[heap] Activate old-to-new slot invalidation

The previous CL https://crrev.com/c/1771783 introduced the old-to-new
invalidation set, while still manually deleting slots in the remembered
set. This CL only clears slots during sweeping when shrinking objects.
The invalidation set is now used to filter slots in scavenge and
mark-compact.

Bug: v8:9454
Change-Id: I3a4c562d29cce0eddd9884e5f6fc1a09d1b5cd5e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1807275
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63964}

src/heap/heap.cc

@@ -5560,9 +5560,10 @@ void Heap::ClearRecordedSlot(HeapObject object, ObjectSlot slot) {
   if (!page->InYoungGeneration()) {
     DCHECK_EQ(page->owner_identity(), OLD_SPACE);
 
-    store_buffer()->MoveAllEntriesToRememberedSet();
-    RememberedSet<OLD_TO_NEW>::Remove(page, slot.address());
-    RememberedSetSweeping::Remove(page, slot.address());
+    if (!page->SweepingDone()) {
+      store_buffer()->MoveAllEntriesToRememberedSet();
+      RememberedSet<OLD_TO_NEW>::Remove(page, slot.address());
+    }
   }
 #endif
 }
@@ -5591,11 +5592,11 @@ void Heap::ClearRecordedSlotRange(Address start, Address end) {
   if (!page->InYoungGeneration()) {
     DCHECK_EQ(page->owner_identity(), OLD_SPACE);
 
-    store_buffer()->MoveAllEntriesToRememberedSet();
-    RememberedSet<OLD_TO_NEW>::RemoveRange(page, start, end,
-                                           SlotSet::KEEP_EMPTY_BUCKETS);
-    RememberedSetSweeping::RemoveRange(page, start, end,
-                                       SlotSet::KEEP_EMPTY_BUCKETS);
+    if (!page->SweepingDone()) {
+      store_buffer()->MoveAllEntriesToRememberedSet();
+      RememberedSet<OLD_TO_NEW>::RemoveRange(page, start, end,
+                                             SlotSet::KEEP_EMPTY_BUCKETS);
+    }
   }
 #endif
 }

src/heap/mark-compact.cc

@@ -3415,7 +3415,7 @@ class RememberedSetUpdatingItem : public UpdatingItem {
       RememberedSet<OLD_TO_NEW>::Iterate(
           chunk_,
           [this, &filter](MaybeObjectSlot slot) {
-            CHECK(filter.IsValid(slot.address()));
+            if (!filter.IsValid(slot.address())) return REMOVE_SLOT;
             return CheckAndUpdateOldToNewSlot(slot);
           },
           SlotSet::PREFREE_EMPTY_BUCKETS);
@@ -3426,7 +3426,7 @@ class RememberedSetUpdatingItem : public UpdatingItem {
       RememberedSetSweeping::Iterate(
           chunk_,
           [this, &filter](MaybeObjectSlot slot) {
-            CHECK(filter.IsValid(slot.address()));
+            if (!filter.IsValid(slot.address())) return REMOVE_SLOT;
             return CheckAndUpdateOldToNewSlot(slot);
           },
           SlotSet::PREFREE_EMPTY_BUCKETS);

src/heap/scavenger.cc

@@ -445,7 +445,7 @@ void Scavenger::ScavengePage(MemoryChunk* page) {
   RememberedSet<OLD_TO_NEW>::Iterate(
       page,
       [this, &filter](MaybeObjectSlot slot) {
-        CHECK(filter.IsValid(slot.address()));
+        if (!filter.IsValid(slot.address())) return REMOVE_SLOT;
         return CheckAndScavengeObject(heap_, slot);
       },
       SlotSet::KEEP_EMPTY_BUCKETS);
@@ -453,7 +453,7 @@ void Scavenger::ScavengePage(MemoryChunk* page) {
   RememberedSetSweeping::Iterate(
       page,
       [this, &filter](MaybeObjectSlot slot) {
-        CHECK(filter.IsValid(slot.address()));
+        if (!filter.IsValid(slot.address())) return REMOVE_SLOT;
         return CheckAndScavengeObject(heap_, slot);
       },
       SlotSet::KEEP_EMPTY_BUCKETS);

src/objects/js-objects.cc

@@ -2922,10 +2922,6 @@ void MigrateFastToSlow(Isolate* isolate, Handle<JSObject> object,
   // garbage.
   int inobject_properties = new_map->GetInObjectProperties();
   if (inobject_properties) {
-    Heap* heap = isolate->heap();
-    heap->ClearRecordedSlotRange(
-        object->address() + map->GetInObjectPropertyOffset(0),
-        object->address() + new_instance_size);
     MemoryChunk* chunk = MemoryChunk::FromHeapObject(*object);
     chunk->InvalidateRecordedSlots(*object);
 

src/objects/string.cc

@@ -161,7 +161,8 @@ bool String::MakeExternal(v8::String::ExternalStringResource* resource) {
   bool has_pointers = StringShape(*this).IsIndirect();
 
   if (has_pointers) {
-    isolate->heap()->NotifyObjectLayoutChange(*this, no_allocation);
+    isolate->heap()->NotifyObjectLayoutChange(*this, no_allocation,
+                                              InvalidateRecordedSlots::kYes);
   }
   // Morph the string to an external string by replacing the map and
   // reinitializing the fields.  This won't work if the space the existing
@@ -187,10 +188,6 @@ bool String::MakeExternal(v8::String::ExternalStringResource* resource) {
   isolate->heap()->CreateFillerObjectAt(
       this->address() + new_size, size - new_size,
       has_pointers ? ClearRecordedSlots::kYes : ClearRecordedSlots::kNo);
-  if (has_pointers) {
-    isolate->heap()->ClearRecordedSlotRange(this->address(),
-                                            this->address() + new_size);
-  }
 
   // We are storing the new map using release store after creating a filler for
   // the left-over space to avoid races with the sweeper thread.
@@ -235,7 +232,8 @@ bool String::MakeExternal(v8::String::ExternalOneByteStringResource* resource) {
   bool has_pointers = StringShape(*this).IsIndirect();
 
   if (has_pointers) {
-    isolate->heap()->NotifyObjectLayoutChange(*this, no_allocation);
+    isolate->heap()->NotifyObjectLayoutChange(*this, no_allocation,
+                                              InvalidateRecordedSlots::kYes);
   }
   // Morph the string to an external string by replacing the map and
   // reinitializing the fields.  This won't work if the space the existing
@@ -260,10 +258,6 @@ bool String::MakeExternal(v8::String::ExternalOneByteStringResource* resource) {
   isolate->heap()->CreateFillerObjectAt(
       this->address() + new_size, size - new_size,
       has_pointers ? ClearRecordedSlots::kYes : ClearRecordedSlots::kNo);
-  if (has_pointers) {
-    isolate->heap()->ClearRecordedSlotRange(this->address(),
-                                            this->address() + new_size);
-  }
 
   // We are storing the new map using release store after creating a filler for
   // the left-over space to avoid races with the sweeper thread.