[heap][elements] Improve Array.prototype.splice speed

- 30% speedup by adding HeapObject shortcut for Heap::InNewSpace

Bug: chromium:835558
Change-Id: I48b5ec43a5ecdd7d82827c955ab418fdeff449d8
Reviewed-on: https://chromium-review.googlesource.com/1027471
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52790}

src/heap/heap-inl.h

@@ -315,41 +315,53 @@ Address Heap::NewSpaceTop() { return new_space_->top(); }
 
 bool Heap::InNewSpace(Object* object) {
   DCHECK(!HasWeakHeapObjectTag(object));
-  return InNewSpace(MaybeObject::FromObject(object));
+  return object->IsHeapObject() && InNewSpace(HeapObject::cast(object));
 }
 
-bool Heap::InFromSpace(Object* object) {
-  DCHECK(!HasWeakHeapObjectTag(object));
-  return InFromSpace(MaybeObject::FromObject(object));
-}
-
-bool Heap::InToSpace(Object* object) {
-  DCHECK(!HasWeakHeapObjectTag(object));
-  return InToSpace(MaybeObject::FromObject(object));
+bool Heap::InNewSpace(MaybeObject* object) {
+  HeapObject* heap_object;
+  return object->ToStrongOrWeakHeapObject(&heap_object) &&
+         InNewSpace(heap_object);
 }
 
-bool Heap::InNewSpace(MaybeObject* object) {
+bool Heap::InNewSpace(HeapObject* heap_object) {
   // Inlined check from NewSpace::Contains.
-  HeapObject* heap_object;
-  bool result = object->ToStrongOrWeakHeapObject(&heap_object) &&
-                Page::FromAddress(heap_object->address())->InNewSpace();
+  bool result = Page::FromAddress(heap_object->address())->InNewSpace();
   DCHECK(!result ||                 // Either not in new space
          gc_state_ != NOT_IN_GC ||  // ... or in the middle of GC
-         InToSpace(object));        // ... or in to-space (where we allocate).
+         InToSpace(heap_object));   // ... or in to-space (where we allocate).
   return result;
 }
 
+bool Heap::InFromSpace(Object* object) {
+  DCHECK(!HasWeakHeapObjectTag(object));
+  return object->IsHeapObject() && InFromSpace(HeapObject::cast(object));
+}
+
 bool Heap::InFromSpace(MaybeObject* object) {
   HeapObject* heap_object;
   return object->ToStrongOrWeakHeapObject(&heap_object) &&
-         MemoryChunk::FromAddress(heap_object->address())
+         InFromSpace(heap_object);
+}
+
+bool Heap::InFromSpace(HeapObject* heap_object) {
+  return MemoryChunk::FromAddress(heap_object->address())
       ->IsFlagSet(Page::IN_FROM_SPACE);
 }
 
+bool Heap::InToSpace(Object* object) {
+  DCHECK(!HasWeakHeapObjectTag(object));
+  return object->IsHeapObject() && InToSpace(HeapObject::cast(object));
+}
+
 bool Heap::InToSpace(MaybeObject* object) {
   HeapObject* heap_object;
   return object->ToStrongOrWeakHeapObject(&heap_object) &&
-         MemoryChunk::FromAddress(heap_object->address())
+         InToSpace(heap_object);
+}
+
+bool Heap::InToSpace(HeapObject* heap_object) {
+  return MemoryChunk::FromAddress(heap_object->address())
       ->IsFlagSet(Page::IN_TO_SPACE);
 }
 
@@ -373,8 +385,10 @@ bool Heap::ShouldBePromoted(Address old_address) {
 void Heap::RecordWrite(Object* object, Object** slot, Object* value) {
   DCHECK(!HasWeakHeapObjectTag(*slot));
   DCHECK(!HasWeakHeapObjectTag(value));
-  RecordWrite(object, reinterpret_cast<MaybeObject**>(slot),
-              reinterpret_cast<MaybeObject*>(value));
+  if (!InNewSpace(value) || !object->IsHeapObject() || InNewSpace(object)) {
+    return;
+  }
+  store_buffer()->InsertEntry(reinterpret_cast<Address>(slot));
 }
 
 void Heap::RecordWrite(Object* object, MaybeObject** slot, MaybeObject* value) {

src/heap/heap.h

@@ -1353,11 +1353,14 @@ class Heap {
 
   // Returns whether the object resides in new space.
   inline bool InNewSpace(Object* object);
-  inline bool InFromSpace(Object* object);
-  inline bool InToSpace(Object* object);
   inline bool InNewSpace(MaybeObject* object);
+  inline bool InNewSpace(HeapObject* heap_object);
+  inline bool InFromSpace(Object* object);
   inline bool InFromSpace(MaybeObject* object);
+  inline bool InFromSpace(HeapObject* heap_object);
+  inline bool InToSpace(Object* object);
   inline bool InToSpace(MaybeObject* object);
+  inline bool InToSpace(HeapObject* heap_object);
 
   // Returns whether the object resides in old space.
   inline bool InOldSpace(Object* object);

src/objects-inl.h

@@ -915,7 +915,7 @@ bool JSObject::PrototypeHasNoElements(Isolate* isolate, JSObject* object) {
   return true;
 }
 
-Object** HeapObject::RawField(HeapObject* obj, int byte_offset) {
+Object** HeapObject::RawField(const HeapObject* obj, int byte_offset) {
   return reinterpret_cast<Object**>(FIELD_ADDR(obj, byte_offset));
 }
 

src/objects.h

@@ -1801,7 +1801,7 @@ class HeapObject: public Object {
   // Does no checking, and is safe to use during GC, while maps are invalid.
   // Does not invoke write barrier, so should only be assigned to
   // during marking GC.
-  static inline Object** RawField(HeapObject* obj, int offset);
+  static inline Object** RawField(const HeapObject* obj, int offset);
   static inline MaybeObject** RawMaybeWeakField(HeapObject* obj, int offset);
 
   DECL_CAST(HeapObject)