Revert of Revert "Revert of Fix memory leak caused by field type in descriptor array."

Revert of Revert "Revert of Fix memory leak caused by field type in descriptor array." (patchset #2 id:20001 of https://codereview.chromium.org/957373002/)

Reason for revert:
GC Stress breakage.

Original issue's description:
> Revert "Revert of Fix memory leak caused by field type in descriptor array."
> 
> This reverts commit b57be748b175695be2507cedf3423b59b9d6cd20 and
> disables the test/mjsunit/debug-clearbreakpointgroup.js because
> BreakLocationIterator::ClearBreakPoint is already broken for unrelated reasons (see v8:3924).
> 
> BUG=v8:3877
> LOG=N
> TEST=cctest/test-heap/Regress3877
> 
> Committed: https://crrev.com/bbf8c0f23d4995da2a9273e8aed818905f791167
> Cr-Commit-Position: refs/heads/master@{#26893}

TBR=marja@chromium.org,ulan@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3877

[Yang, 2015-03-19 07:05:13]

Created Revert of Revert "Revert of Fix memory leak caused by field type in
descriptor array."

[commit-bot: I haz the power, 2015-03-19 07:05:20]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1023503003/1

[commit-bot: I haz the power, 2015-03-19 07:05:25]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2015-03-19 07:05:27]

Failed to apply patch for src/objects.cc:
While running git apply --index -3 -p1;
  error: patch failed: src/objects.cc:2314
  Falling back to three-way merge...
  Applied patch to 'src/objects.cc' with conflicts.
  U src/objects.cc

Patch:       src/objects.cc
Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index
d93f99b3ded2fa659121ea04c0bd6ac41956c988..bef1881acb1ecd73556dec4796bf350dbe0745bd
100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -1704,12 +1704,6 @@
 }
 
 
-static Handle<Object> WrapType(Handle<HeapType> type) {
-  if (type->IsClass()) return Map::WeakCellForMap(type->AsClass()->Map());
-  return type;
-}
-
-
 MaybeHandle<Map> Map::CopyWithField(Handle<Map> map,
                                     Handle<Name> name,
                                     Handle<HeapType> type,
@@ -1735,10 +1729,7 @@
     type = HeapType::Any(isolate);
   }
 
-  Handle<Object> wrapped_type(WrapType(type));
-
-  DataDescriptor new_field_desc(name, index, wrapped_type, attributes,
-                                representation);
+  DataDescriptor new_field_desc(name, index, type, attributes, representation);
   Handle<Map> new_map = Map::CopyAddDescriptor(map, &new_field_desc, flag);
   int unused_property_fields = new_map->unused_property_fields() - 1;
   if (unused_property_fields < 0) {
@@ -2314,16 +2305,15 @@
 
 void Map::UpdateFieldType(int descriptor, Handle<Name> name,
                           Representation new_representation,
-                          Handle<Object> new_wrapped_type) {
-  DCHECK(new_wrapped_type->IsSmi() || new_wrapped_type->IsWeakCell());
+                          Handle<HeapType> new_type) {
   DisallowHeapAllocation no_allocation;
   PropertyDetails details = instance_descriptors()->GetDetails(descriptor);
   if (details.type() != DATA) return;
   if (HasTransitionArray()) {
     TransitionArray* transitions = this->transitions();
     for (int i = 0; i < transitions->number_of_transitions(); ++i) {
-      transitions->GetTarget(i)->UpdateFieldType(
-          descriptor, name, new_representation, new_wrapped_type);
+      transitions->GetTarget(i)
+          ->UpdateFieldType(descriptor, name, new_representation, new_type);
     }
   }
   // It is allowed to change representation here only from None to something.
@@ -2331,9 +2321,9 @@
          details.representation().IsNone());
 
   // Skip if already updated the shared descriptor.
-  if (instance_descriptors()->GetValue(descriptor) == *new_wrapped_type)
return;
+  if (instance_descriptors()->GetFieldType(descriptor) == *new_type) return;
   DataDescriptor d(name, instance_descriptors()->GetFieldIndex(descriptor),
-                   new_wrapped_type, details.attributes(), new_representation);
+                   new_type, details.attributes(), new_representation);
   instance_descriptors()->Replace(descriptor, &d);
 }
 
@@ -2381,10 +2371,8 @@
 
   PropertyDetails details = descriptors->GetDetails(modify_index);
   Handle<Name> name(descriptors->GetKey(modify_index));
-
-  Handle<Object> wrapped_type(WrapType(new_field_type));
   field_owner->UpdateFieldType(modify_index, name, new_representation,
-                               wrapped_type);
+                               new_field_type);
   field_owner->dependent_code()->DeoptimizeDependentCodeGroup(
       isolate, DependentCode::kFieldTypeGroup);
 
@@ -2776,8 +2764,7 @@
           next_field_type =
               GeneralizeFieldType(target_field_type, old_field_type, isolate);
         }
-        Handle<Object> wrapped_type(WrapType(next_field_type));
-        DataDescriptor d(target_key, current_offset, wrapped_type,
+        DataDescriptor d(target_key, current_offset, next_field_type,
                          next_attributes, next_representation);
         current_offset += d.GetDetails().field_width_in_words();
         new_descriptors->Set(i, &d);
@@ -2845,10 +2832,8 @@
           next_field_type = old_field_type;
         }
 
-        Handle<Object> wrapped_type(WrapType(next_field_type));
-
-        DataDescriptor d(old_key, current_offset, wrapped_type,
next_attributes,
-                         next_representation);
+        DataDescriptor d(old_key, current_offset, next_field_type,
+                         next_attributes, next_representation);
         current_offset += d.GetDetails().field_width_in_words();
         new_descriptors->Set(i, &d);
       } else {
@@ -2979,41 +2964,33 @@
     if (!old_details.representation().fits_into(new_details.representation()))
{
       return MaybeHandle<Map>();
     }
+    Object* new_value = new_descriptors->GetValue(i);
+    Object* old_value = old_descriptors->GetValue(i);
     switch (new_details.type()) {
       case DATA: {
-        HeapType* new_type = new_descriptors->GetFieldType(i);
-        PropertyType old_property_type = old_details.type();
-        if (old_property_type == DATA) {
-          HeapType* old_type = old_descriptors->GetFieldType(i);
-          if (!old_type->NowIs(new_type)) {
+        PropertyType old_type = old_details.type();
+        if (old_type == DATA) {
+          if (!HeapType::cast(old_value)->NowIs(HeapType::cast(new_value))) {
             return MaybeHandle<Map>();
           }
         } else {
-          DCHECK(old_property_type == DATA_CONSTANT);
-          Object* old_value = old_descriptors->GetValue(i);
-          if (!new_type->NowContains(old_value)) {
+          DCHECK(old_type == DATA_CONSTANT);
+          if (!HeapType::cast(new_value)->NowContains(old_value)) {
             return MaybeHandle<Map>();
           }
         }
         break;
       }
-      case ACCESSOR: {
-#ifdef DEBUG
-        HeapType* new_type = new_descriptors->GetFieldType(i);
-        DCHECK(HeapType::Any()->Is(new_type));
-#endif
+      case ACCESSOR:
+        DCHECK(HeapType::Any()->Is(HeapType::cast(new_value)));
         break;
-      }
 
       case DATA_CONSTANT:
-      case ACCESSOR_CONSTANT: {
-        Object* old_value = old_descriptors->GetValue(i);
-        Object* new_value = new_descriptors->GetValue(i);
+      case ACCESSOR_CONSTANT:
         if (old_details.location() == kField || old_value != new_value) {
           return MaybeHandle<Map>();
         }
         break;
-      }
     }
   }
   if (new_map->NumberOfOwnDescriptors() != old_nof) return MaybeHandle<Map>();