Revert of Lazily register prototype users (patchset #2 id:20001 of...

Revert of Lazily register prototype users (patchset #2 id:20001 of https://codereview.chromium.org/1104813004/)

Reason for revert:
Suspected of causing GC stress failures.

Original issue's description:
> Lazily register prototype users
>
> when handing out validity cells to handles; because invalidating said cells is the only time we'll need the user registrations.
> Along the way, fix a corner case in WeakFixedArray, which can now be empty after the recently introduced compaction support.
>
> Committed: https://crrev.com/a4bb7643c076b014816431a9b85af3e2edf828e7
> Cr-Commit-Position: refs/heads/master@{#28047}

TBR=yangguo@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1108583002

Cr-Commit-Position: refs/heads/master@{#28049}

src/objects.h

@@ -1841,11 +1841,9 @@ class JSObject: public JSReceiver {
   static void OptimizeAsPrototype(Handle<JSObject> object,
                                   PrototypeOptimizationMode mode);
   static void ReoptimizeIfPrototype(Handle<JSObject> object);
-  static void LazyRegisterPrototypeUser(Handle<Map> user, Isolate* isolate);
-  static bool RegisterPrototypeUserIfNotRegistered(Handle<JSObject> prototype,
-                                                   Handle<HeapObject> user,
-                                                   Isolate* isolate);
-  static bool UnregisterPrototypeUser(Handle<JSObject> prototype,
+  static void RegisterPrototypeUser(Handle<JSObject> prototype,
+                                    Handle<HeapObject> user);
+  static void UnregisterPrototypeUser(Handle<JSObject> prototype,
                                       Handle<HeapObject> user);
   static void InvalidatePrototypeChains(Map* map);
 
@@ -2623,11 +2621,9 @@ class WeakFixedArray : public FixedArray {
   // If |maybe_array| is not a WeakFixedArray, a fresh one will be allocated.
   static Handle<WeakFixedArray> Add(
       Handle<Object> maybe_array, Handle<HeapObject> value,
-      SearchForDuplicates search_for_duplicates = kAlwaysAdd,
-      bool* was_present = NULL);
+      SearchForDuplicates search_for_duplicates = kAlwaysAdd);
 
-  // Returns true if an entry was found and removed.
-  bool Remove(Handle<HeapObject> value);
+  void Remove(Handle<HeapObject> value);
 
   void Compact();
 
@@ -5848,9 +5844,6 @@ class DependentCode: public FixedArray {
 };
 
 
-class PrototypeInfo;
-
-
 // All heap objects have a Map that describes their structure.
 //  A Map contains information about:
 //  - Size information about the object
@@ -6058,10 +6051,6 @@ class Map: public HeapObject {
   // [prototype_info]: Per-prototype metadata. Aliased with transitions
   // (which prototype maps don't have).
   DECL_ACCESSORS(prototype_info, Object)
-  // PrototypeInfo is created lazily using this helper (which installs it on
-  // the given prototype's map).
-  static Handle<PrototypeInfo> GetOrCreatePrototypeInfo(
-      Handle<JSObject> prototype, Isolate* isolate);
 
   // [prototype chain validity cell]: Associated with a prototype object,
   // stored in that object's map's PrototypeInfo, indicates that prototype
@@ -6134,6 +6123,9 @@ class Map: public HeapObject {
   static void SetPrototype(
       Handle<Map> map, Handle<Object> prototype,
       PrototypeOptimizationMode proto_mode = FAST_PROTOTYPE);
+  static bool ShouldRegisterAsPrototypeUser(Handle<Map> map,
+                                            Handle<JSObject> prototype);
+  bool CanUseOptimizationsBasedOnPrototypeRegistry();
 
   // [constructor]: points back to the function responsible for this map.
   // The field overlaps with the back pointer. All maps in a transition tree

test/cctest/test-heap.cc

@@ -5367,15 +5367,3 @@ TEST(Regress472513) {
   TestRightTrimFixedTypedArray(i::kExternalUint16Array, 8 - 1, 3);
   TestRightTrimFixedTypedArray(i::kExternalUint32Array, 4, 3);
 }
-
-
-TEST(WeakFixedArray) {
-  CcTest::InitializeVM();
-  v8::HandleScope scope(CcTest::isolate());
-
-  Handle<HeapNumber> number = CcTest::i_isolate()->factory()->NewHeapNumber(1);
-  Handle<WeakFixedArray> array = WeakFixedArray::Add(Handle<Object>(), number);
-  array->Remove(number);
-  array->Compact();
-  WeakFixedArray::Add(array, number);
-}

test/mjsunit/prototype-changes.js

-// Copyright 2015 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --allow-natives-syntax
-
-function A() {
-  this.a = "a";
-}
-var a = new A();
-
-function B() {
-  this.b = "b";
-}
-B.prototype = a;
-
-function C() {
-  this.c = "c";
-}
-C.prototype = new B();
-
-var c = new C();
-
-function f(expected) {
-  var result = c.z;
-  assertEquals(expected, result);
-}
-f(undefined);
-f(undefined);
-%OptimizeFunctionOnNextCall(f);
-f(undefined);
-a.z = "z";
-f("z");
-f("z");
-
-// Test updating .__proto__ pointers.
-var p1 = {foo: 1.5};
-var p2 = {}; p2.__proto__ = p1;
-var p3 = {}; p3.__proto__ = p2;
-var o = {}; o.__proto__ = p3;
-
-for (var i = 0; i < 2; i++) o.foo;  // Force registration.
-
-var p1a = {foo: 1.7};
-p2.__proto__ = p1a;
-
-function g(o, expected) {
-  var result = o.foo;
-  assertEquals(expected, result);
-}
-
-g(o, 1.7);
-g(o, 1.7);
-g(o, 1.7);
-Object.defineProperty(p1a, "foo", {get: function() { return "foo"}});
-g(o, "foo");