[heap] Reland: Reuse object evacuation information for slot recording in Scavenger.

This reverts commit d6de4af5.

Bug: chromium:852420
Change-Id: Ife02a0e47ddb4a136c552965d9e01c6a0ef18e02
Reviewed-on: https://chromium-review.googlesource.com/1194363Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55470}

src/heap/scavenger.cc

@@ -53,15 +53,13 @@ class IterateAndScavengePromotedObjectsVisitor final : public ObjectVisitor {
     scavenger_->PageMemoryFence(reinterpret_cast<MaybeObject*>(target));
 
     if (Heap::InFromSpace(target)) {
-      scavenger_->ScavengeObject(slot, target);
+      SlotCallbackResult result = scavenger_->ScavengeObject(slot, target);
       bool success = (*slot)->ToStrongOrWeakHeapObject(&target);
       USE(success);
       DCHECK(success);
-      scavenger_->PageMemoryFence(reinterpret_cast<MaybeObject*>(target));
 
-      if (Heap::InNewSpace(target)) {
+      if (result == KEEP_SLOT) {
         SLOW_DCHECK(target->IsHeapObject());
-        SLOW_DCHECK(Heap::InToSpace(target));
         RememberedSet<OLD_TO_NEW>::Insert(Page::FromAddress(slot_address),
                                           slot_address);
       }

src/heap/scavenger.h

@@ -16,6 +16,12 @@ namespace internal {
 
 class OneshotBarrier;
 
+enum class CopyAndForwardResult {
+  SUCCESS_YOUNG_GENERATION,
+  SUCCESS_OLD_GENERATION,
+  FAILURE
+};
+
 class Scavenger {
  public:
   static const int kCopiedListSegmentSize = 256;
@@ -61,34 +67,43 @@ class Scavenger {
 
   // Scavenges an object |object| referenced from slot |p|. |object| is required
   // to be in from space.
-  inline void ScavengeObject(HeapObjectReference** p, HeapObject* object);
+  inline SlotCallbackResult ScavengeObject(HeapObjectReference** p,
+                                           HeapObject* object);
 
   // Copies |source| to |target| and sets the forwarding pointer in |source|.
   V8_INLINE bool MigrateObject(Map* map, HeapObject* source, HeapObject* target,
                                int size);
 
-  V8_INLINE bool SemiSpaceCopyObject(Map* map, HeapObjectReference** slot,
-                                     HeapObject* object, int object_size);
+  V8_INLINE SlotCallbackResult
+  RememberedSetEntryNeeded(CopyAndForwardResult result);
 
-  V8_INLINE bool PromoteObject(Map* map, HeapObjectReference** slot,
-                               HeapObject* object, int object_size);
+  V8_INLINE CopyAndForwardResult SemiSpaceCopyObject(Map* map,
+                                                     HeapObjectReference** slot,
+                                                     HeapObject* object,
+                                                     int object_size);
 
-  V8_INLINE void EvacuateObject(HeapObjectReference** slot, Map* map,
-                                HeapObject* source);
-
-  // Different cases for object evacuation.
+  V8_INLINE CopyAndForwardResult PromoteObject(Map* map,
+                                               HeapObjectReference** slot,
+                                               HeapObject* object,
+                                               int object_size);
 
-  V8_INLINE void EvacuateObjectDefault(Map* map, HeapObjectReference** slot,
-                                       HeapObject* object, int object_size);
+  V8_INLINE SlotCallbackResult EvacuateObject(HeapObjectReference** slot,
+                                              Map* map, HeapObject* source);
 
-  V8_INLINE void EvacuateJSFunction(Map* map, HeapObject** slot,
-                                    JSFunction* object, int object_size);
-
-  inline void EvacuateThinString(Map* map, HeapObject** slot,
-                                 ThinString* object, int object_size);
-
-  inline void EvacuateShortcutCandidate(Map* map, HeapObject** slot,
-                                        ConsString* object, int object_size);
+  // Different cases for object evacuation.
+  V8_INLINE SlotCallbackResult EvacuateObjectDefault(Map* map,
+                                                     HeapObjectReference** slot,
+                                                     HeapObject* object,
+                                                     int object_size);
+
+  inline SlotCallbackResult EvacuateThinString(Map* map, HeapObject** slot,
+                                               ThinString* object,
+                                               int object_size);
+
+  inline SlotCallbackResult EvacuateShortcutCandidate(Map* map,
+                                                      HeapObject** slot,
+                                                      ConsString* object,
+                                                      int object_size);
 
   void IterateAndScavengePromotedObject(HeapObject* target, int size);