Revert "[runtime] Add shortcuts for elements kinds transitions."

This reverts commit b90e83f5.

Reason for revert: Blocks roll:
https://chromium-review.googlesource.com/c/570002/

Confirmed by:
https://chromium-review.googlesource.com/c/571700/2

Original change's description:
> [runtime] Add shortcuts for elements kinds transitions.
> 
> The shortcuts ensure that field type generalization is properly
> propagated in the transition graph.
> 
> Bug: chromium:738763
> Change-Id: Id701a6f95ed6ea093c707fbe0bac228f1f856e9f
> Reviewed-on: https://chromium-review.googlesource.com/567992
> Commit-Queue: Igor Sheludko <ishell@chromium.org>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#46622}

TBR=jkummerow@chromium.org,ishell@chromium.org

Change-Id: I5ede80db6bc209f16c6fd43f6bf3c8865c9577d8
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:738763
Reviewed-on: https://chromium-review.googlesource.com/571741Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46660}

src/heap-symbols.h

@@ -217,7 +217,6 @@
   V(class_start_position_symbol)            \
   V(detailed_stack_trace_symbol)            \
   V(elements_transition_symbol)             \
-  V(elements_transition_shortcut_symbol)    \
   V(error_end_pos_symbol)                   \
   V(error_script_symbol)                    \
   V(error_start_pos_symbol)                 \

src/ic/ic.cc

@@ -1437,7 +1437,7 @@ void KeyedLoadIC::LoadElementPolymorphicHandlers(
     if (receiver_map->is_stable()) {
       Map* tmap = receiver_map->FindElementsKindTransitionedMap(*receiver_maps);
       if (tmap != nullptr) {
-        Map::RegisterElementsKindTransitionShortcut(receiver_map, handle(tmap));
+        receiver_map->NotifyLeafMapLayoutChange();
       }
     }
     handlers->Add(LoadElementHandler(receiver_map));
@@ -2128,9 +2128,10 @@ void KeyedStoreIC::StoreElementPolymorphicHandlers(
         Map* tmap =
             receiver_map->FindElementsKindTransitionedMap(*receiver_maps);
         if (tmap != nullptr) {
+          if (receiver_map->is_stable()) {
+            receiver_map->NotifyLeafMapLayoutChange();
+          }
           transitioned_map = handle(tmap);
-          Map::RegisterElementsKindTransitionShortcut(receiver_map,
-                                                      transitioned_map);
         }
       }
 

src/map-updater.cc

@@ -617,7 +617,7 @@ MapUpdater::State MapUpdater::ConstructNewMap() {
       *split_map, split_details.kind(), GetKey(split_nof),
       split_details.attributes());
   if (maybe_transition != NULL) {
-    maybe_transition->DeprecateTransitionTree(isolate_);
+    maybe_transition->DeprecateTransitionTree();
   }
 
   // If |maybe_transition| is not NULL then the transition array already

src/objects-debug.cc

@@ -1625,13 +1625,7 @@ static bool CheckOneBackPointer(Map* current_map, Object* target) {
 // static
 bool TransitionArray::IsConsistentWithBackPointers(Map* map) {
   Object* transitions = map->raw_transitions();
-  Symbol* elements_transition_shortcut_symbol =
-      map->GetHeap()->elements_transition_shortcut_symbol();
   for (int i = 0; i < TransitionArray::NumberOfTransitions(transitions); ++i) {
-    // Back pointers of shortcut transitions don't point to source maps.
-    Name* name = TransitionArray::GetKey(transitions, i);
-    if (name == elements_transition_shortcut_symbol) continue;
-
     Map* target = TransitionArray::GetTarget(transitions, i);
     if (!CheckOneBackPointer(map, target)) return false;
   }

src/objects-inl.h

@@ -3193,11 +3193,6 @@ Handle<Map> Map::AddMissingTransitionsForTesting(
   return AddMissingTransitions(split_map, descriptors, full_layout_descriptor);
 }
 
-void Map::InsertElementsKindTransitionShortcutForTesting(
-    Isolate* isolate, Handle<Map> map, Handle<Map> transition) {
-  Map::InsertElementsKindTransitionShortcut(isolate, map, transition);
-}
-
 int HeapObject::SizeFromMap(Map* map) const {
   int instance_size = map->instance_size();
   if (instance_size != kVariableSizeSentinel) return instance_size;

src/objects-printer.cc

@@ -1706,9 +1706,6 @@ void TransitionArray::PrintTransitions(std::ostream& os, Object* transitions,
     } else if (key == heap->elements_transition_symbol()) {
       os << "(transition to " << ElementsKindToString(target->elements_kind())
          << ")";
-    } else if (key == heap->elements_transition_shortcut_symbol()) {
-      os << "(shortcut to " << ElementsKindToString(target->elements_kind())
-         << ")";
     } else if (key == heap->strict_function_transition_symbol()) {
       os << " (transition to strict function)";
     } else {
@@ -1755,19 +1752,17 @@ void TransitionArray::PrintTransitionTree(std::ostream& os, Map* map,
       os << "to frozen";
     } else if (key == heap->elements_transition_symbol()) {
       os << "to " << ElementsKindToString(target->elements_kind());
-    } else if (key == heap->elements_transition_shortcut_symbol()) {
-      os << "shortcut to " << ElementsKindToString(target->elements_kind());
     } else if (key == heap->strict_function_transition_symbol()) {
       os << "to strict function";
     } else {
-      DCHECK(!IsSpecialTransition(key));
-      os << "to ";
 #ifdef OBJECT_PRINT
       key->NamePrint(os);
 #else
       key->ShortPrint(os);
 #endif
       os << " ";
+      DCHECK(!IsSpecialTransition(key));
+      os << "to ";
       int descriptor = target->LastAdded();
       DescriptorArray* descriptors = target->instance_descriptors();
       descriptors->PrintDescriptorDetails(os, descriptor,

src/objects.h

@@ -249,11 +249,10 @@ enum TransitionFlag {
 enum SimpleTransitionFlag {
   SIMPLE_PROPERTY_TRANSITION,
   PROPERTY_TRANSITION,
-  // Below are the special transitions.
-  SPECIAL_TRANSITION,
-  SPECIAL_SHORTCUT_TRANSITION
+  SPECIAL_TRANSITION
 };
 
+
 // Indicates whether we are only interested in the descriptors of a particular
 // map, or in all descriptors in the descriptor array.
 enum DescriptorFlag {

src/objects/map.h

@@ -345,11 +345,11 @@ class Map : public HeapObject {
                               Representation new_representation,
                               Handle<FieldType> new_field_type);
 
-  static Handle<Map> ReconfigureProperty(
-      Handle<Map> map, int modify_index, PropertyKind new_kind,
-      PropertyAttributes new_attributes, Representation new_representation,
-      Handle<FieldType> new_field_type,
-      PropertyConstness new_constness = kConst);
+  static Handle<Map> ReconfigureProperty(Handle<Map> map, int modify_index,
+                                         PropertyKind new_kind,
+                                         PropertyAttributes new_attributes,
+                                         Representation new_representation,
+                                         Handle<FieldType> new_field_type);
 
   static Handle<Map> ReconfigureElementsKind(Handle<Map> map,
                                              ElementsKind new_elements_kind);
@@ -495,9 +495,6 @@ class Map : public HeapObject {
   static Handle<Map> TransitionElementsTo(Handle<Map> map,
                                           ElementsKind to_kind);
 
-  static void RegisterElementsKindTransitionShortcut(Handle<Map> map,
-                                                     Handle<Map> transition);
-
   static Handle<Map> AsElementsKind(Handle<Map> map, ElementsKind kind);
 
   static Handle<Map> CopyAsElementsKind(Handle<Map> map, ElementsKind kind,
@@ -747,9 +744,6 @@ class Map : public HeapObject {
       Handle<Map> split_map, Handle<DescriptorArray> descriptors,
       Handle<LayoutDescriptor> full_layout_descriptor);
 
-  static inline void InsertElementsKindTransitionShortcutForTesting(
-      Isolate* isolate, Handle<Map> map, Handle<Map> transition);
-
   // Fires when the layout of an object with a leaf map changes.
   // This includes adding transitions to the leaf map or changing
   // the descriptor array.
@@ -769,10 +763,6 @@ class Map : public HeapObject {
   // not found.
   Map* TryReplayPropertyTransitions(Map* map);
 
-  static void InsertElementsKindTransitionShortcut(Isolate* isolate,
-                                                   Handle<Map> map,
-                                                   Handle<Map> transition);
-
   static void ConnectTransition(Handle<Map> parent, Handle<Map> child,
                                 Handle<Name> name, SimpleTransitionFlag flag);
 
@@ -812,7 +802,7 @@ class Map : public HeapObject {
       Handle<Map> map, ElementsKind elements_kind, int modify_index,
       PropertyKind kind, PropertyAttributes attributes, const char* reason);
 
-  void DeprecateTransitionTree(Isolate* isolate);
+  void DeprecateTransitionTree();
 
   void ReplaceDescriptors(DescriptorArray* new_descriptors,
                           LayoutDescriptor* new_layout_descriptor);
@@ -820,8 +810,7 @@ class Map : public HeapObject {
   // Update field type of the given descriptor to new representation and new
   // type. The type must be prepared for storing in descriptor array:
   // it must be either a simple type or a map wrapped in a weak cell.
-  // Returns true if the elements kind transition shortcut exists.
-  bool UpdateFieldType(int descriptor_number, Handle<Name> name,
+  void UpdateFieldType(int descriptor_number, Handle<Name> name,
                        PropertyConstness new_constness,
                        Representation new_representation,
                        Handle<Object> new_wrapped_type);

src/transitions-inl.h

@@ -98,18 +98,6 @@ void TransitionArray::SetTarget(int transition_number, Map* value) {
   set(ToTargetIndex(transition_number), value);
 }
 
-std::pair<Name*, Map*> TransitionArray::GetKeyAndTarget(Object* raw_transitions,
-                                                        int transition_number) {
-  if (IsSimpleTransition(raw_transitions)) {
-    DCHECK(transition_number == 0);
-    Map* transition = GetSimpleTransition(raw_transitions);
-    return std::make_pair(GetSimpleTransitionKey(transition), transition);
-  }
-  DCHECK(IsFullTransitionArray(raw_transitions));
-  TransitionArray* transition_array = TransitionArray::cast(raw_transitions);
-  return std::make_pair(transition_array->GetKey(transition_number),
-                        transition_array->GetTarget(transition_number));
-}
 
 int TransitionArray::SearchName(Name* name, int* out_insertion_index) {
   DCHECK(name->IsUniqueName());
@@ -125,7 +113,6 @@ bool TransitionArray::IsSpecialTransition(Name* name) {
   return name == heap->nonextensible_symbol() ||
          name == heap->sealed_symbol() || name == heap->frozen_symbol() ||
          name == heap->elements_transition_symbol() ||
-         name == heap->elements_transition_shortcut_symbol() ||
          name == heap->strict_function_transition_symbol();
 }
 #endif

src/transitions.cc

@@ -16,9 +16,7 @@ namespace internal {
 void TransitionArray::Insert(Handle<Map> map, Handle<Name> name,
                              Handle<Map> target, SimpleTransitionFlag flag) {
   Isolate* isolate = map->GetIsolate();
-  if (flag != SPECIAL_SHORTCUT_TRANSITION) {
-    target->SetBackPointer(*map);
-  }
+  target->SetBackPointer(*map);
 
   // If the map doesn't have any transitions at all yet, install the new one.
   if (CanStoreSimpleTransition(map->raw_transitions())) {
@@ -32,7 +30,7 @@ void TransitionArray::Insert(Handle<Map> map, Handle<Name> name,
     ReplaceTransitions(map, *result);
   }
 
-  bool is_special_transition = flag >= SPECIAL_TRANSITION;
+  bool is_special_transition = flag == SPECIAL_TRANSITION;
   // If the map has a simple transition, check if it should be overwritten.
   if (IsSimpleTransition(map->raw_transitions())) {
     Map* old_target = GetSimpleTransition(map->raw_transitions());

src/transitions.h

@@ -153,9 +153,6 @@ class TransitionArray: public FixedArray {
   inline Map* GetTarget(int transition_number);
   inline void SetTarget(int transition_number, Map* target);
 
-  static inline std::pair<Name*, Map*> GetKeyAndTarget(Object* raw_transitions,
-                                                       int transition_number);
-
   static inline PropertyDetails GetTargetDetails(Name* name, Map* target);
 
   // Returns the number of transitions in the array.

test/mjsunit/regress/regress-crbug-738763.js

-// Copyright 2017 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --verify-heap --allow-natives-syntax --expose-gc
-
-let constant = { a: 1 };
-
-function update_array(array) {
-  array.x = constant;
-  %HeapObjectVerify(array);
-  array[0] = undefined;
-  %HeapObjectVerify(array);
-  return array;
-}
-
-let ar1 = [1];
-let ar2 = [2];
-let ar3 = [3];
-gc();
-gc();
-
-update_array(ar1);
-constant = update_array(ar2);
-update_array(ar3);