Revert "[wasm] Reference indirect tables as addresses of global handles"

This reverts commit 186099d4.

Reason for revert: Need to revert:
https://chromium-review.googlesource.com/c/613880

Original change's description:
> [wasm] Reference indirect tables as addresses of global handles
> 
> This sets us up for getting the wasm code generation off the GC heap.
> We reference tables as global handles, which have a stable address. This
> requires an extra instruction when attempting to make an indirect call,
> per table (i.e. one for the signature table and one for the function
> table).
> 
> Bug: 
> Change-Id: I83743ba0f1dfdeba9aee5d27232f8823981288f8
> Reviewed-on: https://chromium-review.googlesource.com/612322
> Commit-Queue: Mircea Trofin <mtrofin@chromium.org>
> Reviewed-by: Brad Nelson <bradnelson@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#47444}

TBR=bradnelson@chromium.org,titzer@chromium.org,mtrofin@chromium.org

Change-Id: Ic3dff87410a51a2072ddc16cfc83a230526d4c56
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/622568Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47450}

src/assembler.cc

@@ -313,17 +313,6 @@ void RelocInfo::update_wasm_memory_reference(
   set_embedded_address(isolate, updated_reference, icache_flush_mode);
 }
 
-void RelocInfo::set_global_handle(Isolate* isolate, Address address,
-                                  ICacheFlushMode icache_flush_mode) {
-  DCHECK_EQ(rmode_, WASM_GLOBAL_HANDLE);
-  set_embedded_address(isolate, address, icache_flush_mode);
-}
-
-Address RelocInfo::global_handle() const {
-  DCHECK_EQ(rmode_, WASM_GLOBAL_HANDLE);
-  return embedded_address();
-}
-
 void RelocInfo::update_wasm_memory_size(Isolate* isolate, uint32_t old_size,
                                         uint32_t new_size,
                                         ICacheFlushMode icache_flush_mode) {
@@ -709,8 +698,6 @@ const char* RelocInfo::RelocModeName(RelocInfo::Mode rmode) {
       return "wasm function table size reference";
     case WASM_PROTECTED_INSTRUCTION_LANDING:
       return "wasm protected instruction landing";
-    case WASM_GLOBAL_HANDLE:
-      return "global handle";
     case NUMBER_OF_MODES:
     case PC_JUMP:
       UNREACHABLE();
@@ -796,7 +783,6 @@ void RelocInfo::Verify(Isolate* isolate) {
     case WASM_MEMORY_SIZE_REFERENCE:
     case WASM_GLOBAL_REFERENCE:
     case WASM_FUNCTION_TABLE_SIZE_REFERENCE:
-    case WASM_GLOBAL_HANDLE:
     case WASM_PROTECTED_INSTRUCTION_LANDING:
     // TODO(eholk): make sure the protected instruction is in range.
     case NONE32:

src/assembler.h

@@ -339,7 +339,6 @@ class RelocInfo {
     WASM_MEMORY_SIZE_REFERENCE,
     WASM_FUNCTION_TABLE_SIZE_REFERENCE,
     WASM_PROTECTED_INSTRUCTION_LANDING,
-    WASM_GLOBAL_HANDLE,
 
     RUNTIME_ENTRY,
     COMMENT,
@@ -447,15 +446,16 @@ class RelocInfo {
     return mode == WASM_FUNCTION_TABLE_SIZE_REFERENCE;
   }
   static inline bool IsWasmReference(Mode mode) {
-    return IsWasmPtrReference(mode) || IsWasmSizeReference(mode);
+    return mode == WASM_MEMORY_REFERENCE || mode == WASM_GLOBAL_REFERENCE ||
+           mode == WASM_MEMORY_SIZE_REFERENCE ||
+           mode == WASM_FUNCTION_TABLE_SIZE_REFERENCE;
   }
   static inline bool IsWasmSizeReference(Mode mode) {
     return mode == WASM_MEMORY_SIZE_REFERENCE ||
            mode == WASM_FUNCTION_TABLE_SIZE_REFERENCE;
   }
   static inline bool IsWasmPtrReference(Mode mode) {
-    return mode == WASM_MEMORY_REFERENCE || mode == WASM_GLOBAL_REFERENCE ||
-           mode == WASM_GLOBAL_HANDLE;
+    return mode == WASM_MEMORY_REFERENCE || mode == WASM_GLOBAL_REFERENCE;
   }
   static inline bool IsWasmProtectedLanding(Mode mode) {
     return mode == WASM_PROTECTED_INSTRUCTION_LANDING;
@@ -490,8 +490,6 @@ class RelocInfo {
   Address wasm_global_reference() const;
   uint32_t wasm_function_table_size_reference() const;
   uint32_t wasm_memory_size_reference() const;
-  Address global_handle() const;
-
   void update_wasm_memory_reference(
       Isolate* isolate, Address old_base, Address new_base,
       ICacheFlushMode icache_flush_mode = FLUSH_ICACHE_IF_NEEDED);
@@ -509,10 +507,6 @@ class RelocInfo {
       WriteBarrierMode write_barrier_mode = UPDATE_WRITE_BARRIER,
       ICacheFlushMode icache_flush_mode = FLUSH_ICACHE_IF_NEEDED);
 
-  void set_global_handle(
-      Isolate* isolate, Address address,
-      ICacheFlushMode icache_flush_mode = FLUSH_ICACHE_IF_NEEDED);
-
   // this relocation applies to;
   // can only be called if IsCodeTarget(rmode_) || IsRuntimeEntry(rmode_)
   INLINE(Address target_address());

src/compiler/pipeline.cc

@@ -849,8 +849,6 @@ void PipelineWasmCompilationJob::ValidateImmovableEmbeddedObjects() const {
     Object* target = nullptr;
     switch (mode) {
       case RelocInfo::CODE_TARGET:
-        // this would be either one of the stubs or builtins, because
-        // we didn't link yet.
         target = reinterpret_cast<Object*>(it.rinfo()->target_address());
         break;
       case RelocInfo::EMBEDDED_OBJECT:
@@ -862,7 +860,9 @@ void PipelineWasmCompilationJob::ValidateImmovableEmbeddedObjects() const {
     CHECK_NOT_NULL(target);
     bool is_immovable =
         target->IsSmi() || Heap::IsImmovable(HeapObject::cast(target));
-    CHECK(is_immovable);
+    // TODO(mtrofin): remove the fixed array part when WebAssembly.Table
+    // is backed by native object, rather than a FixedArray
+    CHECK(is_immovable || target->IsFixedArray());
   }
 }
 

src/compiler/wasm-compiler.cc

@@ -2254,14 +2254,9 @@ Node* WasmGraphBuilder::CallIndirect(uint32_t sig_index, Node** args,
   Node* size = function_table_sizes_[table_index];
   Node* in_bounds = graph()->NewNode(machine->Uint32LessThan(), key, size);
   TrapIfFalse(wasm::kTrapFuncInvalid, in_bounds, position);
-  Node* table_address = function_tables_[table_index];
-  Node* table = graph()->NewNode(
-      jsgraph()->machine()->Load(MachineType::AnyTagged()), table_address,
-      jsgraph()->IntPtrConstant(0), *effect_, *control_);
-  Node* signatures_address = signature_tables_[table_index];
-  Node* signatures = graph()->NewNode(
-      jsgraph()->machine()->Load(MachineType::AnyTagged()), signatures_address,
-      jsgraph()->IntPtrConstant(0), *effect_, *control_);
+  Node* table = function_tables_[table_index];
+  Node* signatures = signature_tables_[table_index];
+
   // Load signature from the table and check.
   // The table is a FixedArray; signatures are encoded as SMIs.
   // [sig1, sig2, sig3, ...., code1, code2, code3 ...]
@@ -2993,16 +2988,10 @@ void WasmGraphBuilder::EnsureFunctionTableNodes() {
   if (function_tables_.size() > 0) return;
   size_t tables_size = env_->function_tables.size();
   for (size_t i = 0; i < tables_size; ++i) {
-    wasm::GlobalHandleAddress function_handle_address =
-        env_->function_tables[i];
-    wasm::GlobalHandleAddress signature_handle_address =
-        env_->signature_tables[i];
-    function_tables_.push_back(jsgraph()->RelocatableIntPtrConstant(
-        reinterpret_cast<intptr_t>(function_handle_address),
-        RelocInfo::WASM_GLOBAL_HANDLE));
-    signature_tables_.push_back(jsgraph()->RelocatableIntPtrConstant(
-        reinterpret_cast<intptr_t>(signature_handle_address),
-        RelocInfo::WASM_GLOBAL_HANDLE));
+    auto function_handle = env_->function_tables[i];
+    auto signature_handle = env_->signature_tables[i];
+    function_tables_.push_back(HeapConstant(function_handle));
+    signature_tables_.push_back(HeapConstant(signature_handle));
     uint32_t table_size = env_->module->function_tables[i].initial_size;
     function_table_sizes_.push_back(jsgraph()->RelocatableInt32Constant(
         static_cast<uint32_t>(table_size),
@@ -3830,8 +3819,8 @@ Handle<Code> CompileJSToWasmWrapper(Isolate* isolate, wasm::WasmModule* module,
 
   // TODO(titzer): compile JS to WASM wrappers without a {ModuleEnv}.
   ModuleEnv env = {module,
-                   std::vector<Address>(),              // function_tables
-                   std::vector<Address>(),              // signature_tables
+                   std::vector<Handle<FixedArray>>(),   // function_tables
+                   std::vector<Handle<FixedArray>>(),   // signature_tables
                    std::vector<wasm::SignatureMap*>(),  // signature_maps
                    std::vector<Handle<Code>>(),         // function_code
                    BUILTIN_CODE(isolate, Illegal),      // default_function_code

src/compiler/wasm-compiler.h

@@ -52,14 +52,12 @@ struct ModuleEnv {
   // A pointer to the decoded module's static representation.
   const wasm::WasmModule* module;
   // The function tables are FixedArrays of code used to dispatch indirect
-  // calls. (the same length as module.function_tables). We use the address
-  // to a global handle to the FixedArray.
-  const std::vector<Address> function_tables;
+  // calls. (the same length as module.function_tables)
+  const std::vector<Handle<FixedArray>> function_tables;
   // The signatures tables are FixedArrays of SMIs used to check signatures
   // match at runtime.
   // (the same length as module.function_tables)
-  //  We use the address to a global handle to the FixedArray.
-  const std::vector<Address> signature_tables;
+  const std::vector<Handle<FixedArray>> signature_tables;
   // Signature maps canonicalize {FunctionSig*} to indexes. New entries can be
   // added to a signature map during graph building.
   // Normally, these signature maps correspond to the signature maps in the

src/wasm/module-compiler.cc

@@ -327,12 +327,13 @@ MaybeHandle<WasmModuleObject> ModuleCompiler::CompileToModuleObject(
     ErrorThrower* thrower, const ModuleWireBytes& wire_bytes,
     Handle<Script> asm_js_script,
     Vector<const byte> asm_js_offset_table_bytes) {
+  Factory* factory = isolate_->factory();
 
   TimedHistogramScope wasm_compile_module_time_scope(
       module_->is_wasm() ? counters()->wasm_compile_wasm_module_time()
                          : counters()->wasm_compile_asm_module_time());
-  return CompileToModuleObjectInternal(
-      isolate_, thrower, wire_bytes, asm_js_script, asm_js_offset_table_bytes);
+  return CompileToModuleObjectInternal(thrower, wire_bytes, asm_js_script,
+                                       asm_js_offset_table_bytes, factory);
 }
 
 namespace {
@@ -518,25 +519,16 @@ double MonotonicallyIncreasingTimeInMs() {
 }
 
 std::unique_ptr<compiler::ModuleEnv> CreateDefaultModuleEnv(
-    Isolate* isolate, WasmModule* module, Handle<Code> illegal_builtin,
-    GlobalHandleLifetimeManager* lifetime_manager) {
-  std::vector<GlobalHandleAddress> function_tables;
-  std::vector<GlobalHandleAddress> signature_tables;
+    Factory* factory, WasmModule* module, Handle<Code> illegal_builtin) {
+  std::vector<Handle<FixedArray>> function_tables;
+  std::vector<Handle<FixedArray>> signature_tables;
   std::vector<SignatureMap*> signature_maps;
 
   for (size_t i = 0; i < module->function_tables.size(); i++) {
-    // We need *some* value for each table. We'll reuse this value when
-    // we want to reset a {WasmCompiledModule}. We could just insert
-    // bogus values (e.g. 0, 1, etc), but to keep things consistent, we'll
-    // create a valid global handle for the undefined value.
-    // These global handles are deleted when finalizing the module object.
-    Handle<Object> func_table =
-        isolate->global_handles()->Create(isolate->heap()->undefined_value());
-    Handle<Object> sig_table =
-        isolate->global_handles()->Create(isolate->heap()->undefined_value());
-    function_tables.push_back(func_table.address());
-    signature_tables.push_back(sig_table.address());
-    signature_maps.push_back(&module->function_tables[i].map);
+    auto& function_table = module->function_tables[i];
+    function_tables.push_back(factory->NewFixedArray(1, TENURED));
+    signature_tables.push_back(factory->NewFixedArray(1, TENURED));
+    signature_maps.push_back(&function_table.map);
   }
 
   std::vector<Handle<Code>> empty_code;
@@ -574,10 +566,9 @@ void ReopenHandles(Isolate* isolate, const std::vector<Handle<T>>& vec) {
 }  // namespace
 
 MaybeHandle<WasmModuleObject> ModuleCompiler::CompileToModuleObjectInternal(
-    Isolate* isolate, ErrorThrower* thrower, const ModuleWireBytes& wire_bytes,
-    Handle<Script> asm_js_script,
-    Vector<const byte> asm_js_offset_table_bytes) {
-  Factory* factory = isolate->factory();
+    ErrorThrower* thrower, const ModuleWireBytes& wire_bytes,
+    Handle<Script> asm_js_script, Vector<const byte> asm_js_offset_table_bytes,
+    Factory* factory) {
   // Check whether lazy compilation is enabled for this module.
   bool lazy_compile = compile_lazy(module_.get());
 
@@ -588,9 +579,7 @@ MaybeHandle<WasmModuleObject> ModuleCompiler::CompileToModuleObjectInternal(
                                   ? BUILTIN_CODE(isolate_, WasmCompileLazy)
                                   : BUILTIN_CODE(isolate_, Illegal);
 
-  GlobalHandleLifetimeManager globals_manager;
-  auto env = CreateDefaultModuleEnv(isolate, module_.get(), init_builtin,
-                                    &globals_manager);
+  auto env = CreateDefaultModuleEnv(factory, module_.get(), init_builtin);
 
   // The {code_table} array contains import wrappers and functions (which
   // are both included in {functions.size()}, and export wrappers).
@@ -706,10 +695,6 @@ MaybeHandle<WasmModuleObject> ModuleCompiler::CompileToModuleObjectInternal(
     func_index++;
   }
 
-  // Now we can relinquish control to the global handles, because the
-  // {WasmModuleObject} will take care of them in its finalizer, which it'll
-  // setup in {New}.
-  globals_manager.ReleaseWithoutDestroying();
   return WasmModuleObject::New(isolate_, compiled_module);
 }
 
@@ -1149,7 +1134,6 @@ MaybeHandle<WasmInstanceObject> InstanceBuilder::Build() {
   DCHECK(!isolate_->has_pending_exception());
   TRACE("Finishing instance %d\n", compiled_module_->instance_id());
   TRACE_CHAIN(module_object_->compiled_module());
-  globals_manager_.ReleaseWithoutDestroying();
   return instance;
 }
 
@@ -1741,16 +1725,9 @@ void InstanceBuilder::InitializeTables(
     CodeSpecialization* code_specialization) {
   int function_table_count = static_cast<int>(module_->function_tables.size());
   Handle<FixedArray> new_function_tables =
-      isolate_->factory()->NewFixedArray(function_table_count, TENURED);
+      isolate_->factory()->NewFixedArray(function_table_count);
   Handle<FixedArray> new_signature_tables =
-      isolate_->factory()->NewFixedArray(function_table_count, TENURED);
-  Handle<FixedArray> old_function_tables = compiled_module_->function_tables();
-  Handle<FixedArray> old_signature_tables =
-      compiled_module_->signature_tables();
-
-  DCHECK_EQ(old_function_tables->length(), new_function_tables->length());
-  DCHECK_EQ(old_signature_tables->length(), new_signature_tables->length());
-
+      isolate_->factory()->NewFixedArray(function_table_count);
   for (int index = 0; index < function_table_count; ++index) {
     WasmIndirectFunctionTable& table = module_->function_tables[index];
     TableInstance& table_instance = table_instances_[index];
@@ -1775,36 +1752,27 @@ void InstanceBuilder::InitializeTables(
             table_size, table_instance.function_table->length());
       }
     }
-    int int_index = static_cast<int>(index);
-
-    // We create a global handle here and delete it when finalizing the
-    // instance. Even if the same table is shared accross many instances, each
-    // will have its own private global handle to it. Meanwhile, we the global
-    // handles root the respective objects (the tables).
-    Handle<FixedArray> global_func_table =
-        isolate_->global_handles()->Create(*table_instance.function_table);
-    Handle<FixedArray> global_sig_table =
-        isolate_->global_handles()->Create(*table_instance.signature_table);
-
-    GlobalHandleAddress new_func_table_addr = global_func_table.address();
-    GlobalHandleAddress new_sig_table_addr = global_sig_table.address();
-    globals_manager_.Add(new_func_table_addr);
-    globals_manager_.Add(new_sig_table_addr);
-
-    WasmCompiledModule::SetTableValue(isolate_, new_function_tables, int_index,
-                                      new_func_table_addr);
-    WasmCompiledModule::SetTableValue(isolate_, new_signature_tables, int_index,
-                                      new_sig_table_addr);
-
-    GlobalHandleAddress old_func_table_addr =
-        WasmCompiledModule::GetTableValue(*old_function_tables, int_index);
-    GlobalHandleAddress old_sig_table_addr =
-        WasmCompiledModule::GetTableValue(*old_signature_tables, int_index);
-
-    code_specialization->RelocatePointer(old_func_table_addr,
-                                         new_func_table_addr);
-    code_specialization->RelocatePointer(old_sig_table_addr,
-                                         new_sig_table_addr);
+
+    new_function_tables->set(static_cast<int>(index),
+                             *table_instance.function_table);
+    new_signature_tables->set(static_cast<int>(index),
+                              *table_instance.signature_table);
+  }
+
+  FixedArray* old_function_tables = compiled_module_->ptr_to_function_tables();
+  DCHECK_EQ(old_function_tables->length(), new_function_tables->length());
+  for (int i = 0, e = new_function_tables->length(); i < e; ++i) {
+    code_specialization->RelocateObject(
+        handle(old_function_tables->get(i), isolate_),
+        handle(new_function_tables->get(i), isolate_));
+  }
+  FixedArray* old_signature_tables =
+      compiled_module_->ptr_to_signature_tables();
+  DCHECK_EQ(old_signature_tables->length(), new_signature_tables->length());
+  for (int i = 0, e = new_signature_tables->length(); i < e; ++i) {
+    code_specialization->RelocateObject(
+        handle(old_signature_tables->get(i), isolate_),
+        handle(new_signature_tables->get(i), isolate_));
   }
 
   compiled_module_->set_function_tables(new_function_tables);
@@ -2090,8 +2058,8 @@ class AsyncCompileJob::PrepareAndStartCompile : public CompileStep {
 
     Factory* factory = isolate->factory();
     Handle<Code> illegal_builtin = BUILTIN_CODE(isolate, Illegal);
-    job_->module_env_ = CreateDefaultModuleEnv(
-        isolate, module_.get(), illegal_builtin, &job_->globals_manager_);
+    job_->module_env_ =
+        CreateDefaultModuleEnv(factory, module_.get(), illegal_builtin);
 
     // The {code_table} array contains import wrappers and functions (which
     // are both included in {functions.size()}, and export wrappers.
@@ -2115,6 +2083,8 @@ class AsyncCompileJob::PrepareAndStartCompile : public CompileStep {
       centry_stub = Handle<Code>(*centry_stub, isolate);
       job_->code_table_ = Handle<FixedArray>(*job_->code_table_, isolate);
       compiler::ModuleEnv* env = job_->module_env_.get();
+      ReopenHandles(isolate, env->function_tables);
+      ReopenHandles(isolate, env->signature_tables);
       ReopenHandles(isolate, env->function_code);
       Handle<Code>* mut =
           const_cast<Handle<Code>*>(&env->default_function_code);
@@ -2358,7 +2328,6 @@ class AsyncCompileJob::FinishModule : public CompileStep {
     Handle<WasmModuleObject> result =
         WasmModuleObject::New(job_->isolate_, job_->compiled_module_);
     // {job_} is deleted in AsyncCompileSucceeded, therefore the {return}.
-    job_->globals_manager_.ReleaseWithoutDestroying();
     return job_->AsyncCompileSucceeded(result);
   }
 };

src/wasm/module-compiler.h

@@ -164,9 +164,9 @@ class ModuleCompiler {
 
  private:
   MaybeHandle<WasmModuleObject> CompileToModuleObjectInternal(
-      Isolate* isolate, ErrorThrower* thrower,
-      const ModuleWireBytes& wire_bytes, Handle<Script> asm_js_script,
-      Vector<const byte> asm_js_offset_table_bytes);
+      ErrorThrower* thrower, const ModuleWireBytes& wire_bytes,
+      Handle<Script> asm_js_script,
+      Vector<const byte> asm_js_offset_table_bytes, Factory* factory);
 
   Isolate* isolate_;
   std::unique_ptr<WasmModule> module_;
@@ -234,7 +234,6 @@ class InstanceBuilder {
   std::vector<Handle<JSFunction>> js_wrappers_;
   JSToWasmWrapperCache js_to_wasm_cache_;
   WeakCallbackInfo<void>::Callback instance_finalizer_callback_;
-  GlobalHandleLifetimeManager globals_manager_;
 
   const std::shared_ptr<Counters>& async_counters() const {
     return async_counters_;
@@ -348,7 +347,6 @@ class AsyncCompileJob {
   Handle<JSPromise> module_promise_;
   std::unique_ptr<ModuleCompiler> compiler_;
   std::unique_ptr<compiler::ModuleEnv> module_env_;
-  GlobalHandleLifetimeManager globals_manager_;
 
   std::vector<DeferredHandles*> deferred_handles_;
   Handle<WasmModuleObject> module_object_;

src/wasm/wasm-code-specialization.cc

@@ -84,7 +84,8 @@ bool IsAtWasmDirectCallTarget(RelocIterator& it) {
 
 }  // namespace
 
-CodeSpecialization::CodeSpecialization(Isolate* isolate, Zone* zone) {}
+CodeSpecialization::CodeSpecialization(Isolate* isolate, Zone* zone)
+    : objects_to_relocate(isolate->heap(), ZoneAllocationPolicy(zone)) {}
 
 CodeSpecialization::~CodeSpecialization() {}
 
@@ -119,8 +120,11 @@ void CodeSpecialization::RelocateDirectCalls(
   relocate_direct_calls_instance = instance;
 }
 
-void CodeSpecialization::RelocatePointer(Address old_ptr, Address new_ptr) {
-  pointers_to_relocate.insert(std::make_pair(old_ptr, new_ptr));
+void CodeSpecialization::RelocateObject(Handle<Object> old_obj,
+                                        Handle<Object> new_obj) {
+  DCHECK(!old_obj.is_null() && !new_obj.is_null());
+  has_objects_to_relocate = true;
+  objects_to_relocate.Set(*old_obj, new_obj);
 }
 
 bool CodeSpecialization::ApplyToWholeInstance(
@@ -187,7 +191,7 @@ bool CodeSpecialization::ApplyToWasmCode(Code* code,
   bool reloc_globals = old_globals_start || new_globals_start;
   bool patch_table_size = old_function_table_size || new_function_table_size;
   bool reloc_direct_calls = !relocate_direct_calls_instance.is_null();
-  bool reloc_pointers = pointers_to_relocate.size() > 0;
+  bool reloc_objects = has_objects_to_relocate;
 
   int reloc_mode = 0;
   auto add_mode = [&reloc_mode](bool cond, RelocInfo::Mode mode) {
@@ -198,7 +202,7 @@ bool CodeSpecialization::ApplyToWasmCode(Code* code,
   add_mode(reloc_globals, RelocInfo::WASM_GLOBAL_REFERENCE);
   add_mode(patch_table_size, RelocInfo::WASM_FUNCTION_TABLE_SIZE_REFERENCE);
   add_mode(reloc_direct_calls, RelocInfo::CODE_TARGET);
-  add_mode(reloc_pointers, RelocInfo::WASM_GLOBAL_HANDLE);
+  add_mode(reloc_objects, RelocInfo::EMBEDDED_OBJECT);
 
   std::unique_ptr<PatchDirectCallsHelper> patch_direct_calls_helper;
   bool changed = false;
@@ -254,12 +258,13 @@ bool CodeSpecialization::ApplyToWasmCode(Code* code,
                                        UPDATE_WRITE_BARRIER, icache_flush_mode);
         changed = true;
       } break;
-      case RelocInfo::WASM_GLOBAL_HANDLE: {
-        DCHECK(reloc_pointers);
-        Address old_ptr = it.rinfo()->global_handle();
-        if (pointers_to_relocate.count(old_ptr) == 1) {
-          Address new_ptr = pointers_to_relocate[old_ptr];
-          it.rinfo()->set_global_handle(code->GetIsolate(), new_ptr,
+      case RelocInfo::EMBEDDED_OBJECT: {
+        DCHECK(reloc_objects);
+        Object* old = it.rinfo()->target_object();
+        Handle<Object>* new_obj = objects_to_relocate.Find(old);
+        if (new_obj) {
+          it.rinfo()->set_target_object(HeapObject::cast(**new_obj),
+                                        UPDATE_WRITE_BARRIER,
                                         icache_flush_mode);
           changed = true;
         }

src/wasm/wasm-code-specialization.h

@@ -39,7 +39,7 @@ class CodeSpecialization {
   // Update all direct call sites based on the code table in the given instance.
   void RelocateDirectCalls(Handle<WasmInstanceObject> instance);
   // Relocate an arbitrary object (e.g. function table).
-  void RelocatePointer(Address old_obj, Address new_obj);
+  void RelocateObject(Handle<Object> old_obj, Handle<Object> new_obj);
 
   // Apply all relocations and patching to all code in the instance (wasm code
   // and exported functions).
@@ -62,7 +62,8 @@ class CodeSpecialization {
 
   Handle<WasmInstanceObject> relocate_direct_calls_instance;
 
-  std::map<Address, Address> pointers_to_relocate;
+  bool has_objects_to_relocate = false;
+  IdentityMap<Handle<Object>, ZoneAllocationPolicy> objects_to_relocate;
 };
 
 }  // namespace wasm

src/wasm/wasm-interpreter.cc

@@ -2328,12 +2328,8 @@ class ThreadImpl {
       if (table_index >= static_cast<uint32_t>(sig_tables->length())) {
         return {ExternalCallResult::INVALID_FUNC};
       }
-      // Reconstitute the global handle to sig_table, and, further below,
-      // to the function table, from the address stored in the
-      // respective table of tables.
-      int table_index_as_int = static_cast<int>(table_index);
-      Handle<FixedArray> sig_table(reinterpret_cast<FixedArray**>(
-          WasmCompiledModule::GetTableValue(sig_tables, table_index_as_int)));
+      FixedArray* sig_table =
+          FixedArray::cast(sig_tables->get(static_cast<int>(table_index)));
       if (entry_index >= static_cast<uint32_t>(sig_table->length())) {
         return {ExternalCallResult::INVALID_FUNC};
       }
@@ -2345,8 +2341,8 @@ class ThreadImpl {
       // Get code object.
       FixedArray* fun_tables = compiled_module->ptr_to_function_tables();
       DCHECK_EQ(sig_tables->length(), fun_tables->length());
-      Handle<FixedArray> fun_table(reinterpret_cast<FixedArray**>(
-          WasmCompiledModule::GetTableValue(fun_tables, table_index_as_int)));
+      FixedArray* fun_table =
+          FixedArray::cast(fun_tables->get(static_cast<int>(table_index)));
       DCHECK_EQ(sig_table->length(), fun_table->length());
       target = Code::cast(fun_table->get(static_cast<int>(entry_index)));
     }

src/wasm/wasm-module.cc

@@ -217,18 +217,18 @@ compiler::ModuleEnv CreateModuleEnvFromCompiledModule(
   DisallowHeapAllocation no_gc;
   WasmModule* module = compiled_module->module();
 
-  std::vector<GlobalHandleAddress> function_tables;
-  std::vector<GlobalHandleAddress> signature_tables;
+  std::vector<Handle<FixedArray>> function_tables;
+  std::vector<Handle<FixedArray>> signature_tables;
   std::vector<SignatureMap*> signature_maps;
 
   int num_function_tables = static_cast<int>(module->function_tables.size());
-  for (int i = 0; i < num_function_tables; ++i) {
+  for (int i = 0; i < num_function_tables; i++) {
     FixedArray* ft = compiled_module->ptr_to_function_tables();
     FixedArray* st = compiled_module->ptr_to_signature_tables();
 
     // TODO(clemensh): defer these handles for concurrent compilation.
-    function_tables.push_back(WasmCompiledModule::GetTableValue(ft, i));
-    signature_tables.push_back(WasmCompiledModule::GetTableValue(st, i));
+    function_tables.push_back(handle(FixedArray::cast(ft->get(i))));
+    signature_tables.push_back(handle(FixedArray::cast(st->get(i))));
     signature_maps.push_back(&module->function_tables[i].map);
   }
 

src/wasm/wasm-objects.h

@@ -24,34 +24,7 @@ namespace internal {
 namespace wasm {
 class InterpretedFrame;
 class WasmInterpreter;
-
-// When we compile or instantiate, we need to create global handles
-// for function tables. Normally, these handles get destroyed when the
-// respective objects get GCed. If we fail to construct those objects,
-// we can leak global hanles. The exit path in these cases isn't unique,
-// and may grow.
-//
-// This type addresses that.
-
-typedef Address GlobalHandleAddress;
-
-class GlobalHandleLifetimeManager final {
- public:
-  void Add(GlobalHandleAddress addr) { handles_.push_back(addr); }
-  // Call this when compilation or instantiation has succeeded, and we've
-  // passed the control to a JS object with a finalizer that'll destroy
-  // the handles.
-  void ReleaseWithoutDestroying() { handles_.clear(); }
-  ~GlobalHandleLifetimeManager() {
-    for (auto& addr : handles_) {
-      GlobalHandles::Destroy(reinterpret_cast<Object**>(addr));
-    }
-  }
-
- private:
-  std::vector<Address> handles_;
-};
-}  // namespace wasm
+}
 
 class WasmCompiledModule;
 class WasmDebugInfo;
@@ -92,9 +65,6 @@ class WasmModuleObject : public JSObject {
 
   static Handle<WasmModuleObject> New(
       Isolate* isolate, Handle<WasmCompiledModule> compiled_module);
-
- private:
-  static void Finalizer(const v8::WeakCallbackInfo<void>& data);
 };
 
 // Representation of a WebAssembly.Table JavaScript-level object.
@@ -416,8 +386,7 @@ class WasmCompiledModule : public FixedArray {
   MACRO(OBJECT, FixedArray, weak_exported_functions)          \
   MACRO(OBJECT, FixedArray, function_tables)                  \
   MACRO(OBJECT, FixedArray, signature_tables)                 \
-  MACRO(CONST_OBJECT, FixedArray, empty_function_tables)      \
-  MACRO(CONST_OBJECT, FixedArray, empty_signature_tables)     \
+  MACRO(OBJECT, FixedArray, empty_function_tables)            \
   MACRO(LARGE_NUMBER, size_t, embedded_mem_start)             \
   MACRO(LARGE_NUMBER, size_t, globals_start)                  \
   MACRO(LARGE_NUMBER, uint32_t, embedded_mem_size)            \
@@ -451,13 +420,12 @@ class WasmCompiledModule : public FixedArray {
   static Handle<WasmCompiledModule> New(
       Isolate* isolate, Handle<WasmSharedModuleData> shared,
       Handle<FixedArray> code_table,
-      const std::vector<wasm::GlobalHandleAddress>& function_tables,
-      const std::vector<wasm::GlobalHandleAddress>& signature_tables);
+      const std::vector<Handle<FixedArray>>& function_tables,
+      const std::vector<Handle<FixedArray>>& signature_tables);
 
   static Handle<WasmCompiledModule> Clone(Isolate* isolate,
                                           Handle<WasmCompiledModule> module);
-  static void Reset(Isolate* isolate, WasmCompiledModule* module,
-                    bool clear_global_handles = true);
+  static void Reset(Isolate* isolate, WasmCompiledModule* module);
 
   Address GetEmbeddedMemStartOrNull() const {
     return has_embedded_mem_start()
@@ -597,11 +565,6 @@ class WasmCompiledModule : public FixedArray {
     set_code_table(testing_table);
   }
 
-  static void SetTableValue(Isolate* isolate, Handle<FixedArray> table,
-                            int index, Address value);
-  static void UpdateTableValue(FixedArray* table, int index, Address value);
-  static Address GetTableValue(FixedArray* table, int index);
-
  private:
   void InitId();
 

test/cctest/wasm/wasm-run-utils.h

@@ -275,14 +275,8 @@ class TestingModule {
       table.map.FindOrInsert(test_module_.functions[function_indexes[i]].sig);
     }
 
-    function_tables_.push_back(
-        isolate_->global_handles()
-            ->Create(*isolate_->factory()->NewFixedArray(table_size))
-            .address());
-    signature_tables_.push_back(
-        isolate_->global_handles()
-            ->Create(*isolate_->factory()->NewFixedArray(table_size))
-            .address());
+    function_tables_.push_back(isolate_->factory()->NewFixedArray(table_size));
+    signature_tables_.push_back(isolate_->factory()->NewFixedArray(table_size));
   }
 
   void PopulateIndirectFunctionTable() {
@@ -290,10 +284,8 @@ class TestingModule {
     // Initialize the fixed arrays in instance->function_tables.
     for (uint32_t i = 0; i < function_tables_.size(); i++) {
       WasmIndirectFunctionTable& table = test_module_.function_tables[i];
-      Handle<FixedArray> function_table(
-          reinterpret_cast<FixedArray**>(function_tables_[i]));
-      Handle<FixedArray> signature_table(
-          reinterpret_cast<FixedArray**>(signature_tables_[i]));
+      Handle<FixedArray> function_table = function_tables_[i];
+      Handle<FixedArray> signature_table = signature_tables_[i];
       int table_size = static_cast<int>(table.values.size());
       for (int j = 0; j < table_size; j++) {
         WasmFunction& function = test_module_.functions[table.values[j]];
@@ -361,8 +353,8 @@ class TestingModule {
   byte* mem_start_;
   uint32_t mem_size_;
   std::vector<Handle<Code>> function_code_;
-  std::vector<GlobalHandleAddress> function_tables_;
-  std::vector<GlobalHandleAddress> signature_tables_;
+  std::vector<Handle<FixedArray>> function_tables_;
+  std::vector<Handle<FixedArray>> signature_tables_;
   V8_ALIGNED(8) byte globals_data_[kMaxGlobalsSize];
   WasmInterpreter* interpreter_;
   Handle<WasmInstanceObject> instance_object_;

test/mjsunit/wasm/compiled-module-management.js

@@ -67,7 +67,5 @@ gc();
   module = null;
 })();
 
-gc();
-// the first GC will clear the module, the second the instance.
 gc();
 %ValidateWasmOrphanedInstance(instance4);