[heap, runtime] Avoid redundant clearing of slots outside an object.

When an object shrinks, we can keep the recorded slots until the sweeper
removes them. It is safe because the recorded slots will not be over-
written with untagged values.

BUG=chromium:694255

Change-Id: I2b910c6345a306e00c7a10396876001e663f51ea
Reviewed-on: https://chromium-review.googlesource.com/591650Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46999}

src/objects.cc

@@ -4019,8 +4019,11 @@ void MigrateFastToFast(Handle<JSObject> object, Handle<Map> new_map) {
 
   if (instance_size_delta > 0) {
     Address address = object->address();
+    // The object has shrunk and is not going to use these slots again.
+    // Since there will be no untagged stores in these slots,
+    // we can just let the sweeper remove slots in the filler.
     heap->CreateFillerObjectAt(address + new_instance_size, instance_size_delta,
-                               ClearRecordedSlots::kYes);
+                               ClearRecordedSlots::kNo);
     heap->AdjustLiveBytes(*object, -instance_size_delta);
   }
 
@@ -4101,8 +4104,11 @@ void MigrateFastToSlow(Handle<JSObject> object, Handle<Map> new_map,
   DCHECK(instance_size_delta >= 0);
 
   if (instance_size_delta > 0) {
+    // The object has shrunk and is not going to use these slots again.
+    // Since there will be no untagged stores in these slots,
+    // we can just let the sweeper remove slots in the filler.
     heap->CreateFillerObjectAt(object->address() + new_instance_size,
-                               instance_size_delta, ClearRecordedSlots::kYes);
+                               instance_size_delta, ClearRecordedSlots::kNo);
     heap->AdjustLiveBytes(*object, -instance_size_delta);
   }
 
@@ -4143,6 +4149,7 @@ void MigrateFastToSlow(Handle<JSObject> object, Handle<Map> new_map,
 // static
 void JSObject::NotifyMapChange(Handle<Map> old_map, Handle<Map> new_map,
                                Isolate* isolate) {
+  DCHECK_LE(new_map->instance_size(), old_map->instance_size());
   if (!old_map->is_prototype_map()) return;
 
   InvalidatePrototypeChains(*old_map);