[runtime] Add shortcuts for elements kinds transitions.

The shortcuts ensure that field type generalization is properly
propagated in the transition graph.

Bug: chromium:738763
Change-Id: Id701a6f95ed6ea093c707fbe0bac228f1f856e9f
Reviewed-on: https://chromium-review.googlesource.com/567992
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46622}

src/heap-symbols.h

@@ -217,6 +217,7 @@
   V(class_start_position_symbol)            \
   V(detailed_stack_trace_symbol)            \
   V(elements_transition_symbol)             \
+  V(elements_transition_shortcut_symbol)    \
   V(error_end_pos_symbol)                   \
   V(error_script_symbol)                    \
   V(error_start_pos_symbol)                 \

src/ic/ic.cc

@@ -1437,7 +1437,7 @@ void KeyedLoadIC::LoadElementPolymorphicHandlers(
     if (receiver_map->is_stable()) {
       Map* tmap = receiver_map->FindElementsKindTransitionedMap(*receiver_maps);
       if (tmap != nullptr) {
-        receiver_map->NotifyLeafMapLayoutChange();
+        Map::RegisterElementsKindTransitionShortcut(receiver_map, handle(tmap));
       }
     }
     handlers->Add(LoadElementHandler(receiver_map));
@@ -2128,10 +2128,9 @@ void KeyedStoreIC::StoreElementPolymorphicHandlers(
         Map* tmap =
             receiver_map->FindElementsKindTransitionedMap(*receiver_maps);
         if (tmap != nullptr) {
-          if (receiver_map->is_stable()) {
-            receiver_map->NotifyLeafMapLayoutChange();
-          }
           transitioned_map = handle(tmap);
+          Map::RegisterElementsKindTransitionShortcut(receiver_map,
+                                                      transitioned_map);
         }
       }
 

src/map-updater.cc

@@ -617,7 +617,7 @@ MapUpdater::State MapUpdater::ConstructNewMap() {
       *split_map, split_details.kind(), GetKey(split_nof),
       split_details.attributes());
   if (maybe_transition != NULL) {
-    maybe_transition->DeprecateTransitionTree();
+    maybe_transition->DeprecateTransitionTree(isolate_);
   }
 
   // If |maybe_transition| is not NULL then the transition array already

src/objects-debug.cc

@@ -1624,7 +1624,13 @@ static bool CheckOneBackPointer(Map* current_map, Object* target) {
 // static
 bool TransitionArray::IsConsistentWithBackPointers(Map* map) {
   Object* transitions = map->raw_transitions();
+  Symbol* elements_transition_shortcut_symbol =
+      map->GetHeap()->elements_transition_shortcut_symbol();
   for (int i = 0; i < TransitionArray::NumberOfTransitions(transitions); ++i) {
+    // Back pointers of shortcut transitions don't point to source maps.
+    Name* name = TransitionArray::GetKey(transitions, i);
+    if (name == elements_transition_shortcut_symbol) continue;
+
     Map* target = TransitionArray::GetTarget(transitions, i);
     if (!CheckOneBackPointer(map, target)) return false;
   }

src/objects-inl.h

@@ -3193,6 +3193,11 @@ Handle<Map> Map::AddMissingTransitionsForTesting(
   return AddMissingTransitions(split_map, descriptors, full_layout_descriptor);
 }
 
+void Map::InsertElementsKindTransitionShortcutForTesting(
+    Isolate* isolate, Handle<Map> map, Handle<Map> transition) {
+  Map::InsertElementsKindTransitionShortcut(isolate, map, transition);
+}
+
 int HeapObject::SizeFromMap(Map* map) const {
   int instance_size = map->instance_size();
   if (instance_size != kVariableSizeSentinel) return instance_size;

src/objects-printer.cc

@@ -1718,6 +1718,9 @@ void TransitionArray::PrintTransitions(std::ostream& os, Object* transitions,
     } else if (key == heap->elements_transition_symbol()) {
       os << "(transition to " << ElementsKindToString(target->elements_kind())
          << ")";
+    } else if (key == heap->elements_transition_shortcut_symbol()) {
+      os << "(shortcut to " << ElementsKindToString(target->elements_kind())
+         << ")";
     } else if (key == heap->strict_function_transition_symbol()) {
       os << " (transition to strict function)";
     } else {
@@ -1764,17 +1767,19 @@ void TransitionArray::PrintTransitionTree(std::ostream& os, Map* map,
       os << "to frozen";
     } else if (key == heap->elements_transition_symbol()) {
       os << "to " << ElementsKindToString(target->elements_kind());
+    } else if (key == heap->elements_transition_shortcut_symbol()) {
+      os << "shortcut to " << ElementsKindToString(target->elements_kind());
     } else if (key == heap->strict_function_transition_symbol()) {
       os << "to strict function";
     } else {
+      DCHECK(!IsSpecialTransition(key));
+      os << "to ";
 #ifdef OBJECT_PRINT
       key->NamePrint(os);
 #else
       key->ShortPrint(os);
 #endif
       os << " ";
-      DCHECK(!IsSpecialTransition(key));
-      os << "to ";
       int descriptor = target->LastAdded();
       DescriptorArray* descriptors = target->instance_descriptors();
       descriptors->PrintDescriptorDetails(os, descriptor,

src/objects.h

@@ -249,10 +249,11 @@ enum TransitionFlag {
 enum SimpleTransitionFlag {
   SIMPLE_PROPERTY_TRANSITION,
   PROPERTY_TRANSITION,
-  SPECIAL_TRANSITION
+  // Below are the special transitions.
+  SPECIAL_TRANSITION,
+  SPECIAL_SHORTCUT_TRANSITION
 };
 
-
 // Indicates whether we are only interested in the descriptors of a particular
 // map, or in all descriptors in the descriptor array.
 enum DescriptorFlag {

src/objects/map.h

@@ -345,11 +345,11 @@ class Map : public HeapObject {
                               Representation new_representation,
                               Handle<FieldType> new_field_type);
 
-  static Handle<Map> ReconfigureProperty(Handle<Map> map, int modify_index,
-                                         PropertyKind new_kind,
-                                         PropertyAttributes new_attributes,
-                                         Representation new_representation,
-                                         Handle<FieldType> new_field_type);
+  static Handle<Map> ReconfigureProperty(
+      Handle<Map> map, int modify_index, PropertyKind new_kind,
+      PropertyAttributes new_attributes, Representation new_representation,
+      Handle<FieldType> new_field_type,
+      PropertyConstness new_constness = kConst);
 
   static Handle<Map> ReconfigureElementsKind(Handle<Map> map,
                                              ElementsKind new_elements_kind);
@@ -495,6 +495,9 @@ class Map : public HeapObject {
   static Handle<Map> TransitionElementsTo(Handle<Map> map,
                                           ElementsKind to_kind);
 
+  static void RegisterElementsKindTransitionShortcut(Handle<Map> map,
+                                                     Handle<Map> transition);
+
   static Handle<Map> AsElementsKind(Handle<Map> map, ElementsKind kind);
 
   static Handle<Map> CopyAsElementsKind(Handle<Map> map, ElementsKind kind,
@@ -744,6 +747,9 @@ class Map : public HeapObject {
       Handle<Map> split_map, Handle<DescriptorArray> descriptors,
       Handle<LayoutDescriptor> full_layout_descriptor);
 
+  static inline void InsertElementsKindTransitionShortcutForTesting(
+      Isolate* isolate, Handle<Map> map, Handle<Map> transition);
+
   // Fires when the layout of an object with a leaf map changes.
   // This includes adding transitions to the leaf map or changing
   // the descriptor array.
@@ -763,6 +769,10 @@ class Map : public HeapObject {
   // not found.
   Map* TryReplayPropertyTransitions(Map* map);
 
+  static void InsertElementsKindTransitionShortcut(Isolate* isolate,
+                                                   Handle<Map> map,
+                                                   Handle<Map> transition);
+
   static void ConnectTransition(Handle<Map> parent, Handle<Map> child,
                                 Handle<Name> name, SimpleTransitionFlag flag);
 
@@ -802,7 +812,7 @@ class Map : public HeapObject {
       Handle<Map> map, ElementsKind elements_kind, int modify_index,
       PropertyKind kind, PropertyAttributes attributes, const char* reason);
 
-  void DeprecateTransitionTree();
+  void DeprecateTransitionTree(Isolate* isolate);
 
   void ReplaceDescriptors(DescriptorArray* new_descriptors,
                           LayoutDescriptor* new_layout_descriptor);
@@ -810,7 +820,8 @@ class Map : public HeapObject {
   // Update field type of the given descriptor to new representation and new
   // type. The type must be prepared for storing in descriptor array:
   // it must be either a simple type or a map wrapped in a weak cell.
-  void UpdateFieldType(int descriptor_number, Handle<Name> name,
+  // Returns true if the elements kind transition shortcut exists.
+  bool UpdateFieldType(int descriptor_number, Handle<Name> name,
                        PropertyConstness new_constness,
                        Representation new_representation,
                        Handle<Object> new_wrapped_type);

src/transitions-inl.h

@@ -98,6 +98,18 @@ void TransitionArray::SetTarget(int transition_number, Map* value) {
   set(ToTargetIndex(transition_number), value);
 }
 
+std::pair<Name*, Map*> TransitionArray::GetKeyAndTarget(Object* raw_transitions,
+                                                        int transition_number) {
+  if (IsSimpleTransition(raw_transitions)) {
+    DCHECK(transition_number == 0);
+    Map* transition = GetSimpleTransition(raw_transitions);
+    return std::make_pair(GetSimpleTransitionKey(transition), transition);
+  }
+  DCHECK(IsFullTransitionArray(raw_transitions));
+  TransitionArray* transition_array = TransitionArray::cast(raw_transitions);
+  return std::make_pair(transition_array->GetKey(transition_number),
+                        transition_array->GetTarget(transition_number));
+}
 
 int TransitionArray::SearchName(Name* name, int* out_insertion_index) {
   DCHECK(name->IsUniqueName());
@@ -113,6 +125,7 @@ bool TransitionArray::IsSpecialTransition(Name* name) {
   return name == heap->nonextensible_symbol() ||
          name == heap->sealed_symbol() || name == heap->frozen_symbol() ||
          name == heap->elements_transition_symbol() ||
+         name == heap->elements_transition_shortcut_symbol() ||
          name == heap->strict_function_transition_symbol();
 }
 #endif

src/transitions.cc

@@ -16,7 +16,9 @@ namespace internal {
 void TransitionArray::Insert(Handle<Map> map, Handle<Name> name,
                              Handle<Map> target, SimpleTransitionFlag flag) {
   Isolate* isolate = map->GetIsolate();
-  target->SetBackPointer(*map);
+  if (flag != SPECIAL_SHORTCUT_TRANSITION) {
+    target->SetBackPointer(*map);
+  }
 
   // If the map doesn't have any transitions at all yet, install the new one.
   if (CanStoreSimpleTransition(map->raw_transitions())) {
@@ -30,7 +32,7 @@ void TransitionArray::Insert(Handle<Map> map, Handle<Name> name,
     ReplaceTransitions(map, *result);
   }
 
-  bool is_special_transition = flag == SPECIAL_TRANSITION;
+  bool is_special_transition = flag >= SPECIAL_TRANSITION;
   // If the map has a simple transition, check if it should be overwritten.
   if (IsSimpleTransition(map->raw_transitions())) {
     Map* old_target = GetSimpleTransition(map->raw_transitions());

src/transitions.h

@@ -153,6 +153,9 @@ class TransitionArray: public FixedArray {
   inline Map* GetTarget(int transition_number);
   inline void SetTarget(int transition_number, Map* target);
 
+  static inline std::pair<Name*, Map*> GetKeyAndTarget(Object* raw_transitions,
+                                                       int transition_number);
+
   static inline PropertyDetails GetTargetDetails(Name* name, Map* target);
 
   // Returns the number of transitions in the array.

test/mjsunit/regress/regress-crbug-738763.js

+// Copyright 2017 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --verify-heap --allow-natives-syntax --expose-gc
+
+let constant = { a: 1 };
+
+function update_array(array) {
+  array.x = constant;
+  %HeapObjectVerify(array);
+  array[0] = undefined;
+  %HeapObjectVerify(array);
+  return array;
+}
+
+let ar1 = [1];
+let ar2 = [2];
+let ar3 = [3];
+gc();
+gc();
+
+update_array(ar1);
+constant = update_array(ar2);
+update_array(ar3);