| Index: test/cctest/heap/test-heap.cc | 
| diff --git a/test/cctest/heap/test-heap.cc b/test/cctest/heap/test-heap.cc | 
| index f191f353b6d65f2d3e73646fbefc6118c30e5abc..577675f0a1e7a69805d52fe765c81b88189f66b3 100644 | 
| --- a/test/cctest/heap/test-heap.cc | 
| +++ b/test/cctest/heap/test-heap.cc | 
| @@ -3627,7 +3627,7 @@ | 
| v8::Utils::OpenHandle(*v8::Local<v8::Function>::Cast( | 
| CcTest::global()->Get(ctx, v8_str("f")).ToLocalChecked()))); | 
|  | 
| -  Handle<TypeFeedbackVector> feedback_vector(f->feedback_vector()); | 
| +  Handle<TypeFeedbackVector> feedback_vector(f->shared()->feedback_vector()); | 
| FeedbackVectorHelper feedback_helper(feedback_vector); | 
|  | 
| int expected_slots = 2; | 
| @@ -3664,7 +3664,7 @@ | 
| static void CheckVectorIC(Handle<JSFunction> f, int slot_index, | 
| InlineCacheState desired_state) { | 
| Handle<TypeFeedbackVector> vector = | 
| -      Handle<TypeFeedbackVector>(f->feedback_vector()); | 
| +      Handle<TypeFeedbackVector>(f->shared()->feedback_vector()); | 
| FeedbackVectorHelper helper(vector); | 
| FeedbackVectorSlot slot = helper.slot(slot_index); | 
| if (vector->GetKind(slot) == FeedbackVectorSlotKind::LOAD_IC) { | 
| @@ -3675,6 +3675,15 @@ | 
| KeyedLoadICNexus nexus(vector, slot); | 
| CHECK(nexus.StateFromFeedback() == desired_state); | 
| } | 
| +} | 
| + | 
| + | 
| +static void CheckVectorICCleared(Handle<JSFunction> f, int slot_index) { | 
| +  Handle<TypeFeedbackVector> vector = | 
| +      Handle<TypeFeedbackVector>(f->shared()->feedback_vector()); | 
| +  FeedbackVectorSlot slot(slot_index); | 
| +  LoadICNexus nexus(vector, slot); | 
| +  CHECK(IC::IsCleared(&nexus)); | 
| } | 
|  | 
|  | 
| @@ -3692,13 +3701,51 @@ | 
| v8::Utils::OpenHandle(*v8::Local<v8::Function>::Cast( | 
| CcTest::global()->Get(ctx, v8_str("f")).ToLocalChecked()))); | 
|  | 
| -  Handle<TypeFeedbackVector> vector(f->feedback_vector()); | 
| +  Handle<TypeFeedbackVector> vector(f->shared()->feedback_vector()); | 
| CHECK(vector->Get(FeedbackVectorSlot(0))->IsWeakCell()); | 
|  | 
| SimulateIncrementalMarking(CcTest::heap()); | 
| CcTest::heap()->CollectAllGarbage(); | 
|  | 
| CHECK(vector->Get(FeedbackVectorSlot(0))->IsWeakCell()); | 
| +} | 
| + | 
| + | 
| +TEST(IncrementalMarkingClearsMonomorphicConstructor) { | 
| +  if (i::FLAG_always_opt) return; | 
| +  CcTest::InitializeVM(); | 
| +  Isolate* isolate = CcTest::i_isolate(); | 
| +  v8::HandleScope scope(CcTest::isolate()); | 
| +  v8::Local<v8::Value> fun1; | 
| +  v8::Local<v8::Context> ctx = CcTest::isolate()->GetCurrentContext(); | 
| + | 
| +  { | 
| +    LocalContext env; | 
| +    CompileRun("function fun() { this.x = 1; };"); | 
| +    fun1 = env->Global()->Get(env.local(), v8_str("fun")).ToLocalChecked(); | 
| +  } | 
| + | 
| +  // Prepare function f that contains a monomorphic constructor for object | 
| +  // originating from a different native context. | 
| +  CHECK(CcTest::global()->Set(ctx, v8_str("fun1"), fun1).FromJust()); | 
| +  CompileRun( | 
| +      "function fun() { this.x = 1; };" | 
| +      "function f(o) { return new o(); } f(fun1); f(fun1);"); | 
| +  Handle<JSFunction> f = Handle<JSFunction>::cast( | 
| +      v8::Utils::OpenHandle(*v8::Local<v8::Function>::Cast( | 
| +          CcTest::global()->Get(ctx, v8_str("f")).ToLocalChecked()))); | 
| + | 
| + | 
| +  Handle<TypeFeedbackVector> vector(f->shared()->feedback_vector()); | 
| +  CHECK(vector->Get(FeedbackVectorSlot(0))->IsWeakCell()); | 
| + | 
| +  // Fire context dispose notification. | 
| +  CcTest::isolate()->ContextDisposedNotification(); | 
| +  SimulateIncrementalMarking(CcTest::heap()); | 
| +  CcTest::heap()->CollectAllGarbage(); | 
| + | 
| +  CHECK_EQ(*TypeFeedbackVector::UninitializedSentinel(isolate), | 
| +           vector->Get(FeedbackVectorSlot(0))); | 
| } | 
|  | 
|  | 
| @@ -3724,6 +3771,38 @@ | 
| } | 
|  | 
|  | 
| +TEST(IncrementalMarkingClearsMonomorphicIC) { | 
| +  if (i::FLAG_always_opt) return; | 
| +  CcTest::InitializeVM(); | 
| +  v8::HandleScope scope(CcTest::isolate()); | 
| +  v8::Local<v8::Value> obj1; | 
| +  v8::Local<v8::Context> ctx = CcTest::isolate()->GetCurrentContext(); | 
| + | 
| +  { | 
| +    LocalContext env; | 
| +    CompileRun("function fun() { this.x = 1; }; var obj = new fun();"); | 
| +    obj1 = env->Global()->Get(env.local(), v8_str("obj")).ToLocalChecked(); | 
| +  } | 
| + | 
| +  // Prepare function f that contains a monomorphic IC for object | 
| +  // originating from a different native context. | 
| +  CHECK(CcTest::global()->Set(ctx, v8_str("obj1"), obj1).FromJust()); | 
| +  CompileRun("function f(o) { return o.x; } f(obj1); f(obj1);"); | 
| +  Handle<JSFunction> f = Handle<JSFunction>::cast( | 
| +      v8::Utils::OpenHandle(*v8::Local<v8::Function>::Cast( | 
| +          CcTest::global()->Get(ctx, v8_str("f")).ToLocalChecked()))); | 
| + | 
| +  CheckVectorIC(f, 0, MONOMORPHIC); | 
| + | 
| +  // Fire context dispose notification. | 
| +  CcTest::isolate()->ContextDisposedNotification(); | 
| +  SimulateIncrementalMarking(CcTest::heap()); | 
| +  CcTest::heap()->CollectAllGarbage(); | 
| + | 
| +  CheckVectorICCleared(f, 0); | 
| +} | 
| + | 
| + | 
| TEST(IncrementalMarkingPreservesPolymorphicIC) { | 
| if (i::FLAG_always_opt) return; | 
| CcTest::InitializeVM(); | 
| @@ -3761,7 +3840,8 @@ | 
| CheckVectorIC(f, 0, POLYMORPHIC); | 
| } | 
|  | 
| -TEST(ContextDisposeDoesntClearPolymorphicIC) { | 
| + | 
| +TEST(IncrementalMarkingClearsPolymorphicIC) { | 
| if (i::FLAG_always_opt) return; | 
| CcTest::InitializeVM(); | 
| v8::HandleScope scope(CcTest::isolate()); | 
| @@ -3796,7 +3876,7 @@ | 
| SimulateIncrementalMarking(CcTest::heap()); | 
| CcTest::heap()->CollectAllGarbage(); | 
|  | 
| -  CheckVectorIC(f, 0, POLYMORPHIC); | 
| +  CheckVectorICCleared(f, 0); | 
| } | 
|  | 
|  | 
| @@ -4212,8 +4292,7 @@ | 
| if (!code->is_optimized_code()) return; | 
| } | 
|  | 
| -  Handle<TypeFeedbackVector> vector = | 
| -      TypeFeedbackVector::New(isolate, handle(shared->feedback_metadata())); | 
| +  Handle<TypeFeedbackVector> vector = handle(shared->feedback_vector()); | 
| Handle<LiteralsArray> lit = | 
| LiteralsArray::New(isolate, vector, shared->num_literals(), TENURED); | 
| Handle<Context> context(isolate->context()); | 
| @@ -4270,8 +4349,7 @@ | 
| if (!code->is_optimized_code()) return; | 
| } | 
|  | 
| -  Handle<TypeFeedbackVector> vector = | 
| -      TypeFeedbackVector::New(isolate, handle(shared->feedback_metadata())); | 
| +  Handle<TypeFeedbackVector> vector = handle(shared->feedback_vector()); | 
| Handle<LiteralsArray> lit = | 
| LiteralsArray::New(isolate, vector, shared->num_literals(), TENURED); | 
| Handle<Context> context(isolate->context()); | 
| @@ -4975,7 +5053,7 @@ | 
| // cleared. Now, verify that one additional call with a new function | 
| // allows monomorphicity. | 
| Handle<TypeFeedbackVector> feedback_vector = Handle<TypeFeedbackVector>( | 
| -      createObj->feedback_vector(), CcTest::i_isolate()); | 
| +      createObj->shared()->feedback_vector(), CcTest::i_isolate()); | 
| for (int i = 0; i < 20; i++) { | 
| Object* slot_value = feedback_vector->Get(FeedbackVectorSlot(0)); | 
| CHECK(slot_value->IsWeakCell()); | 
| @@ -5176,11 +5254,12 @@ | 
| return Handle<JSFunction>::cast(obj); | 
| } | 
|  | 
| -void CheckIC(Handle<JSFunction> function, Code::Kind kind, int slot_index, | 
| -             InlineCacheState state) { | 
| + | 
| +void CheckIC(Code* code, Code::Kind kind, SharedFunctionInfo* shared, | 
| +             int slot_index, InlineCacheState state) { | 
| if (kind == Code::LOAD_IC || kind == Code::KEYED_LOAD_IC || | 
| kind == Code::CALL_IC) { | 
| -    TypeFeedbackVector* vector = function->feedback_vector(); | 
| +    TypeFeedbackVector* vector = shared->feedback_vector(); | 
| FeedbackVectorSlot slot(slot_index); | 
| if (kind == Code::LOAD_IC) { | 
| LoadICNexus nexus(vector, slot); | 
| @@ -5193,7 +5272,7 @@ | 
| CHECK_EQ(nexus.StateFromFeedback(), state); | 
| } | 
| } else { | 
| -    Code* ic = FindFirstIC(function->code(), kind); | 
| +    Code* ic = FindFirstIC(code, kind); | 
| CHECK(ic->is_inline_cache_stub()); | 
| CHECK(ic->ic_state() == state); | 
| } | 
| @@ -5224,12 +5303,12 @@ | 
| CompileRun("(testIC())"); | 
| } | 
| heap->CollectAllGarbage(); | 
| -  CheckIC(loadIC, Code::LOAD_IC, 0, MONOMORPHIC); | 
| +  CheckIC(loadIC->code(), Code::LOAD_IC, loadIC->shared(), 0, MONOMORPHIC); | 
| { | 
| v8::HandleScope scope(CcTest::isolate()); | 
| CompileRun("(testIC())"); | 
| } | 
| -  CheckIC(loadIC, Code::LOAD_IC, 0, MONOMORPHIC); | 
| +  CheckIC(loadIC->code(), Code::LOAD_IC, loadIC->shared(), 0, MONOMORPHIC); | 
| } | 
|  | 
|  | 
| @@ -5260,12 +5339,12 @@ | 
| CompileRun("(testIC())"); | 
| } | 
| heap->CollectAllGarbage(); | 
| -  CheckIC(loadIC, Code::LOAD_IC, 0, POLYMORPHIC); | 
| +  CheckIC(loadIC->code(), Code::LOAD_IC, loadIC->shared(), 0, POLYMORPHIC); | 
| { | 
| v8::HandleScope scope(CcTest::isolate()); | 
| CompileRun("(testIC())"); | 
| } | 
| -  CheckIC(loadIC, Code::LOAD_IC, 0, POLYMORPHIC); | 
| +  CheckIC(loadIC->code(), Code::LOAD_IC, loadIC->shared(), 0, POLYMORPHIC); | 
| } | 
|  | 
|  | 
|  |