Fasterify JSObject::UnregisterPrototypeUser

Fasterify JSObject::UnregisterPrototypeUser

When a (prototype) map registers as a user of its own prototype, it now remembers the index in that prototype's registry where it is listed.
This remembered index is used on un-registration to find the right slot to clear without walking the entire registry.
Compaction of the registry must update all entries' remembered indices.

BUG=chromium:517778, chromium:517406
LOG=n
R=yangguo@chromium.org

Committed: https://crrev.com/1e65e201894791c3bf8473728021f0e548a0543b
Cr-Commit-Position: refs/heads/master@{#30079}

[Yang, 2015-08-07 21:37:24]

lgtm with comments.

https://codereview.chromium.org/1276353004/diff/1/src/objects.cc
File src/objects.cc (right):

https://codereview.chromium.org/1276353004/diff/1/src/objects.cc#newcode7971
src/objects.cc:7971: if (WeakCell::cast(element)->cleared()) continue;
Can we assert that we don't find PrototypeInfo objects here?

https://codereview.chromium.org/1276353004/diff/1/src/objects.cc#newcode7979
src/objects.cc:7979: void WeakFixedArray::CompactPrototypeUserList() {
This is essentially Compact() with an additional block inside the loop. Can we
deduplicate by using template, or a flag?

https://codereview.chromium.org/1276353004/diff/1/src/objects.h
File src/objects.h (right):

https://codereview.chromium.org/1276353004/diff/1/src/objects.h#newcode2543
src/objects.h:2543: void CompactPrototypeUserList();
Not sure if this should live on Map instead.

[Jakob Kummerow, 2015-08-08 12:39:32]

Thanks for the comments. I've templatized the compaction method. CQ it if you
like it; otherwise I'd be happy to iterate.

https://codereview.chromium.org/1276353004/diff/1/src/objects.cc
File src/objects.cc (right):

https://codereview.chromium.org/1276353004/diff/1/src/objects.cc#newcode7971
src/objects.cc:7971: if (WeakCell::cast(element)->cleared()) continue;
On 2015/08/07 21:37:24, Yang wrote:
> Can we assert that we don't find PrototypeInfo objects here?

I agree with the sentiment, but I don't think such a check makes sense. The
WeakFixedArray shouldn't know or care what it's being used for and what kind of
objects are stored in it. The check would have to be "DCHECK(!value->IsMap() ||
!Map::cast(value)->is_prototype_map())", but that would mean that possible
future use cases that store arbitrary maps in a WeakFixedArray without caring
about remembered indices couldn't use the default empty callback.

https://codereview.chromium.org/1276353004/diff/1/src/objects.cc#newcode7979
src/objects.cc:7979: void WeakFixedArray::CompactPrototypeUserList() {
On 2015/08/07 21:37:24, Yang wrote:
> This is essentially Compact() with an additional block inside the loop. Can we
> deduplicate by using template, or a flag?

Done. Used a template to provide a callback that's called for elements being
moved. You likey?

https://codereview.chromium.org/1276353004/diff/1/src/objects.h
File src/objects.h (right):

https://codereview.chromium.org/1276353004/diff/1/src/objects.h#newcode2543
src/objects.h:2543: void CompactPrototypeUserList();
On 2015/08/07 21:37:24, Yang wrote:
> Not sure if this should live on Map instead.

Moved it to JSObject where all the other prototype registration stuff lives.

[Jakob Kummerow, 2015-08-08 12:40:24]

The CQ bit was checked by jkummerow@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2015-08-08 12:40:35]

Dry run: CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1276353004/20001
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1276353004/20001

[Yang, 2015-08-08 13:08:00]

On 2015/08/08 12:40:35, commit-bot: I haz the power wrote:
> Dry run: CQ is trying da patch. Follow status at
>  https://chromium-cq-status.appspot.com/patch-status/1276353004/20001
> View timeline at
>  https://chromium-cq-status.appspot.com/patch-timeline/1276353004/20001

lgtm.

[commit-bot: I haz the power, 2015-08-08 13:10:08]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2015-08-08 13:10:08]

Dry run: Try jobs failed on following builders:
  v8_linux64_rel on tryserver.v8 (JOB_FAILED,
http://build.chromium.org/p/tryserver.v8/builders/v8_linux64_rel/builds/8473)

[Jakob Kummerow, 2015-08-08 18:59:00]

The CQ bit was checked by jkummerow@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2015-08-08 18:59:02]

Dry run: CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1276353004/40001
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1276353004/40001

[commit-bot: I haz the power, 2015-08-08 19:28:55]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2015-08-08 19:28:56]

Dry run: This issue passed the CQ dry run.

[Jakob Kummerow, 2015-08-08 20:59:45]

Yang, I needed a workaround in the serializer to make sure
remembered-slot-updating on compaction doesn't happen too late. Is patch set 3
acceptable, or should we do that differently? Is there maybe a pass over the
heap before actual serialization that could take care of WeakFixedArray
compaction?

[Yang, 2015-08-08 21:48:54]

On 2015/08/08 20:59:45, Jakob wrote:
> Yang, I needed a workaround in the serializer to make sure
> remembered-slot-updating on compaction doesn't happen too late. Is patch set 3
> acceptable, or should we do that differently? Is there maybe a pass over the
> heap before actual serialization that could take care of WeakFixedArray
> compaction?

There is a GC before the actual serialization, but I'm not sure we want to do
the compaction during GC. Since this does not affect the code serializer, but
only the start-up snapshot, the creation of which is not  performance-critical,
we could add a heap walk in V8::CreateSnapshotDataBlob to find all prototype
info objects to compact them before we actually serialize.

I'd be fine with landing this first and then prettify this in a follow-up.

[Jakob Kummerow, 2015-08-08 22:54:44]

The CQ bit was checked by jkummerow@chromium.org

[Jakob Kummerow, 2015-08-08 22:54:44]

The patchset sent to the CQ was uploaded after l-g-t-m from yangguo@chromium.org
Link to the patchset: https://codereview.chromium.org/1276353004/#ps40001
(title: "fix compaction<->serialization interaction")

[commit-bot: I haz the power, 2015-08-08 22:54:52]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1276353004/40001
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1276353004/40001

[commit-bot: I haz the power, 2015-08-08 22:56:22]

Committed patchset #3 (id:40001)

[commit-bot: I haz the power, 2015-08-08 22:56:41]

Patchset 3 (id:??) landed as
https://crrev.com/1e65e201894791c3bf8473728021f0e548a0543b
Cr-Commit-Position: refs/heads/master@{#30079}