[runtime] Use release/acquire for JSGlobalObject's global dictionary

Bug: v8:7790
Change-Id: I4b6ef907c66bdc0a327d211db2f86ebb75f969a7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2536638Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71183}

src/diagnostics/objects-debug.cc

@@ -884,7 +884,8 @@ void JSGlobalProxy::JSGlobalProxyVerify(Isolate* isolate) {
 void JSGlobalObject::JSGlobalObjectVerify(Isolate* isolate) {
   CHECK(IsJSGlobalObject());
   // Do not check the dummy global object for the builtins.
-  if (global_dictionary().NumberOfElements() == 0 && elements().length() == 0) {
+  if (global_dictionary(kAcquireLoad).NumberOfElements() == 0 &&
+      elements().length() == 0) {
     return;
   }
   JSObjectVerify(isolate);
@@ -1629,7 +1630,8 @@ void JSObject::IncrementSpillStatistics(Isolate* isolate,
     info->number_of_fast_used_fields_ += map().NextFreePropertyIndex();
     info->number_of_fast_unused_fields_ += map().UnusedPropertyFields();
   } else if (IsJSGlobalObject()) {
-    GlobalDictionary dict = JSGlobalObject::cast(*this).global_dictionary();
+    GlobalDictionary dict =
+        JSGlobalObject::cast(*this).global_dictionary(kAcquireLoad);
     info->number_of_slow_used_properties_ += dict.NumberOfElements();
     info->number_of_slow_unused_properties_ +=
         dict.Capacity() - dict.NumberOfElements();

src/diagnostics/objects-printer.cc

@@ -298,8 +298,8 @@ bool JSObject::PrintProperties(std::ostream& os) {  // NOLINT
     }
     return map().NumberOfOwnDescriptors() > 0;
   } else if (IsJSGlobalObject()) {
-    PrintDictionaryContents(os,
-                            JSGlobalObject::cast(*this).global_dictionary());
+    PrintDictionaryContents(
+        os, JSGlobalObject::cast(*this).global_dictionary(kAcquireLoad));
   } else if (V8_DICT_MODE_PROTOTYPES_BOOL) {
     PrintDictionaryContents(os, property_dictionary_ordered());
   } else {

src/heap/factory.cc

@@ -2070,7 +2070,7 @@ Handle<JSGlobalObject> Factory::NewJSGlobalObject(
   LOG(isolate(), MapDetails(*new_map));
 
   // Set up the global object as a normalized object.
-  global->set_global_dictionary(*dictionary);
+  global->set_global_dictionary(*dictionary, kReleaseStore);
   global->synchronized_set_map(*new_map);
 
   // Make sure result is a global object with properties in dictionary.

src/heap/object-stats.cc

@@ -581,7 +581,7 @@ void ObjectStatsCollectorImpl::RecordVirtualFunctionTemplateInfoDetails(
 void ObjectStatsCollectorImpl::RecordVirtualJSGlobalObjectDetails(
     JSGlobalObject object) {
   // Properties.
-  GlobalDictionary properties = object.global_dictionary();
+  GlobalDictionary properties = object.global_dictionary(kAcquireLoad);
   RecordHashTableVirtualObjectStats(object, properties,
                                     ObjectStats::GLOBAL_PROPERTIES_TYPE);
   // Elements.

src/init/bootstrapper.cc

@@ -5149,7 +5149,7 @@ void Genesis::TransferNamedProperties(Handle<JSObject> from,
   } else if (from->IsJSGlobalObject()) {
     // Copy all keys and values in enumeration order.
     Handle<GlobalDictionary> properties(
-        JSGlobalObject::cast(*from).global_dictionary(), isolate());
+        JSGlobalObject::cast(*from).global_dictionary(kAcquireLoad), isolate());
     Handle<FixedArray> indices =
         GlobalDictionary::IterationIndices(isolate(), properties);
     for (int i = 0; i < indices->length(); i++) {

src/objects/js-objects-inl.h

@@ -619,16 +619,9 @@ DEF_GETTER(JSObject, HasIndexedInterceptor, bool) {
   return map(isolate).has_indexed_interceptor();
 }
 
-DEF_GETTER(JSGlobalObject, global_dictionary, GlobalDictionary) {
-  DCHECK(!HasFastProperties(isolate));
-  DCHECK(IsJSGlobalObject(isolate));
-  return GlobalDictionary::cast(raw_properties_or_hash(isolate));
-}
-
-void JSGlobalObject::set_global_dictionary(GlobalDictionary dictionary) {
-  DCHECK(IsJSGlobalObject());
-  set_raw_properties_or_hash(dictionary);
-}
+RELEASE_ACQUIRE_ACCESSORS_CHECKED2(JSGlobalObject, global_dictionary,
+                                   GlobalDictionary, kPropertiesOrHashOffset,
+                                   !HasFastProperties(isolate), true)
 
 DEF_GETTER(JSObject, element_dictionary, NumberDictionary) {
   DCHECK(HasDictionaryElements(isolate) ||

src/objects/js-objects.cc

@@ -327,7 +327,7 @@ Maybe<bool> JSReceiver::SetOrCopyDataProperties(
     int source_length;
     if (from->IsJSGlobalObject()) {
       source_length = JSGlobalObject::cast(*from)
-                          .global_dictionary()
+                          .global_dictionary(kAcquireLoad)
                           .NumberOfEnumerableProperties();
     } else if (V8_DICT_MODE_PROTOTYPES_BOOL) {
       source_length =
@@ -744,13 +744,14 @@ void JSReceiver::DeleteNormalizedProperty(Handle<JSReceiver> object,
     // If we have a global object, invalidate the cell and remove it from the
     // global object's dictionary.
     Handle<GlobalDictionary> dictionary(
-        JSGlobalObject::cast(*object).global_dictionary(), isolate);
+        JSGlobalObject::cast(*object).global_dictionary(kAcquireLoad), isolate);
 
     Handle<PropertyCell> cell(dictionary->CellAt(entry), isolate);
 
     Handle<GlobalDictionary> new_dictionary =
         GlobalDictionary::DeleteEntry(isolate, dictionary, entry);
-    JSGlobalObject::cast(*object).set_global_dictionary(*new_dictionary);
+    JSGlobalObject::cast(*object).set_global_dictionary(*new_dictionary,
+                                                        kReleaseStore);
 
     cell->ClearAndInvalidate(ReadOnlyRoots(isolate));
   } else {
@@ -2392,8 +2393,8 @@ void JSObject::SetNormalizedProperty(Handle<JSObject> object, Handle<Name> name,
 
   if (object->IsJSGlobalObject()) {
     Handle<JSGlobalObject> global_obj = Handle<JSGlobalObject>::cast(object);
-    Handle<GlobalDictionary> dictionary(global_obj->global_dictionary(),
-                                        isolate);
+    Handle<GlobalDictionary> dictionary(
+        global_obj->global_dictionary(kAcquireLoad), isolate);
     ReadOnlyRoots roots(isolate);
     InternalIndex entry = dictionary->FindEntry(isolate, roots, name, hash);
 
@@ -2408,7 +2409,7 @@ void JSObject::SetNormalizedProperty(Handle<JSObject> object, Handle<Name> name,
       value = cell;
       dictionary =
           GlobalDictionary::Add(isolate, dictionary, name, value, details);
-      global_obj->set_global_dictionary(*dictionary);
+      global_obj->set_global_dictionary(*dictionary, kReleaseStore);
     } else {
       Handle<PropertyCell> cell = PropertyCell::PrepareForValue(
           isolate, dictionary, entry, value, details);
@@ -4097,7 +4098,8 @@ Maybe<bool> JSObject::PreventExtensionsWithTransition(
       ReadOnlyRoots roots(isolate);
       if (object->IsJSGlobalObject()) {
         Handle<GlobalDictionary> dictionary(
-            JSGlobalObject::cast(*object).global_dictionary(), isolate);
+            JSGlobalObject::cast(*object).global_dictionary(kAcquireLoad),
+            isolate);
         JSObject::ApplyAttributesToDictionary(isolate, roots, dictionary,
                                               attrs);
       } else if (V8_DICT_MODE_PROTOTYPES_BOOL) {
@@ -4358,8 +4360,9 @@ Object JSObject::SlowReverseLookup(Object value) {
     }
     return GetReadOnlyRoots().undefined_value();
   } else if (IsJSGlobalObject()) {
-    return JSGlobalObject::cast(*this).global_dictionary().SlowReverseLookup(
-        value);
+    return JSGlobalObject::cast(*this)
+        .global_dictionary(kAcquireLoad)
+        .SlowReverseLookup(value);
   } else if (V8_DICT_MODE_PROTOTYPES_BOOL) {
     return property_dictionary_ordered().SlowReverseLookup(GetIsolate(), value);
   } else {
@@ -5035,7 +5038,8 @@ void JSGlobalObject::InvalidatePropertyCell(Handle<JSGlobalObject> global,
   JSObject::InvalidatePrototypeValidityCell(*global);
 
   DCHECK(!global->HasFastProperties());
-  auto dictionary = handle(global->global_dictionary(), global->GetIsolate());
+  auto dictionary =
+      handle(global->global_dictionary(kAcquireLoad), global->GetIsolate());
   InternalIndex entry = dictionary->FindEntry(global->GetIsolate(), name);
   if (entry.is_not_found()) return;
   PropertyCell::InvalidateAndReplaceEntry(global->GetIsolate(), dictionary,

src/objects/js-objects.h

@@ -966,9 +966,7 @@ class JSGlobalObject : public JSSpecialObject {
   // [global proxy]: the global proxy object of the context
   DECL_ACCESSORS(global_proxy, JSGlobalProxy)
 
-  // Gets global object properties.
-  DECL_GETTER(global_dictionary, GlobalDictionary)
-  inline void set_global_dictionary(GlobalDictionary dictionary);
+  DECL_RELEASE_ACQUIRE_ACCESSORS(global_dictionary, GlobalDictionary)
 
   static void InvalidatePropertyCell(Handle<JSGlobalObject> object,
                                      Handle<Name> name);

src/objects/keys.cc

@@ -1003,7 +1003,7 @@ Maybe<bool> KeyAccumulator::CollectOwnPropertyNames(Handle<JSReceiver> receiver,
     } else if (object->IsJSGlobalObject()) {
       enum_keys = GetOwnEnumPropertyDictionaryKeys(
           isolate_, mode_, this, object,
-          JSGlobalObject::cast(*object).global_dictionary());
+          JSGlobalObject::cast(*object).global_dictionary(kAcquireLoad));
     } else if (V8_DICT_MODE_PROTOTYPES_BOOL) {
       enum_keys = GetOwnEnumPropertyDictionaryKeys(
           isolate_, mode_, this, object, object->property_dictionary_ordered());
@@ -1040,7 +1040,8 @@ Maybe<bool> KeyAccumulator::CollectOwnPropertyNames(Handle<JSReceiver> receiver,
       }
     } else if (object->IsJSGlobalObject()) {
       RETURN_NOTHING_IF_NOT_SUCCESSFUL(CollectKeysFromDictionary(
-          handle(JSGlobalObject::cast(*object).global_dictionary(), isolate_),
+          handle(JSGlobalObject::cast(*object).global_dictionary(kAcquireLoad),
+                 isolate_),
           this));
     } else if (V8_DICT_MODE_PROTOTYPES_BOOL) {
       RETURN_NOTHING_IF_NOT_SUCCESSFUL(CollectKeysFromDictionary(
@@ -1064,7 +1065,8 @@ ExceptionStatus KeyAccumulator::CollectPrivateNames(Handle<JSReceiver> receiver,
     CollectOwnPropertyNamesInternal<false>(object, this, descs, 0, limit);
   } else if (object->IsJSGlobalObject()) {
     RETURN_FAILURE_IF_NOT_SUCCESSFUL(CollectKeysFromDictionary(
-        handle(JSGlobalObject::cast(*object).global_dictionary(), isolate_),
+        handle(JSGlobalObject::cast(*object).global_dictionary(kAcquireLoad),
+               isolate_),
         this));
   } else if (V8_DICT_MODE_PROTOTYPES_BOOL) {
     RETURN_FAILURE_IF_NOT_SUCCESSFUL(CollectKeysFromDictionary(
@@ -1150,7 +1152,7 @@ Handle<FixedArray> KeyAccumulator::GetOwnEnumPropertyKeys(
   } else if (object->IsJSGlobalObject()) {
     return GetOwnEnumPropertyDictionaryKeys(
         isolate, KeyCollectionMode::kOwnOnly, nullptr, object,
-        JSGlobalObject::cast(*object).global_dictionary());
+        JSGlobalObject::cast(*object).global_dictionary(kAcquireLoad));
   } else if (V8_DICT_MODE_PROTOTYPES_BOOL) {
     return GetOwnEnumPropertyDictionaryKeys(
         isolate, KeyCollectionMode::kOwnOnly, nullptr, object,

src/objects/lookup.cc

@@ -407,7 +407,8 @@ void LookupIterator::PrepareForDataProperty(Handle<Object> value) {
 
   if (holder_obj->IsJSGlobalObject(isolate_)) {
     Handle<GlobalDictionary> dictionary(
-        JSGlobalObject::cast(*holder_obj).global_dictionary(isolate_),
+        JSGlobalObject::cast(*holder_obj)
+            .global_dictionary(isolate_, kAcquireLoad),
         isolate());
     Handle<PropertyCell> cell(dictionary->CellAt(isolate_, dictionary_entry()),
                               isolate());
@@ -504,7 +505,8 @@ void LookupIterator::ReconfigureDataProperty(Handle<Object> value,
     }
     if (holder_obj->IsJSGlobalObject(isolate_)) {
       Handle<GlobalDictionary> dictionary(
-          JSGlobalObject::cast(*holder_obj).global_dictionary(isolate_),
+          JSGlobalObject::cast(*holder_obj)
+              .global_dictionary(isolate_, kAcquireLoad),
           isolate());
 
       Handle<PropertyCell> cell = PropertyCell::PrepareForValue(
@@ -615,13 +617,13 @@ void LookupIterator::ApplyTransitionToDataProperty(
     // Install a property cell.
     Handle<JSGlobalObject> global = Handle<JSGlobalObject>::cast(receiver);
     DCHECK(!global->HasFastProperties());
-    Handle<GlobalDictionary> dictionary(global->global_dictionary(isolate_),
-                                        isolate_);
+    Handle<GlobalDictionary> dictionary(
+        global->global_dictionary(isolate_, kAcquireLoad), isolate_);
 
     dictionary =
         GlobalDictionary::Add(isolate_, dictionary, name(), transition_cell(),
                               property_details_, &number_);
-    global->set_global_dictionary(*dictionary);
+    global->set_global_dictionary(*dictionary, kReleaseStore);
 
     // Reload details containing proper enumeration index value.
     property_details_ = transition_cell()->property_details();
@@ -862,8 +864,8 @@ Handle<Object> LookupIterator::FetchValue(
     return accessor->Get(holder, number_);
   } else if (holder_->IsJSGlobalObject(isolate_)) {
     Handle<JSGlobalObject> holder = GetHolder<JSGlobalObject>();
-    result = holder->global_dictionary(isolate_).ValueAt(isolate_,
-                                                         dictionary_entry());
+    result = holder->global_dictionary(isolate_, kAcquireLoad)
+                 .ValueAt(isolate_, dictionary_entry());
   } else if (!holder_->HasFastProperties(isolate_)) {
     if (V8_DICT_MODE_PROTOTYPES_BOOL) {
       result = holder_->property_dictionary_ordered(isolate_).ValueAt(
@@ -983,9 +985,9 @@ Handle<FieldType> LookupIterator::GetFieldType() const {
 Handle<PropertyCell> LookupIterator::GetPropertyCell() const {
   DCHECK(!IsElement(*holder_));
   Handle<JSGlobalObject> holder = GetHolder<JSGlobalObject>();
-  return handle(
-      holder->global_dictionary(isolate_).CellAt(isolate_, dictionary_entry()),
-      isolate_);
+  return handle(holder->global_dictionary(isolate_, kAcquireLoad)
+                    .CellAt(isolate_, dictionary_entry()),
+                isolate_);
 }
 
 Handle<Object> LookupIterator::GetAccessors() const {
@@ -1023,7 +1025,7 @@ void LookupIterator::WriteDataValue(Handle<Object> value,
     }
   } else if (holder->IsJSGlobalObject(isolate_)) {
     GlobalDictionary dictionary =
-        JSGlobalObject::cast(*holder).global_dictionary(isolate_);
+        JSGlobalObject::cast(*holder).global_dictionary(isolate_, kAcquireLoad);
     dictionary.CellAt(isolate_, dictionary_entry()).set_value(*value);
   } else {
     DCHECK_IMPLIES(holder->IsJSProxy(isolate_), name()->IsPrivate(isolate_));
@@ -1118,8 +1120,8 @@ LookupIterator::State LookupIterator::LookupInSpecialHolder(
       V8_FALLTHROUGH;
     case INTERCEPTOR:
       if (map.IsJSGlobalObjectMap() && !is_js_array_element(is_element)) {
-        GlobalDictionary dict =
-            JSGlobalObject::cast(holder).global_dictionary(isolate_);
+        GlobalDictionary dict = JSGlobalObject::cast(holder).global_dictionary(
+            isolate_, kAcquireLoad);
         number_ = dict.FindEntry(isolate(), name_);
         if (number_.is_not_found()) return NOT_FOUND;
         PropertyCell cell = dict.CellAt(isolate_, number_);

src/profiler/heap-snapshot-generator.cc

@@ -1355,7 +1355,7 @@ void V8HeapExplorer::ExtractPropertyReferences(JSObject js_obj,
   } else if (js_obj.IsJSGlobalObject()) {
     // We assume that global objects can only have slow properties.
     GlobalDictionary dictionary =
-        JSGlobalObject::cast(js_obj).global_dictionary();
+        JSGlobalObject::cast(js_obj).global_dictionary(kAcquireLoad);
     ReadOnlyRoots roots(isolate);
     for (InternalIndex i : dictionary.IterateEntries()) {
       if (!dictionary.IsKey(roots, dictionary.KeyAt(i))) continue;

src/runtime/runtime-object.cc

@@ -624,7 +624,7 @@ RUNTIME_FUNCTION(Runtime_GetProperty) {
       if (holder->IsJSGlobalObject()) {
         // Attempt dictionary lookup.
         GlobalDictionary dictionary =
-            JSGlobalObject::cast(*holder).global_dictionary();
+            JSGlobalObject::cast(*holder).global_dictionary(kAcquireLoad);
         InternalIndex entry = dictionary.FindEntry(isolate, key);
         if (entry.is_found()) {
           PropertyCell cell = dictionary.CellAt(entry);

test/cctest/test-api.cc

@@ -13395,7 +13395,7 @@ static int GetGlobalObjectsCount() {
     if (object.IsJSGlobalObject()) {
       i::JSGlobalObject g = i::JSGlobalObject::cast(object);
       // Skip dummy global object.
-      if (g.global_dictionary().NumberOfElements() != 0) {
+      if (g.global_dictionary(v8::kAcquireLoad).NumberOfElements() != 0) {
         count++;
       }
     }

test/unittests/regress/regress-crbug-1056054-unittest.cc

@@ -13,7 +13,7 @@ using EnumIndexOverflowTest = TestWithNativeContextAndZone;
 
 TEST_F(EnumIndexOverflowTest, GlobalObject) {
   Handle<GlobalDictionary> dictionary(
-      isolate()->global_object()->global_dictionary(), isolate());
+      isolate()->global_object()->global_dictionary(kAcquireLoad), isolate());
   dictionary->set_next_enumeration_index(
       PropertyDetails::DictionaryStorageField::kMax);
   Handle<Object> value(Smi::FromInt(static_cast<int>(42)), isolate());