Reland "[heap] Fine-grained JSArrayBuffer tracking"

Track based on JSArrayBuffer addresses on pages instead of the attached
backing store.

Details of tracking:
- Scavenge: New space pages are processes in bulk on the main thread
- MC: Unswept pages are processed in bulk in parallel. All other pages
  are processed by the sweeper concurrently.

BUG=chromium:611688
LOG=N
TEST=cctest/test-array-buffer-tracker/*
CQ_EXTRA_TRYBOTS=tryserver.v8:v8_linux_arm64_gc_stress_dbg,v8_linux_gc_stress_dbg,v8_mac_gc_stress_dbg,v8_linux64_tsan_rel,v8_mac64_asan_rel

Committed: https://crrev.com/279e274eccf95fbb4bd41d908b9153acf6ec118a
Cr-Commit-Position: refs/heads/master@{#36653}

[Michael Lippautz, 2016-05-31 11:19:09]

Patchset #2 (id:20001) has been deleted

[Michael Lippautz, 2016-05-31 11:23:45]

Patchset #2 (id:40001) has been deleted

[Michael Lippautz, 2016-05-31 11:24:08]

The CQ bit was checked by mlippautz@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2016-05-31 11:24:17]

Dry run: CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/2026633003/60001
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/2026633003/60001

[Michael Lippautz, 2016-05-31 11:24:44]

Description was changed from

==========
Reland "[heap] Fine-grained JSArrayBuffer tracking"

BUG=
==========

to

==========
Track based on JSArrayBuffer addresses on pages instead of the attached
backing store.

Details of tracking:
- Scavenge: New space pages are processes in bulk on the main thread
- MC: Unswept pages are processed in bulk in parallel. All other pages
  are processed by the sweeper concurrently.

BUG=chromium:611688
LOG=N
TEST=cctest/test-array-buffer-tracker/*
CQ_EXTRA_TRYBOTS=tryserver.v8:v8_linux_arm64_gc_stress_dbg,v8_linux_gc_stress_dbg,v8_mac_gc_stress_dbg,v8_linux64_tsan_rel,v8_mac64_asan_rel
==========

[commit-bot: I haz the power, 2016-05-31 12:16:29]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-05-31 12:16:30]

Dry run: This issue passed the CQ dry run.

[Michael Lippautz, 2016-05-31 13:31:42]

mlippautz@chromium.org changed reviewers:
+ hpayer@chromium.org

[Michael Lippautz, 2016-06-01 09:01:53]

Patchset #3 (id:80001) has been deleted

[Michael Lippautz, 2016-06-01 09:32:17]

whoop, please take a look at the new implementation that makes use of the
existing marking information.

[Michael Lippautz, 2016-06-01 11:15:21]

The CQ bit was checked by mlippautz@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2016-06-01 11:15:29]

Dry run: CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/2026633003/100001
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/2026633003/100001

[commit-bot: I haz the power, 2016-06-01 11:57:13]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-06-01 11:57:13]

Dry run: This issue passed the CQ dry run.

[Hannes Payer (out of office), 2016-06-01 13:44:17]

I like it a lot!

https://codereview.chromium.org/2026633003/diff/100001/src/heap/array-buffer-...
File src/heap/array-buffer-tracker.cc (right):

https://codereview.chromium.org/2026633003/diff/100001/src/heap/array-buffer-...
src/heap/array-buffer-tracker.cc:40: void LocalArrayBufferTracker::FreeDead() {
DCHECK that the page of the array buffer was not swept, i.e. we are in a state
where we still have liveness information.

https://codereview.chromium.org/2026633003/diff/100001/src/heap/array-buffer-...
File src/heap/array-buffer-tracker.h (right):

https://codereview.chromium.org/2026633003/diff/100001/src/heap/array-buffer-...
src/heap/array-buffer-tracker.h:18: class Page;
Alphabetic order

https://codereview.chromium.org/2026633003/diff/100001/src/heap/array-buffer-...
src/heap/array-buffer-tracker.h:38: static void FreeDead(Page* page);
All these nice methods had comments in that class, let's add some descriptions.

https://codereview.chromium.org/2026633003/diff/100001/src/heap/mark-compact.cc
File src/heap/mark-compact.cc (right):

https://codereview.chromium.org/2026633003/diff/100001/src/heap/mark-compact....
src/heap/mark-compact.cc:3329: 
// Before we sweep objects on the page, we free dead array buffers which
requires valid mark bits.

https://codereview.chromium.org/2026633003/diff/100001/src/heap/objects-visit...
File src/heap/objects-visiting-inl.h (left):

https://codereview.chromium.org/2026633003/diff/100001/src/heap/objects-visit...
src/heap/objects-visiting-inl.h:104: int
StaticNewSpaceVisitor<StaticVisitor>::VisitJSArrayBuffer(
This method is not needed anymore. You can use the generic object visitor.

https://codereview.chromium.org/2026633003/diff/100001/src/heap/scavenger.cc
File src/heap/scavenger.cc (left):

https://codereview.chromium.org/2026633003/diff/100001/src/heap/scavenger.cc#...
src/heap/scavenger.cc:293: static inline void EvacuateJSArrayBuffer(Map* map,
HeapObject** slot,
This method is not needed anymore. The generic visitor can take care of that.

[Michael Lippautz, 2016-06-01 14:19:19]

All done.

https://codereview.chromium.org/2026633003/diff/100001/src/heap/array-buffer-...
File src/heap/array-buffer-tracker.cc (right):

https://codereview.chromium.org/2026633003/diff/100001/src/heap/array-buffer-...
src/heap/array-buffer-tracker.cc:40: void LocalArrayBufferTracker::FreeDead() {
On 2016/06/01 13:44:17, Hannes Payer wrote:
> DCHECK that the page of the array buffer was not swept, i.e. we are in a state
> where we still have liveness information.

Done (... in the caller where we still have access to the page).

https://codereview.chromium.org/2026633003/diff/100001/src/heap/array-buffer-...
File src/heap/array-buffer-tracker.h (right):

https://codereview.chromium.org/2026633003/diff/100001/src/heap/array-buffer-...
src/heap/array-buffer-tracker.h:18: class Page;
On 2016/06/01 13:44:17, Hannes Payer wrote:
> Alphabetic order

Done.

https://codereview.chromium.org/2026633003/diff/100001/src/heap/array-buffer-...
src/heap/array-buffer-tracker.h:38: static void FreeDead(Page* page);
On 2016/06/01 13:44:17, Hannes Payer wrote:
> All these nice methods had comments in that class, let's add some
descriptions.

Done.

https://codereview.chromium.org/2026633003/diff/100001/src/heap/mark-compact.cc
File src/heap/mark-compact.cc (right):

https://codereview.chromium.org/2026633003/diff/100001/src/heap/mark-compact....
src/heap/mark-compact.cc:3329: 
On 2016/06/01 13:44:17, Hannes Payer wrote:
> // Before we sweep objects on the page, we free dead array buffers which
> requires valid mark bits.

Done.

https://codereview.chromium.org/2026633003/diff/100001/src/heap/objects-visit...
File src/heap/objects-visiting-inl.h (left):

https://codereview.chromium.org/2026633003/diff/100001/src/heap/objects-visit...
src/heap/objects-visiting-inl.h:104: int
StaticNewSpaceVisitor<StaticVisitor>::VisitJSArrayBuffer(
On 2016/06/01 13:44:17, Hannes Payer wrote:
> This method is not needed anymore. You can use the generic object visitor.

Done.

https://codereview.chromium.org/2026633003/diff/100001/src/heap/scavenger.cc
File src/heap/scavenger.cc (left):

https://codereview.chromium.org/2026633003/diff/100001/src/heap/scavenger.cc#...
src/heap/scavenger.cc:293: static inline void EvacuateJSArrayBuffer(Map* map,
HeapObject** slot,
On 2016/06/01 13:44:17, Hannes Payer wrote:
> This method is not needed anymore. The generic visitor can take care of that.

Done.

[Hannes Payer (out of office), 2016-06-01 14:22:32]

lgtm

[Michael Lippautz, 2016-06-01 14:27:22]

The CQ bit was checked by mlippautz@chromium.org

[Michael Lippautz, 2016-06-01 14:27:22]

The patchset sent to the CQ was uploaded after l-g-t-m from hpayer@chromium.org
Link to the patchset: https://codereview.chromium.org/2026633003/#ps140001
(title: "rebase")

[commit-bot: I haz the power, 2016-06-01 14:27:30]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/2026633003/140001
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/2026633003/140001

[commit-bot: I haz the power, 2016-06-01 14:40:18]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-06-01 14:40:19]

Try jobs failed on following builders:
  v8_linux_gc_stress_dbg on tryserver.v8 (JOB_FAILED,
http://build.chromium.org/p/tryserver.v8/builders/v8_linux_gc_stress_dbg/buil...)

[Michael Lippautz, 2016-06-01 15:08:52]

The CQ bit was checked by mlippautz@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2016-06-01 15:09:00]

Dry run: CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/2026633003/160001
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/2026633003/160001

[commit-bot: I haz the power, 2016-06-01 15:24:51]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-06-01 15:24:52]

Dry run: Try jobs failed on following builders:
  v8_linux64_asan_rel_ng on tryserver.v8 (JOB_FAILED,
http://build.chromium.org/p/tryserver.v8/builders/v8_linux64_asan_rel_ng/buil...)
  v8_linux64_asan_rel_ng_triggered on tryserver.v8 (JOB_FAILED,
http://build.chromium.org/p/tryserver.v8/builders/v8_linux64_asan_rel_ng_trig...)

[Michael Lippautz, 2016-06-01 15:48:30]

The CQ bit was checked by mlippautz@chromium.org

[Michael Lippautz, 2016-06-01 15:48:31]

The patchset sent to the CQ was uploaded after l-g-t-m from hpayer@chromium.org
Link to the patchset: https://codereview.chromium.org/2026633003/#ps180001
(title: "Tests should not assert for promotion decisions but only for tracking")

[commit-bot: I haz the power, 2016-06-01 15:48:34]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/2026633003/180001
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/2026633003/180001

[commit-bot: I haz the power, 2016-06-01 16:29:09]

Description was changed from

==========
Track based on JSArrayBuffer addresses on pages instead of the attached
backing store.

Details of tracking:
- Scavenge: New space pages are processes in bulk on the main thread
- MC: Unswept pages are processed in bulk in parallel. All other pages
  are processed by the sweeper concurrently.

BUG=chromium:611688
LOG=N
TEST=cctest/test-array-buffer-tracker/*
CQ_EXTRA_TRYBOTS=tryserver.v8:v8_linux_arm64_gc_stress_dbg,v8_linux_gc_stress_dbg,v8_mac_gc_stress_dbg,v8_linux64_tsan_rel,v8_mac64_asan_rel
==========

to

==========
Track based on JSArrayBuffer addresses on pages instead of the attached
backing store.

Details of tracking:
- Scavenge: New space pages are processes in bulk on the main thread
- MC: Unswept pages are processed in bulk in parallel. All other pages
  are processed by the sweeper concurrently.

BUG=chromium:611688
LOG=N
TEST=cctest/test-array-buffer-tracker/*
CQ_EXTRA_TRYBOTS=tryserver.v8:v8_linux_arm64_gc_stress_dbg,v8_linux_gc_stress_dbg,v8_mac_gc_stress_dbg,v8_linux64_tsan_rel,v8_mac64_asan_rel
==========

[commit-bot: I haz the power, 2016-06-01 16:29:10]

Committed patchset #7 (id:180001)

[commit-bot: I haz the power, 2016-06-01 16:30:46]

Description was changed from

==========
Track based on JSArrayBuffer addresses on pages instead of the attached
backing store.

Details of tracking:
- Scavenge: New space pages are processes in bulk on the main thread
- MC: Unswept pages are processed in bulk in parallel. All other pages
  are processed by the sweeper concurrently.

BUG=chromium:611688
LOG=N
TEST=cctest/test-array-buffer-tracker/*
CQ_EXTRA_TRYBOTS=tryserver.v8:v8_linux_arm64_gc_stress_dbg,v8_linux_gc_stress_dbg,v8_mac_gc_stress_dbg,v8_linux64_tsan_rel,v8_mac64_asan_rel
==========

to

==========
Track based on JSArrayBuffer addresses on pages instead of the attached
backing store.

Details of tracking:
- Scavenge: New space pages are processes in bulk on the main thread
- MC: Unswept pages are processed in bulk in parallel. All other pages
  are processed by the sweeper concurrently.

BUG=chromium:611688
LOG=N
TEST=cctest/test-array-buffer-tracker/*
CQ_EXTRA_TRYBOTS=tryserver.v8:v8_linux_arm64_gc_stress_dbg,v8_linux_gc_stress_dbg,v8_mac_gc_stress_dbg,v8_linux64_tsan_rel,v8_mac64_asan_rel

Committed: https://crrev.com/279e274eccf95fbb4bd41d908b9153acf6ec118a
Cr-Commit-Position: refs/heads/master@{#36653}
==========

[commit-bot: I haz the power, 2016-06-01 16:30:47]

Patchset 7 (id:??) landed as
https://crrev.com/279e274eccf95fbb4bd41d908b9153acf6ec118a
Cr-Commit-Position: refs/heads/master@{#36653}

[Michael Lippautz, 2016-06-02 06:46:31]

A revert of this CL (patchset #7 id:180001) has been created in
https://codereview.chromium.org/2032973002/ by mlippautz@chromium.org.

The reason for reverting is: Also failing with the new implementation:
 
https://build.chromium.org/p/chromium.gpu/builders/Linux%20Debug%20%28NVIDIA%...

Will do a local repro now..