Generalize AllocationMemento::FindForHeapObject and remove corresponding new space check.

src/objects.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 9153 matching lines @@
   if (Marking::IsBlack(Marking::MarkBitFrom(start_of_string))) {
     MemoryChunk::IncrementLiveBytesFromMutator(start_of_string, -delta);
   }
 
 
   if (new_length == 0) return heap->isolate()->factory()->empty_string();
   return string;
 }
 
 
-AllocationMemento* AllocationMemento::FindForJSObject(JSObject* object,
-                                                      bool in_GC) {
-  // Currently, AllocationMemento objects are only allocated immediately
-  // after JSArrays and some JSObjects in NewSpace. Detecting whether a
-  // memento is present involves carefully checking the object immediately
-  // after the current object (if there is one) to see if it's an
-  // AllocationMemento.
-  if (FLAG_track_allocation_sites && object->GetHeap()->InNewSpace(object)) {
+AllocationMemento* AllocationMemento::FindForHeapObject(HeapObject* object,
+                                                        bool in_GC) {
+  // AllocationMemento objects are only allocated immediately after objects in
+  // NewSpace. Detecting whether a memento is present involves carefully
+  // checking the object immediately after the current object (if there is one)
+  // to see if it's an AllocationMemento.
+  ASSERT(object->GetHeap()->InNewSpace(object));
+  if (FLAG_track_allocation_sites) {

[mvstanton, 2013/12/04 16:16:50]

I think you want to add the check in method JSObject::UpdateAllocationSite(),
which is the client for the transitioning case. I'm pretty sure we could get
into there with some old space object.

[Hannes Payer (out of office), 2013/12/04 16:28:30]

Done.

     Address ptr_end = (reinterpret_cast<Address>(object) - kHeapObjectTag) +
         object->Size();
     Address top;
     if (in_GC) {
       top = object->GetHeap()->new_space()->FromSpacePageHigh();
     } else {
       top = object->GetHeap()->NewSpaceTop();
     }
     if ((ptr_end + AllocationMemento::kSize) <= top) {
       // There is room in newspace for allocation info. Do we have some?
@@ skipping 3687 matching lines @@
   CALL_HEAP_FUNCTION_VOID(object->GetIsolate(),
       object->UpdateAllocationSite(to_kind));
 }
 
 
 MaybeObject* JSObject::UpdateAllocationSite(ElementsKind to_kind) {
   if (!FLAG_track_allocation_sites || !IsJSArray()) {
     return this;
   }
 
-  AllocationMemento* memento = AllocationMemento::FindForJSObject(this);
+  AllocationMemento* memento = AllocationMemento::FindForHeapObject(this);
   if (memento == NULL || !memento->IsValid()) {
     return this;
   }
 
   // Walk through to the Allocation Site
   AllocationSite* site = memento->GetAllocationSite();
   return site->DigestTransitionFeedback(to_kind);
 }
 
 
@@ skipping 3751 matching lines @@
 #define ERROR_MESSAGES_TEXTS(C, T) T,
   static const char* error_messages_[] = {
       ERROR_MESSAGES_LIST(ERROR_MESSAGES_TEXTS)
   };
 #undef ERROR_MESSAGES_TEXTS
   return error_messages_[reason];
 }
 
 
 } }  // namespace v8::internal