Reland "Lazily register prototype users..."

...when handing out validity cells to handlers; because invalidating said cells is
the only time we'll need the user registrations.
Along the way, fix a corner case in WeakFixedArray, which can now be empty after
the recently introduced compaction support.

This reverts commit 968715c6.

Original review: https://codereview.chromium.org/1104813004/

Review URL: https://codereview.chromium.org/1110513002

Cr-Commit-Position: refs/heads/master@{#28076}

src/objects.h

@@ -1841,9 +1841,11 @@ class JSObject: public JSReceiver {
   static void OptimizeAsPrototype(Handle<JSObject> object,
                                   PrototypeOptimizationMode mode);
   static void ReoptimizeIfPrototype(Handle<JSObject> object);
-  static void RegisterPrototypeUser(Handle<JSObject> prototype,
-                                    Handle<HeapObject> user);
-  static void UnregisterPrototypeUser(Handle<JSObject> prototype,
+  static void LazyRegisterPrototypeUser(Handle<Map> user, Isolate* isolate);
+  static bool RegisterPrototypeUserIfNotRegistered(Handle<JSObject> prototype,
+                                                   Handle<HeapObject> user,
+                                                   Isolate* isolate);
+  static bool UnregisterPrototypeUser(Handle<JSObject> prototype,
                                       Handle<HeapObject> user);
   static void InvalidatePrototypeChains(Map* map);
 
@@ -2621,9 +2623,11 @@ class WeakFixedArray : public FixedArray {
   // If |maybe_array| is not a WeakFixedArray, a fresh one will be allocated.
   static Handle<WeakFixedArray> Add(
       Handle<Object> maybe_array, Handle<HeapObject> value,
-      SearchForDuplicates search_for_duplicates = kAlwaysAdd);
+      SearchForDuplicates search_for_duplicates = kAlwaysAdd,
+      bool* was_present = NULL);
 
-  void Remove(Handle<HeapObject> value);
+  // Returns true if an entry was found and removed.
+  bool Remove(Handle<HeapObject> value);
 
   void Compact();
 
@@ -5844,6 +5848,9 @@ class DependentCode: public FixedArray {
 };
 
 
+class PrototypeInfo;
+
+
 // All heap objects have a Map that describes their structure.
 //  A Map contains information about:
 //  - Size information about the object
@@ -6051,6 +6058,10 @@ class Map: public HeapObject {
   // [prototype_info]: Per-prototype metadata. Aliased with transitions
   // (which prototype maps don't have).
   DECL_ACCESSORS(prototype_info, Object)
+  // PrototypeInfo is created lazily using this helper (which installs it on
+  // the given prototype's map).
+  static Handle<PrototypeInfo> GetOrCreatePrototypeInfo(
+      Handle<JSObject> prototype, Isolate* isolate);
 
   // [prototype chain validity cell]: Associated with a prototype object,
   // stored in that object's map's PrototypeInfo, indicates that prototype
@@ -6123,9 +6134,6 @@ class Map: public HeapObject {
   static void SetPrototype(
       Handle<Map> map, Handle<Object> prototype,
       PrototypeOptimizationMode proto_mode = FAST_PROTOTYPE);
-  static bool ShouldRegisterAsPrototypeUser(Handle<Map> map,
-                                            Handle<JSObject> prototype);
-  bool CanUseOptimizationsBasedOnPrototypeRegistry();
 
   // [constructor]: points back to the function responsible for this map.
   // The field overlaps with the back pointer. All maps in a transition tree

test/cctest/test-heap.cc

@@ -5367,3 +5367,15 @@ TEST(Regress472513) {
   TestRightTrimFixedTypedArray(i::kExternalUint16Array, 8 - 1, 3);
   TestRightTrimFixedTypedArray(i::kExternalUint32Array, 4, 3);
 }
+
+
+TEST(WeakFixedArray) {
+  CcTest::InitializeVM();
+  v8::HandleScope scope(CcTest::isolate());
+
+  Handle<HeapNumber> number = CcTest::i_isolate()->factory()->NewHeapNumber(1);
+  Handle<WeakFixedArray> array = WeakFixedArray::Add(Handle<Object>(), number);
+  array->Remove(number);
+  array->Compact();
+  WeakFixedArray::Add(array, number);
+}

test/mjsunit/prototype-changes.js

+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function A() {
+  this.a = "a";
+}
+var a = new A();
+
+function B() {
+  this.b = "b";
+}
+B.prototype = a;
+
+function C() {
+  this.c = "c";
+}
+C.prototype = new B();
+
+var c = new C();
+
+function f(expected) {
+  var result = c.z;
+  assertEquals(expected, result);
+}
+f(undefined);
+f(undefined);
+%OptimizeFunctionOnNextCall(f);
+f(undefined);
+a.z = "z";
+f("z");
+f("z");
+
+// Test updating .__proto__ pointers.
+var p1 = {foo: 1.5};
+var p2 = {}; p2.__proto__ = p1;
+var p3 = {}; p3.__proto__ = p2;
+var o = {}; o.__proto__ = p3;
+
+for (var i = 0; i < 2; i++) o.foo;  // Force registration.
+
+var p1a = {foo: 1.7};
+p2.__proto__ = p1a;
+
+function g(o, expected) {
+  var result = o.foo;
+  assertEquals(expected, result);
+}
+
+g(o, 1.7);
+g(o, 1.7);
+g(o, 1.7);
+Object.defineProperty(p1a, "foo", {get: function() { return "foo"}});
+g(o, "foo");