[ptr-compr] Pass Isolate to JSObject::NormalizeProperties()

Bug: v8:9353
Change-Id: Iefeaa8820d3fcccafd92af1ea5e95001fc8ab951
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1648262
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62084}

src/init/bootstrapper.cc

@@ -4601,7 +4601,7 @@ void Genesis::InstallInternalPackedArray(Handle<JSObject> target,
   }
 
   JSObject::NormalizeProperties(
-      prototype, KEEP_INOBJECT_PROPERTIES, 6,
+      isolate(), prototype, KEEP_INOBJECT_PROPERTIES, 6,
       "OptimizeInternalPackedArrayPrototypeForAdding");
   InstallInternalPackedArrayFunction(prototype, "push");
   InstallInternalPackedArrayFunction(prototype, "pop");

src/objects/js-objects.cc

@@ -3264,13 +3264,12 @@ Maybe<PropertyAttributes> JSObject::GetPropertyAttributesWithInterceptor(
   return GetPropertyAttributesWithInterceptorInternal(it, it->GetInterceptor());
 }
 
-void JSObject::NormalizeProperties(Handle<JSObject> object,
+void JSObject::NormalizeProperties(Isolate* isolate, Handle<JSObject> object,
                                    PropertyNormalizationMode mode,
                                    int expected_additional_properties,
                                    const char* reason) {
   if (!object->HasFastProperties()) return;
 
-  Isolate* isolate = object->GetIsolate();
   Handle<Map> map(object->map(), isolate);
   Handle<Map> new_map = Map::Normalize(isolate, map, mode, reason);
 
@@ -3848,7 +3847,7 @@ Maybe<bool> JSObject::PreventExtensionsWithTransition(
   } else {
     DCHECK(old_map->is_dictionary_map() || !old_map->is_prototype_map());
     // Slow path: need to normalize properties for safety
-    NormalizeProperties(object, CLEAR_INOBJECT_PROPERTIES, 0,
+    NormalizeProperties(isolate, object, CLEAR_INOBJECT_PROPERTIES, 0,
                         "SlowPreventExtensions");
 
     // Create a new map, since other objects with this map may be extensible.
@@ -4176,10 +4175,11 @@ static bool PrototypeBenefitsFromNormalization(Handle<JSObject> object) {
 // static
 void JSObject::OptimizeAsPrototype(Handle<JSObject> object,
                                    bool enable_setup_mode) {
+  Isolate* isolate = object->GetIsolate();
   if (object->IsJSGlobalObject()) return;
   if (enable_setup_mode && PrototypeBenefitsFromNormalization(object)) {
     // First normalize to ensure all JSFunctions are DATA_CONSTANT.
-    JSObject::NormalizeProperties(object, KEEP_INOBJECT_PROPERTIES, 0,
+    JSObject::NormalizeProperties(isolate, object, KEEP_INOBJECT_PROPERTIES, 0,
                                   "NormalizeAsPrototype");
   }
   if (object->map().is_prototype_map()) {
@@ -4188,7 +4188,6 @@ void JSObject::OptimizeAsPrototype(Handle<JSObject> object,
       JSObject::MigrateSlowToFast(object, 0, "OptimizeAsPrototype");
     }
   } else {
-    Isolate* isolate = object->GetIsolate();
     Handle<Map> new_map =
         Map::Copy(isolate, handle(object->map(), isolate), "CopyAsPrototype");
     JSObject::MigrateToMap(isolate, object, new_map);

src/objects/js-objects.h

@@ -609,7 +609,7 @@ class JSObject : public JSReceiver {
   // added this number can be indicated to have the backing store allocated to
   // an initial capacity for holding these properties.
   V8_EXPORT_PRIVATE static void NormalizeProperties(
-      Handle<JSObject> object, PropertyNormalizationMode mode,
+      Isolate* isolate, Handle<JSObject> object, PropertyNormalizationMode mode,
       int expected_additional_properties, const char* reason);
 
   // Convert and update the elements backing store to be a

src/objects/lookup.cc

@@ -723,8 +723,8 @@ void LookupIterator::Delete() {
         is_prototype_map ? KEEP_INOBJECT_PROPERTIES : CLEAR_INOBJECT_PROPERTIES;
 
     if (holder->HasFastProperties()) {
-      JSObject::NormalizeProperties(Handle<JSObject>::cast(holder), mode, 0,
-                                    "DeletingProperty");
+      JSObject::NormalizeProperties(isolate_, Handle<JSObject>::cast(holder),
+                                    mode, 0, "DeletingProperty");
       ReloadPropertyInformation<false>();
     }
     JSReceiver::DeleteNormalizedProperty(holder, number_);
@@ -839,7 +839,7 @@ void LookupIterator::TransitionToAccessorPair(Handle<Object> pair,
     }
 
     // Normalize object to make this operation simple.
-    JSObject::NormalizeProperties(receiver, mode, 0,
+    JSObject::NormalizeProperties(isolate_, receiver, mode, 0,
                                   "TransitionToAccessorPair");
 
     JSObject::SetNormalizedProperty(receiver, name_, pair, details);

src/objects/module.cc

@@ -874,7 +874,7 @@ Handle<JSModuleNamespace> Module::GetModuleNamespace(Isolate* isolate,
   // Create the properties in the namespace object. Transition the object
   // to dictionary mode so that property addition is faster.
   PropertyAttributes attr = DONT_DELETE;
-  JSObject::NormalizeProperties(ns, CLEAR_INOBJECT_PROPERTIES,
+  JSObject::NormalizeProperties(isolate, ns, CLEAR_INOBJECT_PROPERTIES,
                                 static_cast<int>(names.size()),
                                 "JSModuleNamespace");
   for (const auto& name : names) {

src/runtime/runtime-object.cc

@@ -440,8 +440,8 @@ RUNTIME_FUNCTION(Runtime_OptimizeObjectForAddingMultipleProperties) {
   // Conservative upper limit to prevent fuzz tests from going OOM.
   if (properties > 100000) return isolate->ThrowIllegalOperation();
   if (object->HasFastProperties() && !object->IsJSGlobalProxy()) {
-    JSObject::NormalizeProperties(object, KEEP_INOBJECT_PROPERTIES, properties,
-                                  "OptimizeForAdding");
+    JSObject::NormalizeProperties(isolate, object, KEEP_INOBJECT_PROPERTIES,
+                                  properties, "OptimizeForAdding");
   }
   return *object;
 }

test/cctest/test-code-stub-assembler.cc

@@ -1109,7 +1109,8 @@ TEST(TryHasOwnProperty) {
         factory->NewFunctionForTest(factory->empty_string());
     Handle<JSObject> object = factory->NewJSObject(function);
     AddProperties(object, names, arraysize(names));
-    JSObject::NormalizeProperties(object, CLEAR_INOBJECT_PROPERTIES, 0, "test");
+    JSObject::NormalizeProperties(isolate, object, CLEAR_INOBJECT_PROPERTIES, 0,
+                                  "test");
 
     JSObject::AddProperty(isolate, object, deleted_property_name, object, NONE);
     CHECK(JSObject::DeleteProperty(object, deleted_property_name,
@@ -1316,7 +1317,8 @@ TEST(TryGetOwnProperty) {
     Handle<JSObject> object = factory->NewJSObject(function);
     AddProperties(object, names, arraysize(names), values, arraysize(values),
                   rand_gen.NextInt());
-    JSObject::NormalizeProperties(object, CLEAR_INOBJECT_PROPERTIES, 0, "test");
+    JSObject::NormalizeProperties(isolate, object, CLEAR_INOBJECT_PROPERTIES, 0,
+                                  "test");
 
     JSObject::AddProperty(isolate, object, deleted_property_name, object, NONE);
     CHECK(JSObject::DeleteProperty(object, deleted_property_name,
@@ -1685,7 +1687,7 @@ TEST(AllocateJSObjectFromMap) {
     Handle<JSObject> object = Handle<JSObject>::cast(
         v8::Utils::OpenHandle(*CompileRun("var object = {a:1,b:2, 1:1, 2:2}; "
                                           "object")));
-    JSObject::NormalizeProperties(object, KEEP_INOBJECT_PROPERTIES, 0,
+    JSObject::NormalizeProperties(isolate, object, KEEP_INOBJECT_PROPERTIES, 0,
                                   "Normalize");
     Handle<JSObject> result = Handle<JSObject>::cast(
         ft.Call(handle(object->map(), isolate),

test/cctest/test-hashcode.cc

@@ -96,7 +96,7 @@ TEST(AddHashCodeToSlowObject) {
   Handle<JSObject> obj =
       isolate->factory()->NewJSObject(isolate->object_function());
   CHECK(obj->HasFastProperties());
-  JSObject::NormalizeProperties(obj, CLEAR_INOBJECT_PROPERTIES, 0,
+  JSObject::NormalizeProperties(isolate, obj, CLEAR_INOBJECT_PROPERTIES, 0,
                                 "cctest/test-hashcode");
   CHECK(obj->raw_properties_or_hash().IsNameDictionary());
 
@@ -165,7 +165,7 @@ TEST(TransitionFastWithPropertyArrayToSlow) {
   CHECK(obj->raw_properties_or_hash().IsPropertyArray());
   CHECK_EQ(hash, obj->property_array().Hash());
 
-  JSObject::NormalizeProperties(obj, KEEP_INOBJECT_PROPERTIES, 0,
+  JSObject::NormalizeProperties(isolate, obj, KEEP_INOBJECT_PROPERTIES, 0,
                                 "cctest/test-hashcode");
   CheckDictionaryObject(obj, hash);
 }
@@ -179,7 +179,7 @@ TEST(TransitionSlowToSlow) {
   CompileRun(source);
 
   Handle<JSObject> obj = GetGlobal<JSObject>("x");
-  JSObject::NormalizeProperties(obj, CLEAR_INOBJECT_PROPERTIES, 0,
+  JSObject::NormalizeProperties(isolate, obj, CLEAR_INOBJECT_PROPERTIES, 0,
                                 "cctest/test-hashcode");
   CHECK(obj->raw_properties_or_hash().IsNameDictionary());
 
@@ -199,7 +199,7 @@ TEST(TransitionSlowToFastWithoutProperties) {
 
   Handle<JSObject> obj =
       isolate->factory()->NewJSObject(isolate->object_function());
-  JSObject::NormalizeProperties(obj, CLEAR_INOBJECT_PROPERTIES, 0,
+  JSObject::NormalizeProperties(isolate, obj, CLEAR_INOBJECT_PROPERTIES, 0,
                                 "cctest/test-hashcode");
   CHECK(obj->raw_properties_or_hash().IsNameDictionary());