Revert of Prepare to enable in-object properties in subclasses on a case by...

Revert of Prepare to enable in-object properties in subclasses on a case by case basis. (patchset #3 id:100001 of https://codereview.chromium.org/1448313002/ )

Reason for revert:
Breaks GC stress: https://build.chromium.org/p/client.v8/builders/V8%20Mac%20GC%20Stress/builds/3174/steps/Mjsunit/logs/classes-subclass-buil..

Original issue's description:
> Prepare to enable in-object properties in subclasses on a case by case basis.
>
> Minor cleanup in VisitorId selection.
>
> Committed: https://crrev.com/7c449a62edfc03aed84d94da323dcfe2b51a3600
> Cr-Commit-Position: refs/heads/master@{#32030}

TBR=verwaest@chromium.org,mstarzinger@chromium.org,ishell@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1449423002

Cr-Commit-Position: refs/heads/master@{#32041}

src/heap/objects-visiting.cc

@@ -79,6 +79,14 @@ StaticVisitorBase::VisitorId StaticVisitorBase::GetVisitorId(
     case WEAK_CELL_TYPE:
       return kVisitWeakCell;
 
+    case JS_SET_TYPE:
+      return GetVisitorIdForSize(kVisitStruct, kVisitStructGeneric,
+                                 JSSet::kSize, has_unboxed_fields);
+
+    case JS_MAP_TYPE:
+      return GetVisitorIdForSize(kVisitStruct, kVisitStructGeneric,
+                                 JSMap::kSize, has_unboxed_fields);
+
     case JS_WEAK_MAP_TYPE:
     case JS_WEAK_SET_TYPE:
       return kVisitJSWeakCollection;
@@ -89,16 +97,24 @@ StaticVisitorBase::VisitorId StaticVisitorBase::GetVisitorId(
     case SHARED_FUNCTION_INFO_TYPE:
       return kVisitSharedFunctionInfo;
 
-    case JS_SET_TYPE:
-    case JS_MAP_TYPE:
     case JS_PROXY_TYPE:
+      return GetVisitorIdForSize(kVisitStruct, kVisitStructGeneric,
+                                 JSProxy::kSize, has_unboxed_fields);
+
     case JS_FUNCTION_PROXY_TYPE:
       return GetVisitorIdForSize(kVisitStruct, kVisitStructGeneric,
-                                 instance_size, has_unboxed_fields);
+                                 JSFunctionProxy::kSize, has_unboxed_fields);
+
+    case FOREIGN_TYPE:
+      return GetVisitorIdForSize(kVisitDataObject, kVisitDataObjectGeneric,
+                                 Foreign::kSize, has_unboxed_fields);
 
     case SYMBOL_TYPE:
       return kVisitSymbol;
 
+    case FILLER_TYPE:
+      return kVisitDataObjectGeneric;
+
     case JS_ARRAY_BUFFER_TYPE:
       return kVisitJSArrayBuffer;
 
@@ -127,10 +143,6 @@ StaticVisitorBase::VisitorId StaticVisitorBase::GetVisitorId(
     case JS_FUNCTION_TYPE:
       return kVisitJSFunction;
 
-    case FILLER_TYPE:
-      if (instance_size == kPointerSize) return kVisitDataObjectGeneric;
-    // Fall through.
-    case FOREIGN_TYPE:
     case HEAP_NUMBER_TYPE:
     case MUTABLE_HEAP_NUMBER_TYPE:
     case SIMD128_VALUE_TYPE:

src/objects.cc

@@ -11897,75 +11897,6 @@ void JSFunction::SetInitialMap(Handle<JSFunction> function, Handle<Map> map,
 }
 
 
-namespace {
-
-bool CanSubclassHaveInobjectProperties(InstanceType instance_type) {
-  switch (instance_type) {
-    case JS_OBJECT_TYPE:
-    case JS_CONTEXT_EXTENSION_OBJECT_TYPE:
-    case JS_GENERATOR_OBJECT_TYPE:
-    case JS_MODULE_TYPE:
-    case JS_VALUE_TYPE:
-    case JS_DATE_TYPE:
-    case JS_ARRAY_TYPE:
-    case JS_MESSAGE_OBJECT_TYPE:
-    case JS_SET_ITERATOR_TYPE:
-    case JS_MAP_ITERATOR_TYPE:
-    case JS_ITERATOR_RESULT_TYPE:
-      return true;
-
-    case JS_TYPED_ARRAY_TYPE:
-    case JS_DATA_VIEW_TYPE:
-    case JS_REGEXP_TYPE:
-    case JS_SET_TYPE:
-    case JS_MAP_TYPE:
-    case JS_PROXY_TYPE:
-    case JS_FUNCTION_PROXY_TYPE:
-    case JS_WEAK_MAP_TYPE:
-    case JS_WEAK_SET_TYPE:
-    case JS_ARRAY_BUFFER_TYPE:
-    case JS_FUNCTION_TYPE:
-      return false;
-
-    case JS_GLOBAL_PROXY_TYPE:
-    case JS_GLOBAL_OBJECT_TYPE:
-    case FIXED_ARRAY_TYPE:
-    case FIXED_DOUBLE_ARRAY_TYPE:
-    case ODDBALL_TYPE:
-    case FOREIGN_TYPE:
-    case MAP_TYPE:
-    case CODE_TYPE:
-    case CELL_TYPE:
-    case PROPERTY_CELL_TYPE:
-    case WEAK_CELL_TYPE:
-    case SYMBOL_TYPE:
-    case BYTECODE_ARRAY_TYPE:
-    case HEAP_NUMBER_TYPE:
-    case MUTABLE_HEAP_NUMBER_TYPE:
-    case SIMD128_VALUE_TYPE:
-    case FILLER_TYPE:
-    case BYTE_ARRAY_TYPE:
-    case FREE_SPACE_TYPE:
-    case SHARED_FUNCTION_INFO_TYPE:
-
-#define TYPED_ARRAY_CASE(Type, type, TYPE, ctype, size) \
-  case FIXED_##TYPE##_ARRAY_TYPE:
-#undef TYPED_ARRAY_CASE
-
-#define MAKE_STRUCT_CASE(NAME, Name, name) case NAME##_TYPE:
-      STRUCT_LIST(MAKE_STRUCT_CASE)
-#undef MAKE_STRUCT_CASE
-      // We must not end up here for these instance types at all.
-      UNREACHABLE();
-    // Fall through.
-    default:
-      return false;
-  }
-}
-
-}  // namespace
-
-
 void JSFunction::EnsureHasInitialMap(Handle<JSFunction> function) {
   if (function->has_initial_map()) return;
   Isolate* isolate = function->GetIsolate();
@@ -12040,27 +11971,25 @@ Handle<Map> JSFunction::EnsureDerivedHasInitialMap(
   // Finally link initial map and constructor function if the original
   // constructor is actually a subclass constructor.
   if (IsSubclassConstructor(new_target->shared()->kind())) {
-    // TODO(ishell): v8:4531, allow ES6 built-ins subclasses to have
-    // in-object properties.
+// TODO(ishell): v8:4531, allow ES6 built-ins subclasses to have
+// in-object properties.
+#if 0
     InstanceType instance_type = constructor_initial_map->instance_type();
-    Handle<Map> map;
-    if (CanSubclassHaveInobjectProperties(instance_type)) {
-      int internal_fields =
-          JSObject::GetInternalFieldCount(*constructor_initial_map);
-      int pre_allocated = constructor_initial_map->GetInObjectProperties() -
-                          constructor_initial_map->unused_property_fields();
-      int instance_size;
-      int in_object_properties;
-      new_target->CalculateInstanceSizeForDerivedClass(
-          instance_type, internal_fields, &instance_size,
-          &in_object_properties);
-
-      int unused_property_fields = in_object_properties - pre_allocated;
-      map = Map::CopyInitialMap(constructor_initial_map, instance_size,
-                                in_object_properties, unused_property_fields);
-    } else {
-      map = Map::CopyInitialMap(constructor_initial_map);
-    }
+    int internal_fields =
+        JSObject::GetInternalFieldCount(*constructor_initial_map);
+    int pre_allocated = constructor_initial_map->GetInObjectProperties() -
+                            constructor_initial_map->unused_property_fields();
+    int instance_size;
+    int in_object_properties;
+    new_target->CalculateInstanceSizeForDerivedClass(
+        instance_type, internal_fields, &instance_size, &in_object_properties);
+
+    int unused_property_fields = in_object_properties - pre_allocated;
+    Handle<Map> map =
+        Map::CopyInitialMap(constructor_initial_map, instance_size,
+                            in_object_properties, unused_property_fields);
+#endif
+    Handle<Map> map = Map::CopyInitialMap(constructor_initial_map);
 
     JSFunction::SetInitialMap(new_target, map, prototype);
     map->SetConstructor(*constructor);