AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[turbofan] Make the JSHeapBroker a member of ObjectRef.

Browse Source 
This makes it more convenient to work with brokerized data.

Bug: v8:7790
Change-Id: I7ffb4054b809c10c67787b2fb89a05e8ce8f4575
Reviewed-on: https://chromium-review.googlesource.com/1138248
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54480}
This commit is contained in:
Georg Neis 2018-07-16 19:26:37 +02:00 committed by Commit Bot
parent b95def3488
commit 56d21252c9
17 changed files with 418 additions and 456 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/compiler/allocation-builder.h
View File

@ -18,10 +18,8 @@ namespace compiler {
// allocated object and also provides helpers for commonly allocated objects. // allocated object and also provides helpers for commonly allocated objects.
class AllocationBuilder final { class AllocationBuilder final {
public: public:
AllocationBuilder(JSGraph* jsgraph, const JSHeapBroker* js_heap_broker, AllocationBuilder(JSGraph* jsgraph, Node* effect, Node* control)
Node* effect, Node* control)
: jsgraph_(jsgraph), : jsgraph_(jsgraph),
js_heap_broker_(js_heap_broker),
allocation_(nullptr), allocation_(nullptr),
effect_(effect), effect_(effect),
control_(control) {} control_(control) {}
@ -79,7 +77,7 @@ class AllocationBuilder final {
} }
// Compound store of a constant into a field. // Compound store of a constant into a field.
void Store(const FieldAccess& access, const ObjectRef& value) { void Store(const FieldAccess& access, const ObjectRef& value) {
Store(access, jsgraph()->Constant(js_heap_broker(), value)); Store(access, jsgraph()->Constant(value));
} }
void FinishAndChange(Node* node) { void FinishAndChange(Node* node) {
@ -96,7 +94,6 @@ class AllocationBuilder final {
protected: protected:
JSGraph* jsgraph() { return jsgraph_; } JSGraph* jsgraph() { return jsgraph_; }
const JSHeapBroker* js_heap_broker() { return js_heap_broker_; }
Isolate* isolate() const { return jsgraph_->isolate(); } Isolate* isolate() const { return jsgraph_->isolate(); }
Graph* graph() { return jsgraph_->graph(); } Graph* graph() { return jsgraph_->graph(); }
CommonOperatorBuilder* common() { return jsgraph_->common(); } CommonOperatorBuilder* common() { return jsgraph_->common(); }
@ -104,7 +101,6 @@ class AllocationBuilder final {
private: private:
JSGraph* const jsgraph_; JSGraph* const jsgraph_;
const JSHeapBroker* const js_heap_broker_;
Node* allocation_; Node* allocation_;
Node* effect_; Node* effect_;
Node* control_; Node* control_;

4
src/compiler/common-operator-reducer.cc
View File

@ -27,8 +27,8 @@ Decision DecideCondition(const JSHeapBroker* broker, Node* const cond) {
} }
case IrOpcode::kHeapConstant: { case IrOpcode::kHeapConstant: {
HeapObjectMatcher mcond(cond); HeapObjectMatcher mcond(cond);
ObjectRef object(mcond.Value()); return mcond.Ref(broker).BooleanValue() ? Decision::kTrue
return object.BooleanValue(broker) ? Decision::kTrue : Decision::kFalse; : Decision::kFalse;
} }
default: default:
return Decision::kUnknown; return Decision::kUnknown;

7
src/compiler/constant-folding-reducer.cc
View File

@ -37,12 +37,11 @@ Reduction ConstantFoldingReducer::Reduce(Node* node) {
if (!upper.IsNone()) { if (!upper.IsNone()) {
Node* replacement = nullptr; Node* replacement = nullptr;
if (upper.IsHeapConstant()) { if (upper.IsHeapConstant()) {
replacement = jsgraph()->Constant(js_heap_broker(), replacement = jsgraph()->Constant(upper.AsHeapConstant()->Ref());
upper.AsHeapConstant()->Ref());
} else if (upper.Is(Type::MinusZero())) { } else if (upper.Is(Type::MinusZero())) {
Factory* factory = jsgraph()->isolate()->factory(); Factory* factory = jsgraph()->isolate()->factory();
ObjectRef minus_zero(factory->minus_zero_value()); ObjectRef minus_zero(js_heap_broker(), factory->minus_zero_value());
replacement = jsgraph()->Constant(js_heap_broker(), minus_zero); replacement = jsgraph()->Constant(minus_zero);
} else if (upper.Is(Type::NaN())) { } else if (upper.Is(Type::NaN())) {
replacement = jsgraph()->NaNConstant(); replacement = jsgraph()->NaNConstant();
} else if (upper.Is(Type::Null())) { } else if (upper.Is(Type::Null())) {

8
src/compiler/js-call-reducer.cc
View File

@ -1730,7 +1730,7 @@ Reduction JSCallReducer::ReduceArrayFilter(Node* node,
Node* a; // Construct the output array. Node* a; // Construct the output array.
{ {
AllocationBuilder ab(jsgraph(), js_heap_broker(), effect, control); AllocationBuilder ab(jsgraph(), effect, control);
ab.Allocate(initial_map->instance_size(), NOT_TENURED, Type::Array()); ab.Allocate(initial_map->instance_size(), NOT_TENURED, Type::Array());
ab.Store(AccessBuilder::ForMap(), initial_map); ab.Store(AccessBuilder::ForMap(), initial_map);
Node* empty_fixed_array = jsgraph()->EmptyFixedArrayConstant(); Node* empty_fixed_array = jsgraph()->EmptyFixedArrayConstant();
@ -1739,9 +1739,9 @@ Reduction JSCallReducer::ReduceArrayFilter(Node* node,
ab.Store(AccessBuilder::ForJSArrayLength(packed_kind), ab.Store(AccessBuilder::ForJSArrayLength(packed_kind),
jsgraph()->ZeroConstant()); jsgraph()->ZeroConstant());
for (int i = 0; i < initial_map->GetInObjectProperties(); ++i) { for (int i = 0; i < initial_map->GetInObjectProperties(); ++i) {
ab.Store( ab.Store(AccessBuilder::ForJSObjectInObjectProperty(
AccessBuilder::ForJSObjectInObjectProperty(MapRef(initial_map), i), MapRef(js_heap_broker(), initial_map), i),
jsgraph()->UndefinedConstant()); jsgraph()->UndefinedConstant());
} }
a = effect = ab.Finish(); a = effect = ab.Finish();
} }

24
src/compiler/js-context-specialization.cc
View File

@ -105,7 +105,7 @@ base::Optional<ContextRef> GetSpecializationContext(
Maybe<OuterContext> maybe_outer) { Maybe<OuterContext> maybe_outer) {
switch (node->opcode()) { switch (node->opcode()) {
case IrOpcode::kHeapConstant: { case IrOpcode::kHeapConstant: {
HeapObjectRef object(HeapConstantOf(node->op())); HeapObjectRef object(broker, HeapConstantOf(node->op()));
if (object.IsContext()) return object.AsContext(); if (object.IsContext()) return object.AsContext();
break; break;
} }
@ -114,7 +114,7 @@ base::Optional<ContextRef> GetSpecializationContext(
if (maybe_outer.To(&outer) && IsContextParameter(node) && if (maybe_outer.To(&outer) && IsContextParameter(node) &&
*distance >= outer.distance) { *distance >= outer.distance) {
*distance -= outer.distance; *distance -= outer.distance;
return ContextRef(outer.context); return ContextRef(broker, outer.context);
} }
break; break;
} }
@ -146,28 +146,26 @@ Reduction JSContextSpecialization::ReduceJSLoadContext(Node* node) {
// Now walk up the concrete context chain for the remaining depth. // Now walk up the concrete context chain for the remaining depth.
ContextRef concrete = maybe_concrete.value(); ContextRef concrete = maybe_concrete.value();
for (; depth > 0; --depth) { for (; depth > 0; --depth) {
concrete = concrete.previous(js_heap_broker()).value(); concrete = concrete.previous().value();
} }
if (!access.immutable()) { if (!access.immutable()) {
// We found the requested context object but since the context slot is // We found the requested context object but since the context slot is
// mutable we can only partially reduce the load. // mutable we can only partially reduce the load.
return SimplifyJSLoadContext( return SimplifyJSLoadContext(node, jsgraph()->Constant(concrete), depth);
node, jsgraph()->Constant(js_heap_broker(), concrete), depth);
} }
// This will hold the final value, if we can figure it out. // This will hold the final value, if we can figure it out.
base::Optional<ObjectRef> maybe_value; base::Optional<ObjectRef> maybe_value;
maybe_value = maybe_value = concrete.get(static_cast<int>(access.index()));
concrete.get(js_heap_broker(), static_cast<int>(access.index()));
if (maybe_value.has_value() && !maybe_value->IsSmi()) { if (maybe_value.has_value() && !maybe_value->IsSmi()) {
// Even though the context slot is immutable, the context might have escaped // Even though the context slot is immutable, the context might have escaped
// before the function to which it belongs has initialized the slot. // before the function to which it belongs has initialized the slot.
// We must be conservative and check if the value in the slot is currently // We must be conservative and check if the value in the slot is currently
// the hole or undefined. Only if it is neither of these, can we be sure // the hole or undefined. Only if it is neither of these, can we be sure
// that it won't change anymore. // that it won't change anymore.
OddballType oddball_type = maybe_value->oddball_type(js_heap_broker()); OddballType oddball_type = maybe_value->oddball_type();
if (oddball_type == OddballType::kUndefined || if (oddball_type == OddballType::kUndefined ||
oddball_type == OddballType::kHole) { oddball_type == OddballType::kHole) {
maybe_value.reset(); maybe_value.reset();
@ -175,15 +173,14 @@ Reduction JSContextSpecialization::ReduceJSLoadContext(Node* node) {
} }
if (!maybe_value.has_value()) { if (!maybe_value.has_value()) {
return SimplifyJSLoadContext( return SimplifyJSLoadContext(node, jsgraph()->Constant(concrete), depth);
node, jsgraph()->Constant(js_heap_broker(), concrete), depth);
} }
// Success. The context load can be replaced with the constant. // Success. The context load can be replaced with the constant.
// TODO(titzer): record the specialization for sharing code across // TODO(titzer): record the specialization for sharing code across
// multiple contexts that have the same value in the corresponding context // multiple contexts that have the same value in the corresponding context
// slot. // slot.
Node* constant = jsgraph_->Constant(js_heap_broker(), *maybe_value); Node* constant = jsgraph_->Constant(*maybe_value);
ReplaceWithValue(node, constant); ReplaceWithValue(node, constant);
return Replace(constant); return Replace(constant);
} }
@ -210,11 +207,10 @@ Reduction JSContextSpecialization::ReduceJSStoreContext(Node* node) {
// Now walk up the concrete context chain for the remaining depth. // Now walk up the concrete context chain for the remaining depth.
ContextRef concrete = maybe_concrete.value(); ContextRef concrete = maybe_concrete.value();
for (; depth > 0; --depth) { for (; depth > 0; --depth) {
concrete = concrete.previous(js_heap_broker()).value(); concrete = concrete.previous().value();
} }
return SimplifyJSStoreContext( return SimplifyJSStoreContext(node, jsgraph()->Constant(concrete), depth);
node, jsgraph()->Constant(js_heap_broker(), concrete), depth);
} }

268
src/compiler/js-create-lowering.cc
View File

@ -42,13 +42,10 @@ Node* GetArgumentsFrameState(Node* frame_state) {
// Checks whether allocation using the given target and new.target can be // Checks whether allocation using the given target and new.target can be
// inlined. // inlined.
bool IsAllocationInlineable(const JSFunctionRef& target, bool IsAllocationInlineable(const JSFunctionRef& target,
const JSFunctionRef& new_target, const JSFunctionRef& new_target) {
const JSHeapBroker* broker) {
return new_target.has_initial_map() && return new_target.has_initial_map() &&
!new_target.initial_map(broker).is_dictionary_map() && !new_target.initial_map().is_dictionary_map() &&
new_target.initial_map(broker) new_target.initial_map().constructor_or_backpointer().equals(target);
.constructor_or_backpointer(broker)
.equals(target);
} }
// When initializing arrays, we'll unfold the loop if the number of // When initializing arrays, we'll unfold the loop if the number of
@ -136,15 +133,13 @@ Reduction JSCreateLowering::ReduceJSCreate(Node* node) {
if (!original_constructor.IsConstructor()) return NoChange(); if (!original_constructor.IsConstructor()) return NoChange();
// Check if we can inline the allocation. // Check if we can inline the allocation.
if (!IsAllocationInlineable(constructor, original_constructor, if (!IsAllocationInlineable(constructor, original_constructor)) {
js_heap_broker())) {
return NoChange(); return NoChange();
} }
// Add a dependency on the {initial_map} to make sure that this code is // Add a dependency on the {initial_map} to make sure that this code is
// deoptimized whenever the {initial_map} changes. // deoptimized whenever the {initial_map} changes.
MapRef initial_map = MapRef initial_map = original_constructor.DependOnInitialMap(dependencies());
original_constructor.DependOnInitialMap(js_heap_broker(), dependencies());
// Force completion of inobject slack tracking before // Force completion of inobject slack tracking before
// generating code to finalize the instance size. // generating code to finalize the instance size.
@ -153,7 +148,7 @@ Reduction JSCreateLowering::ReduceJSCreate(Node* node) {
// Emit code to allocate the JSObject instance for the // Emit code to allocate the JSObject instance for the
// {original_constructor}. // {original_constructor}.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control); AllocationBuilder a(jsgraph(), effect, control);
a.Allocate(slack_tracking_result.instance_size); a.Allocate(slack_tracking_result.instance_size);
a.Store(AccessBuilder::ForMap(), initial_map); a.Store(AccessBuilder::ForMap(), initial_map);
a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(), a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(),
@ -178,7 +173,8 @@ Reduction JSCreateLowering::ReduceJSCreateArguments(Node* node) {
Node* const outer_state = frame_state->InputAt(kFrameStateOuterStateInput); Node* const outer_state = frame_state->InputAt(kFrameStateOuterStateInput);
Node* const control = graph()->start(); Node* const control = graph()->start();
FrameStateInfo state_info = FrameStateInfoOf(frame_state->op()); FrameStateInfo state_info = FrameStateInfoOf(frame_state->op());
SharedFunctionInfoRef shared(state_info.shared_info().ToHandleChecked()); SharedFunctionInfoRef shared(js_heap_broker(),
state_info.shared_info().ToHandleChecked());
// Use the ArgumentsAccessStub for materializing both mapped and unmapped // Use the ArgumentsAccessStub for materializing both mapped and unmapped
// arguments object, but only for non-inlined (i.e. outermost) frames. // arguments object, but only for non-inlined (i.e. outermost) frames.
@ -203,13 +199,11 @@ Reduction JSCreateLowering::ReduceJSCreateArguments(Node* node) {
&has_aliased_arguments); &has_aliased_arguments);
// Load the arguments object map. // Load the arguments object map.
Node* const arguments_map = jsgraph()->Constant( Node* const arguments_map = jsgraph()->Constant(
js_heap_broker(),
has_aliased_arguments has_aliased_arguments
? native_context_ref().fast_aliased_arguments_map( ? native_context_ref().fast_aliased_arguments_map()
js_heap_broker()) : native_context_ref().sloppy_arguments_map());
: native_context_ref().sloppy_arguments_map(js_heap_broker()));
// Actually allocate and initialize the arguments object. // Actually allocate and initialize the arguments object.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control); AllocationBuilder a(jsgraph(), effect, control);
Node* properties = jsgraph()->EmptyFixedArrayConstant(); Node* properties = jsgraph()->EmptyFixedArrayConstant();
STATIC_ASSERT(JSSloppyArgumentsObject::kSize == 5 * kPointerSize); STATIC_ASSERT(JSSloppyArgumentsObject::kSize == 5 * kPointerSize);
a.Allocate(JSSloppyArgumentsObject::kSize); a.Allocate(JSSloppyArgumentsObject::kSize);
@ -235,11 +229,10 @@ Reduction JSCreateLowering::ReduceJSCreateArguments(Node* node) {
graph()->NewNode(simplified()->NewArgumentsElements(0), graph()->NewNode(simplified()->NewArgumentsElements(0),
arguments_frame, arguments_length, effect); arguments_frame, arguments_length, effect);
// Load the arguments object map. // Load the arguments object map.
Node* const arguments_map = jsgraph()->Constant( Node* const arguments_map =
js_heap_broker(), jsgraph()->Constant(native_context_ref().strict_arguments_map());
native_context_ref().strict_arguments_map(js_heap_broker()));
// Actually allocate and initialize the arguments object. // Actually allocate and initialize the arguments object.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control); AllocationBuilder a(jsgraph(), effect, control);
Node* properties = jsgraph()->EmptyFixedArrayConstant(); Node* properties = jsgraph()->EmptyFixedArrayConstant();
STATIC_ASSERT(JSStrictArgumentsObject::kSize == 4 * kPointerSize); STATIC_ASSERT(JSStrictArgumentsObject::kSize == 4 * kPointerSize);
a.Allocate(JSStrictArgumentsObject::kSize); a.Allocate(JSStrictArgumentsObject::kSize);
@ -267,11 +260,9 @@ Reduction JSCreateLowering::ReduceJSCreateArguments(Node* node) {
arguments_frame, rest_length, effect); arguments_frame, rest_length, effect);
// Load the JSArray object map. // Load the JSArray object map.
Node* const jsarray_map = jsgraph()->Constant( Node* const jsarray_map = jsgraph()->Constant(
js_heap_broker(), native_context_ref().js_array_fast_elements_map_index());
native_context_ref().js_array_fast_elements_map_index(
js_heap_broker()));
// Actually allocate and initialize the jsarray. // Actually allocate and initialize the jsarray.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control); AllocationBuilder a(jsgraph(), effect, control);
Node* properties = jsgraph()->EmptyFixedArrayConstant(); Node* properties = jsgraph()->EmptyFixedArrayConstant();
STATIC_ASSERT(JSArray::kSize == 4 * kPointerSize); STATIC_ASSERT(JSArray::kSize == 4 * kPointerSize);
a.Allocate(JSArray::kSize); a.Allocate(JSArray::kSize);
@ -313,13 +304,11 @@ Reduction JSCreateLowering::ReduceJSCreateArguments(Node* node) {
effect = elements->op()->EffectOutputCount() > 0 ? elements : effect; effect = elements->op()->EffectOutputCount() > 0 ? elements : effect;
// Load the arguments object map. // Load the arguments object map.
Node* const arguments_map = jsgraph()->Constant( Node* const arguments_map = jsgraph()->Constant(
js_heap_broker(),
has_aliased_arguments has_aliased_arguments
? native_context_ref().fast_aliased_arguments_map( ? native_context_ref().fast_aliased_arguments_map()
js_heap_broker()) : native_context_ref().sloppy_arguments_map());
: native_context_ref().sloppy_arguments_map(js_heap_broker()));
// Actually allocate and initialize the arguments object. // Actually allocate and initialize the arguments object.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control); AllocationBuilder a(jsgraph(), effect, control);
Node* properties = jsgraph()->EmptyFixedArrayConstant(); Node* properties = jsgraph()->EmptyFixedArrayConstant();
int length = args_state_info.parameter_count() - 1; // Minus receiver. int length = args_state_info.parameter_count() - 1; // Minus receiver.
STATIC_ASSERT(JSSloppyArgumentsObject::kSize == 5 * kPointerSize); STATIC_ASSERT(JSSloppyArgumentsObject::kSize == 5 * kPointerSize);
@ -352,11 +341,10 @@ Reduction JSCreateLowering::ReduceJSCreateArguments(Node* node) {
Node* const elements = AllocateArguments(effect, control, args_state); Node* const elements = AllocateArguments(effect, control, args_state);
effect = elements->op()->EffectOutputCount() > 0 ? elements : effect; effect = elements->op()->EffectOutputCount() > 0 ? elements : effect;
// Load the arguments object map. // Load the arguments object map.
Node* const arguments_map = jsgraph()->Constant( Node* const arguments_map =
js_heap_broker(), jsgraph()->Constant(native_context_ref().strict_arguments_map());
native_context_ref().strict_arguments_map(js_heap_broker()));
// Actually allocate and initialize the arguments object. // Actually allocate and initialize the arguments object.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control); AllocationBuilder a(jsgraph(), effect, control);
Node* properties = jsgraph()->EmptyFixedArrayConstant(); Node* properties = jsgraph()->EmptyFixedArrayConstant();
int length = args_state_info.parameter_count() - 1; // Minus receiver. int length = args_state_info.parameter_count() - 1; // Minus receiver.
STATIC_ASSERT(JSStrictArgumentsObject::kSize == 4 * kPointerSize); STATIC_ASSERT(JSStrictArgumentsObject::kSize == 4 * kPointerSize);
@ -391,11 +379,9 @@ Reduction JSCreateLowering::ReduceJSCreateArguments(Node* node) {
effect = elements->op()->EffectOutputCount() > 0 ? elements : effect; effect = elements->op()->EffectOutputCount() > 0 ? elements : effect;
// Load the JSArray object map. // Load the JSArray object map.
Node* const jsarray_map = jsgraph()->Constant( Node* const jsarray_map = jsgraph()->Constant(
js_heap_broker(), native_context_ref().js_array_fast_elements_map_index());
native_context_ref().js_array_fast_elements_map_index(
js_heap_broker()));
// Actually allocate and initialize the jsarray. // Actually allocate and initialize the jsarray.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control); AllocationBuilder a(jsgraph(), effect, control);
Node* properties = jsgraph()->EmptyFixedArrayConstant(); Node* properties = jsgraph()->EmptyFixedArrayConstant();
// -1 to minus receiver // -1 to minus receiver
@ -439,18 +425,17 @@ Reduction JSCreateLowering::ReduceJSCreateGeneratorObject(Node* node) {
// Add a dependency on the {initial_map} to make sure that this code is // Add a dependency on the {initial_map} to make sure that this code is
// deoptimized whenever the {initial_map} changes. // deoptimized whenever the {initial_map} changes.
MapRef initial_map( MapRef initial_map = js_function.DependOnInitialMap(dependencies());
js_function.DependOnInitialMap(js_heap_broker(), dependencies()));
DCHECK(initial_map.instance_type() == JS_GENERATOR_OBJECT_TYPE || DCHECK(initial_map.instance_type() == JS_GENERATOR_OBJECT_TYPE ||
initial_map.instance_type() == JS_ASYNC_GENERATOR_OBJECT_TYPE); initial_map.instance_type() == JS_ASYNC_GENERATOR_OBJECT_TYPE);
// Allocate a register file. // Allocate a register file.
SharedFunctionInfoRef shared(js_function.shared(js_heap_broker())); SharedFunctionInfoRef shared = js_function.shared();
DCHECK(shared.HasBytecodeArray()); DCHECK(shared.HasBytecodeArray());
int parameter_count_no_receiver = shared.internal_formal_parameter_count(); int parameter_count_no_receiver = shared.internal_formal_parameter_count();
int size = int size =
parameter_count_no_receiver + shared.GetBytecodeArrayRegisterCount(); parameter_count_no_receiver + shared.GetBytecodeArrayRegisterCount();
AllocationBuilder ab(jsgraph(), js_heap_broker(), effect, control); AllocationBuilder ab(jsgraph(), effect, control);
ab.AllocateArray(size, factory()->fixed_array_map()); ab.AllocateArray(size, factory()->fixed_array_map());
for (int i = 0; i < size; ++i) { for (int i = 0; i < size; ++i) {
ab.Store(AccessBuilder::ForFixedArraySlot(i), ab.Store(AccessBuilder::ForFixedArraySlot(i),
@ -459,7 +444,7 @@ Reduction JSCreateLowering::ReduceJSCreateGeneratorObject(Node* node) {
Node* parameters_and_registers = effect = ab.Finish(); Node* parameters_and_registers = effect = ab.Finish();
// Emit code to allocate the JS[Async]GeneratorObject instance. // Emit code to allocate the JS[Async]GeneratorObject instance.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control); AllocationBuilder a(jsgraph(), effect, control);
a.Allocate(slack_tracking_result.instance_size); a.Allocate(slack_tracking_result.instance_size);
Node* empty_fixed_array = jsgraph()->EmptyFixedArrayConstant(); Node* empty_fixed_array = jsgraph()->EmptyFixedArrayConstant();
Node* undefined = jsgraph()->UndefinedConstant(); Node* undefined = jsgraph()->UndefinedConstant();
@ -528,7 +513,7 @@ Reduction JSCreateLowering::ReduceNewArray(Node* node, Node* length,
Node* properties = jsgraph()->EmptyFixedArrayConstant(); Node* properties = jsgraph()->EmptyFixedArrayConstant();
// Perform the allocation of the actual JSArray object. // Perform the allocation of the actual JSArray object.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control); AllocationBuilder a(jsgraph(), effect, control);
a.Allocate(initial_map->instance_size(), pretenure); a.Allocate(initial_map->instance_size(), pretenure);
a.Store(AccessBuilder::ForMap(), initial_map); a.Store(AccessBuilder::ForMap(), initial_map);
a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(), properties); a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(), properties);
@ -536,7 +521,8 @@ Reduction JSCreateLowering::ReduceNewArray(Node* node, Node* length,
a.Store(AccessBuilder::ForJSArrayLength(initial_map->elements_kind()), a.Store(AccessBuilder::ForJSArrayLength(initial_map->elements_kind()),
length); length);
for (int i = 0; i < initial_map->GetInObjectProperties(); ++i) { for (int i = 0; i < initial_map->GetInObjectProperties(); ++i) {
a.Store(AccessBuilder::ForJSObjectInObjectProperty(MapRef(initial_map), i), a.Store(AccessBuilder::ForJSObjectInObjectProperty(
MapRef(js_heap_broker(), initial_map), i),
jsgraph()->UndefinedConstant()); jsgraph()->UndefinedConstant());
} }
RelaxControls(node); RelaxControls(node);
@ -574,14 +560,15 @@ Reduction JSCreateLowering::ReduceNewArray(Node* node, Node* length,
Node* properties = jsgraph()->EmptyFixedArrayConstant(); Node* properties = jsgraph()->EmptyFixedArrayConstant();
// Perform the allocation of the actual JSArray object. // Perform the allocation of the actual JSArray object.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control); AllocationBuilder a(jsgraph(), effect, control);
a.Allocate(initial_map->instance_size(), pretenure); a.Allocate(initial_map->instance_size(), pretenure);
a.Store(AccessBuilder::ForMap(), initial_map); a.Store(AccessBuilder::ForMap(), initial_map);
a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(), properties); a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(), properties);
a.Store(AccessBuilder::ForJSObjectElements(), elements); a.Store(AccessBuilder::ForJSObjectElements(), elements);
a.Store(AccessBuilder::ForJSArrayLength(elements_kind), length); a.Store(AccessBuilder::ForJSArrayLength(elements_kind), length);
for (int i = 0; i < initial_map->GetInObjectProperties(); ++i) { for (int i = 0; i < initial_map->GetInObjectProperties(); ++i) {
a.Store(AccessBuilder::ForJSObjectInObjectProperty(MapRef(initial_map), i), a.Store(AccessBuilder::ForJSObjectInObjectProperty(
MapRef(js_heap_broker(), initial_map), i),
jsgraph()->UndefinedConstant()); jsgraph()->UndefinedConstant());
} }
RelaxControls(node); RelaxControls(node);
@ -630,14 +617,15 @@ Reduction JSCreateLowering::ReduceNewArray(Node* node,
Node* length = jsgraph()->Constant(static_cast<int>(values.size())); Node* length = jsgraph()->Constant(static_cast<int>(values.size()));
// Perform the allocation of the actual JSArray object. // Perform the allocation of the actual JSArray object.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control); AllocationBuilder a(jsgraph(), effect, control);
a.Allocate(initial_map->instance_size(), pretenure); a.Allocate(initial_map->instance_size(), pretenure);
a.Store(AccessBuilder::ForMap(), initial_map); a.Store(AccessBuilder::ForMap(), initial_map);
a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(), properties); a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(), properties);
a.Store(AccessBuilder::ForJSObjectElements(), elements); a.Store(AccessBuilder::ForJSObjectElements(), elements);
a.Store(AccessBuilder::ForJSArrayLength(elements_kind), length); a.Store(AccessBuilder::ForJSArrayLength(elements_kind), length);
for (int i = 0; i < initial_map->GetInObjectProperties(); ++i) { for (int i = 0; i < initial_map->GetInObjectProperties(); ++i) {
a.Store(AccessBuilder::ForJSObjectInObjectProperty(MapRef(initial_map), i), a.Store(AccessBuilder::ForJSObjectInObjectProperty(
MapRef(js_heap_broker(), initial_map), i),
jsgraph()->UndefinedConstant()); jsgraph()->UndefinedConstant());
} }
RelaxControls(node); RelaxControls(node);
@ -730,9 +718,9 @@ Reduction JSCreateLowering::ReduceJSCreateArray(Node* node) {
DCHECK(original_constructor->IsConstructor()); DCHECK(original_constructor->IsConstructor());
// Check if we can inline the allocation. // Check if we can inline the allocation.
if (IsAllocationInlineable(JSFunctionRef(constructor), if (IsAllocationInlineable(
JSFunctionRef(original_constructor), JSFunctionRef(js_heap_broker(), constructor),
js_heap_broker())) { JSFunctionRef(js_heap_broker(), original_constructor))) {
// Force completion of inobject slack tracking before // Force completion of inobject slack tracking before
// generating code to finalize the instance size. // generating code to finalize the instance size.
original_constructor->CompleteInobjectSlackTrackingIfActive(); original_constructor->CompleteInobjectSlackTrackingIfActive();
@ -856,10 +844,10 @@ Reduction JSCreateLowering::ReduceJSCreateArrayIterator(Node* node) {
Node* control = NodeProperties::GetControlInput(node); Node* control = NodeProperties::GetControlInput(node);
// Create the JSArrayIterator result. // Create the JSArrayIterator result.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control); AllocationBuilder a(jsgraph(), effect, control);
a.Allocate(JSArrayIterator::kSize, NOT_TENURED, Type::OtherObject()); a.Allocate(JSArrayIterator::kSize, NOT_TENURED, Type::OtherObject());
a.Store(AccessBuilder::ForMap(), a.Store(AccessBuilder::ForMap(),
native_context_ref().initial_array_iterator_map(js_heap_broker())); native_context_ref().initial_array_iterator_map());
a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(), a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(),
jsgraph()->EmptyFixedArrayConstant()); jsgraph()->EmptyFixedArrayConstant());
a.Store(AccessBuilder::ForJSObjectElements(), a.Store(AccessBuilder::ForJSObjectElements(),
@ -877,7 +865,6 @@ Reduction JSCreateLowering::ReduceJSCreateArrayIterator(Node* node) {
namespace { namespace {
MapRef MapForCollectionIterationKind(const NativeContextRef& native_context, MapRef MapForCollectionIterationKind(const NativeContextRef& native_context,
const JSHeapBroker* broker,
CollectionKind collection_kind, CollectionKind collection_kind,
IterationKind iteration_kind) { IterationKind iteration_kind) {
switch (collection_kind) { switch (collection_kind) {
@ -886,19 +873,19 @@ MapRef MapForCollectionIterationKind(const NativeContextRef& native_context,
case IterationKind::kKeys: case IterationKind::kKeys:
UNREACHABLE(); UNREACHABLE();
case IterationKind::kValues: case IterationKind::kValues:
return native_context.set_value_iterator_map(broker); return native_context.set_value_iterator_map();
case IterationKind::kEntries: case IterationKind::kEntries:
return native_context.set_key_value_iterator_map(broker); return native_context.set_key_value_iterator_map();
} }
break; break;
case CollectionKind::kMap: case CollectionKind::kMap:
switch (iteration_kind) { switch (iteration_kind) {
case IterationKind::kKeys: case IterationKind::kKeys:
return native_context.map_key_iterator_map(broker); return native_context.map_key_iterator_map();
case IterationKind::kValues: case IterationKind::kValues:
return native_context.map_value_iterator_map(broker); return native_context.map_value_iterator_map();
case IterationKind::kEntries: case IterationKind::kEntries:
return native_context.map_key_value_iterator_map(broker); return native_context.map_key_value_iterator_map();
} }
break; break;
} }
@ -922,12 +909,11 @@ Reduction JSCreateLowering::ReduceJSCreateCollectionIterator(Node* node) {
iterated_object, effect, control); iterated_object, effect, control);
// Create the JSArrayIterator result. // Create the JSArrayIterator result.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control); AllocationBuilder a(jsgraph(), effect, control);
a.Allocate(JSCollectionIterator::kSize, NOT_TENURED, Type::OtherObject()); a.Allocate(JSCollectionIterator::kSize, NOT_TENURED, Type::OtherObject());
a.Store( a.Store(AccessBuilder::ForMap(),
AccessBuilder::ForMap(), MapForCollectionIterationKind(
MapForCollectionIterationKind(native_context_ref(), js_heap_broker(), native_context_ref(), p.collection_kind(), p.iteration_kind()));
p.collection_kind(), p.iteration_kind()));
a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(), a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(),
jsgraph()->EmptyFixedArrayConstant()); jsgraph()->EmptyFixedArrayConstant());
a.Store(AccessBuilder::ForJSObjectElements(), a.Store(AccessBuilder::ForJSObjectElements(),
@ -946,7 +932,7 @@ Reduction JSCreateLowering::ReduceJSCreateBoundFunction(Node* node) {
CreateBoundFunctionParameters const& p = CreateBoundFunctionParameters const& p =
CreateBoundFunctionParametersOf(node->op()); CreateBoundFunctionParametersOf(node->op());
int const arity = static_cast<int>(p.arity()); int const arity = static_cast<int>(p.arity());
MapRef const map(p.map()); MapRef const map(js_heap_broker(), p.map());
Node* bound_target_function = NodeProperties::GetValueInput(node, 0); Node* bound_target_function = NodeProperties::GetValueInput(node, 0);
Node* bound_this = NodeProperties::GetValueInput(node, 1); Node* bound_this = NodeProperties::GetValueInput(node, 1);
Node* effect = NodeProperties::GetEffectInput(node); Node* effect = NodeProperties::GetEffectInput(node);
@ -955,7 +941,7 @@ Reduction JSCreateLowering::ReduceJSCreateBoundFunction(Node* node) {
// Create the [[BoundArguments]] for the result. // Create the [[BoundArguments]] for the result.
Node* bound_arguments = jsgraph()->EmptyFixedArrayConstant(); Node* bound_arguments = jsgraph()->EmptyFixedArrayConstant();
if (arity > 0) { if (arity > 0) {
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control); AllocationBuilder a(jsgraph(), effect, control);
a.AllocateArray(arity, factory()->fixed_array_map()); a.AllocateArray(arity, factory()->fixed_array_map());
for (int i = 0; i < arity; ++i) { for (int i = 0; i < arity; ++i) {
a.Store(AccessBuilder::ForFixedArraySlot(i), a.Store(AccessBuilder::ForFixedArraySlot(i),
@ -965,7 +951,7 @@ Reduction JSCreateLowering::ReduceJSCreateBoundFunction(Node* node) {
} }
// Create the JSBoundFunction result. // Create the JSBoundFunction result.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control); AllocationBuilder a(jsgraph(), effect, control);
a.Allocate(JSBoundFunction::kSize, NOT_TENURED, Type::BoundFunction()); a.Allocate(JSBoundFunction::kSize, NOT_TENURED, Type::BoundFunction());
a.Store(AccessBuilder::ForMap(), map); a.Store(AccessBuilder::ForMap(), map);
a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(), a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(),
@ -985,9 +971,9 @@ Reduction JSCreateLowering::ReduceJSCreateClosure(Node* node) {
DisallowHeapAccess no_heap_access; DisallowHeapAccess no_heap_access;
DCHECK_EQ(IrOpcode::kJSCreateClosure, node->opcode()); DCHECK_EQ(IrOpcode::kJSCreateClosure, node->opcode());
CreateClosureParameters const& p = CreateClosureParametersOf(node->op()); CreateClosureParameters const& p = CreateClosureParametersOf(node->op());
SharedFunctionInfoRef shared(p.shared_info()); SharedFunctionInfoRef shared(js_heap_broker(), p.shared_info());
HeapObjectRef feedback_cell(p.feedback_cell()); HeapObjectRef feedback_cell(js_heap_broker(), p.feedback_cell());
HeapObjectRef code(p.code()); HeapObjectRef code(js_heap_broker(), p.code());
Node* effect = NodeProperties::GetEffectInput(node); Node* effect = NodeProperties::GetEffectInput(node);
Node* control = NodeProperties::GetControlInput(node); Node* control = NodeProperties::GetControlInput(node);
Node* context = NodeProperties::GetContextInput(node); Node* context = NodeProperties::GetContextInput(node);
@ -995,13 +981,13 @@ Reduction JSCreateLowering::ReduceJSCreateClosure(Node* node) {
// Use inline allocation of closures only for instantiation sites that have // Use inline allocation of closures only for instantiation sites that have
// seen more than one instantiation, this simplifies the generated code and // seen more than one instantiation, this simplifies the generated code and
// also serves as a heuristic of which allocation sites benefit from it. // also serves as a heuristic of which allocation sites benefit from it.
if (!feedback_cell.map(js_heap_broker()) if (!feedback_cell.map().equals(
.equals(MapRef(factory()->many_closures_cell_map()))) { MapRef(js_heap_broker(), factory()->many_closures_cell_map()))) {
return NoChange(); return NoChange();
} }
MapRef function_map = native_context_ref().GetFunctionMapFromIndex( MapRef function_map =
js_heap_broker(), shared.function_map_index()); native_context_ref().GetFunctionMapFromIndex(shared.function_map_index());
DCHECK(!function_map.IsInobjectSlackTrackingInProgress()); DCHECK(!function_map.IsInobjectSlackTrackingInProgress());
DCHECK(!function_map.is_dictionary_map()); DCHECK(!function_map.is_dictionary_map());
@ -1018,7 +1004,7 @@ Reduction JSCreateLowering::ReduceJSCreateClosure(Node* node) {
// Emit code to allocate the JSFunction instance. // Emit code to allocate the JSFunction instance.
STATIC_ASSERT(JSFunction::kSizeWithoutPrototype == 7 * kPointerSize); STATIC_ASSERT(JSFunction::kSizeWithoutPrototype == 7 * kPointerSize);
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control); AllocationBuilder a(jsgraph(), effect, control);
a.Allocate(function_map.instance_size(), pretenure, Type::Function()); a.Allocate(function_map.instance_size(), pretenure, Type::Function());
a.Store(AccessBuilder::ForMap(), function_map); a.Store(AccessBuilder::ForMap(), function_map);
a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(), a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(),
@ -1054,7 +1040,7 @@ Reduction JSCreateLowering::ReduceJSCreateIterResultObject(Node* node) {
handle(native_context()->iterator_result_map(), isolate())); handle(native_context()->iterator_result_map(), isolate()));
// Emit code to allocate the JSIteratorResult instance. // Emit code to allocate the JSIteratorResult instance.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, graph()->start()); AllocationBuilder a(jsgraph(), effect, graph()->start());
a.Allocate(JSIteratorResult::kSize); a.Allocate(JSIteratorResult::kSize);
a.Store(AccessBuilder::ForMap(), iterator_result_map); a.Store(AccessBuilder::ForMap(), iterator_result_map);
a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(), a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(),
@ -1076,7 +1062,7 @@ Reduction JSCreateLowering::ReduceJSCreateStringIterator(Node* node) {
Node* map = jsgraph()->HeapConstant( Node* map = jsgraph()->HeapConstant(
handle(native_context()->string_iterator_map(), isolate())); handle(native_context()->string_iterator_map(), isolate()));
// Allocate new iterator and attach the iterator to this string. // Allocate new iterator and attach the iterator to this string.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, graph()->start()); AllocationBuilder a(jsgraph(), effect, graph()->start());
a.Allocate(JSStringIterator::kSize, NOT_TENURED, Type::OtherObject()); a.Allocate(JSStringIterator::kSize, NOT_TENURED, Type::OtherObject());
a.Store(AccessBuilder::ForMap(), map); a.Store(AccessBuilder::ForMap(), map);
a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(), a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(),
@ -1101,7 +1087,7 @@ Reduction JSCreateLowering::ReduceJSCreateKeyValueArray(Node* node) {
Node* properties = jsgraph()->EmptyFixedArrayConstant(); Node* properties = jsgraph()->EmptyFixedArrayConstant();
Node* length = jsgraph()->Constant(2); Node* length = jsgraph()->Constant(2);
AllocationBuilder aa(jsgraph(), js_heap_broker(), effect, graph()->start()); AllocationBuilder aa(jsgraph(), effect, graph()->start());
aa.AllocateArray(2, factory()->fixed_array_map()); aa.AllocateArray(2, factory()->fixed_array_map());
aa.Store(AccessBuilder::ForFixedArrayElement(PACKED_ELEMENTS), aa.Store(AccessBuilder::ForFixedArrayElement(PACKED_ELEMENTS),
jsgraph()->ZeroConstant(), key); jsgraph()->ZeroConstant(), key);
@ -1109,7 +1095,7 @@ Reduction JSCreateLowering::ReduceJSCreateKeyValueArray(Node* node) {
jsgraph()->OneConstant(), value); jsgraph()->OneConstant(), value);
Node* elements = aa.Finish(); Node* elements = aa.Finish();
AllocationBuilder a(jsgraph(), js_heap_broker(), elements, graph()->start()); AllocationBuilder a(jsgraph(), elements, graph()->start());
a.Allocate(JSArray::kSize); a.Allocate(JSArray::kSize);
a.Store(AccessBuilder::ForMap(), array_map); a.Store(AccessBuilder::ForMap(), array_map);
a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(), properties); a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(), properties);
@ -1127,7 +1113,7 @@ Reduction JSCreateLowering::ReduceJSCreatePromise(Node* node) {
Handle<Map> promise_map(native_context()->promise_function()->initial_map(), Handle<Map> promise_map(native_context()->promise_function()->initial_map(),
isolate()); isolate());
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, graph()->start()); AllocationBuilder a(jsgraph(), effect, graph()->start());
a.Allocate(promise_map->instance_size()); a.Allocate(promise_map->instance_size());
a.Store(AccessBuilder::ForMap(), promise_map); a.Store(AccessBuilder::ForMap(), promise_map);
a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(), a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(),
@ -1156,19 +1142,18 @@ Reduction JSCreateLowering::ReduceJSCreateLiteralArrayOrObject(Node* node) {
Node* effect = NodeProperties::GetEffectInput(node); Node* effect = NodeProperties::GetEffectInput(node);
Node* control = NodeProperties::GetControlInput(node); Node* control = NodeProperties::GetControlInput(node);
FeedbackVectorRef feedback_vector(p.feedback().vector()); FeedbackVectorRef feedback_vector(js_heap_broker(), p.feedback().vector());
ObjectRef feedback = ObjectRef feedback = feedback_vector.get(p.feedback().slot());
feedback_vector.get(js_heap_broker(), p.feedback().slot());
if (feedback.IsAllocationSite()) { if (feedback.IsAllocationSite()) {
AllocationSiteRef site = feedback.AsAllocationSite(); AllocationSiteRef site = feedback.AsAllocationSite();
if (site.IsFastLiteral(js_heap_broker())) { if (site.IsFastLiteral()) {
PretenureFlag pretenure = NOT_TENURED; PretenureFlag pretenure = NOT_TENURED;
if (FLAG_allocation_site_pretenuring) { if (FLAG_allocation_site_pretenuring) {
pretenure = dependencies()->DependOnPretenureMode( pretenure = dependencies()->DependOnPretenureMode(
site.object<AllocationSite>()); site.object<AllocationSite>());
} }
dependencies()->DependOnElementsKinds(site.object<AllocationSite>()); dependencies()->DependOnElementsKinds(site.object<AllocationSite>());
JSObjectRef boilerplate = site.boilerplate(js_heap_broker()); JSObjectRef boilerplate = site.boilerplate();
Node* value = effect = Node* value = effect =
AllocateFastLiteral(effect, control, boilerplate, pretenure); AllocateFastLiteral(effect, control, boilerplate, pretenure);
ReplaceWithValue(node, value, effect, control); ReplaceWithValue(node, value, effect, control);
@ -1213,13 +1198,14 @@ Reduction JSCreateLowering::ReduceJSCreateEmptyLiteralObject(Node* node) {
Node* properties = jsgraph()->EmptyFixedArrayConstant(); Node* properties = jsgraph()->EmptyFixedArrayConstant();
// Perform the allocation of the actual JSArray object. // Perform the allocation of the actual JSArray object.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control); AllocationBuilder a(jsgraph(), effect, control);
a.Allocate(map->instance_size()); a.Allocate(map->instance_size());
a.Store(AccessBuilder::ForMap(), js_object_map); a.Store(AccessBuilder::ForMap(), js_object_map);
a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(), properties); a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(), properties);
a.Store(AccessBuilder::ForJSObjectElements(), elements); a.Store(AccessBuilder::ForJSObjectElements(), elements);
for (int i = 0; i < map->GetInObjectProperties(); i++) { for (int i = 0; i < map->GetInObjectProperties(); i++) {
a.Store(AccessBuilder::ForJSObjectInObjectProperty(MapRef(map), i), a.Store(AccessBuilder::ForJSObjectInObjectProperty(
MapRef(js_heap_broker(), map), i),
jsgraph()->UndefinedConstant()); jsgraph()->UndefinedConstant());
} }
@ -1235,9 +1221,8 @@ Reduction JSCreateLowering::ReduceJSCreateLiteralRegExp(Node* node) {
Node* effect = NodeProperties::GetEffectInput(node); Node* effect = NodeProperties::GetEffectInput(node);
Node* control = NodeProperties::GetControlInput(node); Node* control = NodeProperties::GetControlInput(node);
FeedbackVectorRef feedback_vector(p.feedback().vector()); FeedbackVectorRef feedback_vector(js_heap_broker(), p.feedback().vector());
ObjectRef feedback = ObjectRef feedback = feedback_vector.get(p.feedback().slot());
feedback_vector.get(js_heap_broker(), p.feedback().slot());
if (feedback.IsJSRegExp()) { if (feedback.IsJSRegExp()) {
JSRegExpRef boilerplate = feedback.AsJSRegExp(); JSRegExpRef boilerplate = feedback.AsJSRegExp();
Node* value = effect = AllocateLiteralRegExp(effect, control, boilerplate); Node* value = effect = AllocateLiteralRegExp(effect, control, boilerplate);
@ -1252,7 +1237,7 @@ Reduction JSCreateLowering::ReduceJSCreateFunctionContext(Node* node) {
DCHECK_EQ(IrOpcode::kJSCreateFunctionContext, node->opcode()); DCHECK_EQ(IrOpcode::kJSCreateFunctionContext, node->opcode());
const CreateFunctionContextParameters& parameters = const CreateFunctionContextParameters& parameters =
CreateFunctionContextParametersOf(node->op()); CreateFunctionContextParametersOf(node->op());
ScopeInfoRef scope_info(parameters.scope_info()); ScopeInfoRef scope_info(js_heap_broker(), parameters.scope_info());
int slot_count = parameters.slot_count(); int slot_count = parameters.slot_count();
ScopeType scope_type = parameters.scope_type(); ScopeType scope_type = parameters.scope_type();
@ -1263,7 +1248,7 @@ Reduction JSCreateLowering::ReduceJSCreateFunctionContext(Node* node) {
Node* control = NodeProperties::GetControlInput(node); Node* control = NodeProperties::GetControlInput(node);
Node* context = NodeProperties::GetContextInput(node); Node* context = NodeProperties::GetContextInput(node);
Node* extension = jsgraph()->TheHoleConstant(); Node* extension = jsgraph()->TheHoleConstant();
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control); AllocationBuilder a(jsgraph(), effect, control);
STATIC_ASSERT(Context::MIN_CONTEXT_SLOTS == 4); // Ensure fully covered. STATIC_ASSERT(Context::MIN_CONTEXT_SLOTS == 4); // Ensure fully covered.
int context_length = slot_count + Context::MIN_CONTEXT_SLOTS; int context_length = slot_count + Context::MIN_CONTEXT_SLOTS;
Handle<Map> map; Handle<Map> map;
@ -1298,13 +1283,13 @@ Reduction JSCreateLowering::ReduceJSCreateFunctionContext(Node* node) {
Reduction JSCreateLowering::ReduceJSCreateWithContext(Node* node) { Reduction JSCreateLowering::ReduceJSCreateWithContext(Node* node) {
DisallowHeapAccess no_heap_access; DisallowHeapAccess no_heap_access;
DCHECK_EQ(IrOpcode::kJSCreateWithContext, node->opcode()); DCHECK_EQ(IrOpcode::kJSCreateWithContext, node->opcode());
ScopeInfoRef scope_info(ScopeInfoOf(node->op())); ScopeInfoRef scope_info(js_heap_broker(), ScopeInfoOf(node->op()));
Node* extension = NodeProperties::GetValueInput(node, 0); Node* extension = NodeProperties::GetValueInput(node, 0);
Node* effect = NodeProperties::GetEffectInput(node); Node* effect = NodeProperties::GetEffectInput(node);
Node* control = NodeProperties::GetControlInput(node); Node* control = NodeProperties::GetControlInput(node);
Node* context = NodeProperties::GetContextInput(node); Node* context = NodeProperties::GetContextInput(node);
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control); AllocationBuilder a(jsgraph(), effect, control);
STATIC_ASSERT(Context::MIN_CONTEXT_SLOTS == 4); // Ensure fully covered. STATIC_ASSERT(Context::MIN_CONTEXT_SLOTS == 4); // Ensure fully covered.
a.AllocateContext(Context::MIN_CONTEXT_SLOTS, factory()->with_context_map()); a.AllocateContext(Context::MIN_CONTEXT_SLOTS, factory()->with_context_map());
a.Store(AccessBuilder::ForContextSlot(Context::SCOPE_INFO_INDEX), scope_info); a.Store(AccessBuilder::ForContextSlot(Context::SCOPE_INFO_INDEX), scope_info);
@ -1320,14 +1305,14 @@ Reduction JSCreateLowering::ReduceJSCreateWithContext(Node* node) {
Reduction JSCreateLowering::ReduceJSCreateCatchContext(Node* node) { Reduction JSCreateLowering::ReduceJSCreateCatchContext(Node* node) {
DisallowHeapAccess no_heap_access; DisallowHeapAccess no_heap_access;
DCHECK_EQ(IrOpcode::kJSCreateCatchContext, node->opcode()); DCHECK_EQ(IrOpcode::kJSCreateCatchContext, node->opcode());
ScopeInfoRef scope_info(ScopeInfoOf(node->op())); ScopeInfoRef scope_info(js_heap_broker(), ScopeInfoOf(node->op()));
Node* exception = NodeProperties::GetValueInput(node, 0); Node* exception = NodeProperties::GetValueInput(node, 0);
Node* effect = NodeProperties::GetEffectInput(node); Node* effect = NodeProperties::GetEffectInput(node);
Node* control = NodeProperties::GetControlInput(node); Node* control = NodeProperties::GetControlInput(node);
Node* context = NodeProperties::GetContextInput(node); Node* context = NodeProperties::GetContextInput(node);
Node* extension = jsgraph()->TheHoleConstant(); Node* extension = jsgraph()->TheHoleConstant();
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control); AllocationBuilder a(jsgraph(), effect, control);
STATIC_ASSERT(Context::MIN_CONTEXT_SLOTS == 4); // Ensure fully covered. STATIC_ASSERT(Context::MIN_CONTEXT_SLOTS == 4); // Ensure fully covered.
a.AllocateContext(Context::MIN_CONTEXT_SLOTS + 1, a.AllocateContext(Context::MIN_CONTEXT_SLOTS + 1,
factory()->catch_context_map()); factory()->catch_context_map());
@ -1346,7 +1331,7 @@ Reduction JSCreateLowering::ReduceJSCreateCatchContext(Node* node) {
Reduction JSCreateLowering::ReduceJSCreateBlockContext(Node* node) { Reduction JSCreateLowering::ReduceJSCreateBlockContext(Node* node) {
DisallowHeapAccess no_heap_access; DisallowHeapAccess no_heap_access;
DCHECK_EQ(IrOpcode::kJSCreateBlockContext, node->opcode()); DCHECK_EQ(IrOpcode::kJSCreateBlockContext, node->opcode());
ScopeInfoRef scope_info(ScopeInfoOf(node->op())); ScopeInfoRef scope_info(js_heap_broker(), ScopeInfoOf(node->op()));
int const context_length = scope_info.ContextLength(); int const context_length = scope_info.ContextLength();
// Use inline allocation for block contexts up to a size limit. // Use inline allocation for block contexts up to a size limit.
@ -1357,7 +1342,7 @@ Reduction JSCreateLowering::ReduceJSCreateBlockContext(Node* node) {
Node* context = NodeProperties::GetContextInput(node); Node* context = NodeProperties::GetContextInput(node);
Node* extension = jsgraph()->TheHoleConstant(); Node* extension = jsgraph()->TheHoleConstant();
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control); AllocationBuilder a(jsgraph(), effect, control);
STATIC_ASSERT(Context::MIN_CONTEXT_SLOTS == 4); // Ensure fully covered. STATIC_ASSERT(Context::MIN_CONTEXT_SLOTS == 4); // Ensure fully covered.
a.AllocateContext(context_length, factory()->block_context_map()); a.AllocateContext(context_length, factory()->block_context_map());
a.Store(AccessBuilder::ForContextSlot(Context::SCOPE_INFO_INDEX), a.Store(AccessBuilder::ForContextSlot(Context::SCOPE_INFO_INDEX),
@ -1387,15 +1372,13 @@ Reduction JSCreateLowering::ReduceJSCreateObject(Node* node) {
if (!prototype_type.IsHeapConstant()) return NoChange(); if (!prototype_type.IsHeapConstant()) return NoChange();
HeapObjectRef prototype_const = prototype_type.AsHeapConstant()->Ref(); HeapObjectRef prototype_const = prototype_type.AsHeapConstant()->Ref();
auto maybe_instance_map = auto maybe_instance_map = prototype_const.TryGetObjectCreateMap();
prototype_const.TryGetObjectCreateMap(js_heap_broker());
if (!maybe_instance_map) return NoChange(); if (!maybe_instance_map) return NoChange();
MapRef instance_map = maybe_instance_map.value(); MapRef instance_map = maybe_instance_map.value();
Node* properties = jsgraph()->EmptyFixedArrayConstant(); Node* properties = jsgraph()->EmptyFixedArrayConstant();
if (instance_map.is_dictionary_map()) { if (instance_map.is_dictionary_map()) {
DCHECK_EQ(prototype_const.type(js_heap_broker()).oddball_type(), DCHECK_EQ(prototype_const.type().oddball_type(), OddballType::kNull);
OddballType::kNull);
// Allocate an empty NameDictionary as backing store for the properties. // Allocate an empty NameDictionary as backing store for the properties.
Handle<Map> map = isolate()->factory()->name_dictionary_map(); Handle<Map> map = isolate()->factory()->name_dictionary_map();
int capacity = int capacity =
@ -1404,7 +1387,7 @@ Reduction JSCreateLowering::ReduceJSCreateObject(Node* node) {
int length = NameDictionary::EntryToIndex(capacity); int length = NameDictionary::EntryToIndex(capacity);
int size = NameDictionary::SizeFor(length); int size = NameDictionary::SizeFor(length);
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control); AllocationBuilder a(jsgraph(), effect, control);
a.Allocate(size, NOT_TENURED, Type::Any()); a.Allocate(size, NOT_TENURED, Type::Any());
a.Store(AccessBuilder::ForMap(), map); a.Store(AccessBuilder::ForMap(), map);
// Initialize FixedArray fields. // Initialize FixedArray fields.
@ -1440,7 +1423,7 @@ Reduction JSCreateLowering::ReduceJSCreateObject(Node* node) {
// Emit code to allocate the JSObject instance for the given // Emit code to allocate the JSObject instance for the given
// {instance_map}. // {instance_map}.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control); AllocationBuilder a(jsgraph(), effect, control);
a.Allocate(instance_size, NOT_TENURED, Type::Any()); a.Allocate(instance_size, NOT_TENURED, Type::Any());
a.Store(AccessBuilder::ForMap(), instance_map); a.Store(AccessBuilder::ForMap(), instance_map);
a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(), properties); a.Store(AccessBuilder::ForJSObjectPropertiesOrHash(), properties);
@ -1473,7 +1456,7 @@ Node* JSCreateLowering::AllocateArguments(Node* effect, Node* control,
auto parameters_it = ++parameters_access.begin(); auto parameters_it = ++parameters_access.begin();
// Actually allocate the backing store. // Actually allocate the backing store.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control); AllocationBuilder a(jsgraph(), effect, control);
a.AllocateArray(argument_count, factory()->fixed_array_map()); a.AllocateArray(argument_count, factory()->fixed_array_map());
for (int i = 0; i < argument_count; ++i, ++parameters_it) { for (int i = 0; i < argument_count; ++i, ++parameters_it) {
DCHECK_NOT_NULL((*parameters_it).node); DCHECK_NOT_NULL((*parameters_it).node);
@ -1503,7 +1486,7 @@ Node* JSCreateLowering::AllocateRestArguments(Node* effect, Node* control,
} }
// Actually allocate the backing store. // Actually allocate the backing store.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control); AllocationBuilder a(jsgraph(), effect, control);
a.AllocateArray(num_elements, factory()->fixed_array_map()); a.AllocateArray(num_elements, factory()->fixed_array_map());
for (int i = 0; i < num_elements; ++i, ++parameters_it) { for (int i = 0; i < num_elements; ++i, ++parameters_it) {
DCHECK_NOT_NULL((*parameters_it).node); DCHECK_NOT_NULL((*parameters_it).node);
@ -1541,7 +1524,7 @@ Node* JSCreateLowering::AllocateAliasedArguments(
// The unmapped argument values recorded in the frame state are stored yet // The unmapped argument values recorded in the frame state are stored yet
// another indirection away and then linked into the parameter map below, // another indirection away and then linked into the parameter map below,
// whereas mapped argument values are replaced with a hole instead. // whereas mapped argument values are replaced with a hole instead.
AllocationBuilder aa(jsgraph(), js_heap_broker(), effect, control); AllocationBuilder aa(jsgraph(), effect, control);
aa.AllocateArray(argument_count, factory()->fixed_array_map()); aa.AllocateArray(argument_count, factory()->fixed_array_map());
for (int i = 0; i < mapped_count; ++i, ++parameters_it) { for (int i = 0; i < mapped_count; ++i, ++parameters_it) {
aa.Store(AccessBuilder::ForFixedArraySlot(i), jsgraph()->TheHoleConstant()); aa.Store(AccessBuilder::ForFixedArraySlot(i), jsgraph()->TheHoleConstant());
@ -1553,7 +1536,7 @@ Node* JSCreateLowering::AllocateAliasedArguments(
Node* arguments = aa.Finish(); Node* arguments = aa.Finish();
// Actually allocate the backing store. // Actually allocate the backing store.
AllocationBuilder a(jsgraph(), js_heap_broker(), arguments, control); AllocationBuilder a(jsgraph(), arguments, control);
a.AllocateArray(mapped_count + 2, factory()->sloppy_arguments_elements_map()); a.AllocateArray(mapped_count + 2, factory()->sloppy_arguments_elements_map());
a.Store(AccessBuilder::ForFixedArraySlot(0), context); a.Store(AccessBuilder::ForFixedArraySlot(0), context);
a.Store(AccessBuilder::ForFixedArraySlot(1), arguments); a.Store(AccessBuilder::ForFixedArraySlot(1), arguments);
@ -1595,7 +1578,7 @@ Node* JSCreateLowering::AllocateAliasedArguments(
arguments_frame, arguments_length, effect); arguments_frame, arguments_length, effect);
// Actually allocate the backing store. // Actually allocate the backing store.
AllocationBuilder a(jsgraph(), js_heap_broker(), arguments, control); AllocationBuilder a(jsgraph(), arguments, control);
a.AllocateArray(mapped_count + 2, factory()->sloppy_arguments_elements_map()); a.AllocateArray(mapped_count + 2, factory()->sloppy_arguments_elements_map());
a.Store(AccessBuilder::ForFixedArraySlot(0), context); a.Store(AccessBuilder::ForFixedArraySlot(0), context);
a.Store(AccessBuilder::ForFixedArraySlot(1), arguments); a.Store(AccessBuilder::ForFixedArraySlot(1), arguments);
@ -1627,7 +1610,7 @@ Node* JSCreateLowering::AllocateElements(Node* effect, Node* control,
Node* value = jsgraph()->TheHoleConstant(); Node* value = jsgraph()->TheHoleConstant();
// Actually allocate the backing store. // Actually allocate the backing store.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control); AllocationBuilder a(jsgraph(), effect, control);
a.AllocateArray(capacity, elements_map, pretenure); a.AllocateArray(capacity, elements_map, pretenure);
for (int i = 0; i < capacity; ++i) { for (int i = 0; i < capacity; ++i) {
Node* index = jsgraph()->Constant(i); Node* index = jsgraph()->Constant(i);
@ -1652,7 +1635,7 @@ Node* JSCreateLowering::AllocateElements(Node* effect, Node* control,
: AccessBuilder::ForFixedArrayElement(); : AccessBuilder::ForFixedArrayElement();
// Actually allocate the backing store. // Actually allocate the backing store.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control); AllocationBuilder a(jsgraph(), effect, control);
a.AllocateArray(capacity, elements_map, pretenure); a.AllocateArray(capacity, elements_map, pretenure);
for (int i = 0; i < capacity; ++i) { for (int i = 0; i < capacity; ++i) {
Node* index = jsgraph()->Constant(i); Node* index = jsgraph()->Constant(i);
@ -1668,7 +1651,7 @@ Node* JSCreateLowering::AllocateFastLiteral(Node* effect, Node* control,
Node* properties = jsgraph()->EmptyFixedArrayConstant(); Node* properties = jsgraph()->EmptyFixedArrayConstant();
// Compute the in-object properties to store first (might have effects). // Compute the in-object properties to store first (might have effects).
MapRef boilerplate_map = boilerplate.map(js_heap_broker()); MapRef boilerplate_map = boilerplate.map();
ZoneVector<std::pair<FieldAccess, Node*>> inobject_fields(zone()); ZoneVector<std::pair<FieldAccess, Node*>> inobject_fields(zone());
inobject_fields.reserve(boilerplate_map.GetInObjectProperties()); inobject_fields.reserve(boilerplate_map.GetInObjectProperties());
int const boilerplate_nof = boilerplate_map.NumberOfOwnDescriptors(); int const boilerplate_nof = boilerplate_map.NumberOfOwnDescriptors();
@ -1677,7 +1660,7 @@ Node* JSCreateLowering::AllocateFastLiteral(Node* effect, Node* control,
boilerplate_map.GetPropertyDetails(i); boilerplate_map.GetPropertyDetails(i);
if (property_details.location() != kField) continue; if (property_details.location() != kField) continue;
DCHECK_EQ(kData, property_details.kind()); DCHECK_EQ(kData, property_details.kind());
NameRef property_name = boilerplate_map.GetPropertyKey(js_heap_broker(), i); NameRef property_name = boilerplate_map.GetPropertyKey(i);
FieldIndex index = boilerplate_map.GetFieldIndexFor(i); FieldIndex index = boilerplate_map.GetFieldIndexFor(i);
FieldAccess access = { FieldAccess access = {
kTaggedBase, index.offset(), property_name.object<Name>(), kTaggedBase, index.offset(), property_name.object<Name>(),
@ -1689,8 +1672,7 @@ Node* JSCreateLowering::AllocateFastLiteral(Node* effect, Node* control,
access.type = Type::Number(); access.type = Type::Number();
value = jsgraph()->Constant(boilerplate.RawFastDoublePropertyAt(index)); value = jsgraph()->Constant(boilerplate.RawFastDoublePropertyAt(index));
} else { } else {
ObjectRef boilerplate_value = ObjectRef boilerplate_value = boilerplate.RawFastPropertyAt(index);
boilerplate.RawFastPropertyAt(js_heap_broker(), index);
if (boilerplate_value.IsJSObject()) { if (boilerplate_value.IsJSObject()) {
JSObjectRef boilerplate_object = boilerplate_value.AsJSObject(); JSObjectRef boilerplate_object = boilerplate_value.AsJSObject();
value = effect = value = effect =
@ -1698,7 +1680,7 @@ Node* JSCreateLowering::AllocateFastLiteral(Node* effect, Node* control,
} else if (property_details.representation().IsDouble()) { } else if (property_details.representation().IsDouble()) {
double number = boilerplate_value.AsMutableHeapNumber().value(); double number = boilerplate_value.AsMutableHeapNumber().value();
// Allocate a mutable HeapNumber box and store the value into it. // Allocate a mutable HeapNumber box and store the value into it.
AllocationBuilder builder(jsgraph(), js_heap_broker(), effect, control); AllocationBuilder builder(jsgraph(), effect, control);
builder.Allocate(HeapNumber::kSize, pretenure); builder.Allocate(HeapNumber::kSize, pretenure);
builder.Store(AccessBuilder::ForMap(), builder.Store(AccessBuilder::ForMap(),
factory()->mutable_heap_number_map()); factory()->mutable_heap_number_map());
@ -1707,12 +1689,11 @@ Node* JSCreateLowering::AllocateFastLiteral(Node* effect, Node* control,
value = effect = builder.Finish(); value = effect = builder.Finish();
} else if (property_details.representation().IsSmi()) { } else if (property_details.representation().IsSmi()) {
// Ensure that value is stored as smi. // Ensure that value is stored as smi.
value = boilerplate_value.oddball_type(js_heap_broker()) == value = boilerplate_value.oddball_type() == OddballType::kUninitialized
OddballType::kUninitialized
? jsgraph()->ZeroConstant() ? jsgraph()->ZeroConstant()
: jsgraph()->Constant(boilerplate_value.AsSmi()); : jsgraph()->Constant(boilerplate_value.AsSmi());
} else { } else {
value = jsgraph()->Constant(js_heap_broker(), boilerplate_value); value = jsgraph()->Constant(boilerplate_value);
} }
} }
inobject_fields.push_back(std::make_pair(access, value)); inobject_fields.push_back(std::make_pair(access, value));
@ -1734,7 +1715,7 @@ Node* JSCreateLowering::AllocateFastLiteral(Node* effect, Node* control,
if (elements->op()->EffectOutputCount() > 0) effect = elements; if (elements->op()->EffectOutputCount() > 0) effect = elements;
// Actually allocate and initialize the object. // Actually allocate and initialize the object.
AllocationBuilder builder(jsgraph(), js_heap_broker(), effect, control); AllocationBuilder builder(jsgraph(), effect, control);
builder.Allocate(boilerplate_map.instance_size(), pretenure, builder.Allocate(boilerplate_map.instance_size(), pretenure,
Type::For(js_heap_broker(), boilerplate_map.object<Map>())); Type::For(js_heap_broker(), boilerplate_map.object<Map>()));
builder.Store(AccessBuilder::ForMap(), boilerplate_map); builder.Store(AccessBuilder::ForMap(), boilerplate_map);
@ -1744,7 +1725,7 @@ Node* JSCreateLowering::AllocateFastLiteral(Node* effect, Node* control,
JSArrayRef boilerplate_array = boilerplate.AsJSArray(); JSArrayRef boilerplate_array = boilerplate.AsJSArray();
builder.Store( builder.Store(
AccessBuilder::ForJSArrayLength(boilerplate_array.GetElementsKind()), AccessBuilder::ForJSArrayLength(boilerplate_array.GetElementsKind()),
boilerplate_array.length(js_heap_broker())); boilerplate_array.length());
} }
for (auto const& inobject_field : inobject_fields) { for (auto const& inobject_field : inobject_fields) {
builder.Store(inobject_field.first, inobject_field.second); builder.Store(inobject_field.first, inobject_field.second);
@ -1755,17 +1736,15 @@ Node* JSCreateLowering::AllocateFastLiteral(Node* effect, Node* control,
Node* JSCreateLowering::AllocateFastLiteralElements(Node* effect, Node* control, Node* JSCreateLowering::AllocateFastLiteralElements(Node* effect, Node* control,
JSObjectRef boilerplate, JSObjectRef boilerplate,
PretenureFlag pretenure) { PretenureFlag pretenure) {
FixedArrayBaseRef boilerplate_elements = FixedArrayBaseRef boilerplate_elements = boilerplate.elements();
boilerplate.elements(js_heap_broker());
// Empty or copy-on-write elements just store a constant. // Empty or copy-on-write elements just store a constant.
int const elements_length = boilerplate_elements.length(); int const elements_length = boilerplate_elements.length();
MapRef elements_map = boilerplate_elements.map(js_heap_broker()); MapRef elements_map = boilerplate_elements.map();
if (boilerplate_elements.length() == 0 || if (boilerplate_elements.length() == 0 || elements_map.IsFixedCowArrayMap()) {
elements_map.IsFixedCowArrayMap(js_heap_broker())) {
if (pretenure == TENURED) { if (pretenure == TENURED) {
boilerplate.EnsureElementsTenured(js_heap_broker()); boilerplate.EnsureElementsTenured();
boilerplate_elements = boilerplate.elements(js_heap_broker()); boilerplate_elements = boilerplate.elements();
} }
return jsgraph()->HeapConstant(boilerplate_elements.object<HeapObject>()); return jsgraph()->HeapConstant(boilerplate_elements.object<HeapObject>());
} }
@ -1784,23 +1763,22 @@ Node* JSCreateLowering::AllocateFastLiteralElements(Node* effect, Node* control,
} else { } else {
FixedArrayRef elements = boilerplate_elements.AsFixedArray(); FixedArrayRef elements = boilerplate_elements.AsFixedArray();
for (int i = 0; i < elements_length; ++i) { for (int i = 0; i < elements_length; ++i) {
if (elements.is_the_hole(js_heap_broker(), i)) { if (elements.is_the_hole(i)) {
elements_values[i] = jsgraph()->TheHoleConstant(); elements_values[i] = jsgraph()->TheHoleConstant();
} else { } else {
ObjectRef element_value = elements.get(js_heap_broker(), i); ObjectRef element_value = elements.get(i);
if (element_value.IsJSObject()) { if (element_value.IsJSObject()) {
elements_values[i] = effect = AllocateFastLiteral( elements_values[i] = effect = AllocateFastLiteral(
effect, control, element_value.AsJSObject(), pretenure); effect, control, element_value.AsJSObject(), pretenure);
} else { } else {
elements_values[i] = elements_values[i] = jsgraph()->Constant(element_value);
jsgraph()->Constant(js_heap_broker(), element_value);
} }
} }
} }
} }
// Allocate the backing store array and store the elements. // Allocate the backing store array and store the elements.
AllocationBuilder builder(jsgraph(), js_heap_broker(), effect, control); AllocationBuilder builder(jsgraph(), effect, control);
builder.AllocateArray(elements_length, elements_map.object<Map>(), pretenure); builder.AllocateArray(elements_length, elements_map.object<Map>(), pretenure);
ElementAccess const access = ElementAccess const access =
(elements_map.instance_type() == FIXED_DOUBLE_ARRAY_TYPE) (elements_map.instance_type() == FIXED_DOUBLE_ARRAY_TYPE)
@ -1814,7 +1792,7 @@ Node* JSCreateLowering::AllocateFastLiteralElements(Node* effect, Node* control,
Node* JSCreateLowering::AllocateLiteralRegExp(Node* effect, Node* control, Node* JSCreateLowering::AllocateLiteralRegExp(Node* effect, Node* control,
JSRegExpRef boilerplate) { JSRegExpRef boilerplate) {
MapRef boilerplate_map = boilerplate.map(js_heap_broker()); MapRef boilerplate_map = boilerplate.map();
// Sanity check that JSRegExp object layout hasn't changed. // Sanity check that JSRegExp object layout hasn't changed.
STATIC_ASSERT(JSRegExp::kDataOffset == JSObject::kHeaderSize); STATIC_ASSERT(JSRegExp::kDataOffset == JSObject::kHeaderSize);
@ -1830,23 +1808,19 @@ Node* JSCreateLowering::AllocateLiteralRegExp(Node* effect, Node* control,
const int size = const int size =
JSRegExp::kSize + JSRegExp::kInObjectFieldCount * kPointerSize; JSRegExp::kSize + JSRegExp::kInObjectFieldCount * kPointerSize;
AllocationBuilder builder(jsgraph(), js_heap_broker(), effect, control); AllocationBuilder builder(jsgraph(), effect, control);
builder.Allocate(size, pretenure, builder.Allocate(size, pretenure,
Type::For(js_heap_broker(), boilerplate_map.object<Map>())); Type::For(js_heap_broker(), boilerplate_map.object<Map>()));
builder.Store(AccessBuilder::ForMap(), boilerplate_map); builder.Store(AccessBuilder::ForMap(), boilerplate_map);
builder.Store(AccessBuilder::ForJSObjectPropertiesOrHash(), builder.Store(AccessBuilder::ForJSObjectPropertiesOrHash(),
boilerplate.raw_properties_or_hash(js_heap_broker())); boilerplate.raw_properties_or_hash());
builder.Store(AccessBuilder::ForJSObjectElements(), builder.Store(AccessBuilder::ForJSObjectElements(), boilerplate.elements());
boilerplate.elements(js_heap_broker()));
builder.Store(AccessBuilder::ForJSRegExpData(), builder.Store(AccessBuilder::ForJSRegExpData(), boilerplate.data());
boilerplate.data(js_heap_broker())); builder.Store(AccessBuilder::ForJSRegExpSource(), boilerplate.source());
builder.Store(AccessBuilder::ForJSRegExpSource(), builder.Store(AccessBuilder::ForJSRegExpFlags(), boilerplate.flags());
boilerplate.source(js_heap_broker()));
builder.Store(AccessBuilder::ForJSRegExpFlags(),
boilerplate.flags(js_heap_broker()));
builder.Store(AccessBuilder::ForJSRegExpLastIndex(), builder.Store(AccessBuilder::ForJSRegExpLastIndex(),
boilerplate.last_index(js_heap_broker())); boilerplate.last_index());
return builder.Finish(); return builder.Finish();
} }
@ -1866,7 +1840,7 @@ SimplifiedOperatorBuilder* JSCreateLowering::simplified() const {
} }
NativeContextRef JSCreateLowering::native_context_ref() const { NativeContextRef JSCreateLowering::native_context_ref() const {
return NativeContextRef(native_context()); return NativeContextRef(js_heap_broker(), native_context());
} }
} // namespace compiler } // namespace compiler

4
src/compiler/js-graph.cc
View File

@ -66,9 +66,9 @@ Node* JSGraph::Constant(Handle<Object> value) {
} }
} }
Node* JSGraph::Constant(const JSHeapBroker* broker, const ObjectRef& ref) { Node* JSGraph::Constant(const ObjectRef& ref) {
if (ref.IsSmi()) return Constant(ref.AsSmi()); if (ref.IsSmi()) return Constant(ref.AsSmi());
OddballType oddball_type = ref.oddball_type(broker); OddballType oddball_type = ref.oddball_type();
if (ref.IsHeapNumber()) { if (ref.IsHeapNumber()) {
return Constant(ref.AsHeapNumber().value()); return Constant(ref.AsHeapNumber().value());
} else if (oddball_type == OddballType::kUndefined) { } else if (oddball_type == OddballType::kUndefined) {

3
src/compiler/js-graph.h
View File

@ -56,8 +56,7 @@ class V8_EXPORT_PRIVATE JSGraph : public MachineGraph {
Node* Constant(Handle<Object> value); Node* Constant(Handle<Object> value);
// Like above, but doesn't access the heap directly. // Like above, but doesn't access the heap directly.
// TODO(neis): Make the broker a member of JSGraph. Node* Constant(const ObjectRef& value);
Node* Constant(const JSHeapBroker* broker, const ObjectRef& value);
// Creates a NumberConstant node, usually canonicalized. // Creates a NumberConstant node, usually canonicalized.
Node* Constant(double value); Node* Constant(double value);

313
src/compiler/js-heap-broker.cc
View File

@ -13,10 +13,11 @@ namespace v8 {
namespace internal { namespace internal {
namespace compiler { namespace compiler {
MapRef HeapObjectRef::map(const JSHeapBroker* broker) const { MapRef HeapObjectRef::map() const {
AllowHandleAllocation handle_allocation; AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference; AllowHandleDereference allow_handle_dereference;
return MapRef(handle(object<HeapObject>()->map(), broker->isolate())); return MapRef(broker(),
handle(object<HeapObject>()->map(), broker()->isolate()));
} }
double HeapNumberRef::value() const { double HeapNumberRef::value() const {
@ -40,26 +41,26 @@ bool ObjectRef::equals(const ObjectRef& other) const {
return object<Object>().equals(other.object<Object>()); return object<Object>().equals(other.object<Object>());
} }
StringRef ObjectRef::TypeOf(const JSHeapBroker* broker) const { StringRef ObjectRef::TypeOf() const {
AllowHandleAllocation handle_allocation; AllowHandleAllocation handle_allocation;
AllowHandleDereference handle_dereference; AllowHandleDereference handle_dereference;
return StringRef(Object::TypeOf(broker->isolate(), object<Object>())); return StringRef(broker(),
Object::TypeOf(broker()->isolate(), object<Object>()));
} }
base::Optional<ContextRef> ContextRef::previous( base::Optional<ContextRef> ContextRef::previous() const {
const JSHeapBroker* broker) const {
AllowHandleAllocation handle_allocation; AllowHandleAllocation handle_allocation;
AllowHandleDereference handle_dereference; AllowHandleDereference handle_dereference;
Context* previous = object<Context>()->previous(); Context* previous = object<Context>()->previous();
if (previous == nullptr) return base::Optional<ContextRef>(); if (previous == nullptr) return base::Optional<ContextRef>();
return ContextRef(handle(previous, broker->isolate())); return ContextRef(broker(), handle(previous, broker()->isolate()));
} }
ObjectRef ContextRef::get(const JSHeapBroker* broker, int index) const { ObjectRef ContextRef::get(int index) const {
AllowHandleAllocation handle_allocation; AllowHandleAllocation handle_allocation;
AllowHandleDereference handle_dereference; AllowHandleDereference handle_dereference;
Handle<Object> value(object<Context>()->get(index), broker->isolate()); Handle<Object> value(object<Context>()->get(index), broker()->isolate());
return ObjectRef(value); return ObjectRef(broker(), value);
} }
JSHeapBroker::JSHeapBroker(Isolate* isolate) : isolate_(isolate) {} JSHeapBroker::JSHeapBroker(Isolate* isolate) : isolate_(isolate) {}
@ -101,31 +102,30 @@ base::Optional<int> JSHeapBroker::TryGetSmi(Handle<Object> object) {
return Smi::cast(*object)->value(); return Smi::cast(*object)->value();
} }
#define DEFINE_IS_AND_AS(Name) \ #define DEFINE_IS_AND_AS(Name) \
bool ObjectRef::Is##Name() const { \ bool ObjectRef::Is##Name() const { \
AllowHandleDereference allow_handle_dereference; \ AllowHandleDereference allow_handle_dereference; \
return object<Object>()->Is##Name(); \ return object<Object>()->Is##Name(); \
} \ } \
Name##Ref ObjectRef::As##Name() const { \ Name##Ref ObjectRef::As##Name() const { \
DCHECK(Is##Name()); \ DCHECK(Is##Name()); \
return Name##Ref(object<HeapObject>()); \ return Name##Ref(broker(), object<HeapObject>()); \
} }
HEAP_BROKER_OBJECT_LIST(DEFINE_IS_AND_AS) HEAP_BROKER_OBJECT_LIST(DEFINE_IS_AND_AS)
#undef DEFINE_IS_AND_AS #undef DEFINE_IS_AND_AS
HeapObjectType HeapObjectRef::type(const JSHeapBroker* broker) const { HeapObjectType HeapObjectRef::type() const {
AllowHandleDereference allow_handle_dereference; AllowHandleDereference allow_handle_dereference;
return broker->HeapObjectTypeFromMap(object<HeapObject>()->map()); return broker()->HeapObjectTypeFromMap(object<HeapObject>()->map());
} }
base::Optional<MapRef> HeapObjectRef::TryGetObjectCreateMap( base::Optional<MapRef> HeapObjectRef::TryGetObjectCreateMap() const {
const JSHeapBroker* broker) const {
AllowHandleAllocation handle_allocation; AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference; AllowHandleDereference allow_handle_dereference;
Handle<Map> instance_map; Handle<Map> instance_map;
if (Map::TryGetObjectCreateMap(broker->isolate(), object<HeapObject>()) if (Map::TryGetObjectCreateMap(broker()->isolate(), object<HeapObject>())
.ToHandle(&instance_map)) { .ToHandle(&instance_map)) {
return MapRef(instance_map); return MapRef(broker(), instance_map);
} else { } else {
return base::Optional<MapRef>(); return base::Optional<MapRef>();
} }
@ -157,12 +157,12 @@ bool JSFunctionRef::IsConstructor() const {
} }
MapRef JSFunctionRef::DependOnInitialMap( MapRef JSFunctionRef::DependOnInitialMap(
const JSHeapBroker* broker, CompilationDependencies* dependencies) const { CompilationDependencies* dependencies) const {
AllowHandleAllocation handle_allocation; AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference; AllowHandleDereference allow_handle_dereference;
Handle<Map> initial_map = Handle<Map> initial_map =
dependencies->DependOnInitialMap(object<JSFunction>()); dependencies->DependOnInitialMap(object<JSFunction>());
return MapRef(initial_map); return MapRef(broker(), initial_map);
} }
void JSFunctionRef::EnsureHasInitialMap() const { void JSFunctionRef::EnsureHasInitialMap() const {
@ -175,8 +175,8 @@ void JSFunctionRef::EnsureHasInitialMap() const {
JSFunction::EnsureHasInitialMap(object<JSFunction>()); JSFunction::EnsureHasInitialMap(object<JSFunction>());
} }
void MapRef::DependOnStableMap(const JSHeapBroker* broker, // TODO(neis): Remove.
CompilationDependencies* dependencies) const { void MapRef::DependOnStableMap(CompilationDependencies* dependencies) const {
AllowHandleAllocation handle_allocation; AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference; AllowHandleDereference allow_handle_dereference;
dependencies->DependOnStableMap(object<Map>()); dependencies->DependOnStableMap(object<Map>());
@ -197,24 +197,25 @@ bool JSFunctionRef::has_initial_map() const {
return object<JSFunction>()->has_initial_map(); return object<JSFunction>()->has_initial_map();
} }
MapRef JSFunctionRef::initial_map(const JSHeapBroker* broker) const { MapRef JSFunctionRef::initial_map() const {
AllowHandleAllocation handle_allocation; AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference; AllowHandleDereference allow_handle_dereference;
return MapRef(handle(object<JSFunction>()->initial_map(), broker->isolate())); return MapRef(broker(), handle(object<JSFunction>()->initial_map(),
broker()->isolate()));
} }
SharedFunctionInfoRef JSFunctionRef::shared(const JSHeapBroker* broker) const { SharedFunctionInfoRef JSFunctionRef::shared() const {
AllowHandleAllocation handle_allocation; AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference; AllowHandleDereference allow_handle_dereference;
return SharedFunctionInfoRef( return SharedFunctionInfoRef(
handle(object<JSFunction>()->shared(), broker->isolate())); broker(), handle(object<JSFunction>()->shared(), broker()->isolate()));
} }
JSGlobalProxyRef JSFunctionRef::global_proxy(const JSHeapBroker* broker) const { JSGlobalProxyRef JSFunctionRef::global_proxy() const {
AllowHandleAllocation handle_allocation; AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference; AllowHandleDereference allow_handle_dereference;
return JSGlobalProxyRef( return JSGlobalProxyRef(broker(), handle(object<JSFunction>()->global_proxy(),
handle(object<JSFunction>()->global_proxy(), broker->isolate())); broker()->isolate()));
} }
base::Optional<ScriptContextTableRef::LookupResult> base::Optional<ScriptContextTableRef::LookupResult>
@ -230,40 +231,38 @@ ScriptContextTableRef::lookup(const NameRef& name) const {
} }
Handle<Context> script_context = Handle<Context> script_context =
ScriptContextTable::GetContext(table, lookup_result.context_index); ScriptContextTable::GetContext(table, lookup_result.context_index);
LookupResult result{ContextRef(script_context), LookupResult result{ContextRef(broker(), script_context),
lookup_result.mode == VariableMode::kConst, lookup_result.mode == VariableMode::kConst,
lookup_result.slot_index}; lookup_result.slot_index};
return result; return result;
} }
ScriptContextTableRef NativeContextRef::script_context_table( ScriptContextTableRef NativeContextRef::script_context_table() const {
const JSHeapBroker* broker) const {
AllowHandleAllocation handle_allocation; AllowHandleAllocation handle_allocation;
AllowHandleDereference handle_dereference; AllowHandleDereference handle_dereference;
return ScriptContextTableRef( return ScriptContextTableRef(
handle(object<Context>()->script_context_table(), broker->isolate())); broker(),
handle(object<Context>()->script_context_table(), broker()->isolate()));
} }
OddballType ObjectRef::oddball_type(const JSHeapBroker* broker) const { OddballType ObjectRef::oddball_type() const {
return IsSmi() ? OddballType::kNone return IsSmi() ? OddballType::kNone : AsHeapObject().type().oddball_type();
: AsHeapObject().type(broker).oddball_type();
} }
ObjectRef FeedbackVectorRef::get(const JSHeapBroker* broker, ObjectRef FeedbackVectorRef::get(FeedbackSlot slot) const {
FeedbackSlot slot) const {
AllowHandleAllocation handle_allocation; AllowHandleAllocation handle_allocation;
AllowHandleDereference handle_dereference; AllowHandleDereference handle_dereference;
Handle<Object> value(object<FeedbackVector>()->Get(slot)->ToObject(), Handle<Object> value(object<FeedbackVector>()->Get(slot)->ToObject(),
broker->isolate()); broker()->isolate());
return ObjectRef(value); return ObjectRef(broker(), value);
} }
JSObjectRef AllocationSiteRef::boilerplate(const JSHeapBroker* broker) const { JSObjectRef AllocationSiteRef::boilerplate() const {
AllowHandleAllocation handle_allocation; AllowHandleAllocation handle_allocation;
AllowHandleDereference handle_dereference; AllowHandleDereference handle_dereference;
Handle<JSObject> value(object<AllocationSite>()->boilerplate(), Handle<JSObject> value(object<AllocationSite>()->boilerplate(),
broker->isolate()); broker()->isolate());
return JSObjectRef(value); return JSObjectRef(broker(), value);
} }
bool JSObjectRef::IsUnboxedDoubleField(FieldIndex index) const { bool JSObjectRef::IsUnboxedDoubleField(FieldIndex index) const {
@ -276,19 +275,19 @@ double JSObjectRef::RawFastDoublePropertyAt(FieldIndex index) const {
return object<JSObject>()->RawFastDoublePropertyAt(index); return object<JSObject>()->RawFastDoublePropertyAt(index);
} }
ObjectRef JSObjectRef::RawFastPropertyAt(const JSHeapBroker* broker, ObjectRef JSObjectRef::RawFastPropertyAt(FieldIndex index) const {
FieldIndex index) const {
AllowHandleAllocation handle_allocation; AllowHandleAllocation handle_allocation;
AllowHandleDereference handle_dereference; AllowHandleDereference handle_dereference;
return ObjectRef( return ObjectRef(broker(),
handle(object<JSObject>()->RawFastPropertyAt(index), broker->isolate())); handle(object<JSObject>()->RawFastPropertyAt(index),
broker()->isolate()));
} }
FixedArrayBaseRef JSObjectRef::elements(const JSHeapBroker* broker) const { FixedArrayBaseRef JSObjectRef::elements() const {
AllowHandleAllocation handle_allocation; AllowHandleAllocation handle_allocation;
AllowHandleDereference handle_dereference; AllowHandleDereference handle_dereference;
return FixedArrayBaseRef( return FixedArrayBaseRef(
handle(object<JSObject>()->elements(), broker->isolate())); broker(), handle(object<JSObject>()->elements(), broker()->isolate()));
} }
namespace { namespace {
@ -374,12 +373,12 @@ const int kMaxFastLiteralProperties = JSObject::kMaxInObjectProperties;
// Determines whether the given array or object literal boilerplate satisfies // Determines whether the given array or object literal boilerplate satisfies
// all limits to be considered for fast deep-copying and computes the total // all limits to be considered for fast deep-copying and computes the total
// size of all objects that are part of the graph. // size of all objects that are part of the graph.
bool AllocationSiteRef::IsFastLiteral(const JSHeapBroker* broker) const { bool AllocationSiteRef::IsFastLiteral() const {
AllowHandleAllocation allow_handle_allocation; AllowHandleAllocation allow_handle_allocation;
AllowHandleDereference allow_handle_dereference; AllowHandleDereference allow_handle_dereference;
int max_properties = kMaxFastLiteralProperties; int max_properties = kMaxFastLiteralProperties;
Handle<JSObject> boilerplate(object<AllocationSite>()->boilerplate(), Handle<JSObject> boilerplate(object<AllocationSite>()->boilerplate(),
broker->isolate()); broker()->isolate());
return IsFastLiteralHelper(boilerplate, kMaxFastLiteralDepth, return IsFastLiteralHelper(boilerplate, kMaxFastLiteralDepth,
&max_properties); &max_properties);
} }
@ -389,19 +388,18 @@ PretenureFlag AllocationSiteRef::GetPretenureMode() const {
return object<AllocationSite>()->GetPretenureMode(); return object<AllocationSite>()->GetPretenureMode();
} }
void JSObjectRef::EnsureElementsTenured(const JSHeapBroker* broker) { void JSObjectRef::EnsureElementsTenured() {
// TODO(jarin) Eventually, we will pretenure the boilerplates before // TODO(jarin) Eventually, we will pretenure the boilerplates before
// the compilation job starts. // the compilation job starts.
AllowHandleAllocation allow_handle_allocation; AllowHandleAllocation allow_handle_allocation;
AllowHandleDereference allow_handle_dereference; AllowHandleDereference allow_handle_dereference;
Handle<FixedArrayBase> object_elements = Handle<FixedArrayBase> object_elements = elements().object<FixedArrayBase>();
elements(broker).object<FixedArrayBase>();
if (Heap::InNewSpace(*object_elements)) { if (Heap::InNewSpace(*object_elements)) {
// If we would like to pretenure a fixed cow array, we must ensure that // If we would like to pretenure a fixed cow array, we must ensure that
// the array is already in old space, otherwise we'll create too many // the array is already in old space, otherwise we'll create too many
// old-to-new-space pointers (overflowing the store buffer). // old-to-new-space pointers (overflowing the store buffer).
object_elements = Handle<FixedArrayBase>( object_elements = Handle<FixedArrayBase>(
broker->isolate()->factory()->CopyAndTenureFixedCOWArray( broker()->isolate()->factory()->CopyAndTenureFixedCOWArray(
Handle<FixedArray>::cast(object_elements))); Handle<FixedArray>::cast(object_elements)));
object<JSObject>()->set_elements(*object_elements); object<JSObject>()->set_elements(*object_elements);
} }
@ -432,11 +430,11 @@ bool MapRef::is_dictionary_map() const {
return object<Map>()->is_dictionary_map(); return object<Map>()->is_dictionary_map();
} }
ObjectRef MapRef::constructor_or_backpointer(const JSHeapBroker* broker) const { ObjectRef MapRef::constructor_or_backpointer() const {
AllowHandleAllocation handle_allocation; AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference; AllowHandleDereference allow_handle_dereference;
return ObjectRef( return ObjectRef(broker(), handle(object<Map>()->constructor_or_backpointer(),
handle(object<Map>()->constructor_or_backpointer(), broker->isolate())); broker()->isolate()));
} }
int MapRef::instance_size() const { int MapRef::instance_size() const {
@ -454,11 +452,12 @@ PropertyDetails MapRef::GetPropertyDetails(int i) const {
return object<Map>()->instance_descriptors()->GetDetails(i); return object<Map>()->instance_descriptors()->GetDetails(i);
} }
NameRef MapRef::GetPropertyKey(const JSHeapBroker* broker, int i) const { NameRef MapRef::GetPropertyKey(int i) const {
AllowHandleAllocation handle_allocation; AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference; AllowHandleDereference allow_handle_dereference;
return NameRef(handle(object<Map>()->instance_descriptors()->GetKey(i), return NameRef(broker(),
broker->isolate())); handle(object<Map>()->instance_descriptors()->GetKey(i),
broker()->isolate()));
} }
bool MapRef::IsJSArrayMap() const { bool MapRef::IsJSArrayMap() const {
@ -471,10 +470,10 @@ bool MapRef::IsInobjectSlackTrackingInProgress() const {
return object<Map>()->IsInobjectSlackTrackingInProgress(); return object<Map>()->IsInobjectSlackTrackingInProgress();
} }
bool MapRef::IsFixedCowArrayMap(const JSHeapBroker* broker) const { bool MapRef::IsFixedCowArrayMap() const {
AllowHandleDereference allow_handle_dereference; AllowHandleDereference allow_handle_dereference;
return *object<Map>() == return *object<Map>() ==
ReadOnlyRoots(broker->isolate()).fixed_cow_array_map(); ReadOnlyRoots(broker()->isolate()).fixed_cow_array_map();
} }
bool MapRef::has_prototype_slot() const { bool MapRef::has_prototype_slot() const {
@ -497,10 +496,11 @@ ElementsKind JSArrayRef::GetElementsKind() const {
return object<JSArray>()->GetElementsKind(); return object<JSArray>()->GetElementsKind();
} }
ObjectRef JSArrayRef::length(const JSHeapBroker* broker) const { ObjectRef JSArrayRef::length() const {
AllowHandleAllocation handle_allocation; AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference; AllowHandleDereference allow_handle_dereference;
return ObjectRef(handle(object<JSArray>()->length(), broker->isolate())); return ObjectRef(broker(),
handle(object<JSArray>()->length(), broker()->isolate()));
} }
int StringRef::length() const { int StringRef::length() const {
@ -513,45 +513,50 @@ uint16_t StringRef::GetFirstChar() {
return object<String>()->Get(0); return object<String>()->Get(0);
} }
double StringRef::ToNumber(const JSHeapBroker* broker) { double StringRef::ToNumber() {
AllowHandleDereference allow_handle_dereference; AllowHandleDereference allow_handle_dereference;
AllowHandleAllocation allow_handle_allocation; AllowHandleAllocation allow_handle_allocation;
AllowHeapAllocation allow_heap_allocation; AllowHeapAllocation allow_heap_allocation;
int flags = ALLOW_HEX | ALLOW_OCTAL | ALLOW_BINARY; int flags = ALLOW_HEX | ALLOW_OCTAL | ALLOW_BINARY;
return StringToDouble(broker->isolate(), broker->isolate()->unicode_cache(), return StringToDouble(broker()->isolate(),
object<String>(), flags); broker()->isolate()->unicode_cache(), object<String>(),
flags);
} }
ObjectRef JSRegExpRef::raw_properties_or_hash( ObjectRef JSRegExpRef::raw_properties_or_hash() const {
const JSHeapBroker* broker) const { AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference;
return ObjectRef(broker(),
handle(object<JSRegExp>()->raw_properties_or_hash(),
broker()->isolate()));
}
ObjectRef JSRegExpRef::data() const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference;
return ObjectRef(broker(),
handle(object<JSRegExp>()->data(), broker()->isolate()));
}
ObjectRef JSRegExpRef::source() const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference;
return ObjectRef(broker(),
handle(object<JSRegExp>()->source(), broker()->isolate()));
}
ObjectRef JSRegExpRef::flags() const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference;
return ObjectRef(broker(),
handle(object<JSRegExp>()->flags(), broker()->isolate()));
}
ObjectRef JSRegExpRef::last_index() const {
AllowHandleAllocation handle_allocation; AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference; AllowHandleDereference allow_handle_dereference;
return ObjectRef( return ObjectRef(
handle(object<JSRegExp>()->raw_properties_or_hash(), broker->isolate())); broker(), handle(object<JSRegExp>()->last_index(), broker()->isolate()));
}
ObjectRef JSRegExpRef::data(const JSHeapBroker* broker) const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference;
return ObjectRef(handle(object<JSRegExp>()->data(), broker->isolate()));
}
ObjectRef JSRegExpRef::source(const JSHeapBroker* broker) const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference;
return ObjectRef(handle(object<JSRegExp>()->source(), broker->isolate()));
}
ObjectRef JSRegExpRef::flags(const JSHeapBroker* broker) const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference;
return ObjectRef(handle(object<JSRegExp>()->flags(), broker->isolate()));
}
ObjectRef JSRegExpRef::last_index(const JSHeapBroker* broker) const {
AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference;
return ObjectRef(handle(object<JSRegExp>()->last_index(), broker->isolate()));
} }
int FixedArrayBaseRef::length() const { int FixedArrayBaseRef::length() const {
@ -559,15 +564,16 @@ int FixedArrayBaseRef::length() const {
return object<FixedArrayBase>()->length(); return object<FixedArrayBase>()->length();
} }
bool FixedArrayRef::is_the_hole(const JSHeapBroker* broker, int i) const { bool FixedArrayRef::is_the_hole(int i) const {
AllowHandleDereference allow_handle_dereference; AllowHandleDereference allow_handle_dereference;
return object<FixedArray>()->is_the_hole(broker->isolate(), i); return object<FixedArray>()->is_the_hole(broker()->isolate(), i);
} }
ObjectRef FixedArrayRef::get(const JSHeapBroker* broker, int i) const { ObjectRef FixedArrayRef::get(int i) const {
AllowHandleAllocation handle_allocation; AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference; AllowHandleDereference allow_handle_dereference;
return ObjectRef(handle(object<FixedArray>()->get(i), broker->isolate())); return ObjectRef(broker(),
handle(object<FixedArray>()->get(i), broker()->isolate()));
} }
bool FixedDoubleArrayRef::is_the_hole(int i) const { bool FixedDoubleArrayRef::is_the_hole(int i) const {
@ -645,104 +651,99 @@ int SharedFunctionInfoRef::GetBytecodeArrayRegisterCount() const {
return object<SharedFunctionInfo>()->GetBytecodeArray()->register_count(); return object<SharedFunctionInfo>()->GetBytecodeArray()->register_count();
} }
MapRef NativeContextRef::fast_aliased_arguments_map( MapRef NativeContextRef::fast_aliased_arguments_map() const {
const JSHeapBroker* broker) const {
AllowHandleAllocation handle_allocation; AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference; AllowHandleDereference allow_handle_dereference;
return MapRef(handle(object<Context>()->fast_aliased_arguments_map(), return MapRef(broker(),
broker->isolate())); handle(object<Context>()->fast_aliased_arguments_map(),
broker()->isolate()));
} }
MapRef NativeContextRef::sloppy_arguments_map( MapRef NativeContextRef::sloppy_arguments_map() const {
const JSHeapBroker* broker) const {
AllowHandleAllocation handle_allocation; AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference; AllowHandleDereference allow_handle_dereference;
return MapRef( return MapRef(broker(), handle(object<Context>()->sloppy_arguments_map(),
handle(object<Context>()->sloppy_arguments_map(), broker->isolate())); broker()->isolate()));
} }
MapRef NativeContextRef::strict_arguments_map( MapRef NativeContextRef::strict_arguments_map() const {
const JSHeapBroker* broker) const {
AllowHandleAllocation handle_allocation; AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference; AllowHandleDereference allow_handle_dereference;
return MapRef( return MapRef(broker(), handle(object<Context>()->strict_arguments_map(),
handle(object<Context>()->strict_arguments_map(), broker->isolate())); broker()->isolate()));
} }
MapRef NativeContextRef::js_array_fast_elements_map_index( MapRef NativeContextRef::js_array_fast_elements_map_index() const {
const JSHeapBroker* broker) const {
AllowHandleAllocation handle_allocation; AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference; AllowHandleDereference allow_handle_dereference;
return MapRef(handle(object<Context>()->js_array_fast_elements_map_index(), return MapRef(broker(),
broker->isolate())); handle(object<Context>()->js_array_fast_elements_map_index(),
broker()->isolate()));
} }
MapRef NativeContextRef::initial_array_iterator_map( MapRef NativeContextRef::initial_array_iterator_map() const {
const JSHeapBroker* broker) const {
AllowHandleAllocation handle_allocation; AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference; AllowHandleDereference allow_handle_dereference;
return MapRef(handle(object<Context>()->initial_array_iterator_map(), return MapRef(broker(),
broker->isolate())); handle(object<Context>()->initial_array_iterator_map(),
broker()->isolate()));
} }
MapRef NativeContextRef::set_value_iterator_map( MapRef NativeContextRef::set_value_iterator_map() const {
const JSHeapBroker* broker) const {
AllowHandleAllocation handle_allocation; AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference; AllowHandleDereference allow_handle_dereference;
return MapRef( return MapRef(broker(), handle(object<Context>()->set_value_iterator_map(),
handle(object<Context>()->set_value_iterator_map(), broker->isolate())); broker()->isolate()));
} }
MapRef NativeContextRef::set_key_value_iterator_map( MapRef NativeContextRef::set_key_value_iterator_map() const {
const JSHeapBroker* broker) const {
AllowHandleAllocation handle_allocation; AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference; AllowHandleDereference allow_handle_dereference;
return MapRef(handle(object<Context>()->set_key_value_iterator_map(), return MapRef(broker(),
broker->isolate())); handle(object<Context>()->set_key_value_iterator_map(),
broker()->isolate()));
} }
MapRef NativeContextRef::map_key_iterator_map( MapRef NativeContextRef::map_key_iterator_map() const {
const JSHeapBroker* broker) const {
AllowHandleAllocation handle_allocation; AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference; AllowHandleDereference allow_handle_dereference;
return MapRef( return MapRef(broker(), handle(object<Context>()->map_key_iterator_map(),
handle(object<Context>()->map_key_iterator_map(), broker->isolate())); broker()->isolate()));
} }
MapRef NativeContextRef::map_value_iterator_map( MapRef NativeContextRef::map_value_iterator_map() const {
const JSHeapBroker* broker) const {
AllowHandleAllocation handle_allocation; AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference; AllowHandleDereference allow_handle_dereference;
return MapRef( return MapRef(broker(), handle(object<Context>()->map_value_iterator_map(),
handle(object<Context>()->map_value_iterator_map(), broker->isolate())); broker()->isolate()));
} }
MapRef NativeContextRef::map_key_value_iterator_map( MapRef NativeContextRef::map_key_value_iterator_map() const {
const JSHeapBroker* broker) const {
AllowHandleAllocation handle_allocation; AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference; AllowHandleDereference allow_handle_dereference;
return MapRef(handle(object<Context>()->map_key_value_iterator_map(), return MapRef(broker(),
broker->isolate())); handle(object<Context>()->map_key_value_iterator_map(),
broker()->isolate()));
} }
MapRef NativeContextRef::GetFunctionMapFromIndex(const JSHeapBroker* broker, MapRef NativeContextRef::GetFunctionMapFromIndex(int index) const {
int index) const {
DCHECK_LE(index, Context::LAST_FUNCTION_MAP_INDEX); DCHECK_LE(index, Context::LAST_FUNCTION_MAP_INDEX);
DCHECK_GE(index, Context::FIRST_FUNCTION_MAP_INDEX); DCHECK_GE(index, Context::FIRST_FUNCTION_MAP_INDEX);
return get(broker, index).AsMap(); return get(index).AsMap();
} }
bool ObjectRef::BooleanValue(const JSHeapBroker* broker) { bool ObjectRef::BooleanValue() {
AllowHandleDereference allow_handle_dereference; AllowHandleDereference allow_handle_dereference;
return object<Object>()->BooleanValue(broker->isolate()); return object<Object>()->BooleanValue(broker()->isolate());
} }
double ObjectRef::OddballToNumber(const JSHeapBroker* broker) const { double ObjectRef::OddballToNumber() const {
OddballType type = oddball_type(broker); OddballType type = oddball_type();
switch (type) { switch (type) {
case OddballType::kBoolean: { case OddballType::kBoolean: {
ObjectRef true_ref(broker->isolate()->factory()->true_value()); ObjectRef true_ref(broker(),
broker()->isolate()->factory()->true_value());
return this->equals(true_ref) ? 1 : 0; return this->equals(true_ref) ? 1 : 0;
break; break;
} }
@ -761,11 +762,11 @@ double ObjectRef::OddballToNumber(const JSHeapBroker* broker) const {
} }
} }
CellRef ModuleRef::GetCell(const JSHeapBroker* broker, int cell_index) { CellRef ModuleRef::GetCell(int cell_index) {
AllowHandleAllocation handle_allocation; AllowHandleAllocation handle_allocation;
AllowHandleDereference allow_handle_dereference; AllowHandleDereference allow_handle_dereference;
return CellRef( return CellRef(broker(), handle(object<Module>()->GetCell(cell_index),
handle(object<Module>()->GetCell(cell_index), broker->isolate())); broker()->isolate()));
} }
} // namespace compiler } // namespace compiler

110
src/compiler/js-heap-broker.h
View File

@ -94,7 +94,8 @@ HEAP_BROKER_OBJECT_LIST(FORWARD_DECL)
class ObjectRef { class ObjectRef {
public: public:
explicit ObjectRef(Handle<Object> object) : object_(object) {} explicit ObjectRef(const JSHeapBroker* broker, Handle<Object> object)
: broker_(broker), object_(object) {}
template <typename T> template <typename T>
Handle<T> object() const { Handle<T> object() const {
@ -102,7 +103,7 @@ class ObjectRef {
return Handle<T>::cast(object_); return Handle<T>::cast(object_);
} }
OddballType oddball_type(const JSHeapBroker* broker) const; OddballType oddball_type() const;
bool IsSmi() const; bool IsSmi() const;
int AsSmi() const; int AsSmi() const;
@ -117,11 +118,15 @@ class ObjectRef {
HEAP_BROKER_OBJECT_LIST(HEAP_AS_METHOD_DECL) HEAP_BROKER_OBJECT_LIST(HEAP_AS_METHOD_DECL)
#undef HEAP_AS_METHOD_DECL #undef HEAP_AS_METHOD_DECL
StringRef TypeOf(const JSHeapBroker* broker) const; StringRef TypeOf() const;
bool BooleanValue(const JSHeapBroker* broker); bool BooleanValue();
double OddballToNumber(const JSHeapBroker* broker) const; double OddballToNumber() const;
protected:
const JSHeapBroker* broker() const { return broker_; }
private: private:
const JSHeapBroker* broker_;
Handle<Object> object_; Handle<Object> object_;
}; };
@ -129,10 +134,9 @@ class HeapObjectRef : public ObjectRef {
public: public:
using ObjectRef::ObjectRef; using ObjectRef::ObjectRef;
HeapObjectType type(const JSHeapBroker* broker) const; HeapObjectType type() const;
MapRef map(const JSHeapBroker* broker) const; MapRef map() const;
base::Optional<MapRef> TryGetObjectCreateMap( base::Optional<MapRef> TryGetObjectCreateMap() const;
const JSHeapBroker* broker) const;
bool IsSeqString() const; bool IsSeqString() const;
bool IsExternalString() const; bool IsExternalString() const;
}; };
@ -143,11 +147,10 @@ class JSObjectRef : public HeapObjectRef {
bool IsUnboxedDoubleField(FieldIndex index) const; bool IsUnboxedDoubleField(FieldIndex index) const;
double RawFastDoublePropertyAt(FieldIndex index) const; double RawFastDoublePropertyAt(FieldIndex index) const;
ObjectRef RawFastPropertyAt(const JSHeapBroker* broker, ObjectRef RawFastPropertyAt(FieldIndex index) const;
FieldIndex index) const;
FixedArrayBaseRef elements(const JSHeapBroker* broker) const; FixedArrayBaseRef elements() const;
void EnsureElementsTenured(const JSHeapBroker* broker); void EnsureElementsTenured();
}; };
struct SlackTrackingResult { struct SlackTrackingResult {
@ -166,15 +169,13 @@ class JSFunctionRef : public JSObjectRef {
BuiltinFunctionId GetBuiltinFunctionId() const; BuiltinFunctionId GetBuiltinFunctionId() const;
bool IsConstructor() const; bool IsConstructor() const;
bool has_initial_map() const; bool has_initial_map() const;
MapRef initial_map(const JSHeapBroker* broker) const; MapRef initial_map() const;
MapRef DependOnInitialMap(const JSHeapBroker* broker, MapRef DependOnInitialMap(CompilationDependencies* dependencies) const;
CompilationDependencies* dependencies) const;
JSGlobalProxyRef global_proxy(const JSHeapBroker* broker) const; JSGlobalProxyRef global_proxy() const;
SlackTrackingResult FinishSlackTracking() const; SlackTrackingResult FinishSlackTracking() const;
SharedFunctionInfoRef shared(const JSHeapBroker* broker) const; SharedFunctionInfoRef shared() const;
void EnsureHasInitialMap() const; void EnsureHasInitialMap() const;
}; };
@ -182,11 +183,11 @@ class JSRegExpRef : public JSObjectRef {
public: public:
using JSObjectRef::JSObjectRef; using JSObjectRef::JSObjectRef;
ObjectRef raw_properties_or_hash(const JSHeapBroker* broker) const; ObjectRef raw_properties_or_hash() const;
ObjectRef data(const JSHeapBroker* broker) const; ObjectRef data() const;
ObjectRef source(const JSHeapBroker* broker) const; ObjectRef source() const;
ObjectRef flags(const JSHeapBroker* broker) const; ObjectRef flags() const;
ObjectRef last_index(const JSHeapBroker* broker) const; ObjectRef last_index() const;
}; };
class HeapNumberRef : public HeapObjectRef { class HeapNumberRef : public HeapObjectRef {
@ -207,28 +208,28 @@ class ContextRef : public HeapObjectRef {
public: public:
using HeapObjectRef::HeapObjectRef; using HeapObjectRef::HeapObjectRef;
base::Optional<ContextRef> previous(const JSHeapBroker* broker) const; base::Optional<ContextRef> previous() const;
ObjectRef get(const JSHeapBroker* broker, int index) const; ObjectRef get(int index) const;
}; };
class NativeContextRef : public ContextRef { class NativeContextRef : public ContextRef {
public: public:
using ContextRef::ContextRef; using ContextRef::ContextRef;
ScriptContextTableRef script_context_table(const JSHeapBroker* broker) const; ScriptContextTableRef script_context_table() const;
MapRef fast_aliased_arguments_map(const JSHeapBroker* broker) const; MapRef fast_aliased_arguments_map() const;
MapRef sloppy_arguments_map(const JSHeapBroker* broker) const; MapRef sloppy_arguments_map() const;
MapRef strict_arguments_map(const JSHeapBroker* broker) const; MapRef strict_arguments_map() const;
MapRef js_array_fast_elements_map_index(const JSHeapBroker* broker) const; MapRef js_array_fast_elements_map_index() const;
MapRef initial_array_iterator_map(const JSHeapBroker* broker) const; MapRef initial_array_iterator_map() const;
MapRef set_value_iterator_map(const JSHeapBroker* broker) const; MapRef set_value_iterator_map() const;
MapRef set_key_value_iterator_map(const JSHeapBroker* broker) const; MapRef set_key_value_iterator_map() const;
MapRef map_key_iterator_map(const JSHeapBroker* broker) const; MapRef map_key_iterator_map() const;
MapRef map_value_iterator_map(const JSHeapBroker* broker) const; MapRef map_value_iterator_map() const;
MapRef map_key_value_iterator_map(const JSHeapBroker* broker) const; MapRef map_key_value_iterator_map() const;
MapRef GetFunctionMapFromIndex(const JSHeapBroker* broker, int index) const; MapRef GetFunctionMapFromIndex(int index) const;
}; };
class NameRef : public HeapObjectRef { class NameRef : public HeapObjectRef {
@ -253,16 +254,16 @@ class FeedbackVectorRef : public HeapObjectRef {
public: public:
using HeapObjectRef::HeapObjectRef; using HeapObjectRef::HeapObjectRef;
ObjectRef get(const JSHeapBroker* broker, FeedbackSlot slot) const; ObjectRef get(FeedbackSlot slot) const;
}; };
class AllocationSiteRef : public HeapObjectRef { class AllocationSiteRef : public HeapObjectRef {
public: public:
using HeapObjectRef::HeapObjectRef; using HeapObjectRef::HeapObjectRef;
JSObjectRef boilerplate(const JSHeapBroker* broker) const; JSObjectRef boilerplate() const;
PretenureFlag GetPretenureMode() const; PretenureFlag GetPretenureMode() const;
bool IsFastLiteral(const JSHeapBroker* broker) const; bool IsFastLiteral() const;
}; };
class MapRef : public HeapObjectRef { class MapRef : public HeapObjectRef {
@ -274,10 +275,10 @@ class MapRef : public HeapObjectRef {
int GetInObjectProperties() const; int GetInObjectProperties() const;
int NumberOfOwnDescriptors() const; int NumberOfOwnDescriptors() const;
PropertyDetails GetPropertyDetails(int i) const; PropertyDetails GetPropertyDetails(int i) const;
NameRef GetPropertyKey(const JSHeapBroker* broker, int i) const; NameRef GetPropertyKey(int i) const;
FieldIndex GetFieldIndexFor(int i) const; FieldIndex GetFieldIndexFor(int i) const;
int GetInObjectPropertyOffset(int index) const; int GetInObjectPropertyOffset(int index) const;
ObjectRef constructor_or_backpointer(const JSHeapBroker* broker) const; ObjectRef constructor_or_backpointer() const;
bool is_stable() const; bool is_stable() const;
bool has_prototype_slot() const; bool has_prototype_slot() const;
@ -286,10 +287,9 @@ class MapRef : public HeapObjectRef {
bool is_dictionary_map() const; bool is_dictionary_map() const;
bool IsJSArrayMap() const; bool IsJSArrayMap() const;
bool IsFixedCowArrayMap(const JSHeapBroker* broker) const; bool IsFixedCowArrayMap() const;
void DependOnStableMap(const JSHeapBroker* broker, void DependOnStableMap(CompilationDependencies* dependencies) const;
CompilationDependencies* dependencies) const;
}; };
class FixedArrayBaseRef : public HeapObjectRef { class FixedArrayBaseRef : public HeapObjectRef {
@ -303,8 +303,8 @@ class FixedArrayRef : public FixedArrayBaseRef {
public: public:
using FixedArrayBaseRef::FixedArrayBaseRef; using FixedArrayBaseRef::FixedArrayBaseRef;
ObjectRef get(const JSHeapBroker* broker, int i) const; ObjectRef get(int i) const;
bool is_the_hole(const JSHeapBroker* broker, int i) const; bool is_the_hole(int i) const;
}; };
class FixedDoubleArrayRef : public FixedArrayBaseRef { class FixedDoubleArrayRef : public FixedArrayBaseRef {
@ -320,7 +320,7 @@ class JSArrayRef : public JSObjectRef {
using JSObjectRef::JSObjectRef; using JSObjectRef::JSObjectRef;
ElementsKind GetElementsKind() const; ElementsKind GetElementsKind() const;
ObjectRef length(const JSHeapBroker* broker) const; ObjectRef length() const;
}; };
class ScopeInfoRef : public HeapObjectRef { class ScopeInfoRef : public HeapObjectRef {
@ -354,29 +354,29 @@ class StringRef : public NameRef {
int length() const; int length() const;
uint16_t GetFirstChar(); uint16_t GetFirstChar();
double ToNumber(const JSHeapBroker* broker); double ToNumber();
}; };
class ModuleRef : public HeapObjectRef { class ModuleRef : public HeapObjectRef {
public: public:
explicit ModuleRef(Handle<Object> object) : HeapObjectRef(object) {} using HeapObjectRef::HeapObjectRef;
CellRef GetCell(const JSHeapBroker* broker, int cell_index); CellRef GetCell(int cell_index);
}; };
class CellRef : public HeapObjectRef { class CellRef : public HeapObjectRef {
public: public:
explicit CellRef(Handle<Object> object) : HeapObjectRef(object) {} using HeapObjectRef::HeapObjectRef;
}; };
class JSGlobalProxyRef : public JSObjectRef { class JSGlobalProxyRef : public JSObjectRef {
public: public:
explicit JSGlobalProxyRef(Handle<Object> object) : JSObjectRef(object) {} using JSObjectRef::JSObjectRef;
}; };
class CodeRef : public HeapObjectRef { class CodeRef : public HeapObjectRef {
public: public:
explicit CodeRef(Handle<Object> object) : HeapObjectRef(object) {} using HeapObjectRef::HeapObjectRef;
}; };
class InternalizedStringRef : public StringRef { class InternalizedStringRef : public StringRef {

30
src/compiler/js-native-context-specialization.cc
View File

@ -68,7 +68,7 @@ JSNativeContextSpecialization::JSNativeContextSpecialization(
global_object_(native_context->global_object(), jsgraph->isolate()), global_object_(native_context->global_object(), jsgraph->isolate()),
global_proxy_(JSGlobalProxy::cast(native_context->global_proxy()), global_proxy_(JSGlobalProxy::cast(native_context->global_proxy()),
jsgraph->isolate()), jsgraph->isolate()),
native_context_(native_context), native_context_(js_heap_broker, native_context),
dependencies_(dependencies), dependencies_(dependencies),
zone_(zone), zone_(zone),
type_cache_(TypeCache::Get()) {} type_cache_(TypeCache::Get()) {}
@ -520,7 +520,7 @@ Reduction JSNativeContextSpecialization::ReduceJSLoadContext(Node* node) {
// context (if any), so we can constant-fold those fields, which is // context (if any), so we can constant-fold those fields, which is
// safe, since the NATIVE_CONTEXT_INDEX slot is always immutable. // safe, since the NATIVE_CONTEXT_INDEX slot is always immutable.
if (access.index() == Context::NATIVE_CONTEXT_INDEX) { if (access.index() == Context::NATIVE_CONTEXT_INDEX) {
Node* value = jsgraph()->Constant(js_heap_broker(), native_context()); Node* value = jsgraph()->Constant(native_context());
ReplaceWithValue(node, value); ReplaceWithValue(node, value);
return Replace(value); return Replace(value);
} }
@ -732,19 +732,19 @@ Reduction JSNativeContextSpecialization::ReduceGlobalAccess(
Reduction JSNativeContextSpecialization::ReduceJSLoadGlobal(Node* node) { Reduction JSNativeContextSpecialization::ReduceJSLoadGlobal(Node* node) {
DCHECK_EQ(IrOpcode::kJSLoadGlobal, node->opcode()); DCHECK_EQ(IrOpcode::kJSLoadGlobal, node->opcode());
NameRef name(LoadGlobalParametersOf(node->op()).name()); NameRef name(js_heap_broker(), LoadGlobalParametersOf(node->op()).name());
Node* effect = NodeProperties::GetEffectInput(node); Node* effect = NodeProperties::GetEffectInput(node);
// Try to lookup the name on the script context table first (lexical scoping). // Try to lookup the name on the script context table first (lexical scoping).
base::Optional<ScriptContextTableRef::LookupResult> result = base::Optional<ScriptContextTableRef::LookupResult> result =
native_context().script_context_table(js_heap_broker()).lookup(name); native_context().script_context_table().lookup(name);
if (result) { if (result) {
ObjectRef contents = result->context.get(js_heap_broker(), result->index); ObjectRef contents = result->context.get(result->index);
OddballType oddball_type = contents.oddball_type(js_heap_broker()); OddballType oddball_type = contents.oddball_type();
if (oddball_type == OddballType::kHole) { if (oddball_type == OddballType::kHole) {
return NoChange(); return NoChange();
} }
Node* context = jsgraph()->Constant(js_heap_broker(), result->context); Node* context = jsgraph()->Constant(result->context);
Node* value = effect = graph()->NewNode( Node* value = effect = graph()->NewNode(
javascript()->LoadContext(0, result->index, result->immutable), context, javascript()->LoadContext(0, result->index, result->immutable), context,
effect); effect);
@ -759,21 +759,21 @@ Reduction JSNativeContextSpecialization::ReduceJSLoadGlobal(Node* node) {
Reduction JSNativeContextSpecialization::ReduceJSStoreGlobal(Node* node) { Reduction JSNativeContextSpecialization::ReduceJSStoreGlobal(Node* node) {
DCHECK_EQ(IrOpcode::kJSStoreGlobal, node->opcode()); DCHECK_EQ(IrOpcode::kJSStoreGlobal, node->opcode());
NameRef name(StoreGlobalParametersOf(node->op()).name()); NameRef name(js_heap_broker(), StoreGlobalParametersOf(node->op()).name());
Node* value = NodeProperties::GetValueInput(node, 0); Node* value = NodeProperties::GetValueInput(node, 0);
Node* effect = NodeProperties::GetEffectInput(node); Node* effect = NodeProperties::GetEffectInput(node);
Node* control = NodeProperties::GetControlInput(node); Node* control = NodeProperties::GetControlInput(node);
// Try to lookup the name on the script context table first (lexical scoping). // Try to lookup the name on the script context table first (lexical scoping).
base::Optional<ScriptContextTableRef::LookupResult> result = base::Optional<ScriptContextTableRef::LookupResult> result =
native_context().script_context_table(js_heap_broker()).lookup(name); native_context().script_context_table().lookup(name);
if (result) { if (result) {
ObjectRef contents = result->context.get(js_heap_broker(), result->index); ObjectRef contents = result->context.get(result->index);
OddballType oddball_type = contents.oddball_type(js_heap_broker()); OddballType oddball_type = contents.oddball_type();
if (oddball_type == OddballType::kHole || result->immutable) { if (oddball_type == OddballType::kHole || result->immutable) {
return NoChange(); return NoChange();
} }
Node* context = jsgraph()->Constant(js_heap_broker(), result->context); Node* context = jsgraph()->Constant(result->context);
effect = graph()->NewNode(javascript()->StoreContext(0, result->index), effect = graph()->NewNode(javascript()->StoreContext(0, result->index),
value, context, effect, control); value, context, effect, control);
ReplaceWithValue(node, value, effect, control); ReplaceWithValue(node, value, effect, control);
@ -1774,7 +1774,7 @@ Node* JSNativeContextSpecialization::InlineApiCall(
Node* code = jsgraph()->HeapConstant(call_api_callback.code()); Node* code = jsgraph()->HeapConstant(call_api_callback.code());
// Add CallApiCallbackStub's register argument as well. // Add CallApiCallbackStub's register argument as well.
Node* context = jsgraph()->Constant(js_heap_broker(), native_context()); Node* context = jsgraph()->Constant(native_context());
Node* inputs[10] = {code, context, data, holder, function_reference, Node* inputs[10] = {code, context, data, holder, function_reference,
receiver}; receiver};
int index = 6 + argc; int index = 6 + argc;
@ -1913,7 +1913,7 @@ JSNativeContextSpecialization::BuildPropertyStore(
!FLAG_unbox_double_fields) { !FLAG_unbox_double_fields) {
if (access_info.HasTransitionMap()) { if (access_info.HasTransitionMap()) {
// Allocate a MutableHeapNumber for the new property. // Allocate a MutableHeapNumber for the new property.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control); AllocationBuilder a(jsgraph(), effect, control);
a.Allocate(HeapNumber::kSize, NOT_TENURED, Type::OtherInternal()); a.Allocate(HeapNumber::kSize, NOT_TENURED, Type::OtherInternal());
a.Store(AccessBuilder::ForMap(), a.Store(AccessBuilder::ForMap(),
factory()->mutable_heap_number_map()); factory()->mutable_heap_number_map());
@ -2768,7 +2768,7 @@ Node* JSNativeContextSpecialization::BuildExtendPropertiesBackingStore(
new_length_and_hash, effect, control); new_length_and_hash, effect, control);
// Allocate and initialize the new properties. // Allocate and initialize the new properties.
AllocationBuilder a(jsgraph(), js_heap_broker(), effect, control); AllocationBuilder a(jsgraph(), effect, control);
a.Allocate(PropertyArray::SizeFor(new_length), NOT_TENURED, a.Allocate(PropertyArray::SizeFor(new_length), NOT_TENURED,
Type::OtherInternal()); Type::OtherInternal());
a.Store(AccessBuilder::ForMap(), jsgraph()->PropertyArrayMapConstant()); a.Store(AccessBuilder::ForMap(), jsgraph()->PropertyArrayMapConstant());

47
src/compiler/js-typed-lowering.cc
View File

@ -93,12 +93,13 @@ class JSBinopReduction final {
if (BothInputsAre(Type::String()) || if (BothInputsAre(Type::String()) ||
BinaryOperationHintOf(node_->op()) == BinaryOperationHint::kString) { BinaryOperationHintOf(node_->op()) == BinaryOperationHint::kString) {
HeapObjectBinopMatcher m(node_); HeapObjectBinopMatcher m(node_);
if (m.right().HasValue() && m.right().Ref().IsString()) { const JSHeapBroker* broker = lowering_->js_heap_broker();
StringRef right_string(m.right().Value()); if (m.right().HasValue() && m.right().Ref(broker).IsString()) {
StringRef right_string = m.right().Ref(broker).AsString();
if (right_string.length() >= ConsString::kMinLength) return true; if (right_string.length() >= ConsString::kMinLength) return true;
} }
if (m.left().HasValue() && m.left().Ref().IsString()) { if (m.left().HasValue() && m.left().Ref(broker).IsString()) {
StringRef left_string(m.left().Value()); StringRef left_string = m.left().Ref(broker).AsString();
if (left_string.length() >= ConsString::kMinLength) { if (left_string.length() >= ConsString::kMinLength) {
// The invariant for ConsString requires the left hand side to be // The invariant for ConsString requires the left hand side to be
// a sequential or external string if the right hand side is the // a sequential or external string if the right hand side is the
@ -718,11 +719,11 @@ Node* JSTypedLowering::BuildGetStringLength(Node* value) {
// TODO(bmeurer): Get rid of this hack and instead have a way to // TODO(bmeurer): Get rid of this hack and instead have a way to
// express the string length in the types. // express the string length in the types.
HeapObjectMatcher m(value); HeapObjectMatcher m(value);
if (!m.HasValue() || !m.Ref().IsString()) { if (!m.HasValue() || !m.Ref(js_heap_broker()).IsString()) {
return graph()->NewNode(simplified()->StringLength(), value); return graph()->NewNode(simplified()->StringLength(), value);
} }
return jsgraph()->Constant(m.Ref().AsString().length()); return jsgraph()->Constant(m.Ref(js_heap_broker()).AsString().length());
} }
Reduction JSTypedLowering::ReduceSpeculativeNumberComparison(Node* node) { Reduction JSTypedLowering::ReduceSpeculativeNumberComparison(Node* node) {
@ -959,17 +960,15 @@ Reduction JSTypedLowering::ReduceJSToNumberOrNumericInput(Node* input) {
if (input_type.Is(Type::String())) { if (input_type.Is(Type::String())) {
HeapObjectMatcher m(input); HeapObjectMatcher m(input);
if (m.HasValue() && m.Ref().IsString()) { if (m.HasValue() && m.Ref(js_heap_broker()).IsString()) {
StringRef input_value = m.Ref().AsString(); StringRef input_value = m.Ref(js_heap_broker()).AsString();
return Replace( return Replace(jsgraph()->Constant(input_value.ToNumber()));
jsgraph()->Constant(input_value.ToNumber(js_heap_broker())));
} }
} }
if (input_type.IsHeapConstant()) { if (input_type.IsHeapConstant()) {
ObjectRef input_value = input_type.AsHeapConstant()->Ref(); ObjectRef input_value = input_type.AsHeapConstant()->Ref();
if (input_value.oddball_type(js_heap_broker()) != OddballType::kNone) { if (input_value.oddball_type() != OddballType::kNone) {
return Replace( return Replace(jsgraph()->Constant(input_value.OddballToNumber()));
jsgraph()->Constant(input_value.OddballToNumber(js_heap_broker())));
} }
} }
if (input_type.Is(Type::Number())) { if (input_type.Is(Type::Number())) {
@ -1135,8 +1134,8 @@ Reduction JSTypedLowering::ReduceJSLoadNamed(Node* node) {
DCHECK_EQ(IrOpcode::kJSLoadNamed, node->opcode()); DCHECK_EQ(IrOpcode::kJSLoadNamed, node->opcode());
Node* receiver = NodeProperties::GetValueInput(node, 0); Node* receiver = NodeProperties::GetValueInput(node, 0);
Type receiver_type = NodeProperties::GetType(receiver); Type receiver_type = NodeProperties::GetType(receiver);
NameRef name(NamedAccessOf(node->op()).name()); NameRef name(js_heap_broker(), NamedAccessOf(node->op()).name());
NameRef length_str(factory()->length_string()); NameRef length_str(js_heap_broker(), factory()->length_string());
// Optimize "length" property of strings. // Optimize "length" property of strings.
if (name.equals(length_str) && receiver_type.Is(Type::String())) { if (name.equals(length_str) && receiver_type.Is(Type::String())) {
Node* value = graph()->NewNode(simplified()->StringLength(), receiver); Node* value = graph()->NewNode(simplified()->StringLength(), receiver);
@ -1371,9 +1370,8 @@ Node* JSTypedLowering::BuildGetModuleCell(Node* node) {
if (module_type.IsHeapConstant()) { if (module_type.IsHeapConstant()) {
ModuleRef module_constant = module_type.AsHeapConstant()->Ref().AsModule(); ModuleRef module_constant = module_type.AsHeapConstant()->Ref().AsModule();
CellRef cell_constant( CellRef cell_constant(module_constant.GetCell(cell_index));
module_constant.GetCell(js_heap_broker(), cell_index)); return jsgraph()->Constant(cell_constant);
return jsgraph()->Constant(js_heap_broker(), cell_constant);
} }
FieldAccess field_access; FieldAccess field_access;
@ -1560,7 +1558,7 @@ Reduction JSTypedLowering::ReduceJSConstruct(Node* node) {
if (target_type.IsHeapConstant() && if (target_type.IsHeapConstant() &&
target_type.AsHeapConstant()->Ref().IsJSFunction()) { target_type.AsHeapConstant()->Ref().IsJSFunction()) {
JSFunctionRef function = target_type.AsHeapConstant()->Ref().AsJSFunction(); JSFunctionRef function = target_type.AsHeapConstant()->Ref().AsJSFunction();
SharedFunctionInfoRef shared = function.shared(js_heap_broker()); SharedFunctionInfoRef shared = function.shared();
// Only optimize [[Construct]] here if {function} is a Constructor. // Only optimize [[Construct]] here if {function} is a Constructor.
if (!function.IsConstructor()) return NoChange(); if (!function.IsConstructor()) return NoChange();
@ -1570,13 +1568,13 @@ Reduction JSTypedLowering::ReduceJSConstruct(Node* node) {
// Patch {node} to an indirect call via the {function}s construct stub. // Patch {node} to an indirect call via the {function}s construct stub.
bool use_builtin_construct_stub = shared.construct_as_builtin(); bool use_builtin_construct_stub = shared.construct_as_builtin();
CodeRef code(use_builtin_construct_stub CodeRef code(js_heap_broker(),
use_builtin_construct_stub
? BUILTIN_CODE(isolate(), JSBuiltinsConstructStub) ? BUILTIN_CODE(isolate(), JSBuiltinsConstructStub)
: BUILTIN_CODE(isolate(), JSConstructStubGeneric)); : BUILTIN_CODE(isolate(), JSConstructStubGeneric));
node->RemoveInput(arity + 1); node->RemoveInput(arity + 1);
node->InsertInput(graph()->zone(), 0, node->InsertInput(graph()->zone(), 0, jsgraph()->Constant(code));
jsgraph()->Constant(js_heap_broker(), code));
node->InsertInput(graph()->zone(), 2, new_target); node->InsertInput(graph()->zone(), 2, new_target);
node->InsertInput(graph()->zone(), 3, jsgraph()->Constant(arity)); node->InsertInput(graph()->zone(), 3, jsgraph()->Constant(arity));
node->InsertInput(graph()->zone(), 4, jsgraph()->UndefinedConstant()); node->InsertInput(graph()->zone(), 4, jsgraph()->UndefinedConstant());
@ -1643,7 +1641,7 @@ Reduction JSTypedLowering::ReduceJSCall(Node* node) {
if (target_type.IsHeapConstant() && if (target_type.IsHeapConstant() &&
target_type.AsHeapConstant()->Ref().IsJSFunction()) { target_type.AsHeapConstant()->Ref().IsJSFunction()) {
JSFunctionRef function = target_type.AsHeapConstant()->Ref().AsJSFunction(); JSFunctionRef function = target_type.AsHeapConstant()->Ref().AsJSFunction();
SharedFunctionInfoRef shared = function.shared(js_heap_broker()); SharedFunctionInfoRef shared = function.shared();
if (shared.HasBreakInfo()) { if (shared.HasBreakInfo()) {
// Do not inline the call if we need to check whether to break at entry. // Do not inline the call if we need to check whether to break at entry.
@ -1663,8 +1661,7 @@ Reduction JSTypedLowering::ReduceJSCall(Node* node) {
// Check if we need to convert the {receiver}. // Check if we need to convert the {receiver}.
if (is_sloppy(shared.language_mode()) && !shared.native() && if (is_sloppy(shared.language_mode()) && !shared.native() &&
!receiver_type.Is(Type::Receiver())) { !receiver_type.Is(Type::Receiver())) {
Node* global_proxy = jsgraph()->Constant( Node* global_proxy = jsgraph()->Constant(function.global_proxy());
js_heap_broker(), function.global_proxy(js_heap_broker()));
receiver = effect = receiver = effect =
graph()->NewNode(simplified()->ConvertReceiver(convert_mode), graph()->NewNode(simplified()->ConvertReceiver(convert_mode),
receiver, global_proxy, effect, control); receiver, global_proxy, effect, control);

6
src/compiler/node-matchers.h
View File

@ -18,6 +18,8 @@ namespace v8 {
namespace internal { namespace internal {
namespace compiler { namespace compiler {
class JSHeapBroker;
// A pattern matcher for nodes. // A pattern matcher for nodes.
struct NodeMatcher { struct NodeMatcher {
explicit NodeMatcher(Node* node) : node_(node) {} explicit NodeMatcher(Node* node) : node_(node) {}
@ -193,7 +195,9 @@ struct HeapObjectMatcher final
return this->HasValue() && this->Value().address() == value.address(); return this->HasValue() && this->Value().address() == value.address();
} }
ObjectRef Ref() const { return ObjectRef(this->Value()); } ObjectRef Ref(const JSHeapBroker* broker) const {
return ObjectRef(broker, this->Value());
}
}; };

3
src/compiler/simplified-operator-reducer.cc
View File

@ -62,8 +62,7 @@ Reduction SimplifiedOperatorReducer::Reduce(Node* node) {
case IrOpcode::kChangeTaggedToBit: { case IrOpcode::kChangeTaggedToBit: {
HeapObjectMatcher m(node->InputAt(0)); HeapObjectMatcher m(node->InputAt(0));
if (m.HasValue()) { if (m.HasValue()) {
HeapObjectRef object(m.Value()); return ReplaceInt32(m.Ref(js_heap_broker()).BooleanValue());
return ReplaceInt32(object.BooleanValue(js_heap_broker()));
} }
if (m.IsChangeBitToTagged()) return Replace(m.InputAt(0)); if (m.IsChangeBitToTagged()) return Replace(m.InputAt(0));
break; break;

30
src/compiler/typed-optimization.cc
View File

@ -93,7 +93,7 @@ base::Optional<MapRef> GetStableMapFromObjectType(
const JSHeapBroker* js_heap_broker, Type object_type) { const JSHeapBroker* js_heap_broker, Type object_type) {
if (object_type.IsHeapConstant()) { if (object_type.IsHeapConstant()) {
HeapObjectRef object = object_type.AsHeapConstant()->Ref(); HeapObjectRef object = object_type.AsHeapConstant()->Ref();
MapRef object_map = object.map(js_heap_broker); MapRef object_map = object.map();
if (object_map.is_stable()) return object_map; if (object_map.is_stable()) return object_map;
} }
return {}; return {};
@ -153,7 +153,7 @@ Reduction TypedOptimization::ReduceCheckMaps(Node* node) {
if (map_type.IsHeapConstant() && if (map_type.IsHeapConstant() &&
map_type.AsHeapConstant()->Ref().equals(*object_map)) { map_type.AsHeapConstant()->Ref().equals(*object_map)) {
if (object_map->CanTransition()) { if (object_map->CanTransition()) {
object_map->DependOnStableMap(js_heap_broker(), dependencies()); object_map->DependOnStableMap(dependencies());
} }
return Replace(effect); return Replace(effect);
} }
@ -219,9 +219,9 @@ Reduction TypedOptimization::ReduceLoadField(Node* node) {
GetStableMapFromObjectType(js_heap_broker(), object_type); GetStableMapFromObjectType(js_heap_broker(), object_type);
if (object_map.has_value()) { if (object_map.has_value()) {
if (object_map->CanTransition()) { if (object_map->CanTransition()) {
object_map->DependOnStableMap(js_heap_broker(), dependencies()); object_map->DependOnStableMap(dependencies());
} }
Node* const value = jsgraph()->Constant(js_heap_broker(), *object_map); Node* const value = jsgraph()->Constant(*object_map);
ReplaceWithValue(node, value); ReplaceWithValue(node, value);
return Replace(value); return Replace(value);
} }
@ -558,32 +558,30 @@ Reduction TypedOptimization::ReduceTypeOf(Node* node) {
Factory* const f = factory(); Factory* const f = factory();
if (type.Is(Type::Boolean())) { if (type.Is(Type::Boolean())) {
return Replace( return Replace(
jsgraph()->Constant(js_heap_broker(), ObjectRef(f->boolean_string()))); jsgraph()->Constant(ObjectRef(js_heap_broker(), f->boolean_string())));
} else if (type.Is(Type::Number())) { } else if (type.Is(Type::Number())) {
return Replace( return Replace(
jsgraph()->Constant(js_heap_broker(), ObjectRef(f->number_string()))); jsgraph()->Constant(ObjectRef(js_heap_broker(), f->number_string())));
} else if (type.Is(Type::String())) { } else if (type.Is(Type::String())) {
return Replace( return Replace(
jsgraph()->Constant(js_heap_broker(), ObjectRef(f->string_string()))); jsgraph()->Constant(ObjectRef(js_heap_broker(), f->string_string())));
} else if (type.Is(Type::BigInt())) { } else if (type.Is(Type::BigInt())) {
return Replace( return Replace(
jsgraph()->Constant(js_heap_broker(), ObjectRef(f->bigint_string()))); jsgraph()->Constant(ObjectRef(js_heap_broker(), f->bigint_string())));
} else if (type.Is(Type::Symbol())) { } else if (type.Is(Type::Symbol())) {
return Replace( return Replace(
jsgraph()->Constant(js_heap_broker(), ObjectRef(f->symbol_string()))); jsgraph()->Constant(ObjectRef(js_heap_broker(), f->symbol_string())));
} else if (type.Is(Type::OtherUndetectableOrUndefined())) { } else if (type.Is(Type::OtherUndetectableOrUndefined())) {
return Replace(jsgraph()->Constant(js_heap_broker(), return Replace(jsgraph()->Constant(
ObjectRef(f->undefined_string()))); ObjectRef(js_heap_broker(), f->undefined_string())));
} else if (type.Is(Type::NonCallableOrNull())) { } else if (type.Is(Type::NonCallableOrNull())) {
return Replace( return Replace(
jsgraph()->Constant(js_heap_broker(), ObjectRef(f->object_string()))); jsgraph()->Constant(ObjectRef(js_heap_broker(), f->object_string())));
} else if (type.Is(Type::Function())) { } else if (type.Is(Type::Function())) {
return Replace( return Replace(
jsgraph()->Constant(js_heap_broker(), ObjectRef(f->function_string()))); jsgraph()->Constant(ObjectRef(js_heap_broker(), f->function_string())));
} else if (type.IsHeapConstant()) { } else if (type.IsHeapConstant()) {
return Replace(jsgraph()->Constant( return Replace(jsgraph()->Constant(type.AsHeapConstant()->Ref().TypeOf()));
js_heap_broker(),
type.AsHeapConstant()->Ref().TypeOf(js_heap_broker())));
} }
return NoChange(); return NoChange();
} }

4
src/compiler/types.cc
View File

@ -827,7 +827,7 @@ Type Type::NewConstant(const JSHeapBroker* js_heap_broker,
return NewConstant(static_cast<double>(maybe_smi.value()), zone); return NewConstant(static_cast<double>(maybe_smi.value()), zone);
} }
HeapObjectRef heap_ref(value); HeapObjectRef heap_ref(js_heap_broker, value);
if (heap_ref.IsHeapNumber()) { if (heap_ref.IsHeapNumber()) {
return NewConstant(heap_ref.AsHeapNumber().value(), zone); return NewConstant(heap_ref.AsHeapNumber().value(), zone);
} }
@ -1064,7 +1064,7 @@ Type Type::OtherNumberConstant(double value, Zone* zone) {
Type Type::HeapConstant(const JSHeapBroker* js_heap_broker, Type Type::HeapConstant(const JSHeapBroker* js_heap_broker,
Handle<i::Object> value, Zone* zone) { Handle<i::Object> value, Zone* zone) {
return FromTypeBase( return FromTypeBase(
HeapConstantType::New(js_heap_broker, HeapObjectRef(value), zone)); HeapConstantType::New(HeapObjectRef(js_heap_broker, value), zone));
} }
// static // static

5
src/compiler/types.h
View File

@ -541,11 +541,10 @@ class V8_EXPORT_PRIVATE HeapConstantType : public NON_EXPORTED_BASE(TypeBase) {
friend class Type; friend class Type;
friend class BitsetType; friend class BitsetType;
static HeapConstantType* New(const JSHeapBroker* broker, static HeapConstantType* New(const HeapObjectRef& heap_ref, Zone* zone) {
const HeapObjectRef& heap_ref, Zone* zone) {
DCHECK(!heap_ref.IsHeapNumber()); DCHECK(!heap_ref.IsHeapNumber());
DCHECK_IMPLIES(heap_ref.IsString(), heap_ref.IsInternalizedString()); DCHECK_IMPLIES(heap_ref.IsString(), heap_ref.IsInternalizedString());
BitsetType::bitset bitset = BitsetType::Lub(heap_ref.type(broker)); BitsetType::bitset bitset = BitsetType::Lub(heap_ref.type());
return new (zone->New(sizeof(HeapConstantType))) return new (zone->New(sizeof(HeapConstantType)))
HeapConstantType(bitset, heap_ref); HeapConstantType(bitset, heap_ref);
} }