Limit the number of transitions allowed per hidden class.

src/transitions.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/v8.h"
 
 #include "src/objects.h"
 #include "src/transitions-inl.h"
 #include "src/utils.h"
 
 namespace v8 {
 namespace internal {
 
 
 Handle<TransitionArray> TransitionArray::Allocate(Isolate* isolate,
-                                                  int number_of_transitions) {
-  Handle<FixedArray> array =
-      isolate->factory()->NewFixedArray(ToKeyIndex(number_of_transitions));
+                                                  int number_of_transitions,
+                                                  int slack) {
+  Handle<FixedArray> array = isolate->factory()->NewFixedArray(
+      LengthFor(number_of_transitions + slack));
   array->set(kPrototypeTransitionsIndex, Smi::FromInt(0));
+  array->set(kTransitionLengthIndex, Smi::FromInt(number_of_transitions));
   return Handle<TransitionArray>::cast(array);
 }
 
 
 Handle<TransitionArray> TransitionArray::AllocateSimple(Isolate* isolate,
                                                         Handle<Map> target) {
   Handle<FixedArray> array =
       isolate->factory()->NewFixedArray(kSimpleTransitionSize);
   array->set(kSimpleTransitionTarget, *target);
   return Handle<TransitionArray>::cast(array);
@@ skipping 48 matching lines @@
     result->NoIncrementalWriteBarrierCopyFrom(
         containing_map->transitions(), kSimpleTransitionIndex, 0);
   }
 
   result->set_back_pointer_storage(
       containing_map->transitions()->back_pointer_storage());
   return result;
 }
 
 
-Handle<TransitionArray> TransitionArray::CopyInsert(Handle<Map> map,
-                                                    Handle<Name> name,
-                                                    Handle<Map> target,
-                                                    SimpleTransitionFlag flag) {
+Handle<TransitionArray> TransitionArray::Insert(Handle<Map> map,
+                                                Handle<Name> name,
+                                                Handle<Map> target,
+                                                SimpleTransitionFlag flag) {
   if (!map->HasTransitionArray()) {
     return TransitionArray::NewWith(map, name, target, flag);
   }
 
   int number_of_transitions = map->transitions()->number_of_transitions();
-  int new_size = number_of_transitions;
+  int new_nof = number_of_transitions;
 
   int insertion_index = map->transitions()->Search(*name);
-  if (insertion_index == kNotFound) ++new_size;
+  if (insertion_index == kNotFound) ++new_nof;
 
-  Handle<TransitionArray> result = Allocate(map->GetIsolate(), new_size);
+  if (new_nof <= map->transitions()->number_of_transitions_storage()) {
+    DisallowHeapAllocation no_gc;
+    TransitionArray* array = map->transitions();
+
+    if (insertion_index != kNotFound) {
+      if (array->IsSimpleTransition()) {
+        DCHECK(insertion_index == kSimpleTransitionIndex);
+        array->set(kSimpleTransitionTarget, *target);
+      } else {
+        array->NoIncrementalWriteBarrierSet(insertion_index, *name, *target);

[Toon Verwaest, 2014/10/23 09:44:34]

You can't omit the incremental write barrier if you didn't just allocate the
transition array.

[mckev, 2014/10/24 02:18:51]

Ah.. SetTarget seems more appropriate then.

+      }
+      return handle(array);
+    }
+
+    array->SetNumberOfTransitions(new_nof);
+    uint32_t hash = name->Hash();
+    for (insertion_index = number_of_transitions; insertion_index > 0;
+         --insertion_index) {
+      Name* key = array->GetKey(insertion_index - 1);
+      if (key->Hash() <= hash) break;
+      array->NoIncrementalWriteBarrierSet(
+          insertion_index, key, array->GetTarget(insertion_index - 1));

[Toon Verwaest, 2014/10/23 09:44:33]

Same here.

+    }
+    array->NoIncrementalWriteBarrierSet(insertion_index, *name, *target);

[Toon Verwaest, 2014/10/23 09:44:33]

Same here.

+    return handle(array);
+  }
+
+  Handle<TransitionArray> result =
+      Allocate(map->GetIsolate(), new_nof,
+               number_of_transitions < 4 ? 1 : number_of_transitions / 2);

[Toon Verwaest, 2014/10/23 09:44:33]

Please add a helper function to calculate the actual number of slack that
doesn't overshoot the limit (kMaxNumberOfTransitions); and use it for allocating
the descriptor array as well.

[mckev, 2014/10/24 02:18:51]

Done.

 
   // The map's transition array may grown smaller during the allocation above as
   // it was weakly traversed, though it is guaranteed not to disappear. Trim the
   // result copy if needed, and recompute variables.
   DCHECK(map->HasTransitionArray());
   DisallowHeapAllocation no_gc;
   TransitionArray* array = map->transitions();
   if (array->number_of_transitions() != number_of_transitions) {
     DCHECK(array->number_of_transitions() < number_of_transitions);
 
     number_of_transitions = array->number_of_transitions();
-    new_size = number_of_transitions;
+    new_nof = number_of_transitions;
 
     insertion_index = array->Search(*name);
-    if (insertion_index == kNotFound) ++new_size;
+    if (insertion_index == kNotFound) ++new_nof;
 
-    result->Shrink(ToKeyIndex(new_size));
+    result->Shrink(ToKeyIndex(new_nof));
   }
 
   if (array->HasPrototypeTransitions()) {
     result->SetPrototypeTransitions(array->GetPrototypeTransitions());
   }
 
-  if (insertion_index != kNotFound) {
-    for (int i = 0; i < number_of_transitions; ++i) {
-      if (i != insertion_index) {
-        result->NoIncrementalWriteBarrierCopyFrom(array, i, i);
-      }
-    }
-    result->NoIncrementalWriteBarrierSet(insertion_index, *name, *target);
-    result->set_back_pointer_storage(array->back_pointer_storage());
-    return result;
-  }
-
   insertion_index = 0;
   for (; insertion_index < number_of_transitions; ++insertion_index) {
     if (InsertionPointFound(array->GetKey(insertion_index), *name)) break;
     result->NoIncrementalWriteBarrierCopyFrom(
         array, insertion_index, insertion_index);
   }
 
   result->NoIncrementalWriteBarrierSet(insertion_index, *name, *target);
 
   for (; insertion_index < number_of_transitions; ++insertion_index) {
     result->NoIncrementalWriteBarrierCopyFrom(
         array, insertion_index, insertion_index + 1);
   }
 
   result->set_back_pointer_storage(array->back_pointer_storage());
   return result;
 }
 
 
 } }  // namespace v8::internal