[runtime] Remove --modify-field-representation-inplace flag

which was enabled a long ago and is not supposed to be disabled.

In addition this CL adds Representation::MightCauseMapDeprecation()
predicate and ensures it's consistent with the existing
MostGenericInPlaceChange() and CanBeInPlaceChangedTo().

Bug: v8:11104, v8:8865
Change-Id: Ia8046b76822c9b20fe3ce85de6b98570334aad21
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2527088
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71151}

src/flags/flag-definitions.h

@@ -1355,8 +1355,6 @@ DEFINE_GENERIC_IMPLICATION(
                   v8::tracing::TracingCategoryObserver::ENABLED_BY_NATIVE))
 DEFINE_BOOL_READONLY(fast_map_update, false,
                      "enable fast map update by caching the migration target")
-DEFINE_BOOL(modify_field_representation_inplace, true,
-            "enable in-place field representation updates")
 DEFINE_INT(max_valid_polymorphic_map_count, 4,
            "maximum number of valid maps to track in POLYMORPHIC state")
 

src/init/bootstrapper.cc

@@ -3603,10 +3603,11 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
               .ToHandleChecked();
 
     // done
-    // TODO(bmeurer): Once FLAG_modify_field_representation_inplace is always
-    // on, we can say Representation::HeapObject() here and have the inplace
-    // update logic take care of the case where someone ever stores a Smi into
-    // the done field.
+    // TODO(ishell): Consider using Representation::HeapObject() here and rely
+    // on the inplace update logic to take care of the case where someone ever
+    // stores a Smi into the done field. The logic works fine but in --jitless
+    // mode FLAG_track_heap_object_fields is off and the logic doesn't handle
+    // generalizations of HeapObject representation properly.
     map = Map::CopyWithField(isolate(), map, factory->done_string(),
                              FieldType::Any(isolate()), NONE,
                              PropertyConstness::kConst,

src/objects/map-inl.h

@@ -565,11 +565,7 @@ bool Map::is_stable() const {
 bool Map::CanBeDeprecated() const {
   for (InternalIndex i : IterateOwnDescriptors()) {
     PropertyDetails details = instance_descriptors(kRelaxedLoad).GetDetails(i);
-    if (details.representation().IsNone()) return true;
-    if (details.representation().IsSmi()) return true;
-    if (details.representation().IsDouble() && FLAG_unbox_double_fields)
-      return true;
-    if (details.representation().IsHeapObject()) return true;
+    if (details.representation().MightCauseMapDeprecation()) return true;
     if (details.kind() == kData && details.location() == kDescriptor) {
       return true;
     }

src/objects/map-updater.cc

@@ -217,6 +217,14 @@ MapUpdater::State MapUpdater::TryReconfigureToDataFieldInplace() {
 
   PropertyDetails old_details =
       old_descriptors_->GetDetails(modified_descriptor_);
+
+  if (old_details.attributes() != new_attributes_ ||
+      old_details.kind() != new_kind_ ||
+      old_details.location() != new_location_) {
+    // These changes can't be done in-place.
+    return state_;  // Not done yet.
+  }
+
   Representation old_representation = old_details.representation();
   if (!old_representation.CanBeInPlaceChangedTo(new_representation_)) {
     return state_;  // Not done yet.

src/objects/property-details.h

@@ -7,7 +7,6 @@
 
 #include "include/v8.h"
 #include "src/utils/allocation.h"
-// TODO(bmeurer): Remove once FLAG_modify_field_representation_inplace is gone.
 #include "src/base/bit-field.h"
 #include "src/flags/flags.h"
 
@@ -104,24 +103,41 @@ class Representation {
     return Equals(other);
   }
 
+  // Returns true if a change from this representation to a more general one
+  // might cause a map deprecation.
+  bool MightCauseMapDeprecation() const {
+    // HeapObject to tagged representation change can be done in-place.
+    if (IsTagged() || IsHeapObject()) return false;
+    // When double fields unboxing is enabled, there must be a map deprecation.
+    // Boxed double to tagged transition is always done in-place.
+    if (IsDouble()) return FLAG_unbox_double_fields;
+    // None to double and smi to double representation changes require
+    // deprecation, because doubles might require box allocation, see
+    // CanBeInPlaceChangedTo().
+    DCHECK(IsNone() || IsSmi());
+    return true;
+  }
+
   bool CanBeInPlaceChangedTo(const Representation& other) const {
+    if (Equals(other)) return true;
     // If it's just a representation generalization case (i.e. property kind and
     // attributes stays unchanged) it's fine to transition from None to anything
     // but double without any modification to the object, because the default
     // uninitialized value for representation None can be overwritten by both
     // smi and tagged values. Doubles, however, would require a box allocation.
     if (IsNone()) return !other.IsDouble();
-    if (!FLAG_modify_field_representation_inplace) return false;
-    return (IsSmi() || (!FLAG_unbox_double_fields && IsDouble()) ||
-            IsHeapObject()) &&
-           other.IsTagged();
+    if (!other.IsTagged()) return false;
+    // Everything but unboxed doubles can be in-place changed to Tagged.
+    if (FLAG_unbox_double_fields && IsDouble()) return false;
+    DCHECK(IsSmi() || (!FLAG_unbox_double_fields && IsDouble()) ||
+           IsHeapObject());
+    return true;
   }
 
   // Return the most generic representation that this representation can be
-  // changed to in-place. If in-place representation changes are disabled, then
-  // this will return the current representation.
+  // changed to in-place. If an in-place representation change is not allowed,
+  // then this will return the current representation.
   Representation MostGenericInPlaceChange() const {
-    if (!FLAG_modify_field_representation_inplace) return *this;
     // Everything but unboxed doubles can be in-place changed to Tagged.
     if (FLAG_unbox_double_fields && IsDouble()) return Representation::Double();
     return Representation::Tagged();

test/mjsunit/compiler/field-representation-tracking.js

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --modify-field-representation-inplace
+// Flags: --allow-natives-syntax
 // Flags: --no-always-opt --opt
 
 // Test that code embedding accesses to a Smi field gets properly

test/mjsunit/field-representation-tracking.js

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --modify-field-representation-inplace
+// Flags: --allow-natives-syntax
 
 // Test that s->t field representation changes are done in-place.
 (function() {

test/mjsunit/track-fields.js

@@ -26,7 +26,6 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 // Flags: --track-fields --track-double-fields --allow-natives-syntax
-// Flags: --modify-field-representation-inplace
 
 // Test transitions caused by changes to field representations.