Revert "[heap] Simplify array buffer tracker"

This reverts commit a402dd63.

Reason for revert: Breaks msan:
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20arm64%20-%20sim%20-%20MSAN/builds/15197

Original change's description:
> [heap] Simplify array buffer tracker
> 
> Retrieve length from the buffer instead of storing in as value in the
> map.
> 
> Change-Id: Icdc87bb46c29fff779bf6e98139324662ced5bf6
> Reviewed-on: https://chromium-review.googlesource.com/518171
> Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
> Reviewed-by: Jochen Eisinger <jochen@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#45600}

NOTRY=true
NOTREECHECKS=true
NOPRESUBMIT=true

TBR=mlippautz@chromium.org,jochen@chromium.org
No-Presubmit: true
No-Tree-Checks: true
No-Try: true

Change-Id: I22e3590528beb911d366b9d93ec302857a631971
Reviewed-on: https://chromium-review.googlesource.com/518117
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45606}

src/heap/array-buffer-tracker-inl.h

@@ -14,7 +14,7 @@ void ArrayBufferTracker::RegisterNew(Heap* heap, JSArrayBuffer* buffer) {
   void* data = buffer->backing_store();
   if (!data) return;
 
-  size_t length = buffer->allocation_length();
+  size_t length = NumberToSize(buffer->byte_length());
   Page* page = Page::FromAddress(buffer->address());
   {
     base::LockGuard<base::RecursiveMutex> guard(page->mutex());
@@ -24,7 +24,7 @@ void ArrayBufferTracker::RegisterNew(Heap* heap, JSArrayBuffer* buffer) {
       tracker = page->local_tracker();
     }
     DCHECK_NOT_NULL(tracker);
-    tracker->Add(buffer);
+    tracker->Add(buffer, length);
   }
   // We may go over the limit of externally allocated memory here. We call the
   // api function to trigger a GC in this case.
@@ -37,29 +37,31 @@ void ArrayBufferTracker::Unregister(Heap* heap, JSArrayBuffer* buffer) {
   if (!data) return;
 
   Page* page = Page::FromAddress(buffer->address());
-  size_t length = buffer->allocation_length();
+  size_t length = 0;
   {
     base::LockGuard<base::RecursiveMutex> guard(page->mutex());
     LocalArrayBufferTracker* tracker = page->local_tracker();
     DCHECK_NOT_NULL(tracker);
-    tracker->Remove(buffer);
+    length = tracker->Remove(buffer);
   }
   heap->update_external_memory(-static_cast<intptr_t>(length));
 }
 
-void LocalArrayBufferTracker::Add(JSArrayBuffer* buffer) {
-  auto ret = array_buffers_.insert(buffer);
+void LocalArrayBufferTracker::Add(Key key, const Value& value) {
+  auto ret = array_buffers_.insert(std::make_pair(key, value));
   USE(ret);
   // Check that we indeed inserted a new value and did not overwrite an existing
   // one (which would be a bug).
   DCHECK(ret.second);
 }
 
-void LocalArrayBufferTracker::Remove(JSArrayBuffer* buffer) {
-  TrackingData::iterator it = array_buffers_.find(buffer);
+LocalArrayBufferTracker::Value LocalArrayBufferTracker::Remove(Key key) {
+  TrackingData::iterator it = array_buffers_.find(key);
   // Check that we indeed find a key to remove.
   DCHECK(it != array_buffers_.end());
+  Value value = it->second;
   array_buffers_.erase(it);
+  return value;
 }
 
 }  // namespace internal

src/heap/array-buffer-tracker.cc

@@ -19,9 +19,9 @@ void LocalArrayBufferTracker::Free(Callback should_free) {
   size_t freed_memory = 0;
   for (TrackingData::iterator it = array_buffers_.begin();
        it != array_buffers_.end();) {
-    JSArrayBuffer* buffer = reinterpret_cast<JSArrayBuffer*>(*it);
+    JSArrayBuffer* buffer = reinterpret_cast<JSArrayBuffer*>(it->first);
     if (should_free(buffer)) {
-      const size_t len = buffer->allocation_length();
+      const size_t len = it->second;
       buffer->FreeBackingStore();
 
       freed_memory += len;
@@ -42,7 +42,7 @@ void LocalArrayBufferTracker::Process(Callback callback) {
   size_t freed_memory = 0;
   for (TrackingData::iterator it = array_buffers_.begin();
        it != array_buffers_.end();) {
-    const CallbackResult result = callback(*it, &new_buffer);
+    const CallbackResult result = callback(it->first, &new_buffer);
     if (result == kKeepEntry) {
       ++it;
     } else if (result == kUpdateEntry) {
@@ -57,13 +57,12 @@ void LocalArrayBufferTracker::Process(Callback callback) {
         tracker = target_page->local_tracker();
       }
       DCHECK_NOT_NULL(tracker);
-      tracker->Add(new_buffer);
+      tracker->Add(new_buffer, it->second);
       if (target_page->InNewSpace()) target_page->mutex()->Unlock();
       it = array_buffers_.erase(it);
     } else if (result == kRemoveEntry) {
-      JSArrayBuffer* buffer = reinterpret_cast<JSArrayBuffer*>(*it);
-      const size_t len = buffer->allocation_length();
-      buffer->FreeBackingStore();
+      const size_t len = it->second;
+      it->first->FreeBackingStore();
       freed_memory += len;
       it = array_buffers_.erase(it);
     } else {

src/heap/array-buffer-tracker.h

@@ -5,7 +5,7 @@
 #ifndef V8_HEAP_ARRAY_BUFFER_TRACKER_H_
 #define V8_HEAP_ARRAY_BUFFER_TRACKER_H_
 
-#include <unordered_set>
+#include <unordered_map>
 
 #include "src/allocation.h"
 #include "src/base/platform/mutex.h"
@@ -60,14 +60,17 @@ class ArrayBufferTracker : public AllStatic {
 // Never use directly but instead always call through |ArrayBufferTracker|.
 class LocalArrayBufferTracker {
  public:
+  typedef JSArrayBuffer* Key;
+  typedef size_t Value;
+
   enum CallbackResult { kKeepEntry, kUpdateEntry, kRemoveEntry };
   enum FreeMode { kFreeDead, kFreeAll };
 
   explicit LocalArrayBufferTracker(Heap* heap) : heap_(heap) {}
   ~LocalArrayBufferTracker();
 
-  inline void Add(JSArrayBuffer* buffer);
-  inline void Remove(JSArrayBuffer* buffer);
+  inline void Add(Key key, const Value& value);
+  inline Value Remove(Key key);
 
   // Frees up array buffers.
   //
@@ -89,16 +92,14 @@ class LocalArrayBufferTracker {
 
   bool IsEmpty() { return array_buffers_.empty(); }
 
-  bool IsTracked(JSArrayBuffer* buffer) {
-    return array_buffers_.find(buffer) != array_buffers_.end();
+  bool IsTracked(Key key) {
+    return array_buffers_.find(key) != array_buffers_.end();
   }
 
  private:
-  typedef std::unordered_set<JSArrayBuffer*> TrackingData;
+  typedef std::unordered_map<Key, Value> TrackingData;
 
   Heap* heap_;
-  // The set contains raw heap pointers which are removed by the GC upon
-  // processing the tracker through its owning page.
   TrackingData array_buffers_;
 };
 

src/heap/mark-compact.cc

@@ -4,8 +4,6 @@
 
 #include "src/heap/mark-compact.h"
 
-#include <unordered_map>
-
 #include "src/base/atomicops.h"
 #include "src/base/bits.h"
 #include "src/base/sys-info.h"