Revert "Reland "[runtime] Add shortcuts for elements kinds transitions.""

This reverts commit 6e27386d.

Reason for revert: There will be another much simpler and
back-mergeable fix.

Original change's description:
> Reland "[runtime] Add shortcuts for elements kinds transitions."
> 
> This is a reland of b90e83f5
> Original change's description:
> > [runtime] Add shortcuts for elements kinds transitions.
> >
> > The shortcuts ensure that field type generalization is properly
> > propagated in the transition graph.
> >
> > Bug: chromium:738763
> > Change-Id: Id701a6f95ed6ea093c707fbe0bac228f1f856e9f
> > Reviewed-on: https://chromium-review.googlesource.com/567992
> > Commit-Queue: Igor Sheludko <ishell@chromium.org>
> > Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#46622}
> 
> Bug: chromium:738763, chromium:742346, chromium:742381, chromium:745844
> Change-Id: I93974e3906b2c7710bd525f15037a2dd97f263ad
> Reviewed-on: https://chromium-review.googlesource.com/575227
> Commit-Queue: Igor Sheludko <ishell@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#46759}

TBR=ulan@chromium.org,jkummerow@chromium.org,ishell@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: chromium:738763, chromium:742346, chromium:742381, chromium:745844
Change-Id: I203dc748c47db554e0a86d61f0e2b7b8b96f2370
Reviewed-on: https://chromium-review.googlesource.com/581547
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46826}

src/heap-symbols.h

@@ -217,7 +217,6 @@
   V(class_start_position_symbol)            \
   V(detailed_stack_trace_symbol)            \
   V(elements_transition_symbol)             \
-  V(elements_transition_shortcut_symbol)    \
   V(error_end_pos_symbol)                   \
   V(error_script_symbol)                    \
   V(error_start_pos_symbol)                 \

src/heap/mark-compact.cc

@@ -2924,22 +2924,6 @@ void MarkCompactCollector::ClearSimpleMapTransition(Map* map,
   }
 }
 
-namespace {
-
-Map* GetTransitionArrayOwnerMap(Heap* heap, TransitionArray* transitions,
-                                int num_transitions) {
-  // Search for any non-shortcut transition.
-  for (int i = 0; i < num_transitions; i++) {
-    Name* key = transitions->GetKey(i);
-    if (TransitionArray::IsShortcutTransition(key)) continue;
-    Map* target = transitions->GetTarget(i);
-    Map* parent = Map::cast(target->constructor_or_backpointer());
-    return parent;
-  }
-  return nullptr;
-}
-
-}  // namespace
 
 void MarkCompactCollector::ClearFullMapTransitions() {
   HeapObject* undefined = heap()->undefined_value();
@@ -2949,20 +2933,16 @@ void MarkCompactCollector::ClearFullMapTransitions() {
     int num_transitions = array->number_of_entries();
     DCHECK_EQ(TransitionArray::NumberOfTransitions(array), num_transitions);
     if (num_transitions > 0) {
-      Map* parent = GetTransitionArrayOwnerMap(heap(), array, num_transitions);
-      if (!parent) {
-        // The transition array contains only shortcut transitions.
-        CompactTransitionArray(parent, array, nullptr);
-      } else {
-        bool parent_is_alive = ObjectMarking::IsBlackOrGrey(
-            parent, MarkingState::Internal(parent));
-        DescriptorArray* descriptors =
-            parent_is_alive ? parent->instance_descriptors() : nullptr;
-        bool descriptors_owner_died =
-            CompactTransitionArray(parent, array, descriptors);
-        if (descriptors_owner_died) {
-          TrimDescriptorArray(parent, descriptors);
-        }
+      Map* map = array->GetTarget(0);
+      Map* parent = Map::cast(map->constructor_or_backpointer());
+      bool parent_is_alive =
+          ObjectMarking::IsBlackOrGrey(parent, MarkingState::Internal(parent));
+      DescriptorArray* descriptors =
+          parent_is_alive ? parent->instance_descriptors() : nullptr;
+      bool descriptors_owner_died =
+          CompactTransitionArray(parent, array, descriptors);
+      if (descriptors_owner_died) {
+        TrimDescriptorArray(parent, descriptors);
       }
     }
     obj = array->next_link();
@@ -2971,41 +2951,6 @@ void MarkCompactCollector::ClearFullMapTransitions() {
   heap()->set_encountered_transition_arrays(Smi::kZero);
 }
 
-namespace {
-
-// Returns true if the target is live and the transition entry should be kept
-// in the transition array. In addition, if current transition entry is a dead
-// shortcut transition this function tries to fixup the entry to make it point
-// to the next live target in a shortcut chain.
-bool FixupDeadTransition(bool is_shortcut_transition, Name* key, Map* target,
-                         TransitionArray* transitions, int transition_index) {
-  if (!ObjectMarking::IsWhite(target, MarkingState::Internal(target))) {
-    return true;
-  }
-  if (!is_shortcut_transition) {
-    // Target map is dead.
-    return false;
-  }
-
-  Symbol* symbol = Symbol::cast(key);
-  // Follow the shortcut transition chain in order to find live target.
-  for (;;) {
-    target = TransitionArray::SearchSpecial(target, symbol);
-    if (target == nullptr ||
-        !ObjectMarking::IsWhite(target, MarkingState::Internal(target))) {
-      break;
-    }
-  }
-  if (target) {
-    // Found live target in shortcuts chain, now fixup the transitions array.
-    // Target slots do not need to be recorded since maps are not compacted.
-    transitions->SetTarget(transition_index, target);
-    return true;
-  }
-  return false;
-}
-
-}  // namespace
 
 bool MarkCompactCollector::CompactTransitionArray(
     Map* map, TransitionArray* transitions, DescriptorArray* descriptors) {
@@ -3014,24 +2959,16 @@ bool MarkCompactCollector::CompactTransitionArray(
   int transition_index = 0;
   // Compact all live transitions to the left.
   for (int i = 0; i < num_transitions; ++i) {
-    Name* key;
-    Map* target;
-    std::tie(key, target) = TransitionArray::GetKeyAndTarget(transitions, i);
-    bool is_shortcut_transition =
-        TransitionArray::IsShortcutTransition(heap(), key);
-
-    DCHECK_IMPLIES(!is_shortcut_transition,
-                   target->constructor_or_backpointer() == map);
-
-    bool is_live_transition = FixupDeadTransition(is_shortcut_transition, key,
-                                                  target, transitions, i);
-    if (!is_live_transition) {
-      if (!is_shortcut_transition && descriptors != nullptr &&
+    Map* target = transitions->GetTarget(i);
+    DCHECK_EQ(target->constructor_or_backpointer(), map);
+    if (ObjectMarking::IsWhite(target, MarkingState::Internal(target))) {
+      if (descriptors != nullptr &&
           target->instance_descriptors() == descriptors) {
         descriptors_owner_died = true;
       }
     } else {
       if (i != transition_index) {
+        Name* key = transitions->GetKey(i);
         transitions->SetKey(transition_index, key);
         Object** key_slot = transitions->GetKeySlot(transition_index);
         RecordSlot(transitions, key_slot, key);

src/ic/ic.cc

@@ -1439,7 +1439,7 @@ void KeyedLoadIC::LoadElementPolymorphicHandlers(
     if (receiver_map->is_stable()) {
       Map* tmap = receiver_map->FindElementsKindTransitionedMap(*receiver_maps);
       if (tmap != nullptr) {
-        Map::RegisterElementsKindTransitionShortcut(receiver_map, handle(tmap));
+        receiver_map->NotifyLeafMapLayoutChange();
       }
     }
     handlers->Add(LoadElementHandler(receiver_map));
@@ -2130,9 +2130,10 @@ void KeyedStoreIC::StoreElementPolymorphicHandlers(
         Map* tmap =
             receiver_map->FindElementsKindTransitionedMap(*receiver_maps);
         if (tmap != nullptr) {
+          if (receiver_map->is_stable()) {
+            receiver_map->NotifyLeafMapLayoutChange();
+          }
           transitioned_map = handle(tmap);
-          Map::RegisterElementsKindTransitionShortcut(receiver_map,
-                                                      transitioned_map);
         }
       }
 

src/map-updater.cc

@@ -617,7 +617,7 @@ MapUpdater::State MapUpdater::ConstructNewMap() {
       *split_map, split_details.kind(), GetKey(split_nof),
       split_details.attributes());
   if (maybe_transition != NULL) {
-    maybe_transition->DeprecateTransitionTree(isolate_);
+    maybe_transition->DeprecateTransitionTree();
   }
 
   // If |maybe_transition| is not NULL then the transition array already

src/objects-debug.cc

@@ -1627,12 +1627,7 @@ static bool CheckOneBackPointer(Map* current_map, Object* target) {
 // static
 bool TransitionArray::IsConsistentWithBackPointers(Map* map) {
   Object* transitions = map->raw_transitions();
-  Heap* heap = map->GetHeap();
   for (int i = 0; i < TransitionArray::NumberOfTransitions(transitions); ++i) {
-    // Back pointers of shortcut transitions don't point to source maps.
-    Name* name = TransitionArray::GetKey(transitions, i);
-    if (IsShortcutTransition(heap, name)) continue;
-
     Map* target = TransitionArray::GetTarget(transitions, i);
     if (!CheckOneBackPointer(map, target)) return false;
   }

src/objects-inl.h

@@ -3184,11 +3184,6 @@ Handle<Map> Map::AddMissingTransitionsForTesting(
   return AddMissingTransitions(split_map, descriptors, full_layout_descriptor);
 }
 
-void Map::InsertElementsKindTransitionShortcutForTesting(
-    Isolate* isolate, Handle<Map> map, Handle<Map> transition) {
-  Map::InsertElementsKindTransitionShortcut(isolate, map, transition);
-}
-
 int HeapObject::SizeFromMap(Map* map) const {
   int instance_size = map->instance_size();
   if (instance_size != kVariableSizeSentinel) return instance_size;

src/objects-printer.cc

@@ -1711,9 +1711,6 @@ void TransitionArray::PrintTransitions(std::ostream& os, Object* transitions,
     } else if (key == heap->elements_transition_symbol()) {
       os << "(transition to " << ElementsKindToString(target->elements_kind())
          << ")";
-    } else if (key == heap->elements_transition_shortcut_symbol()) {
-      os << "(shortcut to " << ElementsKindToString(target->elements_kind())
-         << ")";
     } else if (key == heap->strict_function_transition_symbol()) {
       os << " (transition to strict function)";
     } else {
@@ -1745,7 +1742,8 @@ void TransitionArray::PrintTransitionTree(std::ostream& os, Map* map,
   for (int i = 0; i < num_transitions; i++) {
     Name* key = GetKey(transitions, i);
     Map* target = GetTarget(transitions, i);
-    os << "\n  " << level << "/" << i << ":" << std::setw(level * 2 + 2) << " ";
+    os << std::endl
+       << "  " << level << "/" << i << ":" << std::setw(level * 2 + 2) << " ";
     std::stringstream ss;
     ss << Brief(target);
     os << std::left << std::setw(50) << ss.str() << ": ";
@@ -1759,21 +1757,17 @@ void TransitionArray::PrintTransitionTree(std::ostream& os, Map* map,
       os << "to frozen";
     } else if (key == heap->elements_transition_symbol()) {
       os << "to " << ElementsKindToString(target->elements_kind());
-    } else if (key == heap->elements_transition_shortcut_symbol()) {
-      os << "shortcut to " << ElementsKindToString(target->elements_kind());
-      // Don't print transitions "through" the transition shortcut.
-      continue;
     } else if (key == heap->strict_function_transition_symbol()) {
       os << "to strict function";
     } else {
-      DCHECK(!IsSpecialTransition(key));
-      os << "to ";
 #ifdef OBJECT_PRINT
       key->NamePrint(os);
 #else
       key->ShortPrint(os);
 #endif
       os << " ";
+      DCHECK(!IsSpecialTransition(key));
+      os << "to ";
       int descriptor = target->LastAdded();
       DescriptorArray* descriptors = target->instance_descriptors();
       descriptors->PrintDescriptorDetails(os, descriptor,

src/objects.h

@@ -249,11 +249,10 @@ enum TransitionFlag {
 enum SimpleTransitionFlag {
   SIMPLE_PROPERTY_TRANSITION,
   PROPERTY_TRANSITION,
-  // Below are the special transitions.
-  SPECIAL_TRANSITION,
-  SPECIAL_SHORTCUT_TRANSITION
+  SPECIAL_TRANSITION
 };
 
+
 // Indicates whether we are only interested in the descriptors of a particular
 // map, or in all descriptors in the descriptor array.
 enum DescriptorFlag {

src/objects/map.h

@@ -345,11 +345,11 @@ class Map : public HeapObject {
                               Representation new_representation,
                               Handle<FieldType> new_field_type);
 
-  static Handle<Map> ReconfigureProperty(
-      Handle<Map> map, int modify_index, PropertyKind new_kind,
-      PropertyAttributes new_attributes, Representation new_representation,
-      Handle<FieldType> new_field_type,
-      PropertyConstness new_constness = kConst);
+  static Handle<Map> ReconfigureProperty(Handle<Map> map, int modify_index,
+                                         PropertyKind new_kind,
+                                         PropertyAttributes new_attributes,
+                                         Representation new_representation,
+                                         Handle<FieldType> new_field_type);
 
   static Handle<Map> ReconfigureElementsKind(Handle<Map> map,
                                              ElementsKind new_elements_kind);
@@ -495,9 +495,6 @@ class Map : public HeapObject {
   static Handle<Map> TransitionElementsTo(Handle<Map> map,
                                           ElementsKind to_kind);
 
-  static void RegisterElementsKindTransitionShortcut(Handle<Map> map,
-                                                     Handle<Map> transition);
-
   static Handle<Map> AsElementsKind(Handle<Map> map, ElementsKind kind);
 
   static Handle<Map> CopyAsElementsKind(Handle<Map> map, ElementsKind kind,
@@ -747,9 +744,6 @@ class Map : public HeapObject {
       Handle<Map> split_map, Handle<DescriptorArray> descriptors,
       Handle<LayoutDescriptor> full_layout_descriptor);
 
-  static inline void InsertElementsKindTransitionShortcutForTesting(
-      Isolate* isolate, Handle<Map> map, Handle<Map> transition);
-
   // Fires when the layout of an object with a leaf map changes.
   // This includes adding transitions to the leaf map or changing
   // the descriptor array.
@@ -769,12 +763,6 @@ class Map : public HeapObject {
   // not found.
   Map* TryReplayPropertyTransitions(Map* map);
 
-  static MaybeHandle<Map> GetTransitionShortcutRemoveDeprecated(
-      Isolate* isolate, Handle<Map> map, Handle<Symbol> name);
-  static void InsertElementsKindTransitionShortcut(Isolate* isolate,
-                                                   Handle<Map> map,
-                                                   Handle<Map> transition);
-
   static void ConnectTransition(Handle<Map> parent, Handle<Map> child,
                                 Handle<Name> name, SimpleTransitionFlag flag);
 
@@ -814,7 +802,7 @@ class Map : public HeapObject {
       Handle<Map> map, ElementsKind elements_kind, int modify_index,
       PropertyKind kind, PropertyAttributes attributes, const char* reason);
 
-  void DeprecateTransitionTree(Isolate* isolate);
+  void DeprecateTransitionTree();
 
   void ReplaceDescriptors(DescriptorArray* new_descriptors,
                           LayoutDescriptor* new_layout_descriptor);
@@ -822,8 +810,7 @@ class Map : public HeapObject {
   // Update field type of the given descriptor to new representation and new
   // type. The type must be prepared for storing in descriptor array:
   // it must be either a simple type or a map wrapped in a weak cell.
-  // Returns true if the elements kind transition shortcut exists.
-  bool UpdateFieldType(int descriptor_number, Handle<Name> name,
+  void UpdateFieldType(int descriptor_number, Handle<Name> name,
                        PropertyConstness new_constness,
                        Representation new_representation,
                        Handle<Object> new_wrapped_type);

src/transitions-inl.h

@@ -98,18 +98,6 @@ void TransitionArray::SetTarget(int transition_number, Map* value) {
   set(ToTargetIndex(transition_number), value);
 }
 
-std::pair<Name*, Map*> TransitionArray::GetKeyAndTarget(Object* raw_transitions,
-                                                        int transition_number) {
-  if (IsSimpleTransition(raw_transitions)) {
-    DCHECK(transition_number == 0);
-    Map* transition = GetSimpleTransition(raw_transitions);
-    return std::make_pair(GetSimpleTransitionKey(transition), transition);
-  }
-  DCHECK(IsFullTransitionArray(raw_transitions));
-  TransitionArray* transition_array = TransitionArray::cast(raw_transitions);
-  return std::make_pair(transition_array->GetKey(transition_number),
-                        transition_array->GetTarget(transition_number));
-}
 
 int TransitionArray::SearchName(Name* name, int* out_insertion_index) {
   DCHECK(name->IsUniqueName());
@@ -124,17 +112,9 @@ bool TransitionArray::IsSpecialTransition(Name* name) {
   return name == heap->nonextensible_symbol() ||
          name == heap->sealed_symbol() || name == heap->frozen_symbol() ||
          name == heap->elements_transition_symbol() ||
-         name == heap->elements_transition_shortcut_symbol() ||
          name == heap->strict_function_transition_symbol();
 }
 
-bool TransitionArray::IsShortcutTransition(Name* name) {
-  return IsShortcutTransition(name->GetHeap(), name);
-}
-
-bool TransitionArray::IsShortcutTransition(Heap* heap, Name* name) {
-  return name == heap->elements_transition_shortcut_symbol();
-}
 
 int TransitionArray::CompareKeys(Name* key1, uint32_t hash1, PropertyKind kind1,
                                  PropertyAttributes attributes1, Name* key2,

src/transitions.cc

@@ -16,9 +16,7 @@ namespace internal {
 void TransitionArray::Insert(Handle<Map> map, Handle<Name> name,
                              Handle<Map> target, SimpleTransitionFlag flag) {
   Isolate* isolate = map->GetIsolate();
-  if (flag != SPECIAL_SHORTCUT_TRANSITION) {
-    target->SetBackPointer(*map);
-  }
+  target->SetBackPointer(*map);
 
   // If the map doesn't have any transitions at all yet, install the new one.
   if (CanStoreSimpleTransition(map->raw_transitions())) {
@@ -32,7 +30,7 @@ void TransitionArray::Insert(Handle<Map> map, Handle<Name> name,
     ReplaceTransitions(map, *result);
   }
 
-  bool is_special_transition = flag >= SPECIAL_TRANSITION;
+  bool is_special_transition = flag == SPECIAL_TRANSITION;
   // If the map has a simple transition, check if it should be overwritten.
   if (IsSimpleTransition(map->raw_transitions())) {
     Map* old_target = GetSimpleTransition(map->raw_transitions());

src/transitions.h

@@ -153,9 +153,6 @@ class TransitionArray: public FixedArray {
   inline Map* GetTarget(int transition_number);
   inline void SetTarget(int transition_number, Map* target);
 
-  static inline std::pair<Name*, Map*> GetKeyAndTarget(Object* raw_transitions,
-                                                       int transition_number);
-
   static inline PropertyDetails GetTargetDetails(Name* name, Map* target);
 
   // Returns the number of transitions in the array.
@@ -207,10 +204,6 @@ class TransitionArray: public FixedArray {
   // or frozen transitions.
   static inline bool IsSpecialTransition(Name* name);
 
-  // Returns true for shortcut transitions.
-  static inline bool IsShortcutTransition(Name* name);
-  static inline bool IsShortcutTransition(Heap* heap, Name* name);
-
   // Constant for denoting key was not found.
   static const int kNotFound = -1;
 

test/mjsunit/regress/regress-crbug-738763.js

-// Copyright 2017 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --verify-heap --allow-natives-syntax --expose-gc
-
-let constant = { a: 1 };
-
-function update_array(array) {
-  array.x = constant;
-  %HeapObjectVerify(array);
-  array[0] = undefined;
-  %HeapObjectVerify(array);
-  return array;
-}
-
-let ar1 = [1];
-let ar2 = [2];
-let ar3 = [3];
-gc();
-gc();
-
-update_array(ar1);
-constant = update_array(ar2);
-update_array(ar3);

test/mjsunit/regress/regress-crbug-742346.js

-// Copyright 2017 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --expose-gc --throws
-
-TypeError.prototype.__defineGetter__("name", function() {
-  this[1] = {};
-  gc();
-  new Uint16Array().reduceRight();
-});
-var v = WebAssembly.compile();
-new TypeError().toString();

test/mjsunit/regress/regress-crbug-742381.js

-// Copyright 2017 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-function f(v) {
-  v.x = 0;
-  v[1] = 0.1;
-  v.x = {};
-}
-f({});
-f(new Array(1));
-f(new Array(1));