Make embedded maps in optimized code weak.

src/objects.h

Index: src/objects.h
diff --git a/src/objects.h b/src/objects.h
index 957ffcb53a6056ff52d12560fb3bf0fdf2fd3165..037c90a6dcf7272e020b90c63a401a8bd5763282 100644
--- a/src/objects.h
+++ b/src/objects.h
@@ -4439,6 +4439,12 @@ class Code: public HeapObject {
   inline bool has_function_cache();
   inline void set_has_function_cache(bool flag);
 
+
+  // [marked_for_deoptimization]: For kind OPTIMIZED_FUNCTION tells whether
+  // the code is going to be deoptimized because of dead embedded maps.
+  inline bool marked_for_deoptimization();
+  inline void set_marked_for_deoptimization(bool flag);
+
   bool allowed_in_shared_map_code_cache();
 
   // Get the safepoint entry for the given pc.
@@ -4646,11 +4652,16 @@ class Code: public HeapObject {
   static const int kHasFunctionCacheFirstBit =
       kStackSlotsFirstBit + kStackSlotsBitCount;
   static const int kHasFunctionCacheBitCount = 1;
+  static const int kMarkedForDeoptimizationFirstBit =
+      kStackSlotsFirstBit + kStackSlotsBitCount + 1;
+  static const int kMarkedForDeoptimizationBitCount = 1;
 
   STATIC_ASSERT(kStackSlotsFirstBit + kStackSlotsBitCount <= 32);
   STATIC_ASSERT(kUnaryOpTypeFirstBit + kUnaryOpTypeBitCount <= 32);
   STATIC_ASSERT(kToBooleanStateFirstBit + kToBooleanStateBitCount <= 32);
   STATIC_ASSERT(kHasFunctionCacheFirstBit + kHasFunctionCacheBitCount <= 32);
+  STATIC_ASSERT(kMarkedForDeoptimizationBitCount +
+                kMarkedForDeoptimizationBitCount <= 32);
 
   class StackSlotsField: public BitField<int,
       kStackSlotsFirstBit, kStackSlotsBitCount> {};  // NOLINT
@@ -4660,6 +4671,9 @@ class Code: public HeapObject {
       kToBooleanStateFirstBit, kToBooleanStateBitCount> {};  // NOLINT
   class HasFunctionCacheField: public BitField<bool,
       kHasFunctionCacheFirstBit, kHasFunctionCacheBitCount> {};  // NOLINT
+  class MarkedForDeoptimizationField: public BitField<bool,
+      kMarkedForDeoptimizationFirstBit,
+      kMarkedForDeoptimizationBitCount> {};  // NOLINT
 
   // KindSpecificFlags2 layout (STUB and OPTIMIZED_FUNCTION)
   static const int kStubMajorKeyFirstBit = 0;
@@ -4707,6 +4721,27 @@ class Code: public HeapObject {
 };
 
 
+// These helper functions abstract the layout of dependent codes array of a
+// map. The first element contains the number of codes as a Smi.
+// The subsequent elements contain code objects. The suffix of the array can
+// be filled with Smi(0) if the number of codes is less than the length of the
+// array.
+class DependentCodes {

[ulan, 2012/12/13 14:37:25]

I could make this a proper object that derives from FixedArray, but that seems
to be an overkill. WDYT?

[Michael Starzinger, 2012/12/14 14:15:26]

I think it should derive from FixedArray. One example is the TypeFeedbacksCells
class which does bascially the same. We don't need a separate instance type for
this though.

[ulan, 2013/01/17 09:35:10]

Done.

+ public:
+  static inline int number_of_codes(FixedArray* codes);
+  static inline void set_number_of_codes(FixedArray* codes, int value);
+  static inline Code* code(FixedArray* codes, int i);
+  static inline void set_code(FixedArray* codes, int i, Code* value);
+  static inline Object** code_slot(FixedArray* codes, int i);
+  static inline void clear_code(FixedArray* codes, int i);
+  static Handle<FixedArray> Append(Handle<FixedArray> codes,
+                                   Handle<Code> value);
+ private:
+  static const int kNumberOfCodesOffset = 0;
+  static const int kCodesOffset = 1;
+};
+
+
 // All heap objects have a Map that describes their structure.
 //  A Map contains information about:
 //  - Size information about the object
@@ -4928,6 +4963,9 @@ class Map: public HeapObject {
   // [stub cache]: contains stubs compiled for this map.
   DECL_ACCESSORS(code_cache, Object)
 
+  // [dependent codes]: list of optimized codes that have this map embedded.
+  DECL_ACCESSORS(dependent_codes, FixedArray)
+
   // [back pointer]: points back to the parent map from which a transition
   // leads to this map. The field overlaps with prototype transitions and the
   // back pointer will be moved into the prototype transitions array if
@@ -5137,6 +5175,14 @@ class Map: public HeapObject {
   void ZapPrototypeTransitions();
   void ZapTransitions();
 
+  bool CanTransition() {
+    // Only JSObject and subtypes have map transitions and back pointers.
+    STATIC_ASSERT(LAST_TYPE == LAST_JS_OBJECT_TYPE);
+    return instance_type() >= FIRST_JS_OBJECT_TYPE;
+  }
+
+  inline void AddDependentCode(Handle<Code> code);
+
   // Dispatched behavior.
 #ifdef OBJECT_PRINT
   inline void MapPrint() {
@@ -5190,7 +5236,8 @@ class Map: public HeapObject {
   static const int kDescriptorsOffset =
       kTransitionsOrBackPointerOffset + kPointerSize;
   static const int kCodeCacheOffset = kDescriptorsOffset + kPointerSize;
-  static const int kBitField3Offset = kCodeCacheOffset + kPointerSize;
+  static const int kDependentCodesOffset = kCodeCacheOffset + kPointerSize;
+  static const int kBitField3Offset = kDependentCodesOffset + kPointerSize;
   static const int kSize = kBitField3Offset + kPointerSize;
 
   // Layout of pointer fields. Heap iteration code relies on them