Move prototype metadata from internal properties to prototype maps

Move prototype metadata from internal properties to prototype maps

The motivation is that we prefer to avoid creating internal properties, and we have a usable field on maps ("transitions", which is not used for prototype maps).
This CL also ensures the invariant that prototype maps are never shared, even if they are in dictionary mode.

Committed: https://crrev.com/90cbede58882383173963809c90bf5514cc91648
Cr-Commit-Position: refs/heads/master@{#27617}

[Jakob Kummerow, 2015-03-24 10:40:13]

jkummerow@chromium.org changed reviewers:
+ verwaest@chromium.org

[Jakob Kummerow, 2015-03-24 10:40:14]

Next step as discussed. PTAL.

https://codereview.chromium.org/1033653002/diff/1/src/bootstrapper.cc
File src/bootstrapper.cc (right):

https://codereview.chromium.org/1033653002/diff/1/src/bootstrapper.cc#newcode836
src/bootstrapper.cc:836:
js_global_object_function->initial_map()->set_is_prototype_map(true);
This makes it possible to DCHECK that we only ever install PrototypeInfo structs
on prototype maps.

https://codereview.chromium.org/1033653002/diff/1/src/heap/objects-visiting-i...
File src/heap/objects-visiting-inl.h (left):

https://codereview.chromium.org/1033653002/diff/1/src/heap/objects-visiting-i...
src/heap/objects-visiting-inl.h:590: heap, HeapObject::RawField(map,
Map::kTransitionsOffset));
This is covered by the VisitPointers() call in line 618 (new 614) anyway.

https://codereview.chromium.org/1033653002/diff/1/src/objects.cc
File src/objects.cc (right):

https://codereview.chromium.org/1033653002/diff/1/src/objects.cc#newcode4499
src/objects.cc:4499: MigrateToMap(object, new_map,
expected_additional_properties);
MigrateToMap is now *the* choke point for changing an object's map.

https://codereview.chromium.org/1033653002/diff/1/src/objects.h
File src/objects.h (right):

https://codereview.chromium.org/1033653002/diff/1/src/objects.h#newcode522
src/objects.h:522: #define STRUCT_LIST(V)                                       
               \
clang-format...

[Toon Verwaest, 2015-03-26 16:15:33]

lgtm
I think we don't need the backpointer in the PrototypeInfo though. Get rid of it
if possible.

https://codereview.chromium.org/1033653002/diff/10016/src/factory.cc
File src/factory.cc (right):

https://codereview.chromium.org/1033653002/diff/10016/src/factory.cc#newcode59
src/factory.cc:59: result->set_prototype_users(Smi::FromInt(0));
Something like WeakFixedArray::Empty() perhaps?

https://codereview.chromium.org/1033653002/diff/10016/src/objects-inl.h
File src/objects-inl.h (right):

https://codereview.chromium.org/1033653002/diff/10016/src/objects-inl.h#newco...
src/objects-inl.h:5381: }
double newline

https://codereview.chromium.org/1033653002/diff/10016/src/objects.cc
File src/objects.cc (right):

https://codereview.chromium.org/1033653002/diff/10016/src/objects.cc#newcode9947
src/objects.cc:9947: prototype =
handle(JSObject::cast(prototype->map()->prototype()), isolate);
Use the PrototypeIterator

https://codereview.chromium.org/1033653002/diff/10016/src/objects.cc#newcode9970
src/objects.cc:9970: prototype =
handle(JSObject::cast(prototype->map()->prototype()), isolate);
PrototypeIterator

[Jakob Kummerow, 2015-03-31 14:20:22]

Addressed comments. Got rid of the prototype_object field in PrototypeInfo as
well. PTAL.

https://codereview.chromium.org/1033653002/diff/10016/src/factory.cc
File src/factory.cc (right):

https://codereview.chromium.org/1033653002/diff/10016/src/factory.cc#newcode59
src/factory.cc:59: result->set_prototype_users(Smi::FromInt(0));
On 2015/03/26 16:15:33, Toon Verwaest wrote:
> Something like WeakFixedArray::Empty() perhaps?

Done.

https://codereview.chromium.org/1033653002/diff/10016/src/objects-inl.h
File src/objects-inl.h (right):

https://codereview.chromium.org/1033653002/diff/10016/src/objects-inl.h#newco...
src/objects-inl.h:5381: }
On 2015/03/26 16:15:33, Toon Verwaest wrote:
> double newline

Done.

https://codereview.chromium.org/1033653002/diff/10016/src/objects.cc
File src/objects.cc (right):

https://codereview.chromium.org/1033653002/diff/10016/src/objects.cc#newcode9947
src/objects.cc:9947: prototype =
handle(JSObject::cast(prototype->map()->prototype()), isolate);
On 2015/03/26 16:15:33, Toon Verwaest wrote:
> Use the PrototypeIterator

Done.

https://codereview.chromium.org/1033653002/diff/10016/src/objects.cc#newcode9970
src/objects.cc:9970: prototype =
handle(JSObject::cast(prototype->map()->prototype()), isolate);
On 2015/03/26 16:15:33, Toon Verwaest wrote:
> PrototypeIterator

Done.

[Toon Verwaest, 2015-04-07 09:09:24]

lgtm

[Jakob Kummerow, 2015-04-07 10:19:57]

The CQ bit was checked by jkummerow@chromium.org

[commit-bot: I haz the power, 2015-04-07 10:20:03]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1033653002/50001

[commit-bot: I haz the power, 2015-04-07 10:42:54]

Committed patchset #4 (id:50001)

[commit-bot: I haz the power, 2015-04-07 10:43:06]

Patchset 4 (id:??) landed as
https://crrev.com/90cbede58882383173963809c90bf5514cc91648
Cr-Commit-Position: refs/heads/master@{#27617}