEXT_SLOTS;
Handle<Map> map;
@ -1298,13 +1283,13 @@ Reduction JSCreateLowering::ReduceJSCreateFunctionContext(Node* node) {
Reduction JSCreateLowering::ReduceJSCreateWithContext(Node* node) {
DisallowHeapAccess no_heap_access;
DCHECK_EQ(IrOpcode::kJSCreateWithContext, node->opcode());
ScopeInfoRef scope_info(ScopeInfoOf(node->op()));
ScopeInfoRef scope_info(js_heap_broker(), ScopeInfoOf(node->op()));
Node* extension = NodeProperties::GetValueInput(node, 0);
Node* effect = NodeProperties::GetEffectInput(node);
Node* control = NodeProperties::GetControlInput(node);
Node* context = NodeProperties::GetContextInput(node);
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
AllocationBuilder a(jsgraph(), effect, control);
STATIC_ASSERT(Context::MIN_CONTEXT_SLOTS == 4); // Ensure fully covered.
a.AllocateContext(Context::MIN_CONTEXT_SLOTS, factory()->with_context_map());
a.Store(AccessBuilder::ForContextSlot(Context::SCOPE_INFO_INDEX), scope_info);
@ -1320,14 +1305,14 @@ Reduction JSCreateLowering::ReduceJSCreateWithContext(Node* node) {
Reduction JSCreateLowering::ReduceJSCreateCatchContext(Node* node) {
DisallowHeapAccess no_heap_access;
DCHECK_EQ(IrOpcode::kJSCreateCatchContext, node->opcode());
ScopeInfoRef scope_info(ScopeInfoOf(node->op()));
ScopeInfoRef scope_info(js_heap_broker(), ScopeInfoOf(node->op()));
Node* exception = NodeProperties::GetValueInput(node, 0);
Node* effect = NodeProperties::GetEffectInput(node);
Node* control = NodeProperties::GetControlInput(node);
Node* context = NodeProperties::GetContextInput(node);
Node* extension = jsgraph()->TheHoleConstant();
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
AllocationBuilder a(jsgraph(), effect, control);
STATIC_ASSERT(Context::MIN_CONTEXT_SLOTS == 4); // Ensure fully covered.
a.AllocateContext(Context::MIN_CONTEXT_SLOTS + 1,
factory()->catch_context_map());
@ -1346,7 +1331,7 @@ Reduction JSCreateLowering::ReduceJSCreateCatchContext(Node* node) {
Reduction JSCreateLowering::ReduceJSCreateBlockContext(Node* node) {
DisallowHeapAccess no_heap_access;
DCHECK_EQ(IrOpcode::kJSCreateBlockContext, node->opcode());
ScopeInfoRef scope_info(ScopeInfoOf(node->op()));
ScopeInfoRef scope_info(js_heap_broker(), ScopeInfoOf(node->op()));
int const context_length = scope_info.ContextLength();
// Use inline allocation for block contexts up to a size limit.
@ -1357,7 +1342,7 @@ Reduction JSCreateLowering::ReduceJSCreateBlockContext(Node* node) {
Node* context = NodeProperties::GetContextInput(node);
Node* extension = jsgraph()->TheHoleConstant();
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
AllocationBuilder a(jsgraph(), effect, control);
STATIC_ASSERT(Context::MIN_CONTEXT_SLOTS == 4); // Ensure fully covered.
a.AllocateContext(context_length, factory()->block_context_map());
a.Store(AccessBuilder::ForContextSlot(Context::SCOPE_INFO_INDEX),
@ -1387,15 +1372,13 @@ Reduction JSCreateLowering::ReduceJSCreateObject(Node* node) {
if (!prototype_type.IsHeapConstant()) return NoChange();
HeapObjectRef prototype_const = prototype_type.AsHeapConstant()->Ref();
auto maybe_instance_map =
prototype_const.TryGetObjectCreateMap(js_heap_broker());
auto maybe_instance_map = prototype_const.TryGetObjectCreateMap();
if (!maybe_instance_map) return NoChange();
MapRef instance_map = maybe_instance_map.value();
Node* properties = jsgraph()->EmptyFixedArrayConstant();
if (instance_map.is_dictionary_map()) {
DCHECK_EQ(prototype_const.type(js_heap_broker()).oddball_type(),
OddballType::kNull);
DCHECK_EQ(prototype_const.type().oddball_type(), OddballType::kNull);
// Allocate an empty NameDictionary as backing store for the properties.
Handle<Map> map = isolate()->factory()->name_dictionary_map();
int capacity =
@ -1404,7 +1387,7 @@ Reduction JSCreateLowering::ReduceJSCreateObject(Node* node) {
int length = NameDictionary::EntryToIndex(capacity);
int size = NameDictionary::SizeFor(length);
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
AllocationBuilder a(jsgraph(), effect, control);
a.Allocate(size, NOT_TENURED, Type::Any());
a.Store(AccessBuilder::ForMap(), map);
// Initialize FixedArray fields.
@ -1440,7 +1423,7 @@ Reduction JSCreateLowering::ReduceJSCreateObject(Node* node) {
// Emit code to allocate the JSObject instance for the given
// {instance_map}.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
AllocationBuilder a(jsgraph(), effect, control);
a.Allocate(instance_size, NOT_TENURED, Type::Any());
a.Store(AccessBuilder::ForMap(), instance_map);
a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(), properties);
@ -1473,7 +1456,7 @@ Node* JSCreateLowering::AllocateArguments(Node* effect, Node* control,
auto parameters_it = ++parameters_access.begin();
// Actually allocate the backing store.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
AllocationBuilder a(jsgraph(), effect, control);
a.AllocateArray(argument_count, factory()->fixed_array_map());
for (int i = 0; i < argument_count; ++i, ++parameters_it) {
DCHECK_NOT_NULL((*parameters_it).node);
@ -1503,7 +1486,7 @@ Node* JSCreateLowering::AllocateRestArguments(Node* effect, Node* control,
}
// Actually allocate the backing store.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
AllocationBuilder a(jsgraph(), effect, control);
a.AllocateArray(num_elements, factory()->fixed_array_map());
for (int i = 0; i < num_elements; ++i, ++parameters_it) {
DCHECK_NOT_NULL((*parameters_it).node);
@ -1541,7 +1524,7 @@ Node* JSCreateLowering::AllocateAliasedArguments(
// The unmapped argument values recorded in the frame state are stored yet
// another indirection away and then linked into the parameter map below,
// whereas mapped argument values are replaced with a hole instead.
AllocationBuilder aa(jsgraph(), js_heap_broker(), effect, control);
AllocationBuilder aa(jsgraph(), effect, control);
aa.AllocateArray(argument_count, factory()->fixed_array_map());
for (int i = 0; i < mapped_count; ++i, ++parameters_it) {
aa.Store(AccessBuilder::ForFixedArraySlot(i), jsgraph()->TheHoleConstant());
@ -1553,7 +1536,7 @@ Node* JSCreateLowering::AllocateAliasedArguments(
Node* arguments = aa.Finish();
// Actually allocate the backing store.
AllocationBuilder a(jsgraph(), js_heap_broker(), arguments, control);
AllocationBuilder a(jsgraph(), arguments, control);
a.AllocateArray(mapped_count + 2, factory()->sloppy_arguments_elements_map());
a.Store(AccessBuilder::ForFixedArraySlot(0), context);
a.Store(AccessBuilder::ForFixedArraySlot(1), arguments);
@ -1595,7 +1578,7 @@ Node* JSCreateLowering::AllocateAliasedArguments(
arguments_frame, arguments_length, effect);
// Actually allocate the backing store.
AllocationBuilder a(jsgraph(), js_heap_broker(), arguments, control);
AllocationBuilder a(jsgraph(), arguments, control);
a.AllocateArray(mapped_count + 2, factory()->sloppy_arguments_elements_map());
a.Store(AccessBuilder::ForFixedArraySlot(0), context);
a.Store(AccessBuilder::ForFixedArraySlot(1), arguments);
@ -1627,7 +1610,7 @@ Node* JSCreateLowering::AllocateElements(Node* effect, Node* control,
Node* value = jsgraph()->TheHoleConstant();
// Actually allocate the backing store.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
AllocationBuilder a(jsgraph(), effect, control);
a.AllocateArray(capacity, elements_map, pretenure);
for (int i = 0; i < capacity; ++i) {
Node* index = jsgraph()->Constant(i);
@ -1652,7 +1635,7 @@ Node* JSCreateLowering::AllocateElements(Node* effect, Node* control,
: AccessBuilder::ForFixedArrayElement();
// Actually allocate the backing store.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
AllocationBuilder a(jsgraph(), effect, control);
a.AllocateArray(capacity, elements_map, pretenure);
for (int i = 0; i < capacity; ++i) {
Node* index = jsgraph()->Constant(i);
@ -1668,7 +1651,7 @@ Node* JSCreateLowering::AllocateFastLiteral(Node* effect, Node* control,
Node* properties = jsgraph()->EmptyFixedArrayConstant();
// Compute the in-object properties to store first (might have effects).
MapRef boilerplate_map = boilerplate.map(js_heap_broker());
MapRef boilerplate_map = boilerplate.map();
ZoneVector<std::pair<FieldAccess, Node*>> inobject_fields(zone());
inobject_fields.reserve(boilerplate_map.GetInObjectProperties());
int const boilerplate_nof = boilerplate_map.NumberOfOwnDescriptors();
@ -1677,7 +1660,7 @@ Node* JSCreateLowering::AllocateFastLiteral(Node* effect, Node* control,
boilerplate_map.GetPropertyDetails(i);
if (property_details.location() != kField) continue;
DCHECK_EQ(kData, property_details.kind());
NameRef property_name = boilerplate_map.GetPropertyKey(js_heap_broker(), i);
NameRef property_name = boilerplate_map.GetPropertyKey(i);
FieldIndex index = boilerplate_map.GetFieldIndexFor(i);
FieldAccess access = {
kTaggedBase, index.offset(), property_name.object<Name>(),
@ -1689,8 +1672,7 @@ Node* JSCreateLowering::AllocateFastLiteral(Node* effect, Node* control,
access.type = Type::Number();
value = jsgraph()->Constant(boilerplate.RawFastDoublePropertyAt(index));
} else {
ObjectRef boilerplate_value =
boilerplate.RawFastPropertyAt(js_heap_broker(), index);
ObjectRef boilerplate_value = boilerplate.RawFastPropertyAt(index);
if (boilerplate_value.IsJSObject()) {
JSObjectRef boilerplate_object = boilerplate_value.AsJSObject();
value = effect =
@ -1698,7 +1680,7 @@ Node* JSCreateLowering::AllocateFastLiteral(Node* effect, Node* control,
} else if (property_details.representation().IsDouble()) {
double number = boilerplate_value.AsMutableHeapNumber().value();
// Allocate a mutable HeapNumber box and store the value into it.
AllocationBuilder builder(jsgraph(), js_heap_broker(), effect, control);
AllocationBuilder builder(jsgraph(), effect, control);
builder.Allocate(HeapNumber::kSize, pretenure);
builder.Store(AccessBuilder::ForMap(),
factory()->mutable_heap_number_map());
@ -1707,12 +1689,11 @@ Node* JSCreateLowering::AllocateFastLiteral(Node* effect, Node* control,
value = effect = builder.Finish();
} else if (property_details.representation().IsSmi()) {
// Ensure that value is stored as smi.
value = boilerplate_value.oddball_type(js_heap_broker()) ==
OddballType::kUninitialized
value = boilerplate_value.oddball_type() == OddballType::kUninitialized
? jsgraph()->ZeroConstant()
: jsgraph()->Constant(boilerplate_value.AsSmi());
} else {
value = jsgraph()->Constant(js_heap_broker(), boilerplate_value);
value = jsgraph()->Constant(boilerplate_value);
}
}
inobject_fields.push_back(std::make_pair(access, value));
@ -1734,7 +1715,7 @@ Node* JSCreateLowering::AllocateFastLiteral(Node* effect, Node* control,
if (elements->op()->EffectOutputCount() > 0) effect = elements;
// Actually allocate and initialize the object.
AllocationBuilder builder(jsgraph(), js_heap_broker(), effect, control);
AllocationBuilder builder(jsgraph(), effect, control);
builder.Allocate(boilerplate_map.instance_size(), pretenure,
Type::For(js_heap_broker(), boilerplate_map.object<Map>()));
builder.Store(AccessBuilder::ForMap(), boilerplate_map);
@ -1744,7 +1725,7 @@ Node* JSCreateLowering::AllocateFastLiteral(Node* effect, Node* control,
JSArrayRef boilerplate_array = boilerplate.AsJSArray();
builder.Store(
AccessBuilder::ForJSArrayLength(boilerplate_array.GetElementsKind()),
boilerplate_array.length(js_heap_broker()));
boilerplate_array.length());
}
for (auto const& inobject_field : inobject_fields) {
builder.Store(inobject_field.first, inobject_field.second);
@ -1755,17 +1736,15 @@ Node* JSCreateLowering::AllocateFastLiteral(Node* effect, Node* control,
Node* JSCreateLowering::AllocateFastLiteralElements(Node* effect, Node* control,
JSObjectRef boilerplate,
PretenureFlag pretenure) {
FixedArrayBaseRef boilerplate_elements =
boilerplate.elements(js_heap_broker());
FixedArrayBaseRef boilerplate_elements = boilerplate.elements();
// Empty or copy-on-write elements just store a constant.
int const elements_length = boilerplate_elements.length();
MapRef elements_map = boilerplate_elements.map(js_heap_broker());
if (boilerplate_elements.length() == 0 ||
elements_map.IsFixedCowArrayMap(js_heap_broker())) {
MapRef elements_map = boilerplate_elements.map();
if (boilerplate_elements.length() == 0 || elements_map.IsFixedCowArrayMap()) {
if (pretenure == TENURED) {
boilerplate.EnsureElementsTenured(js_heap_broker());
boilerplate_elements = boilerplate.elements(js_heap_broker());
boilerplate.EnsureElementsTenured();
boilerplate_elements = boilerplate.elements();
}
return jsgraph()->HeapConstant(boilerplate_elements.object<HeapObject>());
}
@ -1784,23 +1763,22 @@ Node* JSCreateLowering::AllocateFastLiteralElements(Node* effect, Node* control,
} else {
FixedArrayRef elements = boilerplate_elements.AsFixedArray();
for (int i = 0; i < elements_length; ++i) {
if (elements.is_the_hole(js_heap_broker(), i)) {
if (elements.is_the_hole(i)) {
elements_values[i] = jsgraph()->TheHoleConstant();
} else {
ObjectRef element_value = elements.get(js_heap_broker(), i);
ObjectRef element_value = elements.get(i);
if (element_value.IsJSObject()) {
elements_values[i] = effect = AllocateFastLiteral(
effect, control, element_value.AsJSObject(), pretenure);
} else {
elements_values[i] =
jsgraph()->Constant(js_heap_broker(), element_value);
elements_values[i] = jsgraph()->Constant(element_value);
}
}
}
}
// Allocate the backing store array and store the elements.
AllocationBuilder builder(jsgraph(), js_heap_broker(), effect, control);
AllocationBuilder builder(jsgraph(), effect, control);
builder.AllocateArray(elements_length, elements_map.object<Map>(), pretenure);
ElementAccess const access =
(elements_map.instance_type() == FIXED_DOUBLE_ARRAY_TYPE)
@ -1814,7 +1792,7 @@ Node* JSCreateLowering::AllocateFastLiteralElements(Node* effect, Node* control,
Node* JSCreateLowering::AllocateLiteralRegExp(Node* effect, Node* control,
JSRegExpRef boilerplate) {
MapRef boilerplate_map = boilerplate.map(js_heap_broker());
MapRef boilerplate_map = boilerplate.map();
// Sanity check that JSRegExp object layout hasn't changed.
STATIC_ASSERT(JSRegExp::kDataOffset == JSObject::kHeaderSize);
@ -1830,23 +1808,19 @@ Node* JSCreateLowering::AllocateLiteralRegExp(Node* effect, Node* control,
const int size =
JSRegExp::kSize + JSRegExp::kInObjectFieldCount * kPointerSize;
AllocationBuilder builder(jsgraph(), js_heap_broker(), effect, control);
AllocationBuilder builder(jsgraph(), effect, control);
builder.Allocate(size, pretenure,
Type::For(js_heap_broker(), boilerplate_map.object<Map>()));
builder.Store(AccessBuilder::ForMap(), boilerplate_map);
builder.Store(AccessBuilder::ForJSObjectPropertiesOrHash(),
boilerplate.raw_properties_or_hash(js_heap_broker()));
builder.Store(AccessBuilder::ForJSObjectElements(),
boilerplate.elements(js_heap_broker()));
boilerplate.raw_properties_or_hash());
builder.Store(AccessBuilder::ForJSObjectElements(), boilerplate.elements());
builder.Store(AccessBuilder::ForJSRegExpData(),
boilerplate.data(js_heap_broker()));
builder.Store(AccessBuilder::ForJSRegExpSource(),
boilerplate.source(js_heap_broker()));
builder.Store(AccessBuilder::ForJSRegExpFlags(),
boilerplate.flags(js_heap_broker()));
builder.Store(AccessBuilder::ForJSRegExpData(), boilerplate.data());
builder.Store(AccessBuilder::ForJSRegExpSource(), boilerplate.source());
builder.Store(AccessBuilder::ForJSRegExpFlags(), boilerplate.flags());
builder.Store(AccessBuilder::ForJSRegExpLastIndex(),
boilerplate.last_index(js_heap_broker()));
boilerplate.last_index());
return builder.Finish();
}
@ -1866,7 +1840,7 @@ SimplifiedOperatorBuilder* JSCreateLowering::simplified() const {
}
NativeContextRef JSCreateLowering::native_context_ref() const {
return NativeContextRef(native_context());
return NativeContextRef(js_heap_broker(), native_context());
}
} // namespace compiler

4
src/compiler/js-graph.cc
View File

@ -66,9 +66,9 @@ Node* JSGraph::Constant(Handle<Object> value) {
}
}
Node* JSGraph::Constant(const JSHeapBroker* broker, const ObjectRef& ref) {
Node* JSGraph::Constant(const ObjectRef& ref) {
if (ref.IsSmi()) return Constant(ref.AsSmi());
OddballType oddball_type = ref.oddball_type(broker);
OddballType oddball_type = ref.oddball_type();
if (ref.IsHeapNumber()) {
return Constant(ref.AsHeapNumber().value());
} else if (oddball_type == OddballType::kUndefined) {

3
src/compiler/js-graph.h
View File

@ -56,8 +56,7 @@ class V8_EXPORT_PRIVATE JSGraph : public MachineGraph {
Node* Constant(Handle<Object> value);
// Like above, but doesn't access the heap directly.
// TODO(neis): Make the broker a member of JSGraph.
Node* Constant(const JSHeapBroker* broker, const ObjectRef& value);
Node* Constant(const ObjectRef& value);
// Creates a NumberConstant node, usually canonicalized.
Node* Constant(double value);

313
src/compiler/js-heap-broker.cc
View File

@ -13,10 +13,11 @@ namespace v8 {
namespace internal {
namespace compiler {
MapRef HeapObjectRef::map(const JSHeapBroker* broker) const {
MapRef HeapObjectRef::map() const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference;
return MapRef(handle(object<HeapObject>()->map(), broker->isolate()));
return MapRef(broker(),
handle(object<HeapObject>()->map(), broker()->isolate()));
}
double HeapNumberRef::value() const {
@ -40,26 +41,26 @@ bool ObjectRef::equals(const ObjectRef& other) const {
return object<Object>().equals(other.object<Object>());
}
StringRef ObjectRef::TypeOf(const JSHeapBroker* broker) const {
StringRef ObjectRef::TypeOf() const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference handle_dereference;
return StringRef(Object::TypeOf(broker->isolate(), object<Object>()));
return StringRef(broker(),
Object::TypeOf(broker()->isolate(), object<Object>()));
}
base::Optional<ContextRef> ContextRef::previous(
const JSHeapBroker* broker) const {
base::Optional<ContextRef> ContextRef::previous() const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference handle_dereference;
Context* previous = object<Context>()->previous();
if (previous == nullptr) return base::Optional<ContextRef>();
return ContextRef(handle(previous, broker->isolate()));
return ContextRef(broker(), handle(previous, broker()->isolate()));
}
ObjectRef ContextRef::get(const JSHeapBroker* broker, int index) const {
ObjectRef ContextRef::get(int index) const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference handle_dereference;
Handle<Object> value(object<Context>()->get(index), broker->isolate());
return ObjectRef(value);
Handle<Object> value(object<Context>()->get(index), broker()->isolate());
return ObjectRef(broker(), value);
}
JSHeapBroker::JSHeapBroker(Isolate* isolate) : isolate_(isolate) {}
@ -101,31 +102,30 @@ base::Optional<int> JSHeapBroker::TryGetSmi(Handle<Object> object) {
return Smi::cast(*object)->value();
}
#define DEFINE_IS_AND_AS(Name) \
bool ObjectRef::Is##Name() const { \
AllowHandleDereference allow_handle_dereference; \
return object<Object>()->Is##Name(); \
} \
Name##Ref ObjectRef::As##Name() const { \
DCHECK(Is##Name()); \
return Name##Ref(object<HeapObject>()); \
#define DEFINE_IS_AND_AS(Name) \
bool ObjectRef::Is##Name() const { \
AllowHandleDereference allow_handle_dereference; \
return object<Object>()->Is##Name(); \
} \
Name##Ref ObjectRef::As##Name() const { \
DCHECK(Is##Name()); \
return Name##Ref(broker(), object<HeapObject>()); \
}
HEAP_BROKER_OBJECT_LIST(DEFINE_IS_AND_AS)
#undef DEFINE_IS_AND_AS
HeapObjectType HeapObjectRef::type(const JSHeapBroker* broker) const {
HeapObjectType HeapObjectRef::type() const {
AllowHandleDereference allow_handle_dereference;
return broker->HeapObjectTypeFromMap(object<HeapObject>()->map());
return broker()->HeapObjectTypeFromMap(object<HeapObject>()->map());
}
base::Optional<MapRef> HeapObjectRef::TryGetObjectCreateMap(
const JSHeapBroker* broker) const {
base::Optional<MapRef> HeapObjectRef::TryGetObjectCreateMap() const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference;
Handle<Map> instance_map;
if (Map::TryGetObjectCreateMap(broker->isolate(), object<HeapObject>())
if (Map::TryGetObjectCreateMap(broker()->isolate(), object<HeapObject>())
.ToHandle(&instance_map)) {
return MapRef(instance_map);
return MapRef(broker(), instance_map);
} else {
return base::Optional<MapRef>();
}
@ -157,12 +157,12 @@ bool JSFunctionRef::IsConstructor() const {
}
MapRef JSFunctionRef::DependOnInitialMap(
const JSHeapBroker* broker, CompilationDependencies* dependencies) const {
CompilationDependencies* dependencies) const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference;
Handle<Map> initial_map =
dependencies->DependOnInitialMap(object<JSFunction>());
return MapRef(initial_map);
return MapRef(broker(), initial_map);
}
void JSFunctionRef::EnsureHasInitialMap() const {
@ -175,8 +175,8 @@ void JSFunctionRef::EnsureHasInitialMap() const {
JSFunction::EnsureHasInitialMap(object<JSFunction>());
}
void MapRef::DependOnStableMap(const JSHeapBroker* broker,
CompilationDependencies* dependencies) const {
// TODO(neis): Remove.
void MapRef::DependOnStableMap(CompilationDependencies* dependencies) const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference;
dependencies->DependOnStableMap(object<Map>());
@ -197,24 +197,25 @@ bool JSFunctionRef::has_initial_map() const {
return object<JSFunction>()->has_initial_map();
}
MapRef JSFunctionRef::initial_map(const JSHeapBroker* broker) const {
MapRef JSFunctionRef::initial_map() const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference;
return MapRef(handle(object<JSFunction>()->initial_map(), broker->isolate()));
return MapRef(broker(), handle(object<JSFunction>()->initial_map(),
broker()->isolate()));
}
SharedFunctionInfoRef JSFunctionRef::shared(const JSHeapBroker* broker) const {
SharedFunctionInfoRef JSFunctionRef::shared() const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference;
return SharedFunctionInfoRef(
handle(object<JSFunction>()->shared(), broker->isolate()));
broker(), handle(object<JSFunction>()->shared(), broker()->isolate()));
}
JSGlobalProxyRef JSFunctionRef::global_proxy(const JSHeapBroker* broker) const {
JSGlobalProxyRef JSFunctionRef::global_proxy() const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference;
return JSGlobalProxyRef(
handle(object<JSFunction>()->global_proxy(), broker->isolate()));
return JSGlobalProxyRef(broker(), handle(object<JSFunction>()->global_proxy(),
broker()->isolate()));
}
base::Optional<ScriptContextTableRef::LookupResult>
@ -230,40 +231,38 @@ ScriptContextTableRef::lookup(const NameRef& name) const {
}
Handle<Context> script_context =
ScriptContextTable::GetContext(table, lookup_result.context_index);
LookupResult result{ContextRef(script_context),
LookupResult result{ContextRef(broker(), script_context),
lookup_result.mode == VariableMode::kConst,
lookup_result.slot_index};
return result;
}
ScriptContextTableRef NativeContextRef::script_context_table(
const JSHeapBroker* broker) const {
ScriptContextTableRef NativeContextRef::script_context_table() const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference handle_dereference;
return ScriptContextTableRef(
handle(object<Context>()->script_context_table(), broker->isolate()));
broker(),
handle(object<Context>()->script_context_table(), broker()->isolate()));
}
OddballType ObjectRef::oddball_type(const JSHeapBroker* broker) const {
return IsSmi() ? OddballType::kNone
: AsHeapObject().type(broker).oddball_type();
OddballType ObjectRef::oddball_type() const {
return IsSmi() ? OddballType::kNone : AsHeapObject().type().oddball_type();
}
ObjectRef FeedbackVectorRef::get(const JSHeapBroker* broker,
FeedbackSlot slot) const {
ObjectRef FeedbackVectorRef::get(FeedbackSlot slot) const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference handle_dereference;
Handle<Object> value(object<FeedbackVector>()->Get(slot)->ToObject(),
broker->isolate());
return ObjectRef(value);
broker()->isolate());
return ObjectRef(broker(), value);
}
JSObjectRef AllocationSiteRef::boilerplate(const JSHeapBroker* broker) const {
JSObjectRef AllocationSiteRef::boilerplate() const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference handle_dereference;
Handle<JSObject> value(object<AllocationSite>()->boilerplate(),
broker->isolate());
return JSObjectRef(value);
broker()->isolate());
return JSObjectRef(broker(), value);
}
bool JSObjectRef::IsUnboxedDoubleField(FieldIndex index) const {
@ -276,19 +275,19 @@ double JSObjectRef::RawFastDoublePropertyAt(FieldIndex index) const {
return object<JSObject>()->RawFastDoublePropertyAt(index);
}
ObjectRef JSObjectRef::RawFastPropertyAt(const JSHeapBroker* broker,
FieldIndex index) const {
ObjectRef JSObjectRef::RawFastPropertyAt(FieldIndex index) const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference handle_dereference;
return ObjectRef(
handle(object<JSObject>()->RawFastPropertyAt(index), broker->isolate()));
return ObjectRef(broker(),
handle(object<JSObject>()->RawFastPropertyAt(index),
broker()->isolate()));
}
FixedArrayBaseRef JSObjectRef::elements(const JSHeapBroker* broker) const {
FixedArrayBaseRef JSObjectRef::elements() const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference handle_dereference;
return FixedArrayBaseRef(
handle(object<JSObject>()->elements(), broker->isolate()));
broker(), handle(object<JSObject>()->elements(), broker()->isolate()));
}
namespace {
@ -374,12 +373,12 @@ const int kMaxFastLiteralProperties = JSObject::kMaxInObjectProperties;
// Determines whether the given array or object literal boilerplate satisfies
// all limits to be considered for fast deep-copying and computes the total
// size of all objects that are part of the graph.
bool AllocationSiteRef::IsFastLiteral(const JSHeapBroker* broker) const {
bool AllocationSiteRef::IsFastLiteral() const {
AllowHandleAllocation allow_handle_allocation;
AllowHandleDereference allow_handle_dereference;
int max_properties = kMaxFastLiteralProperties;
Handle<JSObject> boilerplate(object<AllocationSite>()->boilerplate(),
broker->isolate());
broker()->isolate());
return IsFastLiteralHelper(boilerplate, kMaxFastLiteralDepth,
&max_properties);
}
@ -389,19 +388,18 @@ PretenureFlag AllocationSiteRef::GetPretenureMode() const {
return object<AllocationSite>()->GetPretenureMode();
}
void JSObjectRef::EnsureElementsTenured(const JSHeapBroker* broker) {
void JSObjectRef::EnsureElementsTenured() {
// TODO(jarin) Eventually, we will pretenure the boilerplates before
// the compilation job starts.
AllowHandleAllocation allow_handle_allocation;
AllowHandleDereference allow_handle_dereference;
Handle<FixedArrayBase> object_elements =
elements(broker).object<FixedArrayBase>();
Handle<FixedArrayBase> object_elements = elements().object<FixedArrayBase>();
if (Heap::InNewSpace(*object_elements)) {
// If we would like to pretenure a fixed cow array, we must ensure that
// the array is already in old space, otherwise we'll create too many
// old-to-new-space pointers (overflowing the store buffer).
object_elements = Handle<FixedArrayBase>(
broker->isolate()->factory()->CopyAndTenureFixedCOWArray(
broker()->isolate()->factory()->CopyAndTenureFixedCOWArray(
Handle<FixedArray>::cast(object_elements)));
object<JSObject>()->set_elements(*object_elements);
}
@ -432,11 +430,11 @@ bool MapRef::is_dictionary_map() const {
return object<Map>()->is_dictionary_map();
}
ObjectRef MapRef::constructor_or_backpointer(const JSHeapBroker* broker) const {
ObjectRef MapRef::constructor_or_backpointer() const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference;
return ObjectRef(
handle(object<Map>()->constructor_or_backpointer(), broker->isolate()));
return ObjectRef(broker(), handle(object<Map>()->constructor_or_backpointer(),
broker()->isolate()));
}
int MapRef::instance_size() const {
@ -454,11 +452,12 @@ PropertyDetails MapRef::GetPropertyDetails(int i) const {
return object<Map>()->instance_descriptors()->GetDetails(i);
}
NameRef MapRef::GetPropertyKey(const JSHeapBroker* broker, int i) const {
NameRef MapRef::GetPropertyKey(int i) const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference;
return NameRef(handle(object<Map>()->instance_descriptors()->GetKey(i),
broker->isolate()));
return NameRef(broker(),
handle(object<Map>()->instance_descriptors()->GetKey(i),
broker()->isolate()));
}
bool MapRef::IsJSArrayMap() const {
@ -471,10 +470,10 @@ bool MapRef::IsInobjectSlackTrackingInProgress() const {
return object<Map>()->IsInobjectSlackTrackingInProgress();
}
bool MapRef::IsFixedCowArrayMap(const JSHeapBroker* broker) const {
bool MapRef::IsFixedCowArrayMap() const {
AllowHandleDereference allow_handle_dereference;
return *object<Map>() ==
ReadOnlyRoots(broker->isolate()).fixed_cow_array_map();
ReadOnlyRoots(broker()->isolate()).fixed_cow_array_map();
}
bool MapRef::has_prototype_slot() const {
@ -497,10 +496,11 @@ ElementsKind JSArrayRef::GetElementsKind() const {
return object<JSArray>()->GetElementsKind();
}
ObjectRef JSArrayRef::length(const JSHeapBroker* broker) const {
ObjectRef JSArrayRef::length() const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference;
return ObjectRef(handle(object<JSArray>()->length(), broker->isolate()));
return ObjectRef(broker(),
handle(object<JSArray>()->length(), broker()->isolate()));
}
int StringRef::length() const {
@ -513,45 +513,50 @@ uint16_t StringRef::GetFirstChar() {
return object<String>()->Get(0);
}
double StringRef::ToNumber(const JSHeapBroker* broker) {
double StringRef::ToNumber() {
AllowHandleDereference allow_handle_dereference;
AllowHandleAllocation allow_handle_allocation;
AllowHeapAllocation allow_heap_allocation;
int flags = ALLOW_HEX | ALLOW_OCTAL | ALLOW_BINARY;
return StringToDouble(broker->isolate(), broker->isolate()->unicode_cache(),
object<String>(), flags);
return StringToDouble(broker()->isolate(),
broker()->isolate()->unicode_cache(), object<String>(),
flags);
}
ObjectRef JSRegExpRef::raw_properties_or_hash(
const JSHeapBroker* broker) const {
ObjectRef JSRegExpRef::raw_properties_or_hash() const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference;
return ObjectRef(broker(),
handle(object<JSRegExp>()->raw_properties_or_hash(),
broker()->isolate()));
}
ObjectRef JSRegExpRef::data() const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference;
return ObjectRef(broker(),
handle(object<JSRegExp>()->data(), broker()->isolate()));
}
ObjectRef JSRegExpRef::source() const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference;
return ObjectRef(broker(),
handle(object<JSRegExp>()->source(), broker()->isolate()));
}
ObjectRef JSRegExpRef::flags() const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference;
return ObjectRef(broker(),
handle(object<JSRegExp>()->flags(), broker()->isolate()));
}
ObjectRef JSRegExpRef::last_index() const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference;
return ObjectRef(
handle(object<JSRegExp>()->raw_properties_or_hash(), broker->isolate()));
}
ObjectRef JSRegExpRef::data(const JSHeapBroker* broker) const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference;
return ObjectRef(handle(object<JSRegExp>()->data(), broker->isolate()));
}
ObjectRef JSRegExpRef::source(const JSHeapBroker* broker) const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference;
return ObjectRef(handle(object<JSRegExp>()->source(), broker->isolate()));
}
ObjectRef JSRegExpRef::flags(const JSHeapBroker* broker) const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference;
return ObjectRef(handle(object<JSRegExp>()->flags(), broker->isolate()));
}
ObjectRef JSRegExpRef::last_index(const JSHeapBroker* broker) const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference;
return ObjectRef(handle(object<JSRegExp>()->last_index(), broker->isolate()));
broker(), handle(object<JSRegExp>()->last_index(), broker()->isolate()));
}
int FixedArrayBaseRef::length() const {
@ -559,15 +564,16 @@ int FixedArrayBaseRef::length() const {
return object<FixedArrayBase>()->length();
}
bool FixedArrayRef::is_the_hole(const JSHeapBroker* broker, int i) const {
bool FixedArrayRef::is_the_hole(int i) const {
AllowHandleDereference allow_handle_dereference;
return object<FixedArray>()->is_the_hole(broker->isolate(), i);
return object<FixedArray>()->is_the_hole(broker()->isolate(), i);
}
ObjectRef FixedArrayRef::get(const JSHeapBroker* broker, int i) const {
ObjectRef FixedArrayRef::get(int i) const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference;
return ObjectRef(handle(object<FixedArray>()->get(i), broker->isolate()));
return ObjectRef(broker(),
handle(object<FixedArray>()->get(i), broker()->isolate()));
}
bool FixedDoubleArrayRef::is_the_hole(int i) const {
@ -645,104 +651,99 @@ int SharedFunctionInfoRef::GetBytecodeArrayRegisterCount() const {
return object<SharedFunctionInfo>()->GetBytecodeArray()->register_count();
}
MapRef NativeContextRef::fast_aliased_arguments_map(
const JSHeapBroker* broker) const {
MapRef NativeContextRef::fast_aliased_arguments_map() const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference;
return MapRef(handle(object<Context>()->fast_aliased_arguments_map(),
broker->isolate()));
return MapRef(broker(),
handle(object<Context>()->fast_aliased_arguments_map(),
broker()->isolate()));
}
MapRef NativeContextRef::sloppy_arguments_map(
const JSHeapBroker* broker) const {
MapRef NativeContextRef::sloppy_arguments_map() const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference;
return MapRef(
handle(object<Context>()->sloppy_arguments_map(), broker->isolate()));
return MapRef(broker(), handle(object<Context>()->sloppy_arguments_map(),
broker()->isolate()));
}
MapRef NativeContextRef::strict_arguments_map(
const JSHeapBroker* broker) const {
MapRef NativeContextRef::strict_arguments_map() const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference;
return MapRef(
handle(object<Context>()->strict_arguments_map(), broker->isolate()));
return MapRef(broker(), handle(object<Context>()->strict_arguments_map(),
broker()->isolate()));
}
MapRef NativeContextRef::js_array_fast_elements_map_index(
const JSHeapBroker* broker) const {
MapRef NativeContextRef::js_array_fast_elements_map_index() const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference;
return MapRef(handle(object<Context>()->js_array_fast_elements_map_index(),
broker->isolate()));
return MapRef(broker(),
handle(object<Context>()->js_array_fast_elements_map_index(),
broker()->isolate()));
}
MapRef NativeContextRef::initial_array_iterator_map(
const JSHeapBroker* broker) const {
MapRef NativeContextRef::initial_array_iterator_map() const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference;
return MapRef(handle(object<Context>()->initial_array_iterator_map(),
broker->isolate()));
return MapRef(broker(),
handle(object<Context>()->initial_array_iterator_map(),
broker()->isolate()));
}
MapRef NativeContextRef::set_value_iterator_map(
const JSHeapBroker* broker) const {
MapRef NativeContextRef::set_value_iterator_map() const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference;
return MapRef(
handle(object<Context>()->set_value_iterator_map(), broker->isolate()));
return MapRef(broker(), handle(object<Context>()->set_value_iterator_map(),
broker()->isolate()));
}
MapRef NativeContextRef::set_key_value_iterator_map(
const JSHeapBroker* broker) const {
MapRef NativeContextRef::set_key_value_iterator_map() const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference;
return MapRef(handle(object<Context>()->set_key_value_iterator_map(),
broker->isolate()));
return MapRef(broker(),
handle(object<Context>()->set_key_value_iterator_map(),
broker()->isolate()));
}
MapRef NativeContextRef::map_key_iterator_map(
const JSHeapBroker* broker) const {
MapRef NativeContextRef::map_key_iterator_map() const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference;
return MapRef(
handle(object<Context>()->map_key_iterator_map(), broker->isolate()));
return MapRef(broker(), handle(object<Context>()->map_key_iterator_map(),
broker()->isolate()));
}
MapRef NativeContextRef::map_value_iterator_map(
const JSHeapBroker* broker) const {
MapRef NativeContextRef::map_value_iterator_map() const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference;
return MapRef(
handle(object<Context>()->map_value_iterator_map(), broker->isolate()));
return MapRef(broker(), handle(object<Context>()->map_value_iterator_map(),
broker()->isolate()));
}
MapRef NativeContextRef::map_key_value_iterator_map(
const JSHeapBroker* broker) const {
MapRef NativeContextRef::map_key_value_iterator_map() const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference;
return MapRef(handle(object<Context>()->map_key_value_iterator_map(),
broker->isolate()));
return MapRef(broker(),
handle(object<Context>()->map_key_value_iterator_map(),
broker()->isolate()));
}
MapRef NativeContextRef::GetFunctionMapFromIndex(const JSHeapBroker* broker,
int index) const {
MapRef NativeContextRef::GetFunctionMapFromIndex(int index) const {
DCHECK_LE(index, Context::LAST_FUNCTION_MAP_INDEX);
DCHECK_GE(index, Context::FIRST_FUNCTION_MAP_INDEX);
return get(broker, index).AsMap();
return get(index).AsMap();
}
bool ObjectRef::BooleanValue(const JSHeapBroker* broker) {
bool ObjectRef::BooleanValue() {
AllowHandleDereference allow_handle_dereference;
return object<Object>()->BooleanValue(broker->isolate());
return object<Object>()->BooleanValue(broker()->isolate());
}
double ObjectRef::OddballToNumber(const JSHeapBroker* broker) const {
OddballType type = oddball_type(broker);
double ObjectRef::OddballToNumber() const {
OddballType type = oddball_type();
switch (type) {
case OddballType::kBoolean: {
ObjectRef true_ref(broker->isolate()->factory()->true_value());
ObjectRef true_ref(broker(),
broker()->isolate()->factory()->true_value());
return this->equals(true_ref) ? 1 : 0;
break;
}
@ -761,11 +762,11 @@ double ObjectRef::OddballToNumber(const JSHeapBroker* broker) const {
}
}
CellRef ModuleRef::GetCell(const JSHeapBroker* broker, int cell_index) {
CellRef ModuleRef::GetCell(int cell_index) {
AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference;
return CellRef(
handle(object<Module>()->GetCell(cell_index), broker->isolate()));
return CellRef(broker(), handle(object<Module>()->GetCell(cell_index),
broker()->isolate()));
}
} // namespace compiler

110
src/compiler/js-heap-broker.h
View File

@ -94,7 +94,8 @@ HEAP_BROKER_OBJECT_LIST(FORWARD_DECL)
class ObjectRef {
public:
explicit ObjectRef(Handle<Object> object) : object_(object) {}
explicit ObjectRef(const JSHeapBroker* broker, Handle<Object> object)
: broker_(broker), object_(object) {}
template <typename T>
Handle<T> object() const {
@ -102,7 +103,7 @@ class ObjectRef {
return Handle<T>::cast(object_);
}
OddballType oddball_type(const JSHeapBroker* broker) const;
OddballType oddball_type() const;
bool IsSmi() const;
int AsSmi() const;
@ -117,11 +118,15 @@ class ObjectRef {
HEAP_BROKER_OBJECT_LIST(HEAP_AS_METHOD_DECL)
#undef HEAP_AS_METHOD_DECL
StringRef TypeOf(const JSHeapBroker* broker) const;
bool BooleanValue(const JSHeapBroker* broker);
double OddballToNumber(const JSHeapBroker* broker) const;
StringRef TypeOf() const;
bool BooleanValue();
double OddballToNumber() const;
protected:
const JSHeapBroker* broker() const { return broker_; }
private:
const JSHeapBroker* broker_;
Handle<Object> object_;
};
@ -129,10 +134,9 @@ class HeapObjectRef : public ObjectRef {
public:
using ObjectRef::ObjectRef;
HeapObjectType type(const JSHeapBroker* broker) const;
MapRef map(const JSHeapBroker* broker) const;
base::Optional<MapRef> TryGetObjectCreateMap(
const JSHeapBroker* broker) const;
HeapObjectType type() const;
MapRef map() const;
base::Optional<MapRef> TryGetObjectCreateMap() const;
bool IsSeqString() const;
bool IsExternalString() const;
};
@ -143,11 +147,10 @@ class JSObjectRef : public HeapObjectRef {
bool IsUnboxedDoubleField(FieldIndex index) const;
double RawFastDoublePropertyAt(FieldIndex index) const;
ObjectRef RawFastPropertyAt(const JSHeapBroker* broker,
FieldIndex index) const;
ObjectRef RawFastPropertyAt(FieldIndex index) const;
FixedArrayBaseRef elements(const JSHeapBroker* broker) const;
void EnsureElementsTenured(const JSHeapBroker* broker);
FixedArrayBaseRef elements() const;
void EnsureElementsTenured();
};
struct SlackTrackingResult {
@ -166,15 +169,13 @@ class JSFunctionRef : public JSObjectRef {
BuiltinFunctionId GetBuiltinFunctionId() const;
bool IsConstructor() const;
bool has_initial_map() const;
MapRef initial_map(const JSHeapBroker* broker) const;
MapRef initial_map() const;
MapRef DependOnInitialMap(const JSHeapBroker* broker,
CompilationDependencies* dependencies) const;
MapRef DependOnInitialMap(CompilationDependencies* dependencies) const;
JSGlobalProxyRef global_proxy(const JSHeapBroker* broker) const;
JSGlobalProxyRef global_proxy() const;
SlackTrackingResult FinishSlackTracking() const;
SharedFunctionInfoRef shared(const JSHeapBroker* broker) const;
SharedFunctionInfoRef shared() const;
void EnsureHasInitialMap() const;
};
@ -182,11 +183,11 @@ class JSRegExpRef : public JSObjectRef {
public:
using JSObjectRef::JSObjectRef;
ObjectRef raw_properties_or_hash(const JSHeapBroker* broker) const;
ObjectRef data(const JSHeapBroker* broker) const;
ObjectRef source(const JSHeapBroker* broker) const;
ObjectRef flags(const JSHeapBroker* broker) const;
ObjectRef last_index(const JSHeapBroker* broker) const;
ObjectRef raw_properties_or_hash() const;
ObjectRef data() const;
ObjectRef source() const;
ObjectRef flags() const;
ObjectRef last_index() const;
};
class HeapNumberRef : public HeapObjectRef {
@ -207,28 +208,28 @@ class ContextRef : public HeapObjectRef {
public:
using HeapObjectRef::HeapObjectRef;
base::Optional<ContextRef> previous(const JSHeapBroker* broker) const;
ObjectRef get(const JSHeapBroker* broker, int index) const;
base::Optional<ContextRef> previous() const;
ObjectRef get(int index) const;
};
class NativeContextRef : public ContextRef {
public:
using ContextRef::ContextRef;
ScriptContextTableRef script_context_table(const JSHeapBroker* broker) const;
ScriptContextTableRef script_context_table() const;
MapRef fast_aliased_arguments_map(const JSHeapBroker* broker) const;
MapRef sloppy_arguments_map(const JSHeapBroker* broker) const;
MapRef strict_arguments_map(const JSHeapBroker* broker) const;
MapRef js_array_fast_elements_map_index(const JSHeapBroker* broker) const;
MapRef initial_array_iterator_map(const JSHeapBroker* broker) const;
MapRef set_value_iterator_map(const JSHeapBroker* broker) const;
MapRef set_key_value_iterator_map(const JSHeapBroker* broker) const;
MapRef map_key_iterator_map(const JSHeapBroker* broker) const;
MapRef map_value_iterator_map(const JSHeapBroker* broker) const;
MapRef map_key_value_iterator_map(const JSHeapBroker* broker) const;
MapRef fast_aliased_arguments_map() const;
MapRef sloppy_arguments_map() const;
MapRef strict_arguments_map() const;
MapRef js_array_fast_elements_map_index() const;
MapRef initial_array_iterator_map() const;
MapRef set_value_iterator_map() const;
MapRef set_key_value_iterator_map() const;
MapRef map_key_iterator_map() const;
MapRef map_value_iterator_map() const;
MapRef map_key_value_iterator_map() const;
MapRef GetFunctionMapFromIndex(const JSHeapBroker* broker, int index) const;
MapRef GetFunctionMapFromIndex(int index) const;
};
class NameRef : public HeapObjectRef {
@ -253,16 +254,16 @@ class FeedbackVectorRef : public HeapObjectRef {
public:
using HeapObjectRef::HeapObjectRef;
ObjectRef get(const JSHeapBroker* broker, FeedbackSlot slot) const;
ObjectRef get(FeedbackSlot slot) const;
};
class AllocationSiteRef : public HeapObjectRef {
public:
using HeapObjectRef::HeapObjectRef;
JSObjectRef boilerplate(const JSHeapBroker* broker) const;
JSObjectRef boilerplate() const;
PretenureFlag GetPretenureMode() const;
bool IsFastLiteral(const JSHeapBroker* broker) const;
bool IsFastLiteral() const;
};
class MapRef : public HeapObjectRef {
@ -274,10 +275,10 @@ class MapRef : public HeapObjectRef {
int GetInObjectProperties() const;
int NumberOfOwnDescriptors() const;
PropertyDetails GetPropertyDetails(int i) const;
NameRef GetPropertyKey(const JSHeapBroker* broker, int i) const;
NameRef GetPropertyKey(int i) const;
FieldIndex GetFieldIndexFor(int i) const;
int GetInObjectPropertyOffset(int index) const;
ObjectRef constructor_or_backpointer(const JSHeapBroker* broker) const;
ObjectRef constructor_or_backpointer() const;
bool is_stable() const;
bool has_prototype_slot() const;
@ -286,10 +287,9 @@ class MapRef : public HeapObjectRef {
bool is_dictionary_map() const;
bool IsJSArrayMap() const;
bool IsFixedCowArrayMap(const JSHeapBroker* broker) const;
bool IsFixedCowArrayMap() const;
void DependOnStableMap(const JSHeapBroker* broker,
CompilationDependencies* dependencies) const;
void DependOnStableMap(CompilationDependencies* dependencies) const;
};
class FixedArrayBaseRef : public HeapObjectRef {
@ -303,8 +303,8 @@ class FixedArrayRef : public FixedArrayBaseRef {
public:
using FixedArrayBaseRef::FixedArrayBaseRef;
ObjectRef get(const JSHeapBroker* broker, int i) const;
bool is_the_hole(const JSHeapBroker* broker, int i) const;
ObjectRef get(int i) const;
bool is_the_hole(int i) const;
};
class FixedDoubleArrayRef : public FixedArrayBaseRef {
@ -320,7 +320,7 @@ class JSArrayRef : public JSObjectRef {
using JSObjectRef::JSObjectRef;
ElementsKind GetElementsKind() const;
ObjectRef length(const JSHeapBroker* broker) const;
ObjectRef length() const;
};
class ScopeInfoRef : public HeapObjectRef {
@ -354,29 +354,29 @@ class StringRef : public NameRef {
int length() const;
uint16_t GetFirstChar();
double ToNumber(const JSHeapBroker* broker);
double ToNumber();
};
class ModuleRef : public HeapObjectRef {
public:
explicit ModuleRef(Handle<Object> object) : HeapObjectRef(object) {}
using HeapObjectRef::HeapObjectRef;
CellRef GetCell(const JSHeapBroker* broker, int cell_index);
CellRef GetCell(int cell_index);
};
class CellRef : public HeapObjectRef {
public:
explicit CellRef(Handle<Object> object) : HeapObjectRef(object) {}
using HeapObjectRef::HeapObjectRef;
};
class JSGlobalProxyRef : public JSObjectRef {
public:
explicit JSGlobalProxyRef(Handle<Object> object) : JSObjectRef(object) {}
using JSObjectRef::JSObjectRef;
};
class CodeRef : public HeapObjectRef {
public:
explicit CodeRef(Handle<Object> object) : HeapObjectRef(object) {}
using HeapObjectRef::HeapObjectRef;
};
class InternalizedStringRef : public StringRef {

30
src/compiler/js-native-context-specialization.cc
View File

@ -68,7 +68,7 @@ JSNativeContextSpecialization::JSNativeContextSpecialization(
global_object_(native_context->global_object(), jsgraph->isolate()),
global_proxy_(JSGlobalProxy::cast(native_context->global_proxy()),
jsgraph->isolate()),
native_context_(native_context),
native_context_(js_heap_broker, native_context),
dependencies_(dependencies),
zone_(zone),
type_cache_(TypeCache::Get()) {}
@ -520,7 +520,7 @@ Reduction JSNativeContextSpecialization::ReduceJSLoadContext(Node* node) {
// context (if any), so we can constant-fold those fields, which is
// safe, since the NATIVE_CONTEXT_INDEX slot is always immutable.
if (access.index() == Context::NATIVE_CONTEXT_INDEX) {
Node* value = jsgraph()->Constant(js_heap_broker(), native_context());
Node* value = jsgraph()->Constant(native_context());
ReplaceWithValue(node, value);
return Replace(value);
}
@ -732,19 +732,19 @@ Reduction JSNativeContextSpecialization::ReduceGlobalAccess(
Reduction JSNativeContextSpecialization::ReduceJSLoadGlobal(Node* node) {
DCHECK_EQ(IrOpcode::kJSLoadGlobal, node->opcode());
NameRef name(LoadGlobalParametersOf(node->op()).name());
NameRef name(js_heap_broker(), LoadGlobalParametersOf(node->op()).name());
Node* effect = NodeProperties::GetEffectInput(node);
// Try to lookup the name on the script context table first (lexical scoping).
base::Optional<ScriptContextTableRef::LookupResult> result =
native_context().script_context_table(js_heap_broker()).lookup(name);
native_context().script_context_table().lookup(name);
if (result) {
ObjectRef contents = result->context.get(js_heap_broker(), result->index);
OddballType oddball_type = contents.oddball_type(js_heap_broker());
ObjectRef contents = result->context.get(result->index);
OddballType oddball_type = contents.oddball_type();
if (oddball_type == OddballType::kHole) {
return NoChange();
}
Node* context = jsgraph()->Constant(js_heap_broker(), result->context);
Node* context = jsgraph()->Constant(result->context);
Node* value = effect = graph()->NewNode(
javascript()->LoadContext(0, result->index, result->immutable), context,
effect);
@ -759,21 +759,21 @@ Reduction JSNativeContextSpecialization::ReduceJSLoadGlobal(Node* node) {
Reduction JSNativeContextSpecialization::ReduceJSStoreGlobal(Node* node) {
DCHECK_EQ(IrOpcode::kJSStoreGlobal, node->opcode());
NameRef name(StoreGlobalParametersOf(node->op()).name());
NameRef name(js_heap_broker(), StoreGlobalParametersOf(node->op()).name());
Node* value = NodeProperties::GetValueInput(node, 0);
Node* effect = NodeProperties::GetEffectInput(node);
Node* control = NodeProperties::GetControlInput(node);
// Try to lookup the name on the script context table first (lexical scoping).
base::Optional<ScriptContextTableRef::LookupResult> result =
native_context().script_context_table(js_heap_broker()).lookup(name);
native_context().script_context_table().lookup(name);
if (result) {
ObjectRef contents = result->context.get(js_heap_broker(), result->index);
OddballType oddball_type = contents.oddball_type(js_heap_broker());
ObjectRef contents = result->context.get(result->index);
OddballType oddball_type = contents.oddball_type();
if (oddball_type == OddballType::kHole || result->immutable) {
return NoChange();
}
Node* context = jsgraph()->Constant(js_heap_broker(), result->context);
Node* context = jsgraph()->Constant(result->context);
effect = graph()->NewNode(javascript()->StoreContext(0, result->index),
value, context, effect, control);
ReplaceWithValue(node, value, effect, control);
@ -1774,7 +1774,7 @@ Node* JSNativeContextSpecialization::InlineApiCall(
Node* code = jsgraph()->HeapConstant(call_api_callback.code());
// Add CallApiCallbackStub's register argument as well.
Node* context = jsgraph()->Constant(js_heap_broker(), native_context());
Node* context = jsgraph()->Constant(native_context());
Node* inputs[10] = {code, context, data, holder, function_reference,
receiver};
int index = 6 + argc;
@ -1913,7 +1913,7 @@ JSNativeContextSpecialization::BuildPropertyStore(
!FLAG_unbox_double_fields) {
if (access_info.HasTransitionMap()) {
// Allocate a MutableHeapNumber for the new property.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
AllocationBuilder a(jsgraph(), effect, control);
a.Allocate(HeapNumber::kSize, NOT_TENURED, Type::OtherInternal());
a.Store(AccessBuilder::ForMap(),
factory()->mutable_heap_number_map());
@ -2768,7 +2768,7 @@ Node* JSNativeContextSpecialization::BuildExtendPropertiesBackingStore(
new_length_and_hash, effect, control);
// Allocate and initialize the new properties.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control);
AllocationBuilder a(jsgraph(), effect, control);
a.Allocate(PropertyArray::SizeFor(new_length), NOT_TENURED,
Type::OtherInternal());
a.Store(AccessBuilder::ForMap(), jsgraph()->PropertyArrayMapConstant());

47
src/compiler/js-typed-lowering.cc
View File

@ -93,12 +93,13 @@ class JSBinopReduction final {
if (BothInputsAre(Type::String()) ||
BinaryOperationHintOf(node_->op()) == BinaryOperationHint::kString) {
HeapObjectBinopMatcher m(node_);
if (m.right().HasValue() && m.right().Ref().IsString()) {
StringRef right_string(m.right().Value());
const JSHeapBroker* broker = lowering_->js_heap_broker();
if (m.right().HasValue() && m.right().Ref(broker).IsString()) {
StringRef right_string = m.right().Ref(broker).AsString();
if (right_string.length() >= ConsString::kMinLength) return true;
}
if (m.left().HasValue() && m.left().Ref().IsString()) {
StringRef left_string(m.left().Value());
if (m.left().HasValue() && m.left().Ref(broker).IsString()) {
StringRef left_string = m.left().Ref(broker).AsString();
if (left_string.length() >= ConsString::kMinLength) {
// The invariant for ConsString requires the left hand side to be
// a sequential or external string if the right hand side is the
@ -718,11 +719,11 @@ Node* JSTypedLowering::BuildGetStringLength(Node* value) {
// TODO(bmeurer): Get rid of this hack and instead have a way to
// express the string length in the types.
HeapObjectMatcher m(value);
if (!m.HasValue() || !m.Ref().IsString()) {
if (!m.HasValue() || !m.Ref(js_heap_broker()).IsString()) {
return graph()->NewNode(simplified()->StringLength(), value);
}
return jsgraph()->Constant(m.Ref().AsString().length());
return jsgraph()->Constant(m.Ref(js_heap_broker()).AsString().length());
}
Reduction JSTypedLowering::ReduceSpeculativeNumberComparison(Node* node) {
@ -959,17 +960,15 @@ Reduction JSTypedLowering::ReduceJSToNumberOrNumericInput(Node* input) {
if (input_type.Is(Type::String())) {
HeapObjectMatcher m(input);
if (m.HasValue() && m.Ref().IsString()) {
StringRef input_value = m.Ref().AsString();
return Replace(
jsgraph()->Constant(input_value.ToNumber(js_heap_broker())));
if (m.HasValue() && m.Ref(js_heap_broker()).IsString()) {
StringRef input_value = m.Ref(js_heap_broker()).AsString();
return Replace(jsgraph()->Constant(input_value.ToNumber()));
}
}
if (input_type.IsHeapConstant()) {
ObjectRef input_value = input_type.AsHeapConstant()->Ref();
if (input_value.oddball_type(js_heap_broker()) != OddballType::kNone) {
return Replace(
jsgraph()->Constant(input_value.OddballToNumber(js_heap_broker())));
if (input_value.oddball_type() != OddballType::kNone) {
return Replace(jsgraph()->Constant(input_value.OddballToNumber()));
}
}
if (input_type.Is(Type::Number())) {
@ -1135,8 +1134,8 @@ Reduction JSTypedLowering::ReduceJSLoadNamed(Node* node) {
DCHECK_EQ(IrOpcode::kJSLoadNamed, node->opcode());
Node* receiver = NodeProperties::GetValueInput(node, 0);
Type receiver_type = NodeProperties::GetType(receiver);
NameRef name(NamedAccessOf(node->op()).name());
NameRef length_str(factory()->length_string());
NameRef name(js_heap_broker(), NamedAccessOf(node->op()).name());
NameRef length_str(js_heap_broker(), factory()->length_string());
// Optimize "length" property of strings.
if (name.equals(length_str) && receiver_type.Is(Type::String())) {
Node* value = graph()->NewNode(simplified()->StringLength(), receiver);
@ -1371,9 +1370,8 @@ Node* JSTypedLowering::BuildGetModuleCell(Node* node) {
if (module_type.IsHeapConstant()) {
ModuleRef module_constant = module_type.AsHeapConstant()->Ref().AsModule();
CellRef cell_constant(
module_constant.GetCell(js_heap_broker(), cell_index));
return jsgraph()->Constant(js_heap_broker(), cell_constant);
CellRef cell_constant(module_constant.GetCell(cell_index));
return jsgraph()->Constant(cell_constant);
}
FieldAccess field_access;
@ -1560,7 +1558,7 @@ Reduction JSTypedLowering::ReduceJSConstruct(Node* node) {
if (target_type.IsHeapConstant() &&
target_type.AsHeapConstant()->Ref().IsJSFunction()) {
JSFunctionRef function = target_type.AsHeapConstant()->Ref().AsJSFunction();
SharedFunctionInfoRef shared = function.shared(js_heap_broker());
SharedFunctionInfoRef shared = function.shared();
// Only optimize [[Construct]] here if {function} is a Constructor.
if (!function.IsConstructor()) return NoChange();
@ -1570,13 +1568,13 @@ Reduction JSTypedLowering::ReduceJSConstruct(Node* node) {
// Patch {node} to an indirect call via the {function}s construct stub.
bool use_builtin_construct_stub = shared.construct_as_builtin();
CodeRef code(use_builtin_construct_stub
CodeRef code(js_heap_broker(),
use_builtin_construct_stub
? BUILTIN_CODE(isolate(), JSBuiltinsConstructStub)
: BUILTIN_CODE(isolate(), JSConstructStubGeneric));
node->RemoveInput(arity + 1);
node->InsertInput(graph()->zone(), 0,
jsgraph()->Constant(js_heap_broker(), code));
node->InsertInput(graph()->zone(), 0, jsgraph()->Constant(code));
node->InsertInput(graph()->zone(), 2, new_target);
node->InsertInput(graph()->zone(), 3, jsgraph()->Constant(arity));
node->InsertInput(graph()->zone(), 4, jsgraph()->UndefinedConstant());
@ -1643,7 +1641,7 @@ Reduction JSTypedLowering::ReduceJSCall(Node* node) {
if (target_type.IsHeapConstant() &&
target_type.AsHeapConstant()->Ref().IsJSFunction()) {
JSFunctionRef function = target_type.AsHeapConstant()->Ref().AsJSFunction();
SharedFunctionInfoRef shared = function.shared(js_heap_broker());
SharedFunctionInfoRef shared = function.shared();
if (shared.HasBreakInfo()) {
// Do not inline the call if we need to check whether to break at entry.
@ -1663,8 +1661,7 @@ Reduction JSTypedLowering::ReduceJSCall(Node* node) {
// Check if we need to convert the {receiver}.
if (is_sloppy(shared.language_mode()) && !shared.native() &&
!receiver_type.Is(Type::Receiver())) {
Node* global_proxy = jsgraph()->Constant(
js_heap_broker(), function.global_proxy(js_heap_broker()));
Node* global_proxy = jsgraph()->Constant(function.global_proxy());
receiver = effect =
graph()->NewNode(simplified()->ConvertReceiver(convert_mode),
receiver, global_proxy, effect, control);

6
src/compiler/node-matchers.h
View File

@ -18,6 +18,8 @@ namespace v8 {
namespace internal {
namespace compiler {
class JSHeapBroker;
// A pattern matcher for nodes.
struct NodeMatcher {
explicit NodeMatcher(Node* node) : node_(node) {}
@ -193,7 +195,9 @@ struct HeapObjectMatcher final
return this->HasValue() && this->Value().address() == value.address();
}
ObjectRef Ref() const { return ObjectRef(this->Value()); }
ObjectRef Ref(const JSHeapBroker* broker) const {
return ObjectRef(broker, this->Value());
}
};

3
src/compiler/simplified-operator-reducer.cc
View File

@ -62,8 +62,7 @@ Reduction SimplifiedOperatorReducer::Reduce(Node* node) {
case IrOpcode::kChangeTaggedToBit: {
HeapObjectMatcher m(node->InputAt(0));
if (m.HasValue()) {
HeapObjectRef object(m.Value());
return ReplaceInt32(object.BooleanValue(js_heap_broker()));
return ReplaceInt32(m.Ref(js_heap_broker()).BooleanValue());
}
if (m.IsChangeBitToTagged()) return Replace(m.InputAt(0));
break;

30
src/compiler/typed-optimization.cc
View File

@ -93,7 +93,7 @@ base::Optional<MapRef> GetStableMapFromObjectType(
const JSHeapBroker* js_heap_broker, Type object_type) {
if (object_type.IsHeapConstant()) {
HeapObjectRef object = object_type.AsHeapConstant()->Ref();
MapRef object_map = object.map(js_heap_broker);
MapRef object_map = object.map();
if (object_map.is_stable()) return object_map;
}
return {};
@ -153,7 +153,7 @@ Reduction TypedOptimization::ReduceCheckMaps(Node* node) {
if (map_type.IsHeapConstant() &&
map_type.AsHeapConstant()->Ref().equals(*object_map)) {
if (object_map->CanTransition()) {
object_map->DependOnStableMap(js_heap_broker(), dependencies());
object_map->DependOnStableMap(dependencies());
}
return Replace(effect);
}
@ -219,9 +219,9 @@ Reduction TypedOptimization::ReduceLoadField(Node* node) {
GetStableMapFromObjectType(js_heap_broker(), object_type);
if (object_map.has_value()) {
if (object_map->CanTransition()) {
object_map->DependOnStableMap(js_heap_broker(), dependencies());
object_map->DependOnStableMap(dependencies());
}
Node* const value = jsgraph()->Constant(js_heap_broker(), *object_map);
Node* const value = jsgraph()->Constant(*object_map);
ReplaceWithValue(node, value);
return Replace(value);
}
@ -558,32 +558,30 @@ Reduction TypedOptimization::ReduceTypeOf(Node* node) {
Factory* const f = factory();
if (type.Is(Type::Boolean())) {
return Replace(
jsgraph()->Constant(js_heap_broker(), ObjectRef(f->boolean_string())));
jsgraph()->Constant(ObjectRef(js_heap_broker(), f->boolean_string())));
} else if (type.Is(Type::Number())) {
return Replace(
jsgraph()->Constant(js_heap_broker(), ObjectRef(f->number_string())));
jsgraph()->Constant(ObjectRef(js_heap_broker(), f->number_string())));
} else if (type.Is(Type::String())) {
return Replace(
jsgraph()->Constant(js_heap_broker(), ObjectRef(f->string_string())));
jsgraph()->Constant(ObjectRef(js_heap_broker(), f->string_string())));
} else if (type.Is(Type::BigInt())) {
return Replace(
jsgraph()->Constant(js_heap_broker(), ObjectRef(f->bigint_string())));
jsgraph()->Constant(ObjectRef(js_heap_broker(), f->bigint_string())));
} else if (type.Is(Type::Symbol())) {
return Replace(
jsgraph()->Constant(js_heap_broker(), ObjectRef(f->symbol_string())));
jsgraph()->Constant(ObjectRef(js_heap_broker(), f->symbol_string())));
} else if (type.Is(Type::OtherUndetectableOrUndefined())) {
return Replace(jsgraph()->Constant(js_heap_broker(),
ObjectRef(f->undefined_string())));
return Replace(jsgraph()->Constant(
ObjectRef(js_heap_broker(), f->undefined_string())));
} else if (type.Is(Type::NonCallableOrNull())) {
return Replace(
jsgraph()->Constant(js_heap_broker(), ObjectRef(f->object_string())));
jsgraph()->Constant(ObjectRef(js_heap_broker(), f->object_string())));
} else if (type.Is(Type::Function())) {
return Replace(
jsgraph()->Constant(js_heap_broker(), ObjectRef(f->function_string())));
jsgraph()->Constant(ObjectRef(js_heap_broker(), f->function_string())));
} else if (type.IsHeapConstant()) {
return Replace(jsgraph()->Constant(
js_heap_broker(),
type.AsHeapConstant()->Ref().TypeOf(js_heap_broker())));
return Replace(jsgraph()->Constant(type.AsHeapConstant()->Ref().TypeOf()));
}
return NoChange();
}

4
src/compiler/types.cc
View File

@ -827,7 +827,7 @@ Type Type::NewConstant(const JSHeapBroker* js_heap_broker,
return NewConstant(static_cast<double>(maybe_smi.value()), zone);
}
HeapObjectRef heap_ref(value);
HeapObjectRef heap_ref(js_heap_broker, value);
if (heap_ref.IsHeapNumber()) {
return NewConstant(heap_ref.AsHeapNumber().value(), zone);
}
@ -1064,7 +1064,7 @@ Type Type::OtherNumberConstant(double value, Zone* zone) {
Type Type::HeapConstant(const JSHeapBroker* js_heap_broker,
Handle<i::Object> value, Zone* zone) {
return FromTypeBase(
HeapConstantType::New(js_heap_broker, HeapObjectRef(value), zone));
HeapConstantType::New(HeapObjectRef(js_heap_broker, value), zone));
}
// static

5
src/compiler/types.h
View File

@ -541,11 +541,10 @@ class V8_EXPORT_PRIVATE HeapConstantType : public NON_EXPORTED_BASE(TypeBase) {
friend class Type;
friend class BitsetType;
static HeapConstantType* New(const JSHeapBroker* broker,
const HeapObjectRef& heap_ref, Zone* zone) {
static HeapConstantType* New(const HeapObjectRef& heap_ref, Zone* zone) {
DCHECK(!heap_ref.IsHeapNumber());
DCHECK_IMPLIES(heap_ref.IsString(), heap_ref.IsInternalizedString());
BitsetType::bitset bitset = BitsetType::Lub(heap_ref.type(broker));
BitsetType::bitset bitset = BitsetType::Lub(heap_ref.type());
return new (zone->New(sizeof(HeapConstantType)))
HeapConstantType(bitset, heap_ref);
}