From dad1a8d1185af2b825c746c132096eb98ae8a0aa Mon Sep 17 00:00:00 2001
From: Georg Neis <neis@chromium.org>
Date: Fri, 14 Jul 2017 10:35:10 +0200
Subject: [PATCH] [compiler] Remove two more illegal uses of Handle<T>::cast.

The affected passes are part of OptimizeGraph which runs on a background
thread, so they must not access the heap (cast has a SLOW_DCHECK that
looks at the object's type).

I'm also changing Handle<T>::cast to assert that it's called in a scope
allowing handle dereference.

R=mstarzinger@chromium.org

Bug:
Change-Id: Ibae1e40ec8d57481387570c658eb7cb1ae5de3b9
Reviewed-on: https://chromium-review.googlesource.com/570403
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46667}
---
 src/compiler/escape-analysis.cc  | 4 ++--
 src/compiler/load-elimination.cc | 2 +-
 src/handles.h                    | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/compiler/escape-analysis.cc b/src/compiler/escape-analysis.cc
index c38234f3ad..a40314aec2 100644
--- a/src/compiler/escape-analysis.cc
+++ b/src/compiler/escape-analysis.cc
@@ -1534,8 +1534,8 @@ void EscapeAnalysis::ProcessCheckMaps(Node* node) {
         // CheckMapsValue operator that takes the load-eliminated map value as
         // input.
         if (value->opcode() == IrOpcode::kHeapConstant &&
-            params.maps().contains(ZoneHandleSet<Map>(
-                Handle<Map>::cast(OpParameter<Handle<HeapObject>>(value))))) {
+            params.maps().contains(ZoneHandleSet<Map>(bit_cast<Handle<Map>>(
+                OpParameter<Handle<HeapObject>>(value))))) {
           TRACE("CheckMaps #%i seems to be redundant (until now).\n",
                 node->id());
           return;
diff --git a/src/compiler/load-elimination.cc b/src/compiler/load-elimination.cc
index 6dd27d397b..bd8acaf5cf 100644
--- a/src/compiler/load-elimination.cc
+++ b/src/compiler/load-elimination.cc
@@ -871,7 +871,7 @@ Reduction LoadElimination::ReduceStoreField(Node* node) {
     if (new_value_type->IsHeapConstant()) {
       // Record the new {object} map information.
       ZoneHandleSet<Map> object_maps(
-          Handle<Map>::cast(new_value_type->AsHeapConstant()->Value()));
+          bit_cast<Handle<Map>>(new_value_type->AsHeapConstant()->Value()));
       state = state->AddMaps(object, object_maps, zone());
     }
   } else {
diff --git a/src/handles.h b/src/handles.h
index 5f0012698d..21c2f1987b 100644
--- a/src/handles.h
+++ b/src/handles.h
@@ -125,7 +125,7 @@ class Handle final : public HandleBase {
 
   template <typename S>
   static const Handle<T> cast(Handle<S> that) {
-    T::cast(*reinterpret_cast<T**>(that.location_));
+    T::cast(*reinterpret_cast<T**>(that.location()));
     return Handle<T>(reinterpret_cast<T**>(that.location_));
   }