Revert "[turbofan] Add support for extending properties backing store."

This reverts commit 88a7061a (with
one manually-resolved merge conflict).

It caused a spike of GC crashes on Canary.

TBR=bmeurer@chromium.org

Bug: chromium:708339, v8:5267
Change-Id: I8a5683bbdfb61c95d81a2ee7cdb913f39e553093
Reviewed-on: https://chromium-review.googlesource.com/471928
Commit-Queue: Adam Klein <adamk@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44496}

src/compiler/access-info.cc

@@ -515,6 +515,10 @@ bool AccessInfoFactory::LookupTransition(Handle<Map> map, Handle<Name> name,
                                          MaybeHandle<JSObject> holder,
                                          PropertyAccessInfo* access_info) {
   // Check if the {map} has a data transition with the given {name}.
+  if (map->unused_property_fields() == 0) {
+    *access_info = PropertyAccessInfo::Generic(MapList{map});
+    return true;
+  }
   Handle<Map> transition_map;
   if (TransitionArray::SearchTransition(map, kData, name, NONE)
           .ToHandle(&transition_map)) {

src/compiler/js-native-context-specialization.cc

@@ -1623,42 +1623,19 @@ JSNativeContextSpecialization::BuildPropertyAccess(
           UNREACHABLE();
           break;
       }
-      // Check if we need to perform a transitioning store.
       Handle<Map> transition_map;
       if (access_info.transition_map().ToHandle(&transition_map)) {
-        // Check if we need to grow the properties backing store
-        // with this transitioning store.
-        Handle<Map> original_map(Map::cast(transition_map->GetBackPointer()),
-                                 isolate());
-        if (original_map->unused_property_fields() == 0) {
-          DCHECK(!field_index.is_inobject());
-
-          // Reallocate the properties {storage}.
-          storage = effect = BuildExtendPropertiesBackingStore(
-              original_map, storage, effect, control);
-
-          // Perform the actual store.
-          effect = graph()->NewNode(simplified()->StoreField(field_access),
-                                    storage, value, effect, control);
-
-          // Atomically switch to the new properties below.
-          field_access = AccessBuilder::ForJSObjectProperties();
-          value = storage;
-          storage = receiver;
-        }
         effect = graph()->NewNode(
             common()->BeginRegion(RegionObservability::kObservable), effect);
         effect = graph()->NewNode(
             simplified()->StoreField(AccessBuilder::ForMap()), receiver,
             jsgraph()->Constant(transition_map), effect, control);
-        effect = graph()->NewNode(simplified()->StoreField(field_access),
-                                  storage, value, effect, control);
+      }
+      effect = graph()->NewNode(simplified()->StoreField(field_access), storage,
+                                value, effect, control);
+      if (access_info.HasTransitionMap()) {
         effect = graph()->NewNode(common()->FinishRegion(),
                                   jsgraph()->UndefinedConstant(), effect);
-      } else {
-        // Regular non-transitioning field store.
-        effect = graph()->NewNode(simplified()->StoreField(field_access),
-                                  storage, value, effect, control);
       }
     }
   } else {
@@ -2186,46 +2163,6 @@ Node* JSNativeContextSpecialization::BuildCheckMaps(
                           effect, control);
 }
 
-Node* JSNativeContextSpecialization::BuildExtendPropertiesBackingStore(
-    Handle<Map> map, Node* properties, Node* effect, Node* control) {
-  DCHECK_EQ(0, map->unused_property_fields());
-  // Compute the length of the old {properties} and the new properties.
-  int length = map->NextFreePropertyIndex() - map->GetInObjectProperties();
-  int new_length = length + JSObject::kFieldsAdded;
-  // Collect the field values from the {properties}.
-  ZoneVector<Node*> values(zone());
-  values.reserve(new_length);
-  for (int i = 0; i < length; ++i) {
-    Node* value = effect = graph()->NewNode(
-        simplified()->LoadField(AccessBuilder::ForFixedArraySlot(i)),
-        properties, effect, control);
-    values.push_back(value);
-  }
-  // Initialize the new fields to undefined.
-  for (int i = 0; i < JSObject::kFieldsAdded; ++i) {
-    values.push_back(jsgraph()->UndefinedConstant());
-  }
-  // Allocate and initialize the new properties.
-  effect = graph()->NewNode(
-      common()->BeginRegion(RegionObservability::kNotObservable), effect);
-  Node* new_properties = effect = graph()->NewNode(
-      simplified()->Allocate(Type::OtherInternal(), NOT_TENURED),
-      jsgraph()->Constant(FixedArray::SizeFor(new_length)), effect, control);
-  effect = graph()->NewNode(simplified()->StoreField(AccessBuilder::ForMap()),
-                            new_properties, jsgraph()->FixedArrayMapConstant(),
-                            effect, control);
-  effect = graph()->NewNode(
-      simplified()->StoreField(AccessBuilder::ForFixedArrayLength()),
-      new_properties, jsgraph()->Constant(new_length), effect, control);
-  for (int i = 0; i < new_length; ++i) {
-    effect = graph()->NewNode(
-        simplified()->StoreField(
-            AccessBuilder::ForFixedArraySlot(i, kNoWriteBarrier)),
-        new_properties, values[i], effect, control);
-  }
-  return graph()->NewNode(common()->FinishRegion(), new_properties, effect);
-}
-
 void JSNativeContextSpecialization::AssumePrototypesStable(
     std::vector<Handle<Map>> const& receiver_maps, Handle<JSObject> holder) {
   // Determine actual holder and perform prototype chain checks.

src/compiler/js-native-context-specialization.h

@@ -132,10 +132,6 @@ class JSNativeContextSpecialization final : public AdvancedReducer {
   Node* BuildCheckMaps(Node* receiver, Node* effect, Node* control,
                        std::vector<Handle<Map>> const& maps);
 
-  // Construct appropriate subgraph to extend properties backing store.
-  Node* BuildExtendPropertiesBackingStore(Handle<Map> map, Node* properties,
-                                          Node* effect, Node* control);
-
   // Adds stability dependencies on all prototypes of every class in
   // {receiver_type} up to (and including) the {holder}.
   void AssumePrototypesStable(std::vector<Handle<Map>> const& receiver_maps,