Replace ad-hoc weakness in transition array with WeakCell.

src/heap/mark-compact.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/v8.h"
 
 #include "src/base/atomicops.h"
 #include "src/base/bits.h"
 #include "src/code-stubs.h"
 #include "src/compilation-cache.h"
@@ skipping 2450 matching lines @@
       descriptors == dead_transition->instance_descriptors() &&
       number_of_own_descriptors > 0) {
     TrimDescriptorArray(map, descriptors, number_of_own_descriptors);
     DCHECK(descriptors->number_of_descriptors() == number_of_own_descriptors);
     map->set_owns_descriptors(true);
     return;
   }
 
   int transition_index = 0;
 
-  bool descriptors_owner_died = false;
+  // This flag will be cleared if we find the live owner in the loop below.
+  bool descriptors_owner_died = true;
 
   // Compact all live descriptors to the left.
-  for (int i = 0; i < num_transitions; ++i) {
-    Map* target = TransitionArray::GetTarget(transitions, i);
-    if (ClearMapBackPointer(target)) {
-      if (target->instance_descriptors() == descriptors) {
-        descriptors_owner_died = true;
+  if (TransitionArray::IsFullTransitionArray(transitions)) {
+    for (int i = 0; i < num_transitions; ++i) {
+      WeakCell* target_cell =
+          TransitionArray::cast(transitions)->GetTargetCell(i);
+      if (!target_cell->cleared()) {
+        if (Map::cast(target_cell->value())->instance_descriptors() ==
+            descriptors) {
+          descriptors_owner_died = false;
+        }
+        if (i != transition_index) {
+          TransitionArray* t = TransitionArray::cast(transitions);
+          Name* key = t->GetKey(i);
+          t->SetKey(transition_index, key);
+          Object** key_slot = t->GetKeySlot(transition_index);
+          RecordSlot(key_slot, key_slot, key);
+          WeakCell* target_cell = t->GetTargetCell(i);

[brucedawson, 2015/06/20 00:08:03]

This variable declaration shadows the target_cell variable of the same type in
the outer scope. There doesn't appear to be a bug here, but this can cause
confusion. Consider either reusing the outer variable or using a different name.

+          t->SetTargetCell(transition_index, target_cell);
+          Object** target_slot = t->GetTargetSlot(transition_index);
+          RecordSlot(target_slot, target_slot, target_cell);
+        }
+        transition_index++;
       }
-    } else {
-      if (i != transition_index) {
-        DCHECK(TransitionArray::IsFullTransitionArray(transitions));
-        TransitionArray* t = TransitionArray::cast(transitions);
-        Name* key = t->GetKey(i);
-        t->SetKey(transition_index, key);
-        Object** key_slot = t->GetKeySlot(transition_index);
-        RecordSlot(key_slot, key_slot, key);
-        // Target slots do not need to be recorded since maps are not compacted.
-        t->SetTarget(transition_index, t->GetTarget(i));
+    }
+  } else if (transitions->IsWeakCell()) {
+    WeakCell* target_cell = WeakCell::cast(transitions);
+    if (!target_cell->cleared()) {
+      if (Map::cast(target_cell->value())->instance_descriptors() ==
+          descriptors) {
+        descriptors_owner_died = false;
       }
       transition_index++;
     }
   }
 
   // If there are no transitions to be cleared, return.
   // TODO(verwaest) Should be an assert, otherwise back pointers are not
   // properly cleared.
   if (transition_index == num_transitions) return;
 
@@ skipping 2236 matching lines @@
   SlotsBuffer* buffer = *buffer_address;
   while (buffer != NULL) {
     SlotsBuffer* next_buffer = buffer->next();
     DeallocateBuffer(buffer);
     buffer = next_buffer;
   }
   *buffer_address = NULL;
 }
 }  // namespace internal
 }  // namespace v8