[heap] Scavenger: Move code entry slot recording to promoted visitor

Bug: chromium:738865
Change-Id: Ic30a3e1012771d2e37b0e10aa59ab348a40bac10
Reviewed-on: https://chromium-review.googlesource.com/574714Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46717}

src/heap/scavenger-inl.h

@@ -121,30 +121,6 @@ void Scavenger::EvacuateObjectDefault(Map* map, HeapObject** slot,
   FatalProcessOutOfMemory("Scavenger: semi-space copy\n");
 }
 
-void Scavenger::EvacuateJSFunction(Map* map, HeapObject** slot,
-                                   JSFunction* object, int object_size) {
-  EvacuateObjectDefault(map, slot, object, object_size);
-
-  if (!is_incremental_marking_) return;
-
-  MapWord map_word = object->map_word();
-  DCHECK(map_word.IsForwardingAddress());
-  HeapObject* target = map_word.ToForwardingAddress();
-
-  // TODO(mlippautz): Notify collector of this object so we don't have to
-  // retrieve the state our of thin air.
-  if (ObjectMarking::IsBlack(target, MarkingState::Internal(target))) {
-    // This object is black and it might not be rescanned by marker.
-    // We should explicitly record code entry slot for compaction because
-    // promotion queue processing (IteratePromotedObjectPointers) will
-    // miss it as it is not HeapObject-tagged.
-    Address code_entry_slot = target->address() + JSFunction::kCodeEntryOffset;
-    Code* code = Code::cast(Code::GetObjectFromEntryAddress(code_entry_slot));
-    heap()->mark_compact_collector()->RecordCodeEntrySlot(
-        target, code_entry_slot, code);
-  }
-}
-
 void Scavenger::EvacuateThinString(Map* map, HeapObject** slot,
                                    ThinString* object, int object_size) {
   if (!is_incremental_marking_) {
@@ -203,9 +179,6 @@ void Scavenger::EvacuateObject(HeapObject** slot, Map* map,
     case kVisitShortcutCandidate:
       EvacuateShortcutCandidate(map, slot, ConsString::cast(source), size);
       break;
-    case kVisitJSFunction:
-      EvacuateJSFunction(map, slot, JSFunction::cast(source), size);
-      break;
     default:
       EvacuateObjectDefault(map, slot, source, size);
       break;

src/heap/scavenger.cc

@@ -50,11 +50,13 @@ class IterateAndScavengePromotedObjectsVisitor final : public ObjectVisitor {
   }
 
   inline void VisitCodeEntry(JSFunction* host, Address code_entry_slot) final {
-    // Black allocation requires us to process objects referenced by
-    // promoted objects.
-    if (heap_->incremental_marking()->black_allocation()) {
+    // Black allocation is not enabled during Scavenges.
+    DCHECK(!heap_->incremental_marking()->black_allocation());
+
+    if (ObjectMarking::IsBlack(host, MarkingState::Internal(host))) {
       Code* code = Code::cast(Code::GetObjectFromEntryAddress(code_entry_slot));
-      heap_->incremental_marking()->WhiteToGreyAndPush(code);
+      heap_->mark_compact_collector()->RecordCodeEntrySlot(
+          host, code_entry_slot, code);
     }
   }