[js weak refs] Add WeakCell.prototype.holdings

BUG=v8:8179

Change-Id: I528e64fafff2dc00808c48107799d39603f0ca48
Reviewed-on: https://chromium-review.googlesource.com/c/1275823
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56697}

src/bootstrapper.cc

@@ -4564,6 +4564,10 @@ void Genesis::InitializeGlobal_harmony_weak_refs() {
         isolate(), weak_cell_prototype, factory->to_string_tag_symbol(),
         factory->WeakCell_string(),
         static_cast<PropertyAttributes>(DONT_ENUM | READ_ONLY));
+
+    SimpleInstallGetter(isolate(), weak_cell_prototype,
+                        factory->holdings_string(),
+                        Builtins::kWeakCellHoldingsGetter, false);
   }
 
   {

src/builtins/builtins-definitions.h

@@ -1334,6 +1334,7 @@ namespace internal {
   CPP(Trace)                                                                   \
                                                                                \
   /* Weak refs */                                                              \
+  CPP(WeakCellHoldingsGetter)                                                  \
   CPP(WeakFactoryCleanupIteratorNext)                                          \
   CPP(WeakFactoryConstructor)                                                  \
   CPP(WeakFactoryMakeCell)

src/builtins/builtins-weak-refs.cc

@@ -42,6 +42,8 @@ BUILTIN(WeakFactoryMakeCell) {
   // SameValue(target, holdings).
   Handle<JSObject> js_object = Handle<JSObject>::cast(object);
 
+  Handle<Object> holdings = args.atOrUndefined(isolate, 2);
+
   // TODO(marja): Realms.
 
   Handle<Map> weak_cell_map(isolate->native_context()->js_weak_cell_map(),
@@ -54,6 +56,7 @@ BUILTIN(WeakFactoryMakeCell) {
       Handle<JSWeakCell>::cast(isolate->factory()->NewJSObjectFromMap(
           weak_cell_map, TENURED, Handle<AllocationSite>::null()));
   weak_cell->set_target(*js_object);
+  weak_cell->set_holdings(*holdings);
   weak_factory->AddWeakCell(*weak_cell);
   return *weak_cell;
 }
@@ -73,5 +76,11 @@ BUILTIN(WeakFactoryCleanupIteratorNext) {
   return *isolate->factory()->NewJSIteratorResult(weak_cell_object, false);
 }
 
+BUILTIN(WeakCellHoldingsGetter) {
+  HandleScope scope(isolate);
+  CHECK_RECEIVER(JSWeakCell, weak_cell, "get WeakCell.holdings");
+  return weak_cell->holdings();
+}
+
 }  // namespace internal
 }  // namespace v8

src/heap-symbols.h

@@ -155,6 +155,7 @@
   V(_, grapheme_string, "grapheme")                                   \
   V(_, groups_string, "groups")                                       \
   V(_, has_string, "has")                                             \
+  V(_, holdings_string, "holdings")                                   \
   V(_, ignoreCase_string, "ignoreCase")                               \
   V(_, illegal_access_string, "illegal access")                       \
   V(_, illegal_argument_string, "illegal argument")                   \

src/objects-printer.cc

@@ -1279,6 +1279,7 @@ void JSWeakCell::JSWeakCellPrint(std::ostream& os) {
   JSObjectPrintHeader(os, this, "JSWeakCell");
   os << "\n - factory: " << Brief(factory());
   os << "\n - target: " << Brief(target());
+  os << "\n - holdings: " << Brief(holdings());
   os << "\n - prev: " << Brief(prev());
   os << "\n - next: " << Brief(next());
   os << "\n";

src/objects/js-weak-refs-inl.h

@@ -24,6 +24,7 @@ CAST_ACCESSOR(JSWeakFactory)
 
 ACCESSORS(JSWeakCell, factory, JSWeakFactory, kFactoryOffset)
 ACCESSORS(JSWeakCell, target, Object, kTargetOffset)
+ACCESSORS(JSWeakCell, holdings, Object, kHoldingsOffset)
 ACCESSORS(JSWeakCell, next, Object, kNextOffset)
 ACCESSORS(JSWeakCell, prev, Object, kPrevOffset)
 CAST_ACCESSOR(JSWeakCell)

src/objects/js-weak-refs.h

@@ -59,6 +59,7 @@ class JSWeakCell : public JSObject {
 
   DECL_ACCESSORS(factory, JSWeakFactory)
   DECL_ACCESSORS(target, Object)
+  DECL_ACCESSORS(holdings, Object)
 
   // For storing doubly linked lists of JSWeakCells in JSWeakFactory.
   DECL_ACCESSORS(prev, Object)
@@ -66,7 +67,8 @@ class JSWeakCell : public JSObject {
 
   static const int kFactoryOffset = JSObject::kHeaderSize;
   static const int kTargetOffset = kFactoryOffset + kPointerSize;
-  static const int kPrevOffset = kTargetOffset + kPointerSize;
+  static const int kHoldingsOffset = kTargetOffset + kPointerSize;
+  static const int kPrevOffset = kHoldingsOffset + kPointerSize;
   static const int kNextOffset = kPrevOffset + kPointerSize;
   static const int kSize = kNextOffset + kPointerSize;
 

test/mjsunit/harmony/weakrefs/basics.js

@@ -31,8 +31,55 @@
   assertEquals(wc.toString(), "[object WeakCell]");
   assertNotSame(wc.__proto__, Object.prototype);
   assertSame(wc.__proto__.__proto__, Object.prototype);
+  assertEquals(wc.holdings, undefined);
+  let desc = Object.getOwnPropertyDescriptor(wc.__proto__, "holdings");
+  assertEquals(true, desc.configurable);
+  assertEquals(false, desc.enumerable);
+  assertEquals("function", typeof desc.get);
+  assertEquals(undefined, desc.set);
+})();
+
+(function TestMakeCellWithHoldings() {
+  let wf = new WeakFactory();
+  let obj = {a: 1};
+  let holdings = {b: 2};
+  let wc = wf.makeCell(obj, holdings);
+  assertSame(wc.holdings, holdings);
+})();
+
+(function TestMakeCellWithHoldingsSetHoldings() {
+  let wf = new WeakFactory();
+  let obj = {a: 1};
+  let holdings = {b: 2};
+  let wc = wf.makeCell(obj, holdings);
+  assertSame(wc.holdings, holdings);
+  wc.holdings = 5;
+  assertSame(wc.holdings, holdings);
+})();
+
+(function TestMakeCellWithHoldingsSetHoldingsStrict() {
+  "use strict";
+  let wf = new WeakFactory();
+  let obj = {a: 1};
+  let holdings = {b: 2};
+  let wc = wf.makeCell(obj, holdings);
+  assertSame(wc.holdings, holdings);
+  assertThrows(() => { wc.holdings = 5; }, TypeError);
+  assertSame(wc.holdings, holdings);
 })();
 
 (function TestMakeCellWithoutWeakFactory() {
   assertThrows(() => WeakFactory.prototype.makeCell.call({}, {}), TypeError);
+  // Does not throw:
+  let wf = new WeakFactory();
+  WeakFactory.prototype.makeCell.call(wf, {});
+})();
+
+(function TestHoldingsWithoutWeakCell() {
+  let wf = new WeakFactory();
+  let wc = wf.makeCell({});
+  let holdings_getter = Object.getOwnPropertyDescriptor(wc.__proto__, "holdings").get;
+  assertThrows(() => holdings_getter.call({}), TypeError);
+  // Does not throw:
+  holdings_getter.call(wc);
 })();

test/mjsunit/harmony/weakrefs/iterating-weak-cells.js

@@ -13,10 +13,14 @@ let cleanup = function(iter) {
   }
   assertEquals(cells.length, 2);
   if (cells[0] == wc1) {
+    assertEquals(cells[0].holdings, 1);
     assertEquals(cells[1], wc2);
+    assertEquals(cells[1].holdings, 2);
   } else {
     assertEquals(cells[0], wc2);
+    assertEquals(cells[0].holdings, 2);
     assertEquals(cells[1], wc1);
+    assertEquals(cells[1].holdings, 1);
   }
   cleanup_called = true;
 }
@@ -24,8 +28,8 @@ let cleanup = function(iter) {
 let wf = new WeakFactory(cleanup);
 let o1 = {};
 let o2 = {};
-let wc1 = wf.makeCell(o1);
-let wc2 = wf.makeCell(o2);
+let wc1 = wf.makeCell(o1, 1);
+let wc2 = wf.makeCell(o2, 2);
 
 gc();
 assertFalse(cleanup_called);

tools/v8heapconst.py

@@ -295,41 +295,41 @@ KNOWN_MAPS = {
   ("RO_SPACE", 0x02699): (171, "Tuple2Map"),
   ("RO_SPACE", 0x02739): (173, "ArrayBoilerplateDescriptionMap"),
   ("RO_SPACE", 0x02a79): (161, "InterceptorInfoMap"),
-  ("RO_SPACE", 0x04f49): (153, "AccessCheckInfoMap"),
-  ("RO_SPACE", 0x04f99): (154, "AccessorInfoMap"),
-  ("RO_SPACE", 0x04fe9): (155, "AccessorPairMap"),
-  ("RO_SPACE", 0x05039): (156, "AliasedArgumentsEntryMap"),
-  ("RO_SPACE", 0x05089): (157, "AllocationMementoMap"),
-  ("RO_SPACE", 0x050d9): (158, "AsyncGeneratorRequestMap"),
-  ("RO_SPACE", 0x05129): (159, "DebugInfoMap"),
-  ("RO_SPACE", 0x05179): (160, "FunctionTemplateInfoMap"),
-  ("RO_SPACE", 0x051c9): (162, "InterpreterDataMap"),
-  ("RO_SPACE", 0x05219): (163, "ModuleInfoEntryMap"),
-  ("RO_SPACE", 0x05269): (164, "ModuleMap"),
-  ("RO_SPACE", 0x052b9): (165, "ObjectTemplateInfoMap"),
-  ("RO_SPACE", 0x05309): (166, "PromiseCapabilityMap"),
-  ("RO_SPACE", 0x05359): (167, "PromiseReactionMap"),
-  ("RO_SPACE", 0x053a9): (168, "PrototypeInfoMap"),
-  ("RO_SPACE", 0x053f9): (169, "ScriptMap"),
-  ("RO_SPACE", 0x05449): (170, "StackFrameInfoMap"),
-  ("RO_SPACE", 0x05499): (172, "Tuple3Map"),
-  ("RO_SPACE", 0x054e9): (174, "WasmDebugInfoMap"),
-  ("RO_SPACE", 0x05539): (175, "WasmExportedFunctionDataMap"),
-  ("RO_SPACE", 0x05589): (176, "CallableTaskMap"),
-  ("RO_SPACE", 0x055d9): (177, "CallbackTaskMap"),
-  ("RO_SPACE", 0x05629): (178, "PromiseFulfillReactionJobTaskMap"),
-  ("RO_SPACE", 0x05679): (179, "PromiseRejectReactionJobTaskMap"),
-  ("RO_SPACE", 0x056c9): (180, "PromiseResolveThenableJobTaskMap"),
-  ("RO_SPACE", 0x05719): (181, "MicrotaskQueueMap"),
-  ("RO_SPACE", 0x05769): (182, "AllocationSiteWithWeakNextMap"),
-  ("RO_SPACE", 0x057b9): (182, "AllocationSiteWithoutWeakNextMap"),
-  ("RO_SPACE", 0x05809): (214, "LoadHandler1Map"),
-  ("RO_SPACE", 0x05859): (214, "LoadHandler2Map"),
-  ("RO_SPACE", 0x058a9): (214, "LoadHandler3Map"),
-  ("RO_SPACE", 0x058f9): (221, "StoreHandler0Map"),
-  ("RO_SPACE", 0x05949): (221, "StoreHandler1Map"),
-  ("RO_SPACE", 0x05999): (221, "StoreHandler2Map"),
-  ("RO_SPACE", 0x059e9): (221, "StoreHandler3Map"),
+  ("RO_SPACE", 0x04f61): (153, "AccessCheckInfoMap"),
+  ("RO_SPACE", 0x04fb1): (154, "AccessorInfoMap"),
+  ("RO_SPACE", 0x05001): (155, "AccessorPairMap"),
+  ("RO_SPACE", 0x05051): (156, "AliasedArgumentsEntryMap"),
+  ("RO_SPACE", 0x050a1): (157, "AllocationMementoMap"),
+  ("RO_SPACE", 0x050f1): (158, "AsyncGeneratorRequestMap"),
+  ("RO_SPACE", 0x05141): (159, "DebugInfoMap"),
+  ("RO_SPACE", 0x05191): (160, "FunctionTemplateInfoMap"),
+  ("RO_SPACE", 0x051e1): (162, "InterpreterDataMap"),
+  ("RO_SPACE", 0x05231): (163, "ModuleInfoEntryMap"),
+  ("RO_SPACE", 0x05281): (164, "ModuleMap"),
+  ("RO_SPACE", 0x052d1): (165, "ObjectTemplateInfoMap"),
+  ("RO_SPACE", 0x05321): (166, "PromiseCapabilityMap"),
+  ("RO_SPACE", 0x05371): (167, "PromiseReactionMap"),
+  ("RO_SPACE", 0x053c1): (168, "PrototypeInfoMap"),
+  ("RO_SPACE", 0x05411): (169, "ScriptMap"),
+  ("RO_SPACE", 0x05461): (170, "StackFrameInfoMap"),
+  ("RO_SPACE", 0x054b1): (172, "Tuple3Map"),
+  ("RO_SPACE", 0x05501): (174, "WasmDebugInfoMap"),
+  ("RO_SPACE", 0x05551): (175, "WasmExportedFunctionDataMap"),
+  ("RO_SPACE", 0x055a1): (176, "CallableTaskMap"),
+  ("RO_SPACE", 0x055f1): (177, "CallbackTaskMap"),
+  ("RO_SPACE", 0x05641): (178, "PromiseFulfillReactionJobTaskMap"),
+  ("RO_SPACE", 0x05691): (179, "PromiseRejectReactionJobTaskMap"),
+  ("RO_SPACE", 0x056e1): (180, "PromiseResolveThenableJobTaskMap"),
+  ("RO_SPACE", 0x05731): (181, "MicrotaskQueueMap"),
+  ("RO_SPACE", 0x05781): (182, "AllocationSiteWithWeakNextMap"),
+  ("RO_SPACE", 0x057d1): (182, "AllocationSiteWithoutWeakNextMap"),
+  ("RO_SPACE", 0x05821): (214, "LoadHandler1Map"),
+  ("RO_SPACE", 0x05871): (214, "LoadHandler2Map"),
+  ("RO_SPACE", 0x058c1): (214, "LoadHandler3Map"),
+  ("RO_SPACE", 0x05911): (221, "StoreHandler0Map"),
+  ("RO_SPACE", 0x05961): (221, "StoreHandler1Map"),
+  ("RO_SPACE", 0x059b1): (221, "StoreHandler2Map"),
+  ("RO_SPACE", 0x05a01): (221, "StoreHandler3Map"),
   ("MAP_SPACE", 0x00139): (1057, "ExternalMap"),
   ("MAP_SPACE", 0x00189): (1073, "JSMessageObjectMap"),
 }