[turbofan] Move typer into the background.

... if FLAG_concurrent_compiler_frontend is enabled.

Bug: v8:7790
Change-Id: I448560b21d54c8907e8cbf68bdaf8bbdf2b034df
Reviewed-on: https://chromium-review.googlesource.com/1241959
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56205}

src/compiler/js-heap-broker.cc

@@ -1358,9 +1358,10 @@ void JSHeapBroker::SerializeStandardObjects() {
   Factory* const f = isolate()->factory();
 
   // Maps, strings, oddballs
-  GetOrCreateData(f->NaN_string());
+  GetOrCreateData(f->arguments_marker_map());
   GetOrCreateData(f->bigint_string());
   GetOrCreateData(f->block_context_map());
+  GetOrCreateData(f->boolean_map());
   GetOrCreateData(f->boolean_string());
   GetOrCreateData(f->catch_context_map());
   GetOrCreateData(f->empty_fixed_array());
@@ -1379,23 +1380,32 @@ void JSHeapBroker::SerializeStandardObjects() {
   GetOrCreateData(f->minus_zero_value());
   GetOrCreateData(f->mutable_heap_number_map());
   GetOrCreateData(f->name_dictionary_map());
+  GetOrCreateData(f->NaN_string());
+  GetOrCreateData(f->null_map());
   GetOrCreateData(f->null_string());
   GetOrCreateData(f->null_value());
   GetOrCreateData(f->number_string());
   GetOrCreateData(f->object_string());
   GetOrCreateData(f->one_pointer_filler_map());
   GetOrCreateData(f->optimized_out());
+  GetOrCreateData(f->optimized_out_map());
   GetOrCreateData(f->property_array_map());
   GetOrCreateData(f->sloppy_arguments_elements_map());
   GetOrCreateData(f->stale_register());
+  GetOrCreateData(f->stale_register_map());
   GetOrCreateData(f->string_string());
   GetOrCreateData(f->symbol_string());
+  GetOrCreateData(f->termination_exception_map());
+  GetOrCreateData(f->the_hole_map());
   GetOrCreateData(f->the_hole_value());
   GetOrCreateData(f->true_string());
   GetOrCreateData(f->true_value());
+  GetOrCreateData(f->undefined_map());
   GetOrCreateData(f->undefined_string());
   GetOrCreateData(f->undefined_value());
+  GetOrCreateData(f->uninitialized_map());
   GetOrCreateData(f->with_context_map());
+  GetOrCreateData(f->zero_string());
 
   // Property cells
   GetOrCreateData(f->array_buffer_neutering_protector())

src/compiler/js-heap-copy-reducer.h

@@ -17,7 +17,7 @@ class JSHeapBroker;
 // by handles embedded in the graph is copied to the heap broker.
 // TODO(jarin) This is just a temporary solution until the graph uses only
 // ObjetRef-derived reference to refer to the heap data.
-class JSHeapCopyReducer : public Reducer {
+class V8_EXPORT_PRIVATE JSHeapCopyReducer : public Reducer {
  public:
   explicit JSHeapCopyReducer(JSHeapBroker* broker);
 

src/compiler/operation-typer.cc

@@ -20,10 +20,8 @@ OperationTyper::OperationTyper(Isolate* isolate, JSHeapBroker* js_heap_broker,
                                Zone* zone)
     : zone_(zone), cache_(TypeCache::Get()) {
   Factory* factory = isolate->factory();
-  infinity_ =
-      Type::NewConstant(js_heap_broker, factory->infinity_value(), zone);
-  minus_infinity_ =
-      Type::NewConstant(js_heap_broker, factory->minus_infinity_value(), zone);
+  infinity_ = Type::NewConstant(V8_INFINITY, zone);
+  minus_infinity_ = Type::NewConstant(-V8_INFINITY, zone);
   Type truncating_to_zero = Type::MinusZeroOrNaN();
   DCHECK(!truncating_to_zero.Maybe(Type::Integral32()));
 

src/compiler/pipeline.cc

@@ -313,12 +313,17 @@ class PipelineData {
                                    : wasm_engine_->GetCodeTracer();
   }
 
-  Typer* CreateTyper(Typer::Flags flags) {
-    CHECK_NULL(typer_);
-    typer_ = new Typer(isolate(), js_heap_broker(), flags, graph());
+  Typer* CreateTyper() {
+    DCHECK_NULL(typer_);
+    typer_ = new Typer(isolate(), js_heap_broker(), typer_flags_, graph());
     return typer_;
   }
 
+  void AddTyperFlag(Typer::Flag flag) {
+    DCHECK_NULL(typer_);
+    typer_flags_ |= flag;
+  }
+
   void DeleteTyper() {
     delete typer_;
     typer_ = nullptr;
@@ -448,6 +453,7 @@ class PipelineData {
   MaybeHandle<Code> code_;
   CodeGenerator* code_generator_ = nullptr;
   Typer* typer_ = nullptr;
+  Typer::Flags typer_flags_ = Typer::kNoFlags;
 
   // All objects in the following group of fields are allocated in graph_zone_.
   // They are all set to nullptr when the graph_zone_ is destroyed.
@@ -1317,6 +1323,12 @@ struct CopyMetadataForConcurrentCompilePhase {
     JSHeapCopyReducer heap_copy_reducer(data->js_heap_broker());
     AddReducer(data, &graph_reducer, &heap_copy_reducer);
     graph_reducer.ReduceGraph();
+
+    // Some nodes that are no longer in the graph might still be in the cache.
+    NodeVector cached_nodes(temp_zone);
+    data->jsgraph()->GetCachedNodes(&cached_nodes);
+    for (Node* const node : cached_nodes) graph_reducer.ReduceNode(node);
+
     data->js_heap_broker()->StopSerializing();
   }
 };
@@ -2012,30 +2024,28 @@ bool PipelineImpl::CreateGraph() {
   Run<EarlyGraphTrimmingPhase>();
   RunPrintAndVerify(EarlyGraphTrimmingPhase::phase_name(), true);
 
-  // Run the type-sensitive lowerings and optimizations on the graph.
+  // Determine the Typer operation flags.
   {
-    // Determine the Typer operation flags.
-    Typer::Flags flags = Typer::kNoFlags;
     if (is_sloppy(info()->shared_info()->language_mode()) &&
         info()->shared_info()->IsUserJavaScript()) {
       // Sloppy mode functions always have an Object for this.
-      flags |= Typer::kThisIsReceiver;
+      data->AddTyperFlag(Typer::kThisIsReceiver);
     }
     if (IsClassConstructor(info()->shared_info()->kind())) {
       // Class constructors cannot be [[Call]]ed.
-      flags |= Typer::kNewTargetIsReceiver;
+      data->AddTyperFlag(Typer::kNewTargetIsReceiver);
     }
+  }
 
-    // Type the graph and keep the Typer running on newly created nodes within
-    // this scope; the Typer is automatically unlinked from the Graph once we
-    // leave this scope below.
-
-    Run<TyperPhase>(data->CreateTyper(flags));
-    RunPrintAndVerify(TyperPhase::phase_name());
-
+  // Run the type-sensitive lowerings and optimizations on the graph.
+  {
     if (FLAG_concurrent_compiler_frontend) {
       Run<CopyMetadataForConcurrentCompilePhase>();
     } else {
+      // Type the graph and keep the Typer running such that new nodes get
+      // automatically typed when they are created.
+      Run<TyperPhase>(data->CreateTyper());
+      RunPrintAndVerify(TyperPhase::phase_name());
       Run<TypedLoweringPhase>();
       RunPrintAndVerify(TypedLoweringPhase::phase_name());
       data->DeleteTyper();
@@ -2053,6 +2063,10 @@ bool PipelineImpl::OptimizeGraph(Linkage* linkage) {
   data->BeginPhaseKind("lowering");
 
   if (FLAG_concurrent_compiler_frontend) {
+    // Type the graph and keep the Typer running such that new nodes get
+    // automatically typed when they are created.
+    Run<TyperPhase>(data->CreateTyper());
+    RunPrintAndVerify(TyperPhase::phase_name());
     Run<TypedLoweringPhase>();
     RunPrintAndVerify(TypedLoweringPhase::phase_name());
     data->DeleteTyper();

src/compiler/typer.cc

@@ -1420,7 +1420,6 @@ Type Typer::Visitor::JSCallTyper(Type fun, Typer* t) {
     return Type::NonInternal();
   }
   JSFunctionRef function = fun.AsHeapConstant()->Ref().AsJSFunction();
-  function.Serialize();
   if (!function.shared().HasBuiltinFunctionId()) {
     return Type::NonInternal();
   }

test/unittests/compiler/graph-unittest.cc

@@ -4,6 +4,7 @@
 
 #include "test/unittests/compiler/graph-unittest.h"
 
+#include "src/compiler/js-heap-copy-reducer.h"
 #include "src/compiler/node-properties.h"
 #include "src/heap/factory.h"
 #include "src/objects-inl.h"  // TODO(everyone): Make typer.h IWYU compliant.
@@ -69,6 +70,8 @@ Node* GraphTest::HeapConstant(const Handle<HeapObject>& value) {
   Node* node = graph()->NewNode(common()->HeapConstant(value));
   Type type = Type::NewConstant(js_heap_broker(), value, zone());
   NodeProperties::SetType(node, type);
+  JSHeapCopyReducer heap_copy_reducer(js_heap_broker());
+  heap_copy_reducer.Reduce(node);
   return node;
 }