Revert "[runtime] Load only 10 bits as PropertyArray length"

This reverts commit b2bf43d5.

Reason for revert: 
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20nosnap%20-%20debug/builds/14149

Original change's description:
> [runtime] Load only 10 bits as PropertyArray length
> 
> Bug: v8:6404
> Change-Id: I187f20006c14aab4a36e2bfef31ca68ebb249e43
> Reviewed-on: https://chromium-review.googlesource.com/576516
> Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Reviewed-by: Camillo Bruni <cbruni@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#46822}

TBR=ulan@chromium.org,jkummerow@chromium.org,mstarzinger@chromium.org,cbruni@chromium.org,gsathya@chromium.org

Change-Id: If55b65f040a5a541726e39c35c12e3a5731aa744
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:6404
Reviewed-on: https://chromium-review.googlesource.com/582607Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46823}

src/code-stub-assembler.cc

@@ -2349,30 +2349,6 @@ Node* CodeStubAssembler::AllocateFixedArray(ElementsKind kind,
   return array;
 }
 
-void CodeStubAssembler::InitializePropertyArrayLength(Node* property_array,
-                                                      Node* length,
-                                                      ParameterMode mode) {
-  CSA_SLOW_ASSERT(this, IsPropertyArray(property_array));
-  CSA_ASSERT(
-      this, IntPtrOrSmiGreaterThan(length, IntPtrOrSmiConstant(0, mode), mode));
-  CSA_ASSERT(
-      this,
-      IntPtrOrSmiLessThanOrEqual(
-          length, IntPtrOrSmiConstant(PropertyArray::kMaxLength, mode), mode));
-  StoreObjectFieldNoWriteBarrier(property_array, PropertyArray::kLengthOffset,
-                                 ParameterToTagged(length, mode),
-                                 MachineRepresentation::kTaggedSigned);
-}
-
-Node* CodeStubAssembler::LoadPropertyArrayLength(Node* property_array) {
-  CSA_SLOW_ASSERT(this, IsPropertyArray(property_array));
-  Node* const value =
-      LoadObjectField(property_array, PropertyArray::kLengthOffset,
-                      MachineType::TaggedSigned());
-  Node* const length = SmiAnd(value, SmiConstant(PropertyArray::kLengthMask));
-  return length;
-}
-
 Node* CodeStubAssembler::AllocatePropertyArray(Node* capacity_node,
                                                ParameterMode mode,
                                                AllocationFlags flags) {
@@ -2385,7 +2361,8 @@ Node* CodeStubAssembler::AllocatePropertyArray(Node* capacity_node,
   Heap::RootListIndex map_index = Heap::kPropertyArrayMapRootIndex;
   DCHECK(Heap::RootIsImmortalImmovable(map_index));
   StoreMapNoWriteBarrier(array, map_index);
-  InitializePropertyArrayLength(array, capacity_node, mode);
+  StoreObjectFieldNoWriteBarrier(array, FixedArray::kLengthOffset,
+                                 ParameterToTagged(capacity_node, mode));
   return array;
 }
 

src/code-stub-assembler.h

@@ -419,12 +419,6 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   // Map::GetConstructor()).
   Node* LoadMapConstructor(Node* map);
 
-  // This is only used on a newly allocated PropertyArray which
-  // doesn't have an existing hash.
-  void InitializePropertyArrayLength(Node* property_array, Node* length,
-                                     ParameterMode mode);
-  Node* LoadPropertyArrayLength(Node* property_array);
-
   // Check if the map is set for slow properties.
   Node* IsDictionaryMap(Node* map);
 

src/compiler/access-builder.cc

@@ -476,19 +476,6 @@ FieldAccess AccessBuilder::ForFixedArrayLength() {
   return access;
 }
 
-// static
-FieldAccess AccessBuilder::ForPropertyArrayLength() {
-  // TODO(gsathya): Update the value range once we add the hash code.
-  FieldAccess access = {kTaggedBase,
-                        PropertyArray::kLengthOffset,
-                        MaybeHandle<Name>(),
-                        MaybeHandle<Map>(),
-                        TypeCache::Get().kPropertyArrayLengthType,
-                        MachineType::TaggedSigned(),
-                        kNoWriteBarrier};
-  return access;
-}
-
 // static
 FieldAccess AccessBuilder::ForFixedTypedArrayBaseBasePointer() {
   FieldAccess access = {

src/compiler/access-builder.h

@@ -160,9 +160,6 @@ class V8_EXPORT_PRIVATE AccessBuilder final
   // Provides access to FixedArray::length() field.
   static FieldAccess ForFixedArrayLength();
 
-  // Provides access to PropertyArray::length() field.
-  static FieldAccess ForPropertyArrayLength();
-
   // Provides access to FixedTypedArrayBase::base_pointer() field.
   static FieldAccess ForFixedTypedArrayBaseBasePointer();
 

src/compiler/js-native-context-specialization.cc

@@ -2248,14 +2248,13 @@ Node* JSNativeContextSpecialization::BuildExtendPropertiesBackingStore(
       simplified()->StoreField(AccessBuilder::ForMap()), new_properties,
       jsgraph()->PropertyArrayMapConstant(), effect, control);
   effect = graph()->NewNode(
-      simplified()->StoreField(AccessBuilder::ForPropertyArrayLength()),
+      simplified()->StoreField(AccessBuilder::ForFixedArrayLength()),
       new_properties, jsgraph()->Constant(new_length), effect, control);
   for (int i = 0; i < new_length; ++i) {
     effect = graph()->NewNode(
         simplified()->StoreField(AccessBuilder::ForFixedArraySlot(i)),
         new_properties, values[i], effect, control);
   }
-  // TODO(gsathya): Update hash code here.
   return graph()->NewNode(common()->FinishRegion(), new_properties, effect);
 }
 

src/compiler/type-cache.h

@@ -83,11 +83,6 @@ class TypeCache final {
   // [0, FixedArray::kMaxLength].
   Type* const kFixedArrayLengthType = CreateRange(0.0, FixedArray::kMaxLength);
 
-  // The PropertyArray::length property always containts a smi in the range
-  // [0, PropertyArray::kMaxLength].
-  Type* const kPropertyArrayLengthType =
-      CreateRange(0.0, PropertyArray::kMaxLength);
-
   // The FixedDoubleArray::length property always containts a smi in the range
   // [0, FixedDoubleArray::kMaxLength].
   Type* const kFixedDoubleArrayLengthType =

src/heap/heap.cc

@@ -4084,19 +4084,6 @@ AllocationResult Heap::AllocateEmptyFixedTypedArray(
   return AllocateFixedTypedArray(0, array_type, false, TENURED);
 }
 
-namespace {
-template <typename T>
-void initialize_length(T* array, int length) {
-  array->set_length(length);
-}
-
-template <>
-void initialize_length<PropertyArray>(PropertyArray* array, int length) {
-  array->initialize_length(length);
-}
-
-}  // namespace
-
 template <typename T>
 AllocationResult Heap::CopyArrayAndGrow(T* src, int grow_by,
                                         PretenureFlag pretenure) {
@@ -4111,7 +4098,7 @@ AllocationResult Heap::CopyArrayAndGrow(T* src, int grow_by,
 
   obj->set_map_after_allocation(src->map(), SKIP_WRITE_BARRIER);
   T* result = T::cast(obj);
-  initialize_length(result, new_len);
+  result->set_length(new_len);
 
   // Copy the content.
   DisallowHeapAllocation no_gc;
@@ -4172,7 +4159,7 @@ AllocationResult Heap::CopyArrayWithMap(T* src, Map* map) {
   }
 
   // Slow case: Just copy the content one-by-one.
-  initialize_length(result, len);
+  result->set_length(len);
   for (int i = 0; i < len; i++) result->set(i, src->get(i), mode);
   return result;
 }
@@ -4256,7 +4243,7 @@ AllocationResult Heap::AllocatePropertyArray(int length,
 
   result->set_map_after_allocation(property_array_map(), SKIP_WRITE_BARRIER);
   PropertyArray* array = PropertyArray::cast(result);
-  array->initialize_length(length);
+  array->set_length(length);
   MemsetPointer(array->data_start(), undefined_value(), length);
   return result;
 }

src/ic/accessor-assembler.cc

@@ -1050,7 +1050,9 @@ void AccessorAssembler::ExtendPropertiesBackingStore(Node* object,
   ParameterMode mode = OptimalParameterMode();
 
   Node* properties = LoadProperties(object);
-  Node* length = TaggedToParameter(LoadPropertyArrayLength(properties), mode);
+  Node* length = (mode == INTPTR_PARAMETERS)
+                     ? LoadAndUntagFixedArrayBaseLength(properties)
+                     : LoadFixedArrayBaseLength(properties);
 
   // Previous property deletion could have left behind unused backing store
   // capacity even for a map that think it doesn't have any unused fields.
@@ -1084,7 +1086,6 @@ void AccessorAssembler::ExtendPropertiesBackingStore(Node* object,
   CopyPropertyArrayValues(properties, new_properties, length,
                           SKIP_WRITE_BARRIER, mode);
 
-  // TODO(gsathya): Update hash code here.
   StoreObjectField(object, JSObject::kPropertiesOrHashOffset, new_properties);
   Comment("] Extend storage");
   Goto(&done);

src/objects-inl.h

@@ -2701,23 +2701,8 @@ const HashTable<Derived, Shape>* HashTable<Derived, Shape>::cast(
 SMI_ACCESSORS(FixedArrayBase, length, kLengthOffset)
 SYNCHRONIZED_SMI_ACCESSORS(FixedArrayBase, length, kLengthOffset)
 
-int PropertyArray::length() const {
-  Object* value = READ_FIELD(this, kLengthOffset);
-  int len = Smi::ToInt(value);
-  return len & kLengthMask;
-}
-
-void PropertyArray::initialize_length(int len) {
-  SLOW_DCHECK(len >= 0);
-  SLOW_DCHECK(len < kMaxLength);
-  WRITE_FIELD(this, kLengthOffset, Smi::FromInt(len));
-}
-
-int PropertyArray::synchronized_length() const {
-  Object* value = ACQUIRE_READ_FIELD(this, kLengthOffset);
-  int len = Smi::ToInt(value);
-  return len & kLengthMask;
-}
+SMI_ACCESSORS(PropertyArray, length, kLengthOffset)
+SYNCHRONIZED_SMI_ACCESSORS(PropertyArray, length, kLengthOffset)
 
 SMI_ACCESSORS(FreeSpace, size, kSizeOffset)
 RELAXED_SMI_ACCESSORS(FreeSpace, size, kSizeOffset)

src/objects.h

@@ -3041,13 +3041,11 @@ class PropertyArray : public HeapObject {
  public:
   // [length]: length of the array.
   inline int length() const;
+  inline void set_length(int length);
 
-  // Get the length using acquire loads.
+  // Get and set the length using acquire loads and release stores.
   inline int synchronized_length() const;
-
-  // This is only used on a newly allocated PropertyArray which
-  // doesn't have an existing hash.
-  inline void initialize_length(int length);
+  inline void synchronized_set_length(int value);
 
   inline Object* get(int index) const;
 
@@ -3077,10 +3075,6 @@ class PropertyArray : public HeapObject {
   // No weak fields.
   typedef BodyDescriptor BodyDescriptorWeak;
 
-  static const int kLengthMask = 1023;
-  static const int kMaxLength = kLengthMask;
-  STATIC_ASSERT(kMaxLength > kMaxNumberOfDescriptors);
-
  private:
   DISALLOW_IMPLICIT_CONSTRUCTORS(PropertyArray);
 };

src/objects/object-macros-undef.h

@@ -34,8 +34,6 @@
 #undef WRITE_INT_FIELD
 #undef READ_INTPTR_FIELD
 #undef WRITE_INTPTR_FIELD
-#undef RELAXED_READ_INTPTR_FIELD
-#undef RELAXED_WRITE_INTPTR_FIELD
 #undef READ_UINT8_FIELD
 #undef WRITE_UINT8_FIELD
 #undef READ_INT8_FIELD

src/objects/object-macros.h

@@ -178,10 +178,6 @@
 #define WRITE_INT_FIELD(p, offset, value) \
   (*reinterpret_cast<int*>(FIELD_ADDR(p, offset)) = value)
 
-#define RELAXED_READ_INTPTR_FIELD(p, offset) \
-  static_cast<intptr_t>(base::Relaxed_Load(  \
-      reinterpret_cast<const base::AtomicWord*>(FIELD_ADDR_CONST(p, offset))))
-
 #define READ_INTPTR_FIELD(p, offset) \
   (*reinterpret_cast<const intptr_t*>(FIELD_ADDR_CONST(p, offset)))