Add infrastructure to keep track of references to prototypes.

src/objects.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_OBJECTS_H_
 #define V8_OBJECTS_H_
 
 #include <iosfwd>
 
 #include "src/allocation.h"
@@ skipping 70 matching lines @@
 //           - MapCache
 //         - OrderedHashTable
 //           - OrderedHashSet
 //           - OrderedHashMap
 //         - Context
 //         - TypeFeedbackVector
 //         - JSFunctionResultCache
 //         - ScopeInfo
 //         - TransitionArray
 //         - ScriptContextTable
+//         - WeakFixedArray
 //       - FixedDoubleArray
 //       - ExternalArray
 //         - ExternalUint8ClampedArray
 //         - ExternalInt8Array
 //         - ExternalUint8Array
 //         - ExternalInt16Array
 //         - ExternalUint16Array
 //         - ExternalInt32Array
 //         - ExternalUint32Array
 //         - ExternalFloat32Array
@@ skipping 834 matching lines @@
   V(LayoutDescriptor)              \
   V(Map)                           \
   V(DescriptorArray)               \
   V(TransitionArray)               \
   V(TypeFeedbackVector)            \
   V(DeoptimizationInputData)       \
   V(DeoptimizationOutputData)      \
   V(DependentCode)                 \
   V(FixedArray)                    \
   V(FixedDoubleArray)              \
+  V(WeakFixedArray)                \
   V(ConstantPoolArray)             \
   V(Context)                       \
   V(ScriptContextTable)            \
   V(NativeContext)                 \
   V(ScopeInfo)                     \
   V(JSFunction)                    \
   V(Code)                          \
   V(Oddball)                       \
   V(SharedFunctionInfo)            \
   V(JSValue)                       \
@@ skipping 853 matching lines @@
   // Sets the property value in a normalized object given (key, value, details).
   // Handles the special representation of JS global objects.
   static void SetNormalizedProperty(Handle<JSObject> object,
                                     Handle<Name> key,
                                     Handle<Object> value,
                                     PropertyDetails details);
 
   static void OptimizeAsPrototype(Handle<JSObject> object,
                                   PrototypeOptimizationMode mode);
   static void ReoptimizeIfPrototype(Handle<JSObject> object);
+  static void RegisterPrototypeUser(Handle<JSObject> prototype,
+                                    Handle<HeapObject> user);
+  static void UnregisterPrototypeUser(Handle<JSObject> prototype,
+                                      Handle<HeapObject> user);
 
   // Retrieve interceptors.
   InterceptorInfo* GetNamedInterceptor();
   InterceptorInfo* GetIndexedInterceptor();
 
   // Used from JSReceiver.
   MUST_USE_RESULT static Maybe<PropertyAttributes>
       GetPropertyAttributesWithInterceptor(Handle<JSObject> holder,
                                            Handle<Object> receiver,
                                            Handle<Name> name);
@@ skipping 753 matching lines @@
 
   // Dispatched behavior.
   DECLARE_PRINTER(FixedDoubleArray)
   DECLARE_VERIFIER(FixedDoubleArray)
 
  private:
   DISALLOW_IMPLICIT_CONSTRUCTORS(FixedDoubleArray);
 };
 
 
+class WeakFixedArray : public FixedArray {
+ public:
+  inline Object* get(int index) const;
+
+  static bool StoreAnywhere(Handle<WeakFixedArray> array,

[Toon Verwaest, 2014/12/01 15:23:54]

What about combining StoreAnywhere with GrowAndStore into
Handle<WFA> Add(Handle<WFA>, ...)?

[Jakob Kummerow, 2014/12/02 12:32:15]

Done.

+                            Handle<HeapObject> value,
+                            bool may_be_duplicate = false);
+
+  static Handle<WeakFixedArray> GrowAndStore(Handle<WeakFixedArray> original,
+                                             Handle<HeapObject> value);
+  void Delete(Handle<HeapObject> value);

[Toon Verwaest, 2014/12/01 15:23:54]

And then rename to Remove to match Add.

[Jakob Kummerow, 2014/12/02 12:32:15]

Done.

+
+  DECLARE_CAST(WeakFixedArray)
+
+ private:
+  static const int kLastUsedIndexIndex = 0;
+  static const int kReservedFieldCount = 1;
+
+  static void Set(Handle<WeakFixedArray> array, int index,
+                  Handle<HeapObject> value);
+  inline void clear(int index);
+  inline int length() const;
+  inline bool IsEmptySlot(int index) const;
+
+  inline int last_used_index() const;
+  inline void set_last_used_index(int index);
+
+  static void CopyFrom(Handle<WeakFixedArray> target,
+                       Handle<WeakFixedArray> source);
+
+  friend class Factory;  // For kReservedFieldCount.

[Toon Verwaest, 2014/12/01 15:23:54]

Just move the method onto WeakFixedArray rather than having this indirection
over the factory. Just like DescriptorArray::Allocate. In that case, you don't
need to friend anything.

[Jakob Kummerow, 2014/12/02 12:32:15]

Done. I've merged CopyFrom into it, to avoid redundant initialization.

+
+  // Disallow inherited setters.
+  void set(int index, Smi* value);
+  void set(int index, Object* value);
+  void set(int index, Object* value, WriteBarrierMode mode);
+  DISALLOW_IMPLICIT_CONSTRUCTORS(WeakFixedArray);
+};
+
+
 // ConstantPoolArray describes a fixed-sized array containing constant pool
 // entries.
 //
 // A ConstantPoolArray can be structured in two different ways depending upon
 // whether it is extended or small. The is_extended_layout() method can be used
 // to discover which layout the constant pool has.
 //
 // The format of a small constant pool is:
 //   [kSmallLayout1Offset]                    : Small section layout bitmap 1
 //   [kSmallLayout2Offset]                    : Small section layout bitmap 2
@@ skipping 3275 matching lines @@
   // Tells whether the instance needs security checks when accessing its
   // properties.
   inline void set_is_access_check_needed(bool access_check_needed);
   inline bool is_access_check_needed();
 
   // Returns true if map has a non-empty stub code cache.
   inline bool has_code_cache();
 
   // [prototype]: implicit prototype object.
   DECL_ACCESSORS(prototype, Object)
+  // TODO(jkummerow): make set_prototype private.
+  void SetPrototype(Handle<Object> prototype,
+                    PrototypeOptimizationMode proto_mode = FAST_PROTOTYPE);
+  bool ShouldRegisterAsPrototypeUser(Handle<JSObject> prototype);
+  bool CanUseOptimizationsBasedOnPrototypeRegistry();
 
   // [constructor]: points back to the function responsible for this map.
   DECL_ACCESSORS(constructor, Object)
 
   // [instance descriptors]: describes the object.
   DECL_ACCESSORS(instance_descriptors, DescriptorArray)
 
   // [layout descriptor]: describes the object layout.
   DECL_ACCESSORS(layout_descriptor, LayoutDescriptor)
   // |layout descriptor| accessor which can be used from GC.
@@ skipping 309 matching lines @@
   typedef void (*TraverseCallback)(Map* map, void* data);
 
   void TraverseTransitionTree(TraverseCallback callback, void* data);
 
   // When you set the prototype of an object using the __proto__ accessor you
   // need a new map for the object (the prototype is stored in the map).  In
   // order not to multiply maps unnecessarily we store these as transitions in
   // the original map.  That way we can transition to the same map if the same
   // prototype is set, rather than creating a new map every time.  The
   // transitions are in the form of a map where the keys are prototype objects
-  // and the values are the maps the are transitioned to.
+  // and the values are the maps they transition to.
   static const int kMaxCachedPrototypeTransitions = 256;
   static Handle<Map> TransitionToPrototype(Handle<Map> map,
-                                           Handle<Object> prototype);
+                                           Handle<Object> prototype,
+                                           PrototypeOptimizationMode mode);
 
   static const int kMaxPreAllocatedPropertyFields = 255;
 
   // Layout description.
   static const int kInstanceSizesOffset = HeapObject::kHeaderSize;
   static const int kInstanceAttributesOffset = kInstanceSizesOffset + kIntSize;
   static const int kBitField3Offset = kInstanceAttributesOffset + kIntSize;
   static const int kPrototypeOffset = kBitField3Offset + kPointerSize;
   static const int kConstructorOffset = kPrototypeOffset + kPointerSize;
   // Storage for the transition array is overloaded to directly contain a back
@@ skipping 4764 matching lines @@
     } else {
       value &= ~(1 << bit_position);
     }
     return value;
   }
 };
 
 } }  // namespace v8::internal
 
 #endif  // V8_OBJECTS_H_