[compiler] Disable a few MapRef serialization methods

.. when concurrent inlining is on.

SerializeBackPointer
SerializeForElementLoad
SerializeRootMap

For SerializeRootMap: Due to changed root map access timing, it
is now possible to see an abandoned prototype map - added logic
for that in RemoveImpossibleMaps.

Bug: v8:7790
Change-Id: Icdb3fff12536bfdc84923e7cd40bad9978a2a401
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2948658
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75065}

src/compiler/heap-refs.cc

@@ -1196,16 +1196,13 @@ class MapData : public HeapObjectData {
     return prototype_;
   }
 
-  void SerializeForElementLoad(JSHeapBroker* broker);
-
   void SerializeForElementStore(JSHeapBroker* broker);
 
   bool has_extra_serialized_data() const {
     return serialized_elements_kind_generalizations_ ||
            serialized_own_descriptors_ || serialized_constructor_ ||
            serialized_backpointer_ || serialized_prototype_ ||
-           serialized_root_map_ || serialized_for_element_load_ ||
-           serialized_for_element_store_;
+           serialized_root_map_ || serialized_for_element_store_;
   }
 
  private:
@@ -1255,8 +1252,6 @@ class MapData : public HeapObjectData {
   bool serialized_root_map_ = false;
   ObjectData* root_map_ = nullptr;
 
-  bool serialized_for_element_load_ = false;
-
   bool serialized_for_element_store_ = false;
 };
 
@@ -2897,26 +2892,12 @@ base::Optional<MapRef> MapRef::AsElementsKind(ElementsKind kind) const {
   return base::Optional<MapRef>();
 }
 
-void MapRef::SerializeForElementLoad() {
-  if (data()->should_access_heap()) return;
-  CHECK_EQ(broker()->mode(), JSHeapBroker::kSerializing);
-  data()->AsMap()->SerializeForElementLoad(broker());
-}
-
 void MapRef::SerializeForElementStore() {
   if (data()->should_access_heap()) return;
   CHECK_EQ(broker()->mode(), JSHeapBroker::kSerializing);
   data()->AsMap()->SerializeForElementStore(broker());
 }
 
-void MapData::SerializeForElementLoad(JSHeapBroker* broker) {
-  if (serialized_for_element_load_) return;
-  serialized_for_element_load_ = true;
-
-  TraceScope tracer(broker, this, "MapData::SerializeForElementLoad");
-  SerializePrototype(broker);
-}
-
 void MapData::SerializeForElementStore(JSHeapBroker* broker) {
   if (serialized_for_element_store_) return;
   serialized_for_element_store_ = true;
@@ -3560,7 +3541,7 @@ base::Optional<HeapObjectRef> MapRef::prototype() const {
 }
 
 void MapRef::SerializeRootMap() {
-  if (data_->should_access_heap()) return;
+  if (data_->should_access_heap() || broker()->is_concurrent_inlining()) return;
   CHECK_EQ(broker()->mode(), JSHeapBroker::kSerializing);
   data()->AsMap()->SerializeRootMap(broker());
 }
@@ -4484,7 +4465,7 @@ bool MapRef::serialized_own_descriptor(InternalIndex descriptor_index) const {
 }
 
 void MapRef::SerializeBackPointer() {
-  if (data_->should_access_heap()) return;
+  if (data_->should_access_heap() || broker()->is_concurrent_inlining()) return;
   CHECK_IMPLIES(!FLAG_turbo_concurrent_get_property_access_info,
                 broker()->mode() == JSHeapBroker::kSerializing);
   data()->AsMap()->SerializeBackPointer(broker());

src/compiler/heap-refs.h

@@ -706,8 +706,6 @@ class V8_EXPORT_PRIVATE MapRef : public HeapObjectRef {
   bool TrySerializePrototype();
   base::Optional<HeapObjectRef> prototype() const;
 
-  void SerializeForElementLoad();
-
   void SerializeForElementStore();
   bool HasOnlyStablePrototypesWithFastElements(
       ZoneVector<MapRef>* prototype_maps);

src/compiler/js-native-context-specialization.cc

@@ -1655,8 +1655,7 @@ base::Optional<JSTypedArrayRef> GetTypedArrayConstant(JSHeapBroker* broker,
 void JSNativeContextSpecialization::RemoveImpossibleMaps(
     Node* object, ZoneVector<Handle<Map>>* maps) const {
   base::Optional<MapRef> root_map = InferRootMap(object);
-  if (root_map.has_value()) {
-    DCHECK(!root_map->is_abandoned_prototype_map());
+  if (root_map.has_value() && !root_map->is_abandoned_prototype_map()) {
     maps->erase(
         std::remove_if(maps->begin(), maps->end(),
                        [root_map, this](Handle<Map> map) {

src/compiler/serializer-for-background-compilation.cc

@@ -3309,7 +3309,7 @@ void SerializerForBackgroundCompilation::ProcessElementAccess(
       switch (access_mode) {
         case AccessMode::kHas:
         case AccessMode::kLoad:
-          map.SerializeForElementLoad();
+          map.SerializePrototype();
           break;
         case AccessMode::kStore:
           map.SerializeForElementStore();