[heap] Avoid the use of cells to point from code to new-space objects.

src/heap/heap.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_HEAP_HEAP_H_
 #define V8_HEAP_HEAP_H_
 
 #include <cmath>
 #include <map>
 
@@ skipping 171 matching lines @@
     EmptySlowElementDictionary)                                                \
   V(FixedArray, materialized_objects, MaterializedObjects)                     \
   V(FixedArray, microtask_queue, MicrotaskQueue)                               \
   V(TypeFeedbackVector, dummy_vector, DummyVector)                             \
   V(FixedArray, empty_literals_array, EmptyLiteralsArray)                      \
   V(FixedArray, empty_sloppy_arguments_elements, EmptySloppyArgumentsElements) \
   V(FixedArray, cleared_optimized_code_map, ClearedOptimizedCodeMap)           \
   V(FixedArray, detached_contexts, DetachedContexts)                           \
   V(ArrayList, retained_maps, RetainedMaps)                                    \
   V(WeakHashTable, weak_object_to_code_table, WeakObjectToCodeTable)           \
+  /* weak_code_to_new_space_ref_list is an arraylist of weak cells, where */   \
+  /* slots with even indices refer to the weak object, and the subsequent */   \
+  /* slots refer to the code with the reference to the weak object. */         \
+  V(ArrayList, weak_code_to_new_space_ref_list, WeakCodeToNewSpaceRefList)     \

[ulan, 2016/06/08 14:37:00]

Lets name it weak_new_space_object_to_code_list.

[ahaas, 2016/06/09 10:34:32]

Done.

   V(PropertyCell, array_protector, ArrayProtector)                             \
   V(Cell, is_concat_spreadable_protector, IsConcatSpreadableProtector)         \
   V(PropertyCell, empty_property_cell, EmptyPropertyCell)                      \
   V(Object, weak_stack_trace_list, WeakStackTraceList)                         \
   V(Object, noscript_shared_function_infos, NoScriptSharedFunctionInfos)       \
   V(Map, bytecode_array_map, BytecodeArrayMap)                                 \
   V(WeakCell, empty_weak_cell, EmptyWeakCell)                                  \
   V(PropertyCell, has_instance_protector, HasInstanceProtector)                \
   V(Cell, species_protector, SpeciesProtector)
 
@@ skipping 629 matching lines @@
         amount_of_external_allocated_memory_freed_.Value();
     amount_of_external_allocated_memory_freed_.SetValue(0);
   }
 
   void DeoptMarkedAllocationSites();
 
   bool DeoptMaybeTenuredAllocationSites() {
     return new_space_.IsAtMaximumCapacity() && maximum_size_scavenges_ == 0;
   }
 
+  void RecordWeakCodeToNewSpaceReference(Handle<HeapObject> obj,
+                                         Handle<WeakCell> code);
+
   void AddWeakObjectToCodeDependency(Handle<HeapObject> obj,
                                      Handle<DependentCode> dep);
 
   DependentCode* LookupWeakObjectToCodeDependency(Handle<HeapObject> obj);
 
   void AddRetainedMap(Handle<Map> map);
 
   // This event is triggered after successful allocation of a new object made
   // by runtime. Allocations of target space for object evacuation do not
   // trigger the event. In order to track ALL allocations one must turn off
@@ skipping 1817 matching lines @@
   friend class LargeObjectSpace;
   friend class NewSpace;
   friend class PagedSpace;
   DISALLOW_COPY_AND_ASSIGN(AllocationObserver);
 };
 
 }  // namespace internal
 }  // namespace v8
 
 #endif  // V8_HEAP_HEAP_H_