[heap] Notify GC on potentially unsafe object layout changes.

[heap] Notify GC on potentially unsafe object layout changes.

During concurrent marking we need special handling of object layout
changes that remove tagged in-object fields or replaces them with
untagged in-object fields.

This patch adds a function for notifying object layout changes and
verification code that is triggered on each map change in runtime.

BUG=chromium:694255
Review-Url: https://codereview.chromium.org/2702303002
Cr-Commit-Position: refs/heads/master@{#43342}
Committed: https://chromium.googlesource.com/v8/v8/+/fbee722c918ea3842f3e0f3c276860603c4b649b

[ulan, 2017-02-20 14:32:44]

ulan@chromium.org changed reviewers:
+ hpayer@chromium.org, ishell@chromium.org

[ulan, 2017-02-20 14:32:44]

ptal

[ulan, 2017-02-20 14:33:31]

ulan@chromium.org changed reviewers:
+ mlippautz@chromium.org

[Hannes Payer (out of office), 2017-02-20 14:53:04]

lgtm

[Igor Sheludko, 2017-02-21 10:22:25]

https://codereview.chromium.org/2702303002/diff/40001/src/heap/heap.cc
File src/heap/heap.cc (right):

https://codereview.chromium.org/2702303002/diff/40001/src/heap/heap.cc#newcod...
src/heap/heap.cc:4296: void Heap::NotifyObjectLayoutChange(HeapObject* object,
WDYT about putting this to heap-inl.h?

https://codereview.chromium.org/2702303002/diff/40001/src/objects.cc
File src/objects.cc (right):

https://codereview.chromium.org/2702303002/diff/40001/src/objects.cc#newcode3293
src/objects.cc:3293: FieldIndex index = FieldIndex::ForPropertyIndex(target, i);
This will work only if target is a non-dictionary map...

https://codereview.chromium.org/2702303002/diff/40001/src/objects.cc#newcode3302
src/objects.cc:3302: return TransitionRemovesTaggedField(target) ||
... if a slow map does not contain inobject space then the first predicate will
return false and the second predicate will get a slow map as a target.

[Igor Sheludko, 2017-02-21 10:36:37]

lgtm

https://codereview.chromium.org/2702303002/diff/40001/src/objects.cc
File src/objects.cc (right):

https://codereview.chromium.org/2702303002/diff/40001/src/objects.cc#newcode3293
src/objects.cc:3293: FieldIndex index = FieldIndex::ForPropertyIndex(target, i);
On 2017/02/21 10:22:25, Igor Sheludko wrote:
> This will work only if target is a non-dictionary map...

Please ignore my comments.

[ulan, 2017-02-21 10:36:59]

The CQ bit was checked by ulan@chromium.org

[commit-bot: I haz the power, 2017-02-21 10:37:12]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2017-02-21 11:03:49]

CQ is committing da patch.

Bot data: {"patchset_id": 40001, "attempt_start_ts": 1487673419847220,
"parent_rev": "a182f8d510983e22cc05e16ae4ce7c43a6ecb07d", "commit_rev":
"fbee722c918ea3842f3e0f3c276860603c4b649b"}

[commit-bot: I haz the power, 2017-02-21 11:03:53]

Description was changed from

==========
[heap] Notify GC on potentially unsafe object layout changes.

During concurrent marking we need special handling of object layout
changes that remove tagged in-object fields or replaces them with
untagged in-object fields.

This patch adds a function for notifying object layout changes and
verification code that is triggered on each map change in runtime.

BUG=chromium:694255
==========

to

==========
[heap] Notify GC on potentially unsafe object layout changes.

During concurrent marking we need special handling of object layout
changes that remove tagged in-object fields or replaces them with
untagged in-object fields.

This patch adds a function for notifying object layout changes and
verification code that is triggered on each map change in runtime.

BUG=chromium:694255

Review-Url: https://codereview.chromium.org/2702303002
Cr-Commit-Position: refs/heads/master@{#43342}
Committed:
https://chromium.googlesource.com/v8/v8/+/fbee722c918ea3842f3e0f3c276860603c4...
==========

[commit-bot: I haz the power, 2017-02-21 11:03:53]

Committed patchset #3 (id:40001) as
https://chromium.googlesource.com/v8/v8/+/fbee722c918ea3842f3e0f3c276860603c4...