commit 043dfe76f81601942aa5b8e8e14e717d981c97cc
author Georg Neis <neis@chromium.org> Tue Sep 18 07:48:38 2018
committer Georg Neis <neis@chromium.org> Tue Sep 18 08:19:20 2018
tree 33ddddd9bb9f7a9494326e76e28937c0ba126c92
parent f85f9e6505f458b2b1e432e9d31868383f8c79fa

[turbofan] Serialize IsUnboxedDoubleField.

I'm also changing the function signature to take the descriptor_index
instead of the FieldIndex, because this lets me reuse the vector of
property descriptors as storage.

Bug: v8:7790
Change-Id: Ie9dadcba2204b6825e5791f9c630fc8b1079a930
Reviewed-on: https://chromium-review.googlesource.com/1227873
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55981}

src/compiler/js-create-lowering.cc

diff --git a/src/compiler/js-create-lowering.cc b/src/compiler/js-create-lowering.cc
index fa47532..4e0d748 100644
--- a/src/compiler/js-create-lowering.cc
+++ b/src/compiler/js-create-lowering.cc
@@ -1667,7 +1667,7 @@
         MaybeHandle<Map>(), Type::Any(),    MachineType::AnyTagged(),
         kFullWriteBarrier};
     Node* value;
-    if (boilerplate.map().IsUnboxedDoubleField(index)) {
+    if (boilerplate_map.IsUnboxedDoubleField(i)) {
       access.machine_type = MachineType::Float64();
       access.type = Type::Number();
       value = jsgraph()->Constant(boilerplate.RawFastDoublePropertyAt(index));

src/compiler/js-heap-broker.cc

diff --git a/src/compiler/js-heap-broker.cc b/src/compiler/js-heap-broker.cc
index a20851b..baddcc0 100644
--- a/src/compiler/js-heap-broker.cc
+++ b/src/compiler/js-heap-broker.cc
@@ -494,6 +494,7 @@
   FieldIndex field_index;
   MapData* field_owner = nullptr;
   ObjectData* field_type = nullptr;
+  bool is_unboxed_double_field = false;
 };
 
 class MapData : public HeapObjectData {
@@ -1078,6 +1079,8 @@
       d.field_owner =
           broker()->GetOrCreateData(map->FindFieldOwner(isolate, i))->AsMap();
       d.field_type = broker()->GetOrCreateData(descriptors->GetFieldType(i));
+      d.is_unboxed_double_field = map->IsUnboxedDoubleField(d.field_index);
+      // Recurse.
       d.field_owner->SerializeDescriptors();
     }
     descriptors_.push_back(d);
@@ -1567,7 +1570,6 @@
     return object<JSObject>()->RawFastDoublePropertyAt(index);
   }
   JSObjectData* object_data = data()->AsJSObject();
-  CHECK(map().IsUnboxedDoubleField(index));
   CHECK(index.is_inobject());
   return object_data->GetInobjectField(index.property_index()).AsDouble();
 }
@@ -1581,7 +1583,6 @@
                             broker()->isolate()));
   }
   JSObjectData* object_data = data()->AsJSObject();
-  CHECK(!map().IsUnboxedDoubleField(index));
   CHECK(index.is_inobject());
   return ObjectRef(
       object_data->GetInobjectField(index.property_index()).AsObject());
@@ -1688,9 +1689,17 @@
       data()->AsMap()->descriptors().at(descriptor_index).field_type);
 }
 
-bool MapRef::IsUnboxedDoubleField(FieldIndex index) const {
-  AllowHandleDereference allow_handle_dereference;
-  return object<Map>()->IsUnboxedDoubleField(index);
+bool MapRef::IsUnboxedDoubleField(int descriptor_index) const {
+  if (broker()->mode() == JSHeapBroker::kDisabled) {
+    AllowHandleDereference allow_handle_dereference;
+    return object<Map>()->IsUnboxedDoubleField(
+        FieldIndex::ForDescriptor(*object<Map>(), descriptor_index));
+  }
+  return data()
+      ->AsMap()
+      ->descriptors()
+      .at(descriptor_index)
+      .is_unboxed_double_field;
 }
 
 uint16_t StringRef::GetFirstChar() {

src/compiler/js-heap-broker.h

diff --git a/src/compiler/js-heap-broker.h b/src/compiler/js-heap-broker.h
index 190b0a2..cfd127c 100644
--- a/src/compiler/js-heap-broker.h
+++ b/src/compiler/js-heap-broker.h
@@ -340,7 +340,7 @@
   NameRef GetPropertyKey(int descriptor_index) const;
   FieldIndex GetFieldIndexFor(int descriptor_index) const;
   ObjectRef GetFieldType(int descriptor_index) const;
-  bool IsUnboxedDoubleField(FieldIndex index) const;
+  bool IsUnboxedDoubleField(int descriptor_index) const;
 };
 
 class FixedArrayBaseRef : public HeapObjectRef {