[ptr-compr] Isolatify Map::MigrateToMap() and friends

... and DescriptorArray.

Bug: v8:9353
Change-Id: Ie05cbdc57f95e2edadbbed47cc2252bd381a76c8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1683727Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62499}

src/objects/descriptor-array-inl.h

@@ -107,9 +107,14 @@ ObjectSlot DescriptorArray::GetDescriptorSlot(int descriptor) {
 }
 
 Name DescriptorArray::GetKey(int descriptor_number) const {
+  Isolate* isolate = GetIsolateForPtrCompr(*this);
+  return GetKey(isolate, descriptor_number);
+}
+
+Name DescriptorArray::GetKey(Isolate* isolate, int descriptor_number) const {
   DCHECK_LT(descriptor_number, number_of_descriptors());
   int entry_offset = OffsetOfDescriptorAt(descriptor_number);
-  return Name::cast(EntryKeyField::Relaxed_Load(*this, entry_offset));
+  return Name::cast(EntryKeyField::Relaxed_Load(isolate, *this, entry_offset));
 }
 
 void DescriptorArray::SetKey(int descriptor_number, Name key) {
@@ -124,7 +129,12 @@ int DescriptorArray::GetSortedKeyIndex(int descriptor_number) {
 }
 
 Name DescriptorArray::GetSortedKey(int descriptor_number) {
-  return GetKey(GetSortedKeyIndex(descriptor_number));
+  Isolate* isolate = GetIsolateForPtrCompr(*this);
+  return GetSortedKey(isolate, descriptor_number);
+}
+
+Name DescriptorArray::GetSortedKey(Isolate* isolate, int descriptor_number) {
+  return GetKey(isolate, GetSortedKeyIndex(descriptor_number));
 }
 
 void DescriptorArray::SetSortedKey(int descriptor_number, int pointer) {
@@ -133,7 +143,13 @@ void DescriptorArray::SetSortedKey(int descriptor_number, int pointer) {
 }
 
 Object DescriptorArray::GetStrongValue(int descriptor_number) {
-  return GetValue(descriptor_number).cast<Object>();
+  Isolate* isolate = GetIsolateForPtrCompr(*this);
+  return GetStrongValue(isolate, descriptor_number);
+}
+
+Object DescriptorArray::GetStrongValue(Isolate* isolate,
+                                       int descriptor_number) {
+  return GetValue(isolate, descriptor_number).cast<Object>();
 }
 
 void DescriptorArray::SetValue(int descriptor_number, MaybeObject value) {
@@ -144,9 +160,14 @@ void DescriptorArray::SetValue(int descriptor_number, MaybeObject value) {
 }
 
 MaybeObject DescriptorArray::GetValue(int descriptor_number) {
+  Isolate* isolate = GetIsolateForPtrCompr(*this);
+  return GetValue(isolate, descriptor_number);
+}
+
+MaybeObject DescriptorArray::GetValue(Isolate* isolate, int descriptor_number) {
   DCHECK_LT(descriptor_number, number_of_descriptors());
   int entry_offset = OffsetOfDescriptorAt(descriptor_number);
-  return EntryValueField::Relaxed_Load(*this, entry_offset);
+  return EntryValueField::Relaxed_Load(isolate, *this, entry_offset);
 }
 
 PropertyDetails DescriptorArray::GetDetails(int descriptor_number) {
@@ -169,8 +190,14 @@ int DescriptorArray::GetFieldIndex(int descriptor_number) {
 }
 
 FieldType DescriptorArray::GetFieldType(int descriptor_number) {
+  Isolate* isolate = GetIsolateForPtrCompr(*this);
+  return GetFieldType(isolate, descriptor_number);
+}
+
+FieldType DescriptorArray::GetFieldType(Isolate* isolate,
+                                        int descriptor_number) {
   DCHECK_EQ(GetDetails(descriptor_number).location(), kField);
-  MaybeObject wrapped_type = GetValue(descriptor_number);
+  MaybeObject wrapped_type = GetValue(isolate, descriptor_number);
   return Map::UnwrapFieldType(wrapped_type);
 }
 

src/objects/descriptor-array.h

@@ -73,13 +73,18 @@ class DescriptorArray : public HeapObject {
 
   // Accessors for fetching instance descriptor at descriptor number.
   inline Name GetKey(int descriptor_number) const;
+  inline Name GetKey(Isolate* isolate, int descriptor_number) const;
   inline Object GetStrongValue(int descriptor_number);
+  inline Object GetStrongValue(Isolate* isolate, int descriptor_number);
   inline MaybeObject GetValue(int descriptor_number);
+  inline MaybeObject GetValue(Isolate* isolate, int descriptor_number);
   inline PropertyDetails GetDetails(int descriptor_number);
   inline int GetFieldIndex(int descriptor_number);
   inline FieldType GetFieldType(int descriptor_number);
+  inline FieldType GetFieldType(Isolate* isolate, int descriptor_number);
 
   inline Name GetSortedKey(int descriptor_number);
+  inline Name GetSortedKey(Isolate* isolate, int descriptor_number);
   inline int GetSortedKeyIndex(int descriptor_number);
   inline void SetSortedKey(int pointer, int descriptor_number);
 

src/objects/field-index-inl.h

@@ -19,7 +19,7 @@ FieldIndex FieldIndex::ForInObjectOffset(int offset, Encoding encoding) {
   return FieldIndex(true, offset, encoding, 0, 0);
 }
 
-FieldIndex FieldIndex::ForPropertyIndex(const Map map, int property_index,
+FieldIndex FieldIndex::ForPropertyIndex(Map map, int property_index,
                                         Representation representation) {
   DCHECK(map.instance_type() >= FIRST_NONSTRING_TYPE);
   int inobject_properties = map.GetInObjectProperties();
@@ -60,9 +60,15 @@ int FieldIndex::GetLoadByFieldIndex() const {
   return is_double() ? (result | 1) : result;
 }
 
-FieldIndex FieldIndex::ForDescriptor(const Map map, int descriptor_index) {
+FieldIndex FieldIndex::ForDescriptor(Map map, int descriptor_index) {
+  Isolate* isolate = GetIsolateForPtrCompr(map);
+  return ForDescriptor(isolate, map, descriptor_index);
+}
+
+FieldIndex FieldIndex::ForDescriptor(Isolate* isolate, Map map,
+                                     int descriptor_index) {
   PropertyDetails details =
-      map.instance_descriptors().GetDetails(descriptor_index);
+      map.instance_descriptors(isolate).GetDetails(descriptor_index);
   int field_index = details.field_index();
   return ForPropertyIndex(map, field_index, details.representation());
 }

src/objects/field-index.h

@@ -24,10 +24,12 @@ class FieldIndex final {
   FieldIndex() : bit_field_(0) {}
 
   static inline FieldIndex ForPropertyIndex(
-      const Map map, int index,
+      Map map, int index,
       Representation representation = Representation::Tagged());
   static inline FieldIndex ForInObjectOffset(int offset, Encoding encoding);
-  static inline FieldIndex ForDescriptor(const Map map, int descriptor_index);
+  static inline FieldIndex ForDescriptor(Map map, int descriptor_index);
+  static inline FieldIndex ForDescriptor(Isolate* isolate, Map map,
+                                         int descriptor_index);
 
   inline int GetLoadByFieldIndex() const;
 

src/objects/js-objects.cc

@@ -1926,7 +1926,8 @@ MaybeHandle<FixedArray> GetOwnValuesOrEntries(Isolate* isolate,
   int length = 0;
 
   for (int i = 0; i < keys->length(); ++i) {
-    Handle<Name> key = Handle<Name>::cast(handle(keys->get(i), isolate));
+    Handle<Name> key =
+        Handle<Name>::cast(handle(keys->get(isolate, i), isolate));
 
     if (filter & ONLY_ENUMERABLE) {
       PropertyDescriptor descriptor;
@@ -2597,7 +2598,7 @@ void MigrateFastToFast(Isolate* isolate, Handle<JSObject> object,
                        Handle<Map> new_map) {
   Handle<Map> old_map(object->map(), isolate);
   // In case of a regular transition.
-  if (new_map->GetBackPointer() == *old_map) {
+  if (new_map->GetBackPointer(isolate) == *old_map) {
     // If the map does not add named properties, simply set the map.
     if (old_map->NumberOfOwnDescriptors() ==
         new_map->NumberOfOwnDescriptors()) {
@@ -2606,7 +2607,7 @@ void MigrateFastToFast(Isolate* isolate, Handle<JSObject> object,
     }
 
     // If the map adds a new kDescriptor property, simply set the map.
-    PropertyDetails details = new_map->GetLastDescriptorDetails();
+    PropertyDetails details = new_map->GetLastDescriptorDetails(isolate);
     if (details.location() == kDescriptor) {
       object->synchronized_set_map(*new_map);
       return;
@@ -2616,14 +2617,14 @@ void MigrateFastToFast(Isolate* isolate, Handle<JSObject> object,
     // can also simply set the map (modulo a special case for mutable
     // double boxes).
     FieldIndex index =
-        FieldIndex::ForDescriptor(*new_map, new_map->LastAdded());
-    if (index.is_inobject() ||
-        index.outobject_array_index() < object->property_array().length()) {
+        FieldIndex::ForDescriptor(isolate, *new_map, new_map->LastAdded());
+    if (index.is_inobject() || index.outobject_array_index() <
+                                   object->property_array(isolate).length()) {
       // We still need to allocate MutableHeapNumbers for double fields
       // if either double field unboxing is disabled or the double field
       // is in the PropertyArray backing store (where we don't support
       // double field unboxing).
-      if (index.is_double() && !new_map->IsUnboxedDoubleField(index)) {
+      if (index.is_double() && !new_map->IsUnboxedDoubleField(isolate, index)) {
         auto value = isolate->factory()->NewMutableHeapNumberWithHoleNaN();
         object->RawFastPropertyAtPut(index, *value);
       }
@@ -2634,7 +2635,7 @@ void MigrateFastToFast(Isolate* isolate, Handle<JSObject> object,
     // This migration is a transition from a map that has run out of property
     // space. Extend the backing store.
     int grow_by = new_map->UnusedPropertyFields() + 1;
-    Handle<PropertyArray> old_storage(object->property_array(), isolate);
+    Handle<PropertyArray> old_storage(object->property_array(isolate), isolate);
     Handle<PropertyArray> new_storage =
         isolate->factory()->CopyPropertyArrayAndGrow(old_storage, grow_by);
 
@@ -2680,10 +2681,10 @@ void MigrateFastToFast(Isolate* isolate, Handle<JSObject> object,
   Handle<FixedArray> inobject_props =
       isolate->factory()->NewFixedArray(inobject);
 
-  Handle<DescriptorArray> old_descriptors(old_map->instance_descriptors(),
-                                          isolate);
-  Handle<DescriptorArray> new_descriptors(new_map->instance_descriptors(),
-                                          isolate);
+  Handle<DescriptorArray> old_descriptors(
+      old_map->instance_descriptors(isolate), isolate);
+  Handle<DescriptorArray> new_descriptors(
+      new_map->instance_descriptors(isolate), isolate);
   int old_nof = old_map->NumberOfOwnDescriptors();
   int new_nof = new_map->NumberOfOwnDescriptors();
 
@@ -2711,13 +2712,13 @@ void MigrateFastToFast(Isolate* isolate, Handle<JSObject> object,
         }
       } else {
         DCHECK_EQ(kData, old_details.kind());
-        value = handle(old_descriptors->GetStrongValue(i), isolate);
+        value = handle(old_descriptors->GetStrongValue(isolate, i), isolate);
         DCHECK(!old_representation.IsDouble() && !representation.IsDouble());
       }
     } else {
       DCHECK_EQ(kField, old_details.location());
-      FieldIndex index = FieldIndex::ForDescriptor(*old_map, i);
-      if (object->IsUnboxedDoubleField(index)) {
+      FieldIndex index = FieldIndex::ForDescriptor(isolate, *old_map, i);
+      if (object->IsUnboxedDoubleField(isolate, index)) {
         uint64_t old_bits = object->RawFastDoublePropertyAsBitsAt(index);
         if (representation.IsDouble()) {
           value = isolate->factory()->NewMutableHeapNumberFromBits(old_bits);
@@ -2725,7 +2726,7 @@ void MigrateFastToFast(Isolate* isolate, Handle<JSObject> object,
           value = isolate->factory()->NewHeapNumberFromBits(old_bits);
         }
       } else {
-        value = handle(object->RawFastPropertyAt(index), isolate);
+        value = handle(object->RawFastPropertyAt(isolate, index), isolate);
         if (!old_representation.IsDouble() && representation.IsDouble()) {
           DCHECK_IMPLIES(old_representation.IsNone(),
                          value->IsUninitialized(isolate));
@@ -2777,11 +2778,11 @@ void MigrateFastToFast(Isolate* isolate, Handle<JSObject> object,
   int limit = Min(inobject, number_of_fields);
   for (int i = 0; i < limit; i++) {
     FieldIndex index = FieldIndex::ForPropertyIndex(*new_map, i);
-    Object value = inobject_props->get(i);
+    Object value = inobject_props->get(isolate, i);
     // Can't use JSObject::FastPropertyAtPut() because proper map was not set
     // yet.
-    if (new_map->IsUnboxedDoubleField(index)) {
-      DCHECK(value.IsMutableHeapNumber());
+    if (new_map->IsUnboxedDoubleField(isolate, index)) {
+      DCHECK(value.IsMutableHeapNumber(isolate));
       // Ensure that all bits of the double value are preserved.
       object->RawFastDoublePropertyAsBitsAtPut(
           index, MutableHeapNumber::cast(value).value_as_bits());
@@ -2820,15 +2821,15 @@ void MigrateFastToSlow(Isolate* isolate, Handle<JSObject> object,
                        Handle<Map> new_map,
                        int expected_additional_properties) {
   // The global object is always normalized.
-  DCHECK(!object->IsJSGlobalObject());
+  DCHECK(!object->IsJSGlobalObject(isolate));
   // JSGlobalProxy must never be normalized
-  DCHECK(!object->IsJSGlobalProxy());
+  DCHECK(!object->IsJSGlobalProxy(isolate));
 
   DCHECK_IMPLIES(new_map->is_prototype_map(),
                  Map::IsPrototypeChainInvalidated(*new_map));
 
   HandleScope scope(isolate);
-  Handle<Map> map(object->map(), isolate);
+  Handle<Map> map(object->map(isolate), isolate);
 
   // Allocate new content.
   int real_size = map->NumberOfOwnDescriptors();
@@ -2842,33 +2843,33 @@ void MigrateFastToSlow(Isolate* isolate, Handle<JSObject> object,
   Handle<NameDictionary> dictionary =
       NameDictionary::New(isolate, property_count);
 
-  Handle<DescriptorArray> descs(map->instance_descriptors(), isolate);
+  Handle<DescriptorArray> descs(map->instance_descriptors(isolate), isolate);
   for (int i = 0; i < real_size; i++) {
     PropertyDetails details = descs->GetDetails(i);
-    Handle<Name> key(descs->GetKey(i), isolate);
+    Handle<Name> key(descs->GetKey(isolate, i), isolate);
     Handle<Object> value;
     if (details.location() == kField) {
-      FieldIndex index = FieldIndex::ForDescriptor(*map, i);
+      FieldIndex index = FieldIndex::ForDescriptor(isolate, *map, i);
       if (details.kind() == kData) {
-        if (object->IsUnboxedDoubleField(index)) {
+        if (object->IsUnboxedDoubleField(isolate, index)) {
           double old_value = object->RawFastDoublePropertyAt(index);
           value = isolate->factory()->NewHeapNumber(old_value);
         } else {
-          value = handle(object->RawFastPropertyAt(index), isolate);
+          value = handle(object->RawFastPropertyAt(isolate, index), isolate);
           if (details.representation().IsDouble()) {
-            DCHECK(value->IsMutableHeapNumber());
+            DCHECK(value->IsMutableHeapNumber(isolate));
             double old_value = Handle<MutableHeapNumber>::cast(value)->value();
             value = isolate->factory()->NewHeapNumber(old_value);
           }
         }
       } else {
         DCHECK_EQ(kAccessor, details.kind());
-        value = handle(object->RawFastPropertyAt(index), isolate);
+        value = handle(object->RawFastPropertyAt(isolate, index), isolate);
       }
 
     } else {
       DCHECK_EQ(kDescriptor, details.location());
-      value = handle(descs->GetStrongValue(i), isolate);
+      value = handle(descs->GetStrongValue(isolate, i), isolate);
     }
     DCHECK(!value.is_null());
     PropertyDetails d(details.kind(), details.attributes(),
@@ -2933,8 +2934,8 @@ void MigrateFastToSlow(Isolate* isolate, Handle<JSObject> object,
 void JSObject::MigrateToMap(Isolate* isolate, Handle<JSObject> object,
                             Handle<Map> new_map,
                             int expected_additional_properties) {
-  if (object->map() == *new_map) return;
-  Handle<Map> old_map(object->map(), isolate);
+  if (object->map(isolate) == *new_map) return;
+  Handle<Map> old_map(object->map(isolate), isolate);
   NotifyMapChange(old_map, new_map, isolate);
 
   if (old_map->is_dictionary_map()) {
@@ -2958,8 +2959,8 @@ void JSObject::MigrateToMap(Isolate* isolate, Handle<JSObject> object,
       DCHECK(old_map->is_abandoned_prototype_map());
       // Ensure that no transition was inserted for prototype migrations.
       DCHECK_EQ(0, TransitionsAccessor(isolate, old_map).NumberOfTransitions());
-      DCHECK(new_map->GetBackPointer().IsUndefined());
-      DCHECK(object->map() != *old_map);
+      DCHECK(new_map->GetBackPointer(isolate).IsUndefined(isolate));
+      DCHECK(object->map(isolate) != *old_map);
     }
   } else {
     MigrateFastToSlow(isolate, object, new_map, expected_additional_properties);

src/objects/lookup.cc

@@ -614,7 +614,7 @@ void LookupIterator::PrepareTransitionToDataProperty(
     property_details_ =
         PropertyDetails(kData, attributes, PropertyCellType::kNoCell);
   } else {
-    property_details_ = transition->GetLastDescriptorDetails();
+    property_details_ = transition->GetLastDescriptorDetails(isolate_);
     has_property_ = true;
   }
 }
@@ -650,7 +650,7 @@ void LookupIterator::ApplyTransitionToDataProperty(
   if (simple_transition) {
     int number = transition->LastAdded();
     number_ = static_cast<uint32_t>(number);
-    property_details_ = transition->GetLastDescriptorDetails();
+    property_details_ = transition->GetLastDescriptorDetails(isolate_);
     state_ = DATA;
   } else if (receiver->map().is_dictionary_map()) {
     Handle<NameDictionary> dictionary(receiver->property_dictionary(),
@@ -736,7 +736,7 @@ void LookupIterator::TransitionToAccessorProperty(
     if (simple_transition) {
       int number = new_map->LastAdded();
       number_ = static_cast<uint32_t>(number);
-      property_details_ = new_map->GetLastDescriptorDetails();
+      property_details_ = new_map->GetLastDescriptorDetails(isolate_);
       state_ = ACCESSOR;
       return;
     }

src/objects/map-inl.h

@@ -173,8 +173,8 @@ bool Map::TooManyFastProperties(StoreOrigin store_origin) const {
   }
 }
 
-PropertyDetails Map::GetLastDescriptorDetails() const {
-  return instance_descriptors().GetDetails(LastAdded());
+PropertyDetails Map::GetLastDescriptorDetails(Isolate* isolate) const {
+  return instance_descriptors(isolate).GetDetails(LastAdded());
 }
 
 int Map::LastAdded() const {

src/objects/map.h

@@ -633,7 +633,7 @@ class Map : public HeapObject {
   // chain state.
   inline bool IsPrototypeValidityCellValid() const;
 
-  inline PropertyDetails GetLastDescriptorDetails() const;
+  inline PropertyDetails GetLastDescriptorDetails(Isolate* isolate) const;
 
   inline int LastAdded() const;
 

src/objects/transitions-inl.h

@@ -102,9 +102,8 @@ PropertyDetails TransitionsAccessor::GetTargetDetails(Name name, Map target) {
   return descriptors.GetDetails(descriptor);
 }
 
-// static
 PropertyDetails TransitionsAccessor::GetSimpleTargetDetails(Map transition) {
-  return transition.GetLastDescriptorDetails();
+  return transition.GetLastDescriptorDetails(isolate_);
 }
 
 // static

src/objects/transitions.cc

@@ -226,7 +226,7 @@ MaybeHandle<Map> TransitionsAccessor::FindTransitionToDataProperty(
   PropertyAttributes attributes = name->IsPrivate() ? DONT_ENUM : NONE;
   Map target = SearchTransition(*name, kData, attributes);
   if (target.is_null()) return MaybeHandle<Map>();
-  PropertyDetails details = target.GetLastDescriptorDetails();
+  PropertyDetails details = target.GetLastDescriptorDetails(isolate_);
   DCHECK_EQ(attributes, details.attributes());
   DCHECK_EQ(kData, details.kind());
   if (requested_location == kFieldOnly && details.location() != kField) {

src/objects/transitions.h

@@ -147,7 +147,7 @@ class V8_EXPORT_PRIVATE TransitionsAccessor {
   friend class MarkCompactCollector;  // For HasSimpleTransitionTo.
   friend class TransitionArray;
 
-  static inline PropertyDetails GetSimpleTargetDetails(Map transition);
+  inline PropertyDetails GetSimpleTargetDetails(Map transition);
 
   static inline Name GetSimpleTransitionKey(Map transition);
 

test/cctest/test-transitions.cc

@@ -289,7 +289,7 @@ TEST(TransitionArray_SameFieldNamesDifferentAttributes) {
     if (key == *name) {
       // Attributes transition.
       PropertyAttributes attributes =
-          target.GetLastDescriptorDetails().attributes();
+          target.GetLastDescriptorDetails(isolate).attributes();
       CHECK_EQ(*attr_maps[static_cast<int>(attributes)], target);
     } else {
       for (int j = 0; j < PROPS_COUNT; j++) {