Reland "[runtime] Add shortcuts for elements kinds transitions."

This is a reland of b90e83f5
Original change's description:
> [runtime] Add shortcuts for elements kinds transitions.
>
> The shortcuts ensure that field type generalization is properly
> propagated in the transition graph.
>
> Bug: chromium:738763
> Change-Id: Id701a6f95ed6ea093c707fbe0bac228f1f856e9f
> Reviewed-on: https://chromium-review.googlesource.com/567992
> Commit-Queue: Igor Sheludko <ishell@chromium.org>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#46622}

Bug: chromium:738763, chromium:742346, chromium:742381, chromium:745844
Change-Id: I93974e3906b2c7710bd525f15037a2dd97f263ad
Reviewed-on: https://chromium-review.googlesource.com/575227
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46759}

src/heap-symbols.h

@@ -217,6 +217,7 @@
   V(class_start_position_symbol)            \
   V(detailed_stack_trace_symbol)            \
   V(elements_transition_symbol)             \
+  V(elements_transition_shortcut_symbol)    \
   V(error_end_pos_symbol)                   \
   V(error_script_symbol)                    \
   V(error_start_pos_symbol)                 \

src/heap/mark-compact.cc

@@ -2974,6 +2974,22 @@ void MarkCompactCollector::ClearSimpleMapTransition(Map* map,
   }
 }
 
+namespace {
+
+Map* GetTransitionArrayOwnerMap(Heap* heap, TransitionArray* transitions,
+                                int num_transitions) {
+  // Search for any non-shortcut transition.
+  for (int i = 0; i < num_transitions; i++) {
+    Name* key = transitions->GetKey(i);
+    if (TransitionArray::IsShortcutTransition(key)) continue;
+    Map* target = transitions->GetTarget(i);
+    Map* parent = Map::cast(target->constructor_or_backpointer());
+    return parent;
+  }
+  return nullptr;
+}
+
+}  // namespace
 
 void MarkCompactCollector::ClearFullMapTransitions() {
   HeapObject* undefined = heap()->undefined_value();
@@ -2983,16 +2999,20 @@ void MarkCompactCollector::ClearFullMapTransitions() {
     int num_transitions = array->number_of_entries();
     DCHECK_EQ(TransitionArray::NumberOfTransitions(array), num_transitions);
     if (num_transitions > 0) {
-      Map* map = array->GetTarget(0);
-      Map* parent = Map::cast(map->constructor_or_backpointer());
-      bool parent_is_alive =
-          ObjectMarking::IsBlackOrGrey(parent, MarkingState::Internal(parent));
-      DescriptorArray* descriptors =
-          parent_is_alive ? parent->instance_descriptors() : nullptr;
-      bool descriptors_owner_died =
-          CompactTransitionArray(parent, array, descriptors);
-      if (descriptors_owner_died) {
-        TrimDescriptorArray(parent, descriptors);
+      Map* parent = GetTransitionArrayOwnerMap(heap(), array, num_transitions);
+      if (!parent) {
+        // The transition array contains only shortcut transitions.
+        CompactTransitionArray(parent, array, nullptr);
+      } else {
+        bool parent_is_alive = ObjectMarking::IsBlackOrGrey(
+            parent, MarkingState::Internal(parent));
+        DescriptorArray* descriptors =
+            parent_is_alive ? parent->instance_descriptors() : nullptr;
+        bool descriptors_owner_died =
+            CompactTransitionArray(parent, array, descriptors);
+        if (descriptors_owner_died) {
+          TrimDescriptorArray(parent, descriptors);
+        }
       }
     }
     obj = array->next_link();
@@ -3001,6 +3021,41 @@ void MarkCompactCollector::ClearFullMapTransitions() {
   heap()->set_encountered_transition_arrays(Smi::kZero);
 }
 
+namespace {
+
+// Returns true if the target is live and the transition entry should be kept
+// in the transition array. In addition, if current transition entry is a dead
+// shortcut transition this function tries to fixup the entry to make it point
+// to the next live target in a shortcut chain.
+bool FixupDeadTransition(bool is_shortcut_transition, Name* key, Map* target,
+                         TransitionArray* transitions, int transition_index) {
+  if (!ObjectMarking::IsWhite(target, MarkingState::Internal(target))) {
+    return true;
+  }
+  if (!is_shortcut_transition) {
+    // Target map is dead.
+    return false;
+  }
+
+  Symbol* symbol = Symbol::cast(key);
+  // Follow the shortcut transition chain in order to find live target.
+  for (;;) {
+    target = TransitionArray::SearchSpecial(target, symbol);
+    if (target == nullptr ||
+        !ObjectMarking::IsWhite(target, MarkingState::Internal(target))) {
+      break;
+    }
+  }
+  if (target) {
+    // Found live target in shortcuts chain, now fixup the transitions array.
+    // Target slots do not need to be recorded since maps are not compacted.
+    transitions->SetTarget(transition_index, target);
+    return true;
+  }
+  return false;
+}
+
+}  // namespace
 
 bool MarkCompactCollector::CompactTransitionArray(
     Map* map, TransitionArray* transitions, DescriptorArray* descriptors) {
@@ -3009,16 +3064,24 @@ bool MarkCompactCollector::CompactTransitionArray(
   int transition_index = 0;
   // Compact all live transitions to the left.
   for (int i = 0; i < num_transitions; ++i) {
-    Map* target = transitions->GetTarget(i);
-    DCHECK_EQ(target->constructor_or_backpointer(), map);
-    if (ObjectMarking::IsWhite(target, MarkingState::Internal(target))) {
-      if (descriptors != nullptr &&
+    Name* key;
+    Map* target;
+    std::tie(key, target) = TransitionArray::GetKeyAndTarget(transitions, i);
+    bool is_shortcut_transition =
+        TransitionArray::IsShortcutTransition(heap(), key);
+
+    DCHECK_IMPLIES(!is_shortcut_transition,
+                   target->constructor_or_backpointer() == map);
+
+    bool is_live_transition = FixupDeadTransition(is_shortcut_transition, key,
+                                                  target, transitions, i);
+    if (!is_live_transition) {
+      if (!is_shortcut_transition && descriptors != nullptr &&
           target->instance_descriptors() == descriptors) {
         descriptors_owner_died = true;
       }
     } else {
       if (i != transition_index) {
-        Name* key = transitions->GetKey(i);
         transitions->SetKey(transition_index, key);
         Object** key_slot = transitions->GetKeySlot(transition_index);
         RecordSlot(transitions, key_slot, key);

src/ic/ic.cc

@@ -1438,7 +1438,7 @@ void KeyedLoadIC::LoadElementPolymorphicHandlers(
     if (receiver_map->is_stable()) {
       Map* tmap = receiver_map->FindElementsKindTransitionedMap(*receiver_maps);
       if (tmap != nullptr) {
-        receiver_map->NotifyLeafMapLayoutChange();
+        Map::RegisterElementsKindTransitionShortcut(receiver_map, handle(tmap));
       }
     }
     handlers->Add(LoadElementHandler(receiver_map));
@@ -2129,10 +2129,9 @@ void KeyedStoreIC::StoreElementPolymorphicHandlers(
         Map* tmap =
             receiver_map->FindElementsKindTransitionedMap(*receiver_maps);
         if (tmap != nullptr) {
-          if (receiver_map->is_stable()) {
-            receiver_map->NotifyLeafMapLayoutChange();
-          }
           transitioned_map = handle(tmap);
+          Map::RegisterElementsKindTransitionShortcut(receiver_map,
+                                                      transitioned_map);
         }
       }
 

src/map-updater.cc

@@ -617,7 +617,7 @@ MapUpdater::State MapUpdater::ConstructNewMap() {
       *split_map, split_details.kind(), GetKey(split_nof),
       split_details.attributes());
   if (maybe_transition != NULL) {
-    maybe_transition->DeprecateTransitionTree();
+    maybe_transition->DeprecateTransitionTree(isolate_);
   }
 
   // If |maybe_transition| is not NULL then the transition array already

src/objects-debug.cc

@@ -1625,7 +1625,12 @@ static bool CheckOneBackPointer(Map* current_map, Object* target) {
 // static
 bool TransitionArray::IsConsistentWithBackPointers(Map* map) {
   Object* transitions = map->raw_transitions();
+  Heap* heap = map->GetHeap();
   for (int i = 0; i < TransitionArray::NumberOfTransitions(transitions); ++i) {
+    // Back pointers of shortcut transitions don't point to source maps.
+    Name* name = TransitionArray::GetKey(transitions, i);
+    if (IsShortcutTransition(heap, name)) continue;
+
     Map* target = TransitionArray::GetTarget(transitions, i);
     if (!CheckOneBackPointer(map, target)) return false;
   }

src/objects-inl.h

@@ -3183,6 +3183,11 @@ Handle<Map> Map::AddMissingTransitionsForTesting(
   return AddMissingTransitions(split_map, descriptors, full_layout_descriptor);
 }
 
+void Map::InsertElementsKindTransitionShortcutForTesting(
+    Isolate* isolate, Handle<Map> map, Handle<Map> transition) {
+  Map::InsertElementsKindTransitionShortcut(isolate, map, transition);
+}
+
 int HeapObject::SizeFromMap(Map* map) const {
   int instance_size = map->instance_size();
   if (instance_size != kVariableSizeSentinel) return instance_size;

src/objects-printer.cc

@@ -1706,6 +1706,9 @@ void TransitionArray::PrintTransitions(std::ostream& os, Object* transitions,
     } else if (key == heap->elements_transition_symbol()) {
       os << "(transition to " << ElementsKindToString(target->elements_kind())
          << ")";
+    } else if (key == heap->elements_transition_shortcut_symbol()) {
+      os << "(shortcut to " << ElementsKindToString(target->elements_kind())
+         << ")";
     } else if (key == heap->strict_function_transition_symbol()) {
       os << " (transition to strict function)";
     } else {
@@ -1737,8 +1740,7 @@ void TransitionArray::PrintTransitionTree(std::ostream& os, Map* map,
   for (int i = 0; i < num_transitions; i++) {
     Name* key = GetKey(transitions, i);
     Map* target = GetTarget(transitions, i);
-    os << std::endl
-       << "  " << level << "/" << i << ":" << std::setw(level * 2 + 2) << " ";
+    os << "\n  " << level << "/" << i << ":" << std::setw(level * 2 + 2) << " ";
     std::stringstream ss;
     ss << Brief(target);
     os << std::left << std::setw(50) << ss.str() << ": ";
@@ -1752,17 +1754,21 @@ void TransitionArray::PrintTransitionTree(std::ostream& os, Map* map,
       os << "to frozen";
     } else if (key == heap->elements_transition_symbol()) {
       os << "to " << ElementsKindToString(target->elements_kind());
+    } else if (key == heap->elements_transition_shortcut_symbol()) {
+      os << "shortcut to " << ElementsKindToString(target->elements_kind());
+      // Don't print transitions "through" the transition shortcut.
+      continue;
     } else if (key == heap->strict_function_transition_symbol()) {
       os << "to strict function";
     } else {
+      DCHECK(!IsSpecialTransition(key));
+      os << "to ";
 #ifdef OBJECT_PRINT
       key->NamePrint(os);
 #else
       key->ShortPrint(os);
 #endif
       os << " ";
-      DCHECK(!IsSpecialTransition(key));
-      os << "to ";
       int descriptor = target->LastAdded();
       DescriptorArray* descriptors = target->instance_descriptors();
       descriptors->PrintDescriptorDetails(os, descriptor,

src/objects.h

@@ -249,10 +249,11 @@ enum TransitionFlag {
 enum SimpleTransitionFlag {
   SIMPLE_PROPERTY_TRANSITION,
   PROPERTY_TRANSITION,
-  SPECIAL_TRANSITION
+  // Below are the special transitions.
+  SPECIAL_TRANSITION,
+  SPECIAL_SHORTCUT_TRANSITION
 };
 
-
 // Indicates whether we are only interested in the descriptors of a particular
 // map, or in all descriptors in the descriptor array.
 enum DescriptorFlag {

src/objects/map.h

@@ -345,11 +345,11 @@ class Map : public HeapObject {
                               Representation new_representation,
                               Handle<FieldType> new_field_type);
 
-  static Handle<Map> ReconfigureProperty(Handle<Map> map, int modify_index,
-                                         PropertyKind new_kind,
-                                         PropertyAttributes new_attributes,
-                                         Representation new_representation,
-                                         Handle<FieldType> new_field_type);
+  static Handle<Map> ReconfigureProperty(
+      Handle<Map> map, int modify_index, PropertyKind new_kind,
+      PropertyAttributes new_attributes, Representation new_representation,
+      Handle<FieldType> new_field_type,
+      PropertyConstness new_constness = kConst);
 
   static Handle<Map> ReconfigureElementsKind(Handle<Map> map,
                                              ElementsKind new_elements_kind);
@@ -495,6 +495,9 @@ class Map : public HeapObject {
   static Handle<Map> TransitionElementsTo(Handle<Map> map,
                                           ElementsKind to_kind);
 
+  static void RegisterElementsKindTransitionShortcut(Handle<Map> map,
+                                                     Handle<Map> transition);
+
   static Handle<Map> AsElementsKind(Handle<Map> map, ElementsKind kind);
 
   static Handle<Map> CopyAsElementsKind(Handle<Map> map, ElementsKind kind,
@@ -744,6 +747,9 @@ class Map : public HeapObject {
       Handle<Map> split_map, Handle<DescriptorArray> descriptors,
       Handle<LayoutDescriptor> full_layout_descriptor);
 
+  static inline void InsertElementsKindTransitionShortcutForTesting(
+      Isolate* isolate, Handle<Map> map, Handle<Map> transition);
+
   // Fires when the layout of an object with a leaf map changes.
   // This includes adding transitions to the leaf map or changing
   // the descriptor array.
@@ -763,6 +769,12 @@ class Map : public HeapObject {
   // not found.
   Map* TryReplayPropertyTransitions(Map* map);
 
+  static MaybeHandle<Map> GetTransitionShortcutRemoveDeprecated(
+      Isolate* isolate, Handle<Map> map, Handle<Symbol> name);
+  static void InsertElementsKindTransitionShortcut(Isolate* isolate,
+                                                   Handle<Map> map,
+                                                   Handle<Map> transition);
+
   static void ConnectTransition(Handle<Map> parent, Handle<Map> child,
                                 Handle<Name> name, SimpleTransitionFlag flag);
 
@@ -802,7 +814,7 @@ class Map : public HeapObject {
       Handle<Map> map, ElementsKind elements_kind, int modify_index,
       PropertyKind kind, PropertyAttributes attributes, const char* reason);
 
-  void DeprecateTransitionTree();
+  void DeprecateTransitionTree(Isolate* isolate);
 
   void ReplaceDescriptors(DescriptorArray* new_descriptors,
                           LayoutDescriptor* new_layout_descriptor);
@@ -810,7 +822,8 @@ class Map : public HeapObject {
   // Update field type of the given descriptor to new representation and new
   // type. The type must be prepared for storing in descriptor array:
   // it must be either a simple type or a map wrapped in a weak cell.
-  void UpdateFieldType(int descriptor_number, Handle<Name> name,
+  // Returns true if the elements kind transition shortcut exists.
+  bool UpdateFieldType(int descriptor_number, Handle<Name> name,
                        PropertyConstness new_constness,
                        Representation new_representation,
                        Handle<Object> new_wrapped_type);

src/transitions-inl.h

@@ -98,6 +98,18 @@ void TransitionArray::SetTarget(int transition_number, Map* value) {
   set(ToTargetIndex(transition_number), value);
 }
 
+std::pair<Name*, Map*> TransitionArray::GetKeyAndTarget(Object* raw_transitions,
+                                                        int transition_number) {
+  if (IsSimpleTransition(raw_transitions)) {
+    DCHECK(transition_number == 0);
+    Map* transition = GetSimpleTransition(raw_transitions);
+    return std::make_pair(GetSimpleTransitionKey(transition), transition);
+  }
+  DCHECK(IsFullTransitionArray(raw_transitions));
+  TransitionArray* transition_array = TransitionArray::cast(raw_transitions);
+  return std::make_pair(transition_array->GetKey(transition_number),
+                        transition_array->GetTarget(transition_number));
+}
 
 int TransitionArray::SearchName(Name* name, int* out_insertion_index) {
   DCHECK(name->IsUniqueName());
@@ -112,9 +124,17 @@ bool TransitionArray::IsSpecialTransition(Name* name) {
   return name == heap->nonextensible_symbol() ||
          name == heap->sealed_symbol() || name == heap->frozen_symbol() ||
          name == heap->elements_transition_symbol() ||
+         name == heap->elements_transition_shortcut_symbol() ||
          name == heap->strict_function_transition_symbol();
 }
 
+bool TransitionArray::IsShortcutTransition(Name* name) {
+  return IsShortcutTransition(name->GetHeap(), name);
+}
+
+bool TransitionArray::IsShortcutTransition(Heap* heap, Name* name) {
+  return name == heap->elements_transition_shortcut_symbol();
+}
 
 int TransitionArray::CompareKeys(Name* key1, uint32_t hash1, PropertyKind kind1,
                                  PropertyAttributes attributes1, Name* key2,

src/transitions.cc

@@ -16,7 +16,9 @@ namespace internal {
 void TransitionArray::Insert(Handle<Map> map, Handle<Name> name,
                              Handle<Map> target, SimpleTransitionFlag flag) {
   Isolate* isolate = map->GetIsolate();
-  target->SetBackPointer(*map);
+  if (flag != SPECIAL_SHORTCUT_TRANSITION) {
+    target->SetBackPointer(*map);
+  }
 
   // If the map doesn't have any transitions at all yet, install the new one.
   if (CanStoreSimpleTransition(map->raw_transitions())) {
@@ -30,7 +32,7 @@ void TransitionArray::Insert(Handle<Map> map, Handle<Name> name,
     ReplaceTransitions(map, *result);
   }
 
-  bool is_special_transition = flag == SPECIAL_TRANSITION;
+  bool is_special_transition = flag >= SPECIAL_TRANSITION;
   // If the map has a simple transition, check if it should be overwritten.
   if (IsSimpleTransition(map->raw_transitions())) {
     Map* old_target = GetSimpleTransition(map->raw_transitions());

src/transitions.h

@@ -153,6 +153,9 @@ class TransitionArray: public FixedArray {
   inline Map* GetTarget(int transition_number);
   inline void SetTarget(int transition_number, Map* target);
 
+  static inline std::pair<Name*, Map*> GetKeyAndTarget(Object* raw_transitions,
+                                                       int transition_number);
+
   static inline PropertyDetails GetTargetDetails(Name* name, Map* target);
 
   // Returns the number of transitions in the array.
@@ -204,6 +207,10 @@ class TransitionArray: public FixedArray {
   // or frozen transitions.
   static inline bool IsSpecialTransition(Name* name);
 
+  // Returns true for shortcut transitions.
+  static inline bool IsShortcutTransition(Name* name);
+  static inline bool IsShortcutTransition(Heap* heap, Name* name);
+
   // Constant for denoting key was not found.
   static const int kNotFound = -1;
 

test/mjsunit/regress/regress-crbug-738763.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --verify-heap --allow-natives-syntax --expose-gc
+
+let constant = { a: 1 };
+
+function update_array(array) {
+  array.x = constant;
+  %HeapObjectVerify(array);
+  array[0] = undefined;
+  %HeapObjectVerify(array);
+  return array;
+}
+
+let ar1 = [1];
+let ar2 = [2];
+let ar3 = [3];
+gc();
+gc();
+
+update_array(ar1);
+constant = update_array(ar2);
+update_array(ar3);

test/mjsunit/regress/regress-crbug-742346.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc --throws
+
+TypeError.prototype.__defineGetter__("name", function() {
+  this[1] = {};
+  gc();
+  new Uint16Array().reduceRight();
+});
+var v = WebAssembly.compile();
+new TypeError().toString();

test/mjsunit/regress/regress-crbug-742381.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function f(v) {
+  v.x = 0;
+  v[1] = 0.1;
+  v.x = {};
+}
+f({});
+f(new Array(1));
+f(new Array(1));