[runtime] Introduce Load/StoreHandler heap objects.

They will eventually be used instead of Tuple3/FixedArray by the IC system.

Bug: v8:5561, v8:7159
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I39faad1b2dc10ce7d42cb7477ea87b64d1e0b44c
Reviewed-on: https://chromium-review.googlesource.com/806178
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49908}

BUILD.gn

@@ -763,6 +763,8 @@ action("postmortem-metadata") {
     "src/objects-inl.h",
     "src/objects/code-inl.h",
     "src/objects/code.h",
+    "src/objects/data-handler.h",
+    "src/objects/data-handler-inl.h",
     "src/objects/fixed-array-inl.h",
     "src/objects/fixed-array.h",
     "src/objects/js-array-inl.h",

include/v8.h

@@ -9084,9 +9084,9 @@ class Internals {
   static const int kFirstNonstringType = 0x80;
   static const int kOddballType = 0x83;
   static const int kForeignType = 0x87;
-  static const int kJSSpecialApiObjectType = 0xbc;
-  static const int kJSApiObjectType = 0xc0;
-  static const int kJSObjectType = 0xc1;
+  static const int kJSSpecialApiObjectType = 0xbe;
+  static const int kJSApiObjectType = 0xc2;
+  static const int kJSObjectType = 0xc3;
 
   static const int kUndefinedOddballKind = 5;
   static const int kNullOddballKind = 3;

src/compiler/code-assembler.h

@@ -17,6 +17,7 @@
 #include "src/globals.h"
 #include "src/heap/heap.h"
 #include "src/machine-type.h"
+#include "src/objects/data-handler.h"
 #include "src/runtime/runtime.h"
 #include "src/zone/zone-containers.h"
 

src/compiler/types.cc

@@ -309,6 +309,8 @@ Type::bitset BitsetType::Lub(i::Map* map) {
     case PROTOTYPE_INFO_TYPE:
     case TUPLE2_TYPE:
     case TUPLE3_TYPE:
+    case LOAD_HANDLER_TYPE:
+    case STORE_HANDLER_TYPE:
     case CONTEXT_EXTENSION_TYPE:
     case ASYNC_GENERATOR_REQUEST_TYPE:
     case CODE_DATA_CONTAINER_TYPE:

src/deoptimizer.cc

@@ -3677,6 +3677,8 @@ Handle<Object> TranslatedState::MaterializeCapturedObjectAt(
     case PROTOTYPE_INFO_TYPE:
     case TUPLE2_TYPE:
     case TUPLE3_TYPE:
+    case LOAD_HANDLER_TYPE:
+    case STORE_HANDLER_TYPE:
     case ASYNC_GENERATOR_REQUEST_TYPE:
     case WASM_MODULE_TYPE:
     case WASM_INSTANCE_TYPE:

src/factory-inl.h

@@ -29,6 +29,14 @@ ROOT_LIST(ROOT_ACCESSOR)
 STRUCT_LIST(STRUCT_MAP_ACCESSOR)
 #undef STRUCT_MAP_ACCESSOR
 
+#define DATA_HANDLER_MAP_ACCESSOR(NAME, Name, Size, name)                \
+  Handle<Map> Factory::name##_map() {                                    \
+    return Handle<Map>(bit_cast<Map**>(                                  \
+        &isolate()->heap()->roots_[Heap::k##Name##Size##MapRootIndex])); \
+  }
+DATA_HANDLER_LIST(DATA_HANDLER_MAP_ACCESSOR)
+#undef DATA_HANDLER_MAP_ACCESSOR
+
 #define STRING_ACCESSOR(name, str)                              \
   Handle<String> Factory::name() {                              \
     return Handle<String>(bit_cast<String**>(                   \

src/factory.cc

@@ -2766,6 +2766,27 @@ Handle<Map> Factory::ObjectLiteralMapFromCache(Handle<Context> native_context,
   return map;
 }
 
+Handle<LoadHandler> Factory::NewLoadHandler(int data_count) {
+  Handle<Map> map;
+  if (data_count == 1) {
+    map = load_handler1_map();
+  } else {
+    DCHECK_EQ(2, data_count);
+    map = load_handler2_map();
+  }
+  return New<LoadHandler>(map, OLD_SPACE);
+}
+
+Handle<StoreHandler> Factory::NewStoreHandler(int data_count) {
+  Handle<Map> map;
+  if (data_count == 1) {
+    map = store_handler1_map();
+  } else {
+    DCHECK_EQ(2, data_count);
+    map = store_handler2_map();
+  }
+  return New<StoreHandler>(map, OLD_SPACE);
+}
 
 void Factory::SetRegExpAtomData(Handle<JSRegExp> regexp,
                                 JSRegExp::Type type,

src/factory.h

@@ -7,8 +7,10 @@
 
 #include "src/feedback-vector.h"
 #include "src/globals.h"
+#include "src/ic/handler-configuration.h"
 #include "src/isolate.h"
 #include "src/messages.h"
+#include "src/objects/data-handler.h"
 #include "src/objects/descriptor-array.h"
 #include "src/objects/dictionary.h"
 #include "src/objects/js-array.h"
@@ -735,6 +737,11 @@ class V8_EXPORT_PRIVATE Factory final {
   STRUCT_LIST(STRUCT_MAP_ACCESSOR)
 #undef STRUCT_MAP_ACCESSOR
 
+#define DATA_HANDLER_MAP_ACCESSOR(NAME, Name, Size, name) \
+  inline Handle<Map> name##_map();
+  DATA_HANDLER_LIST(DATA_HANDLER_MAP_ACCESSOR)
+#undef DATA_HANDLER_MAP_ACCESSOR
+
 #define STRING_ACCESSOR(name, str) inline Handle<String> name();
   INTERNALIZED_STRING_LIST(STRING_ACCESSOR)
 #undef STRING_ACCESSOR
@@ -806,6 +813,9 @@ class V8_EXPORT_PRIVATE Factory final {
   Handle<Map> ObjectLiteralMapFromCache(Handle<Context> native_context,
                                         int number_of_properties);
 
+  Handle<LoadHandler> NewLoadHandler(int data_count);
+  Handle<StoreHandler> NewStoreHandler(int data_count);
+
   Handle<RegExpMatchInfo> NewRegExpMatchInfo();
 
   // Creates a new FixedArray that holds the data associated with the

src/heap/heap-inl.h

@@ -52,6 +52,13 @@ ROOT_LIST(ROOT_ACCESSOR)
 STRUCT_LIST(STRUCT_MAP_ACCESSOR)
 #undef STRUCT_MAP_ACCESSOR
 
+#define DATA_HANDLER_MAP_ACCESSOR(NAME, Name, Size, name)  \
+  Map* Heap::name##_map() {                                \
+    return Map::cast(roots_[k##Name##Size##MapRootIndex]); \
+  }
+DATA_HANDLER_LIST(DATA_HANDLER_MAP_ACCESSOR)
+#undef DATA_HANDLER_MAP_ACCESSOR
+
 #define STRING_ACCESSOR(name, str) \
   String* Heap::name() { return String::cast(roots_[k##name##RootIndex]); }
 INTERNALIZED_STRING_LIST(STRING_ACCESSOR)

src/heap/heap.cc

@@ -46,7 +46,7 @@
 #include "src/heap/stress-marking-observer.h"
 #include "src/heap/sweeper.h"
 #include "src/interpreter/interpreter.h"
-#include "src/objects/object-macros.h"
+#include "src/objects/data-handler.h"
 #include "src/objects/shared-function-info.h"
 #include "src/regexp/jsregexp.h"
 #include "src/runtime-profiler.h"
@@ -61,6 +61,9 @@
 #include "src/v8.h"
 #include "src/vm-state-inl.h"
 
+// Has to be the last include (doesn't have include guards):
+#include "src/objects/object-macros.h"
+
 namespace v8 {
 namespace internal {
 

src/heap/heap.h

@@ -561,42 +561,48 @@ class HistogramInfo : public NumberAndSizeInfo {
 class Heap {
  public:
   // Declare all the root indices.  This defines the root list order.
+  // clang-format off
   enum RootListIndex {
-#define ROOT_INDEX_DECLARATION(type, name, camel_name) k##camel_name##RootIndex,
-    STRONG_ROOT_LIST(ROOT_INDEX_DECLARATION)
-#undef ROOT_INDEX_DECLARATION
-
-#define STRING_INDEX_DECLARATION(name, str) k##name##RootIndex,
-        INTERNALIZED_STRING_LIST(STRING_INDEX_DECLARATION)
-#undef STRING_DECLARATION
-
-#define SYMBOL_INDEX_DECLARATION(name) k##name##RootIndex,
-            PRIVATE_SYMBOL_LIST(SYMBOL_INDEX_DECLARATION)
-#undef SYMBOL_INDEX_DECLARATION
-
-#define SYMBOL_INDEX_DECLARATION(name, description) k##name##RootIndex,
-                PUBLIC_SYMBOL_LIST(SYMBOL_INDEX_DECLARATION)
-                    WELL_KNOWN_SYMBOL_LIST(SYMBOL_INDEX_DECLARATION)
-#undef SYMBOL_INDEX_DECLARATION
-
-#define ACCESSOR_INDEX_DECLARATION(accessor_name, AccessorName) \
-  k##AccessorName##AccessorRootIndex,
-                        ACCESSOR_INFO_LIST(ACCESSOR_INDEX_DECLARATION)
-#undef ACCESSOR_INDEX_DECLARATION
-
-// Utility type maps
-#define DECLARE_STRUCT_MAP(NAME, Name, name) k##Name##MapRootIndex,
-                            STRUCT_LIST(DECLARE_STRUCT_MAP)
-#undef DECLARE_STRUCT_MAP
-                                kStringTableRootIndex,
-
-#define ROOT_INDEX_DECLARATION(type, name, camel_name) k##camel_name##RootIndex,
-    SMI_ROOT_LIST(ROOT_INDEX_DECLARATION)
-#undef ROOT_INDEX_DECLARATION
-        kRootListLength,
+#define DECL(type, name, camel_name) k##camel_name##RootIndex,
+    STRONG_ROOT_LIST(DECL)
+#undef DECL
+
+#define DECL(name, str) k##name##RootIndex,
+    INTERNALIZED_STRING_LIST(DECL)
+#undef DECL
+
+#define DECL(name) k##name##RootIndex,
+    PRIVATE_SYMBOL_LIST(DECL)
+#undef DECL
+
+#define DECL(name, description) k##name##RootIndex,
+    PUBLIC_SYMBOL_LIST(DECL)
+    WELL_KNOWN_SYMBOL_LIST(DECL)
+#undef DECL
+
+#define DECL(accessor_name, AccessorName) k##AccessorName##AccessorRootIndex,
+    ACCESSOR_INFO_LIST(DECL)
+#undef DECL
+
+#define DECL(NAME, Name, name) k##Name##MapRootIndex,
+    STRUCT_LIST(DECL)
+#undef DECL
+
+#define DECL(NAME, Name, Size, name) k##Name##Size##MapRootIndex,
+    DATA_HANDLER_LIST(DECL)
+#undef DECL
+
+    kStringTableRootIndex,
+
+#define DECL(type, name, camel_name) k##camel_name##RootIndex,
+    SMI_ROOT_LIST(DECL)
+#undef DECL
+
+    kRootListLength,
     kStrongRootListLength = kStringTableRootIndex,
     kSmiRootsStart = kStringTableRootIndex + 1
   };
+  // clang-format on
 
   enum FindMementoMode { kForRuntime, kForGC };
 
@@ -1047,6 +1053,11 @@ class Heap {
   STRUCT_LIST(STRUCT_MAP_ACCESSOR)
 #undef STRUCT_MAP_ACCESSOR
 
+#define DATA_HANDLER_MAP_ACCESSOR(NAME, Name, Size, name) \
+  inline Map* name##_map();
+  DATA_HANDLER_LIST(DATA_HANDLER_MAP_ACCESSOR)
+#undef DATA_HANDLER_MAP_ACCESSOR
+
 #define STRING_ACCESSOR(name, str) inline String* name();
   INTERNALIZED_STRING_LIST(STRING_ACCESSOR)
 #undef STRING_ACCESSOR

src/heap/setup-heap-internal.cc

@@ -17,6 +17,7 @@
 #include "src/lookup-cache.h"
 #include "src/objects-inl.h"
 #include "src/objects/arguments.h"
+#include "src/objects/data-handler.h"
 #include "src/objects/debug-objects.h"
 #include "src/objects/descriptor-array.h"
 #include "src/objects/dictionary.h"
@@ -69,6 +70,11 @@ const Heap::StructTable Heap::struct_table[] = {
   {NAME##_TYPE, Name::kSize, k##Name##MapRootIndex},
     STRUCT_LIST(STRUCT_TABLE_ELEMENT)
 #undef STRUCT_TABLE_ELEMENT
+
+#define DATA_HANDLER_ELEMENT(NAME, Name, Size, name) \
+  {NAME##_TYPE, Name::kSizeWithData##Size, k##Name##Size##MapRootIndex},
+        DATA_HANDLER_LIST(DATA_HANDLER_ELEMENT)
+#undef DATA_HANDLER_ELEMENT
 };
 
 namespace {

src/ic/handler-configuration-inl.h

@@ -9,10 +9,17 @@
 
 #include "src/field-index-inl.h"
 #include "src/objects-inl.h"
+#include "src/objects/data-handler-inl.h"
+
+// Has to be the last include (doesn't have include guards):
+#include "src/objects/object-macros.h"
 
 namespace v8 {
 namespace internal {
 
+TYPE_CHECKER(LoadHandler, LOAD_HANDLER_TYPE)
+CAST_ACCESSOR(LoadHandler)
+
 // Decodes kind from Smi-handler.
 LoadHandler::Kind LoadHandler::GetHandlerKind(Smi* smi_handler) {
   return KindBits::decode(smi_handler->value());
@@ -125,6 +132,9 @@ Handle<Smi> LoadHandler::LoadIndexedString(Isolate* isolate,
   return handle(Smi::FromInt(config), isolate);
 }
 
+TYPE_CHECKER(StoreHandler, STORE_HANDLER_TYPE)
+CAST_ACCESSOR(StoreHandler)
+
 Handle<Smi> StoreHandler::StoreGlobalProxy(Isolate* isolate) {
   int config = KindBits::encode(kGlobalProxy);
   return handle(Smi::FromInt(config), isolate);
@@ -251,4 +261,6 @@ bool StoreHandler::IsHandler(Object* maybe_handler) {
 }  // namespace internal
 }  // namespace v8
 
+#include "src/objects/object-macros-undef.h"
+
 #endif  // V8_IC_HANDLER_CONFIGURATION_INL_H_

src/ic/handler-configuration.h

@@ -9,14 +9,25 @@
 #include "src/field-index.h"
 #include "src/globals.h"
 #include "src/objects.h"
+#include "src/objects/data-handler.h"
 #include "src/utils.h"
 
+// Has to be the last include (doesn't have include guards):
+#include "src/objects/object-macros.h"
+
 namespace v8 {
 namespace internal {
 
-// A set of bit fields representing Smi handlers for loads.
-class LoadHandler {
+// A set of bit fields representing Smi handlers for loads and a HeapObject
+// that represents load handlers that can't be encoded in a Smi.
+// TODO(ishell): move to load-handler.h
+class LoadHandler final : public DataHandler {
  public:
+  DECL_CAST(LoadHandler)
+
+  DECL_PRINTER(LoadHandler)
+  DECL_VERIFIER(LoadHandler)
+
   enum Kind {
     kElement,
     kIndexedString,
@@ -190,9 +201,16 @@ class LoadHandler {
                                                    Handle<Smi> smi_handler);
 };
 
-// A set of bit fields representing Smi handlers for stores.
-class StoreHandler {
+// A set of bit fields representing Smi handlers for stores and a HeapObject
+// that represents store handlers that can't be encoded in a Smi.
+// TODO(ishell): move to store-handler.h
+class StoreHandler final : public DataHandler {
  public:
+  DECL_CAST(StoreHandler)
+
+  DECL_PRINTER(StoreHandler)
+  DECL_VERIFIER(StoreHandler)
+
   enum Kind {
     kElement,
     kField,
@@ -342,4 +360,6 @@ class StoreHandler {
 }  // namespace internal
 }  // namespace v8
 
+#include "src/objects/object-macros-undef.h"
+
 #endif  // V8_IC_HANDLER_CONFIGURATION_H_

src/objects-body-descriptors-inl.h

@@ -564,6 +564,9 @@ ReturnType BodyDescriptorApply(InstanceType type, T1 p1, T2 p2, T3 p3) {
       } else {
         return Op::template apply<StructBodyDescriptor>(p1, p2, p3);
       }
+    case LOAD_HANDLER_TYPE:
+    case STORE_HANDLER_TYPE:
+      return Op::template apply<StructBodyDescriptor>(p1, p2, p3);
     default:
       PrintF("Unknown type: %d\n", type);
       UNREACHABLE();

src/objects-debug.cc

@@ -14,6 +14,7 @@
 #include "src/macro-assembler.h"
 #include "src/objects-inl.h"
 #include "src/objects/bigint.h"
+#include "src/objects/data-handler-inl.h"
 #include "src/objects/debug-objects-inl.h"
 #include "src/objects/literal-objects.h"
 #include "src/objects/module.h"
@@ -252,6 +253,14 @@ void HeapObject::HeapObjectVerify() {
     STRUCT_LIST(MAKE_STRUCT_CASE)
 #undef MAKE_STRUCT_CASE
 
+    case LOAD_HANDLER_TYPE:
+      LoadHandler::cast(this)->LoadHandlerVerify();
+      break;
+
+    case STORE_HANDLER_TYPE:
+      StoreHandler::cast(this)->StoreHandlerVerify();
+      break;
+
     default:
       UNREACHABLE();
       break;
@@ -1303,7 +1312,7 @@ void PrototypeInfo::PrototypeInfoVerify() {
   } else {
     CHECK(prototype_users()->IsSmi());
   }
-  CHECK(validity_cell()->IsCell() || validity_cell()->IsSmi());
+  CHECK(validity_cell()->IsSmi() || validity_cell()->IsCell());
 }
 
 void Tuple2::Tuple2Verify() {
@@ -1325,6 +1334,27 @@ void Tuple3::Tuple3Verify() {
   VerifyObjectField(kValue3Offset);
 }
 
+void DataHandler::DataHandlerVerify() {
+  CHECK(IsDataHandler());
+  CHECK_IMPLIES(!smi_handler()->IsSmi(),
+                smi_handler()->IsCode() && IsStoreHandler());
+  CHECK(validity_cell()->IsSmi() || validity_cell()->IsCell());
+  VerifyObjectField(kData1Offset);
+  if (map()->instance_size() >= kSizeWithData2) {
+    VerifyObjectField(kData2Offset);
+  }
+}
+
+void LoadHandler::LoadHandlerVerify() {
+  DataHandler::DataHandlerVerify();
+  // TODO(ishell): check handler integrity
+}
+
+void StoreHandler::StoreHandlerVerify() {
+  DataHandler::DataHandlerVerify();
+  // TODO(ishell): check handler integrity
+}
+
 void ContextExtension::ContextExtensionVerify() {
   CHECK(IsContextExtension());
   VerifyObjectField(kScopeInfoOffset);

src/objects-inl.h

@@ -34,6 +34,7 @@
 #include "src/objects.h"
 #include "src/objects/arguments-inl.h"
 #include "src/objects/bigint.h"
+#include "src/objects/data-handler-inl.h"
 #include "src/objects/fixed-array-inl.h"
 #include "src/objects/hash-table-inl.h"
 #include "src/objects/hash-table.h"

src/objects-printer.cc

@@ -241,6 +241,14 @@ void HeapObject::HeapObjectPrint(std::ostream& os) {  // NOLINT
   STRUCT_LIST(MAKE_STRUCT_CASE)
 #undef MAKE_STRUCT_CASE
 
+    case LOAD_HANDLER_TYPE:
+      LoadHandler::cast(this)->LoadHandlerPrint(os);
+      break;
+
+    case STORE_HANDLER_TYPE:
+      StoreHandler::cast(this)->StoreHandlerPrint(os);
+      break;
+
     default:
       os << "UNKNOWN TYPE " << map()->instance_type();
       UNREACHABLE();
@@ -1439,6 +1447,30 @@ void Tuple3::Tuple3Print(std::ostream& os) {  // NOLINT
   os << "\n";
 }
 
+void LoadHandler::LoadHandlerPrint(std::ostream& os) {  // NOLINT
+  HeapObject::PrintHeader(os, "LoadHandler");
+  // TODO(ishell): implement printing based on handler kind
+  os << "\n - handler: " << Brief(smi_handler());
+  os << "\n - validity_cell: " << Brief(validity_cell());
+  os << "\n - data1: " << Brief(data1());
+  if (map()->instance_size() >= kSizeWithData2) {
+    os << "\n - data2: " << Brief(data2());
+  }
+  os << "\n";
+}
+
+void StoreHandler::StoreHandlerPrint(std::ostream& os) {  // NOLINT
+  HeapObject::PrintHeader(os, "StoreHandler");
+  // TODO(ishell): implement printing based on handler kind
+  os << "\n - handler: " << Brief(smi_handler());
+  os << "\n - validity_cell: " << Brief(validity_cell());
+  os << "\n - data1: " << Brief(data1());
+  if (map()->instance_size() >= kSizeWithData2) {
+    os << "\n - data2: " << Brief(data2());
+  }
+  os << "\n";
+}
+
 void ContextExtension::ContextExtensionPrint(std::ostream& os) {  // NOLINT
   HeapObject::PrintHeader(os, "ContextExtension");
   os << "\n - scope_info: " << Brief(scope_info());

src/objects.cc

@@ -3284,7 +3284,10 @@ VisitorId Map::GetVisitorId(Map* map) {
       if (instance_type == ALLOCATION_SITE_TYPE) {
         return kVisitAllocationSite;
       }
+      return kVisitStruct;
 
+    case LOAD_HANDLER_TYPE:
+    case STORE_HANDLER_TYPE:
       return kVisitStruct;
 
     default:

src/objects.h

@@ -370,6 +370,8 @@ const int kStubMinorKeyBits = kSmiValueSize - kStubMajorKeyBits - 1;
   V(MODULE_TYPE)                                                \
   V(MODULE_INFO_ENTRY_TYPE)                                     \
   V(ASYNC_GENERATOR_REQUEST_TYPE)                               \
+  V(LOAD_HANDLER_TYPE)                                          \
+  V(STORE_HANDLER_TYPE)                                         \
   V(FIXED_ARRAY_TYPE)                                           \
   V(HASH_TABLE_TYPE)                                            \
   V(DESCRIPTOR_ARRAY_TYPE)                                      \
@@ -555,6 +557,12 @@ const int kStubMinorKeyBits = kSmiValueSize - kStubMajorKeyBits - 1;
   V(MODULE_INFO_ENTRY, ModuleInfoEntry, module_info_entry)                   \
   V(ASYNC_GENERATOR_REQUEST, AsyncGeneratorRequest, async_generator_request)
 
+#define DATA_HANDLER_LIST(V)                        \
+  V(LOAD_HANDLER, LoadHandler, 1, load_handler1)    \
+  V(LOAD_HANDLER, LoadHandler, 2, load_handler2)    \
+  V(STORE_HANDLER, StoreHandler, 1, store_handler1) \
+  V(STORE_HANDLER, StoreHandler, 2, store_handler2)
+
 // We use the full 16 bits of the instance_type field to encode heap object
 // instance types. All the high-order bits (bit 7-15) are cleared if the object
 // is a string, and contain set bits if it is not a string.
@@ -725,6 +733,8 @@ enum InstanceType : uint16_t {
   MODULE_TYPE,
   MODULE_INFO_ENTRY_TYPE,
   ASYNC_GENERATOR_REQUEST_TYPE,
+  LOAD_HANDLER_TYPE,
+  STORE_HANDLER_TYPE,
   FIXED_ARRAY_TYPE,  // FIRST_FIXED_ARRAY_TYPE
   HASH_TABLE_TYPE,
   DESCRIPTOR_ARRAY_TYPE,
@@ -945,6 +955,7 @@ template <class C> inline bool Is(Object* obj);
   V(Constructor)                          \
   V(Context)                              \
   V(CoverageInfo)                         \
+  V(DataHandler)                          \
   V(DeoptimizationData)                   \
   V(DependentCode)                        \
   V(DescriptorArray)                      \
@@ -1013,6 +1024,7 @@ template <class C> inline bool Is(Object* obj);
   V(JSWeakCollection)                     \
   V(JSWeakMap)                            \
   V(JSWeakSet)                            \
+  V(LoadHandler)                          \
   V(Map)                                  \
   V(MapCache)                             \
   V(ModuleInfo)                           \
@@ -1044,6 +1056,7 @@ template <class C> inline bool Is(Object* obj);
   V(SmallOrderedHashMap)                  \
   V(SmallOrderedHashSet)                  \
   V(SourcePositionTableWithFrameCache)    \
+  V(StoreHandler)                         \
   V(String)                               \
   V(StringSet)                            \
   V(StringTable)                          \

src/objects/data-handler-inl.h

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_DATA_HANDLER_INL_H_
+#define V8_DATA_HANDLER_INL_H_
+
+#include "src/objects/data-handler.h"
+
+// Has to be the last include (doesn't have include guards):
+#include "src/objects/object-macros.h"
+
+namespace v8 {
+namespace internal {
+
+bool HeapObject::IsDataHandler() const {
+  return IsLoadHandler() || IsStoreHandler();
+}
+
+CAST_ACCESSOR(DataHandler)
+
+ACCESSORS(DataHandler, smi_handler, Object, kSmiHandlerOffset)
+ACCESSORS(DataHandler, validity_cell, Object, kValidityCellOffset)
+
+ACCESSORS(DataHandler, data1, Object, kData1Offset)
+ACCESSORS_CHECKED(DataHandler, data2, Object, kData2Offset,
+                  map()->instance_size() >= kSizeWithData2)
+
+}  // namespace internal
+}  // namespace v8
+
+#include "src/objects/object-macros-undef.h"
+
+#endif  // V8_DATA_HANDLER_INL_H_

src/objects/data-handler.h

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_DATA_HANDLER_H_
+#define V8_DATA_HANDLER_H_
+
+#include "src/objects.h"
+
+// Has to be the last include (doesn't have include guards):
+#include "src/objects/object-macros.h"
+
+namespace v8 {
+namespace internal {
+
+// DataHandler is a base class for load and store handlers that can't be
+// encoded in one Smi. Kind of a handler can be deduced from instance type.
+class DataHandler : public Struct {
+ public:
+  // [smi_handler]: A Smi which encodes a handler or Code object (we still
+  // use code handlers for accessing lexical environment variables, but soon
+  // only smi handlers will remain). See LoadHandler and StoreHandler for
+  // details about encoding.
+  DECL_ACCESSORS(smi_handler, Object)
+
+  // [validity_cell]: A validity Cell that guards prototype chain modifications.
+  DECL_ACCESSORS(validity_cell, Object)
+
+  // [data1,2]: These are optional general-purpose fields whose content and
+  // presence depends on the handler kind.
+  DECL_ACCESSORS(data1, Object)
+  DECL_ACCESSORS(data2, Object)
+
+// Layout description.
+#define DATA_HANDLER_FIELDS(V)         \
+  V(kSmiHandlerOffset, kPointerSize)   \
+  V(kValidityCellOffset, kPointerSize) \
+  V(kData1Offset, kPointerSize)        \
+  V(kSizeWithData1, 0)                 \
+  V(kData2Offset, kPointerSize)        \
+  V(kSizeWithData2, 0)
+
+  DEFINE_FIELD_OFFSET_CONSTANTS(HeapObject::kHeaderSize, DATA_HANDLER_FIELDS)
+#undef DATA_HANDLER_FIELDS
+
+  DECL_CAST(DataHandler)
+
+  DECL_VERIFIER(DataHandler)
+};
+
+}  // namespace internal
+}  // namespace v8
+
+#include "src/objects/object-macros-undef.h"
+
+#endif  // V8_DATA_HANDLER_H_

src/profiler/heap-snapshot-generator.cc

@@ -1907,6 +1907,9 @@ const char* V8HeapExplorer::GetStrongGcSubrootName(Object* object) {
 #define STRUCT_MAP_NAME(NAME, Name, name) NAME_ENTRY(name##_map)
     STRUCT_LIST(STRUCT_MAP_NAME)
 #undef STRUCT_MAP_NAME
+#define DATA_HANDLER_MAP_NAME(NAME, Name, Size, name) NAME_ENTRY(name##_map)
+    DATA_HANDLER_LIST(DATA_HANDLER_MAP_NAME)
+#undef DATA_HANDLER_MAP_NAME
 #define STRING_NAME(name, str) NAME_ENTRY(name)
     INTERNALIZED_STRING_LIST(STRING_NAME)
 #undef STRING_NAME

src/v8.gyp

@@ -1162,6 +1162,8 @@
         'objects/code.h',
         'objects/compilation-cache.h',
         'objects/compilation-cache-inl.h',
+        'objects/data-handler.h',
+        'objects/data-handler-inl.h',
         'objects/debug-objects-inl.h',
         'objects/debug-objects.cc',
         'objects/debug-objects.h',

tools/v8heapconst.py

@@ -72,92 +72,94 @@ INSTANCE_TYPES = {
   168: "MODULE_TYPE",
   169: "MODULE_INFO_ENTRY_TYPE",
   170: "ASYNC_GENERATOR_REQUEST_TYPE",
-  171: "FIXED_ARRAY_TYPE",
-  172: "HASH_TABLE_TYPE",
-  173: "DESCRIPTOR_ARRAY_TYPE",
-  174: "TRANSITION_ARRAY_TYPE",
-  175: "FEEDBACK_VECTOR_TYPE",
-  176: "PROPERTY_ARRAY_TYPE",
-  177: "SHARED_FUNCTION_INFO_TYPE",
-  178: "CELL_TYPE",
-  179: "WEAK_CELL_TYPE",
-  180: "PROPERTY_CELL_TYPE",
-  181: "SMALL_ORDERED_HASH_MAP_TYPE",
-  182: "SMALL_ORDERED_HASH_SET_TYPE",
-  183: "CODE_DATA_CONTAINER_TYPE",
-  184: "JS_PROXY_TYPE",
-  185: "JS_GLOBAL_OBJECT_TYPE",
-  186: "JS_GLOBAL_PROXY_TYPE",
-  187: "JS_MODULE_NAMESPACE_TYPE",
-  188: "JS_SPECIAL_API_OBJECT_TYPE",
-  189: "JS_VALUE_TYPE",
-  190: "JS_MESSAGE_OBJECT_TYPE",
-  191: "JS_DATE_TYPE",
-  192: "JS_API_OBJECT_TYPE",
-  193: "JS_OBJECT_TYPE",
-  194: "JS_ARGUMENTS_TYPE",
-  195: "JS_CONTEXT_EXTENSION_OBJECT_TYPE",
-  196: "JS_GENERATOR_OBJECT_TYPE",
-  197: "JS_ASYNC_GENERATOR_OBJECT_TYPE",
-  198: "JS_ARRAY_TYPE",
-  199: "JS_ARRAY_BUFFER_TYPE",
-  200: "JS_TYPED_ARRAY_TYPE",
-  201: "JS_DATA_VIEW_TYPE",
-  202: "JS_SET_TYPE",
-  203: "JS_MAP_TYPE",
-  204: "JS_SET_KEY_VALUE_ITERATOR_TYPE",
-  205: "JS_SET_VALUE_ITERATOR_TYPE",
-  206: "JS_MAP_KEY_ITERATOR_TYPE",
-  207: "JS_MAP_KEY_VALUE_ITERATOR_TYPE",
-  208: "JS_MAP_VALUE_ITERATOR_TYPE",
-  209: "JS_WEAK_MAP_TYPE",
-  210: "JS_WEAK_SET_TYPE",
-  211: "JS_PROMISE_TYPE",
-  212: "JS_REGEXP_TYPE",
-  213: "JS_ERROR_TYPE",
-  214: "JS_ASYNC_FROM_SYNC_ITERATOR_TYPE",
-  215: "JS_STRING_ITERATOR_TYPE",
-  216: "JS_TYPED_ARRAY_KEY_ITERATOR_TYPE",
-  217: "JS_FAST_ARRAY_KEY_ITERATOR_TYPE",
-  218: "JS_GENERIC_ARRAY_KEY_ITERATOR_TYPE",
-  219: "JS_UINT8_ARRAY_KEY_VALUE_ITERATOR_TYPE",
-  220: "JS_INT8_ARRAY_KEY_VALUE_ITERATOR_TYPE",
-  221: "JS_UINT16_ARRAY_KEY_VALUE_ITERATOR_TYPE",
-  222: "JS_INT16_ARRAY_KEY_VALUE_ITERATOR_TYPE",
-  223: "JS_UINT32_ARRAY_KEY_VALUE_ITERATOR_TYPE",
-  224: "JS_INT32_ARRAY_KEY_VALUE_ITERATOR_TYPE",
-  225: "JS_FLOAT32_ARRAY_KEY_VALUE_ITERATOR_TYPE",
-  226: "JS_FLOAT64_ARRAY_KEY_VALUE_ITERATOR_TYPE",
-  227: "JS_UINT8_CLAMPED_ARRAY_KEY_VALUE_ITERATOR_TYPE",
-  228: "JS_FAST_SMI_ARRAY_KEY_VALUE_ITERATOR_TYPE",
-  229: "JS_FAST_HOLEY_SMI_ARRAY_KEY_VALUE_ITERATOR_TYPE",
-  230: "JS_FAST_ARRAY_KEY_VALUE_ITERATOR_TYPE",
-  231: "JS_FAST_HOLEY_ARRAY_KEY_VALUE_ITERATOR_TYPE",
-  232: "JS_FAST_DOUBLE_ARRAY_KEY_VALUE_ITERATOR_TYPE",
-  233: "JS_FAST_HOLEY_DOUBLE_ARRAY_KEY_VALUE_ITERATOR_TYPE",
-  234: "JS_GENERIC_ARRAY_KEY_VALUE_ITERATOR_TYPE",
-  235: "JS_UINT8_ARRAY_VALUE_ITERATOR_TYPE",
-  236: "JS_INT8_ARRAY_VALUE_ITERATOR_TYPE",
-  237: "JS_UINT16_ARRAY_VALUE_ITERATOR_TYPE",
-  238: "JS_INT16_ARRAY_VALUE_ITERATOR_TYPE",
-  239: "JS_UINT32_ARRAY_VALUE_ITERATOR_TYPE",
-  240: "JS_INT32_ARRAY_VALUE_ITERATOR_TYPE",
-  241: "JS_FLOAT32_ARRAY_VALUE_ITERATOR_TYPE",
-  242: "JS_FLOAT64_ARRAY_VALUE_ITERATOR_TYPE",
-  243: "JS_UINT8_CLAMPED_ARRAY_VALUE_ITERATOR_TYPE",
-  244: "JS_FAST_SMI_ARRAY_VALUE_ITERATOR_TYPE",
-  245: "JS_FAST_HOLEY_SMI_ARRAY_VALUE_ITERATOR_TYPE",
-  246: "JS_FAST_ARRAY_VALUE_ITERATOR_TYPE",
-  247: "JS_FAST_HOLEY_ARRAY_VALUE_ITERATOR_TYPE",
-  248: "JS_FAST_DOUBLE_ARRAY_VALUE_ITERATOR_TYPE",
-  249: "JS_FAST_HOLEY_DOUBLE_ARRAY_VALUE_ITERATOR_TYPE",
-  250: "JS_GENERIC_ARRAY_VALUE_ITERATOR_TYPE",
-  251: "WASM_INSTANCE_TYPE",
-  252: "WASM_MEMORY_TYPE",
-  253: "WASM_MODULE_TYPE",
-  254: "WASM_TABLE_TYPE",
-  255: "JS_BOUND_FUNCTION_TYPE",
-  256: "JS_FUNCTION_TYPE",
+  171: "LOAD_HANDLER_TYPE",
+  172: "STORE_HANDLER_TYPE",
+  173: "FIXED_ARRAY_TYPE",
+  174: "HASH_TABLE_TYPE",
+  175: "DESCRIPTOR_ARRAY_TYPE",
+  176: "TRANSITION_ARRAY_TYPE",
+  177: "FEEDBACK_VECTOR_TYPE",
+  178: "PROPERTY_ARRAY_TYPE",
+  179: "SHARED_FUNCTION_INFO_TYPE",
+  180: "CELL_TYPE",
+  181: "WEAK_CELL_TYPE",
+  182: "PROPERTY_CELL_TYPE",
+  183: "SMALL_ORDERED_HASH_MAP_TYPE",
+  184: "SMALL_ORDERED_HASH_SET_TYPE",
+  185: "CODE_DATA_CONTAINER_TYPE",
+  186: "JS_PROXY_TYPE",
+  187: "JS_GLOBAL_OBJECT_TYPE",
+  188: "JS_GLOBAL_PROXY_TYPE",
+  189: "JS_MODULE_NAMESPACE_TYPE",
+  190: "JS_SPECIAL_API_OBJECT_TYPE",
+  191: "JS_VALUE_TYPE",
+  192: "JS_MESSAGE_OBJECT_TYPE",
+  193: "JS_DATE_TYPE",
+  194: "JS_API_OBJECT_TYPE",
+  195: "JS_OBJECT_TYPE",
+  196: "JS_ARGUMENTS_TYPE",
+  197: "JS_CONTEXT_EXTENSION_OBJECT_TYPE",
+  198: "JS_GENERATOR_OBJECT_TYPE",
+  199: "JS_ASYNC_GENERATOR_OBJECT_TYPE",
+  200: "JS_ARRAY_TYPE",
+  201: "JS_ARRAY_BUFFER_TYPE",
+  202: "JS_TYPED_ARRAY_TYPE",
+  203: "JS_DATA_VIEW_TYPE",
+  204: "JS_SET_TYPE",
+  205: "JS_MAP_TYPE",
+  206: "JS_SET_KEY_VALUE_ITERATOR_TYPE",
+  207: "JS_SET_VALUE_ITERATOR_TYPE",
+  208: "JS_MAP_KEY_ITERATOR_TYPE",
+  209: "JS_MAP_KEY_VALUE_ITERATOR_TYPE",
+  210: "JS_MAP_VALUE_ITERATOR_TYPE",
+  211: "JS_WEAK_MAP_TYPE",
+  212: "JS_WEAK_SET_TYPE",
+  213: "JS_PROMISE_TYPE",
+  214: "JS_REGEXP_TYPE",
+  215: "JS_ERROR_TYPE",
+  216: "JS_ASYNC_FROM_SYNC_ITERATOR_TYPE",
+  217: "JS_STRING_ITERATOR_TYPE",
+  218: "JS_TYPED_ARRAY_KEY_ITERATOR_TYPE",
+  219: "JS_FAST_ARRAY_KEY_ITERATOR_TYPE",
+  220: "JS_GENERIC_ARRAY_KEY_ITERATOR_TYPE",
+  221: "JS_UINT8_ARRAY_KEY_VALUE_ITERATOR_TYPE",
+  222: "JS_INT8_ARRAY_KEY_VALUE_ITERATOR_TYPE",
+  223: "JS_UINT16_ARRAY_KEY_VALUE_ITERATOR_TYPE",
+  224: "JS_INT16_ARRAY_KEY_VALUE_ITERATOR_TYPE",
+  225: "JS_UINT32_ARRAY_KEY_VALUE_ITERATOR_TYPE",
+  226: "JS_INT32_ARRAY_KEY_VALUE_ITERATOR_TYPE",
+  227: "JS_FLOAT32_ARRAY_KEY_VALUE_ITERATOR_TYPE",
+  228: "JS_FLOAT64_ARRAY_KEY_VALUE_ITERATOR_TYPE",
+  229: "JS_UINT8_CLAMPED_ARRAY_KEY_VALUE_ITERATOR_TYPE",
+  230: "JS_FAST_SMI_ARRAY_KEY_VALUE_ITERATOR_TYPE",
+  231: "JS_FAST_HOLEY_SMI_ARRAY_KEY_VALUE_ITERATOR_TYPE",
+  232: "JS_FAST_ARRAY_KEY_VALUE_ITERATOR_TYPE",
+  233: "JS_FAST_HOLEY_ARRAY_KEY_VALUE_ITERATOR_TYPE",
+  234: "JS_FAST_DOUBLE_ARRAY_KEY_VALUE_ITERATOR_TYPE",
+  235: "JS_FAST_HOLEY_DOUBLE_ARRAY_KEY_VALUE_ITERATOR_TYPE",
+  236: "JS_GENERIC_ARRAY_KEY_VALUE_ITERATOR_TYPE",
+  237: "JS_UINT8_ARRAY_VALUE_ITERATOR_TYPE",
+  238: "JS_INT8_ARRAY_VALUE_ITERATOR_TYPE",
+  239: "JS_UINT16_ARRAY_VALUE_ITERATOR_TYPE",
+  240: "JS_INT16_ARRAY_VALUE_ITERATOR_TYPE",
+  241: "JS_UINT32_ARRAY_VALUE_ITERATOR_TYPE",
+  242: "JS_INT32_ARRAY_VALUE_ITERATOR_TYPE",
+  243: "JS_FLOAT32_ARRAY_VALUE_ITERATOR_TYPE",
+  244: "JS_FLOAT64_ARRAY_VALUE_ITERATOR_TYPE",
+  245: "JS_UINT8_CLAMPED_ARRAY_VALUE_ITERATOR_TYPE",
+  246: "JS_FAST_SMI_ARRAY_VALUE_ITERATOR_TYPE",
+  247: "JS_FAST_HOLEY_SMI_ARRAY_VALUE_ITERATOR_TYPE",
+  248: "JS_FAST_ARRAY_VALUE_ITERATOR_TYPE",
+  249: "JS_FAST_HOLEY_ARRAY_VALUE_ITERATOR_TYPE",
+  250: "JS_FAST_DOUBLE_ARRAY_VALUE_ITERATOR_TYPE",
+  251: "JS_FAST_HOLEY_DOUBLE_ARRAY_VALUE_ITERATOR_TYPE",
+  252: "JS_GENERIC_ARRAY_VALUE_ITERATOR_TYPE",
+  253: "WASM_INSTANCE_TYPE",
+  254: "WASM_MEMORY_TYPE",
+  255: "WASM_MODULE_TYPE",
+  256: "WASM_TABLE_TYPE",
+  257: "JS_BOUND_FUNCTION_TYPE",
+  258: "JS_FUNCTION_TYPE",
 }
 
 # List of known V8 maps.
@@ -165,8 +167,8 @@ KNOWN_MAPS = {
   0x02201: (138, "FreeSpaceMap"),
   0x02251: (132, "MetaMap"),
   0x022a1: (131, "NullMap"),
-  0x022f1: (173, "DescriptorArrayMap"),
-  0x02341: (171, "FixedArrayMap"),
+  0x022f1: (175, "DescriptorArrayMap"),
+  0x02341: (173, "FixedArrayMap"),
   0x02391: (149, "OnePointerFillerMap"),
   0x023e1: (149, "TwoPointerFillerMap"),
   0x02431: (131, "UninitializedMap"),
@@ -176,55 +178,55 @@ KNOWN_MAPS = {
   0x02571: (131, "TheHoleMap"),
   0x025c1: (131, "BooleanMap"),
   0x02611: (136, "ByteArrayMap"),
-  0x02661: (171, "FixedCOWArrayMap"),
-  0x026b1: (172, "HashTableMap"),
+  0x02661: (173, "FixedCOWArrayMap"),
+  0x026b1: (174, "HashTableMap"),
   0x02701: (128, "SymbolMap"),
   0x02751: (72, "OneByteStringMap"),
-  0x027a1: (171, "ScopeInfoMap"),
-  0x027f1: (177, "SharedFunctionInfoMap"),
+  0x027a1: (173, "ScopeInfoMap"),
+  0x027f1: (179, "SharedFunctionInfoMap"),
   0x02841: (133, "CodeMap"),
-  0x02891: (171, "FunctionContextMap"),
-  0x028e1: (178, "CellMap"),
-  0x02931: (179, "WeakCellMap"),
-  0x02981: (180, "GlobalPropertyCellMap"),
+  0x02891: (173, "FunctionContextMap"),
+  0x028e1: (180, "CellMap"),
+  0x02931: (181, "WeakCellMap"),
+  0x02981: (182, "GlobalPropertyCellMap"),
   0x029d1: (135, "ForeignMap"),
-  0x02a21: (174, "TransitionArrayMap"),
-  0x02a71: (175, "FeedbackVectorMap"),
+  0x02a21: (176, "TransitionArrayMap"),
+  0x02a71: (177, "FeedbackVectorMap"),
   0x02ac1: (131, "ArgumentsMarkerMap"),
   0x02b11: (131, "ExceptionMap"),
   0x02b61: (131, "TerminationExceptionMap"),
   0x02bb1: (131, "OptimizedOutMap"),
   0x02c01: (131, "StaleRegisterMap"),
-  0x02c51: (171, "NativeContextMap"),
-  0x02ca1: (171, "ModuleContextMap"),
-  0x02cf1: (171, "EvalContextMap"),
-  0x02d41: (171, "ScriptContextMap"),
-  0x02d91: (171, "BlockContextMap"),
-  0x02de1: (171, "CatchContextMap"),
-  0x02e31: (171, "WithContextMap"),
-  0x02e81: (171, "DebugEvaluateContextMap"),
-  0x02ed1: (171, "ScriptContextTableMap"),
+  0x02c51: (173, "NativeContextMap"),
+  0x02ca1: (173, "ModuleContextMap"),
+  0x02cf1: (173, "EvalContextMap"),
+  0x02d41: (173, "ScriptContextMap"),
+  0x02d91: (173, "BlockContextMap"),
+  0x02de1: (173, "CatchContextMap"),
+  0x02e31: (173, "WithContextMap"),
+  0x02e81: (173, "DebugEvaluateContextMap"),
+  0x02ed1: (173, "ScriptContextTableMap"),
   0x02f21: (148, "FixedDoubleArrayMap"),
   0x02f71: (134, "MutableHeapNumberMap"),
-  0x02fc1: (172, "OrderedHashMapMap"),
-  0x03011: (172, "OrderedHashSetMap"),
-  0x03061: (172, "NameDictionaryMap"),
-  0x030b1: (172, "GlobalDictionaryMap"),
-  0x03101: (172, "NumberDictionaryMap"),
-  0x03151: (172, "StringTableMap"),
-  0x031a1: (172, "WeakHashTableMap"),
-  0x031f1: (171, "SloppyArgumentsElementsMap"),
-  0x03241: (181, "SmallOrderedHashMapMap"),
-  0x03291: (182, "SmallOrderedHashSetMap"),
-  0x032e1: (183, "CodeDataContainerMap"),
-  0x03331: (190, "JSMessageObjectMap"),
-  0x03381: (193, "ExternalMap"),
+  0x02fc1: (174, "OrderedHashMapMap"),
+  0x03011: (174, "OrderedHashSetMap"),
+  0x03061: (174, "NameDictionaryMap"),
+  0x030b1: (174, "GlobalDictionaryMap"),
+  0x03101: (174, "NumberDictionaryMap"),
+  0x03151: (174, "StringTableMap"),
+  0x031a1: (174, "WeakHashTableMap"),
+  0x031f1: (173, "SloppyArgumentsElementsMap"),
+  0x03241: (183, "SmallOrderedHashMapMap"),
+  0x03291: (184, "SmallOrderedHashSetMap"),
+  0x032e1: (185, "CodeDataContainerMap"),
+  0x03331: (192, "JSMessageObjectMap"),
+  0x03381: (195, "ExternalMap"),
   0x033d1: (137, "BytecodeArrayMap"),
-  0x03421: (171, "ModuleInfoMap"),
-  0x03471: (178, "NoClosuresCellMap"),
-  0x034c1: (178, "OneClosureCellMap"),
-  0x03511: (178, "ManyClosuresCellMap"),
-  0x03561: (176, "PropertyArrayMap"),
+  0x03421: (173, "ModuleInfoMap"),
+  0x03471: (180, "NoClosuresCellMap"),
+  0x034c1: (180, "OneClosureCellMap"),
+  0x03511: (180, "ManyClosuresCellMap"),
+  0x03561: (178, "PropertyArrayMap"),
   0x035b1: (130, "BigIntMap"),
   0x03601: (106, "NativeSourceStringMap"),
   0x03651: (64, "StringMap"),