[heap] Fix hash table over-allocation calculation.

The generic HashTableBase approach was producing the wrong results for
the over-allocation, so I'm using the HashTable template now, which
seems to produce the right results.

Also distinguish properties backing stores for prototypes from regular
properties backing stores (since we're primarily interested in the
prototypes for now).

Bug: v8:7266
Change-Id: I5bbda6851f0320168ada1beb104042d0052c9a17
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1559869Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60737}

src/heap/object-stats.cc

@@ -369,8 +369,9 @@ class ObjectStatsCollectorImpl {
   bool RecordSimpleVirtualObjectStats(HeapObject parent, HeapObject obj,
                                       ObjectStats::VirtualInstanceType type);
   // For HashTable it is possible to compute over allocated memory.
+  template <typename Derived, typename Shape>
   void RecordHashTableVirtualObjectStats(HeapObject parent,
-                                         HashTableBase hash_table,
+                                         HashTable<Derived, Shape> hash_table,
                                          ObjectStats::VirtualInstanceType type);
 
   bool SameLiveness(HeapObject obj1, HeapObject obj2);
@@ -438,18 +439,14 @@ bool ObjectStatsCollectorImpl::ShouldRecordObject(HeapObject obj,
   return true;
 }
 
+template <typename Derived, typename Shape>
 void ObjectStatsCollectorImpl::RecordHashTableVirtualObjectStats(
-    HeapObject parent, HashTableBase hash_table,
+    HeapObject parent, HashTable<Derived, Shape> hash_table,
     ObjectStats::VirtualInstanceType type) {
-  size_t entry_size =
-      ((hash_table->length() - HashTableBase::kPrefixStartIndex) /
-       hash_table->Capacity()) *
-      kTaggedSize;
   size_t over_allocated =
-      (hash_table->length() -
-       (HashTableBase::kPrefixStartIndex + hash_table->NumberOfElements() +
-        hash_table->NumberOfDeletedElements())) *
-      entry_size;
+      (hash_table->Capacity() - (hash_table->NumberOfElements() +
+                                 hash_table->NumberOfDeletedElements())) *
+      HashTable<Derived, Shape>::kEntrySize * kTaggedSize;
   RecordVirtualObjectStats(parent, hash_table, type, hash_table->Size(),
                            over_allocated);
 }
@@ -463,6 +460,7 @@ bool ObjectStatsCollectorImpl::RecordSimpleVirtualObjectStats(
 bool ObjectStatsCollectorImpl::RecordVirtualObjectStats(
     HeapObject parent, HeapObject obj, ObjectStats::VirtualInstanceType type,
     size_t size, size_t over_allocated, CowMode check_cow_array) {
+  CHECK_LT(over_allocated, size);
   if (!SameLiveness(parent, obj) || !ShouldRecordObject(obj, check_cow_array)) {
     return false;
   }
@@ -557,13 +555,18 @@ void ObjectStatsCollectorImpl::RecordVirtualJSObjectDetails(JSObject object) {
       size_t over_allocated =
           object->map()->UnusedPropertyFields() * kTaggedSize;
       RecordVirtualObjectStats(object, properties,
-                               ObjectStats::OBJECT_PROPERTY_ARRAY_TYPE,
+                               object->map()->is_prototype_map()
+                                   ? ObjectStats::PROTOTYPE_PROPERTY_ARRAY_TYPE
+                                   : ObjectStats::OBJECT_PROPERTY_ARRAY_TYPE,
                                properties->Size(), over_allocated);
     }
   } else {
     NameDictionary properties = object->property_dictionary();
     RecordHashTableVirtualObjectStats(
-        object, properties, ObjectStats::OBJECT_PROPERTY_DICTIONARY_TYPE);
+        object, properties,
+        object->map()->is_prototype_map()
+            ? ObjectStats::PROTOTYPE_PROPERTY_DICTIONARY_TYPE
+            : ObjectStats::OBJECT_PROPERTY_DICTIONARY_TYPE);
   }
 
   // Elements.

src/heap/object-stats.h

@@ -64,6 +64,8 @@
   V(OPTIMIZED_CODE_LITERALS_TYPE)                \
   V(OTHER_CONTEXT_TYPE)                          \
   V(PROTOTYPE_DESCRIPTOR_ARRAY_TYPE)             \
+  V(PROTOTYPE_PROPERTY_ARRAY_TYPE)               \
+  V(PROTOTYPE_PROPERTY_DICTIONARY_TYPE)          \
   V(PROTOTYPE_USERS_TYPE)                        \
   V(REGEXP_MULTIPLE_CACHE_TYPE)                  \
   V(RELOC_INFO_TYPE)                             \