Vector-based ICs also need to hold maps weakly.

src/type-feedback-vector.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/v8.h"
 
 #include "src/ic/ic.h"
 #include "src/ic/ic-state.h"
 #include "src/objects.h"
 #include "src/type-feedback-vector-inl.h"
@@ skipping 205 matching lines @@
     SetFeedback(*array);
     return array;
   }
   return Handle<FixedArray>::cast(feedback);
 }
 
 
 void FeedbackNexus::InstallHandlers(int start_index, TypeHandleList* types,
                                     CodeHandleList* handlers) {
   Isolate* isolate = GetIsolate();
-  FixedArray* array = FixedArray::cast(GetFeedback());
+  Handle<FixedArray> array = handle(FixedArray::cast(GetFeedback()), isolate);
   int receiver_count = types->length();
   for (int current = 0; current < receiver_count; ++current) {
     Handle<HeapType> type = types->at(current);
     Handle<Map> map = IC::TypeToMap(*type, isolate);
-    array->set(start_index + (current * 2), *map);
+    Handle<WeakCell> cell = Map::WeakCellForMap(map);
+    array->set(start_index + (current * 2), *cell);
     array->set(start_index + (current * 2 + 1), *handlers->at(current));
   }
 }
 
 
 InlineCacheState LoadICNexus::StateFromFeedback() const {
   Isolate* isolate = GetIsolate();
   Object* feedback = GetFeedback();
   if (feedback == *vector()->UninitializedSentinel(isolate)) {
     return UNINITIALIZED;
   } else if (feedback == *vector()->MegamorphicSentinel(isolate)) {
     return MEGAMORPHIC;
   } else if (feedback == *vector()->PremonomorphicSentinel(isolate)) {
     return PREMONOMORPHIC;
   } else if (feedback->IsFixedArray()) {
+    // Determine state purely by our structure, don't check if the maps are
+    // cleared.
     FixedArray* array = FixedArray::cast(feedback);
     int length = array->length();
     DCHECK(length >= 2);
     return length == 2 ? MONOMORPHIC : POLYMORPHIC;
   }
 
   return UNINITIALIZED;
 }
 
 
 InlineCacheState KeyedLoadICNexus::StateFromFeedback() const {
   Isolate* isolate = GetIsolate();
   Object* feedback = GetFeedback();
   if (feedback == *vector()->UninitializedSentinel(isolate)) {
     return UNINITIALIZED;
   } else if (feedback == *vector()->PremonomorphicSentinel(isolate)) {
     return PREMONOMORPHIC;
   } else if (feedback == *vector()->GenericSentinel(isolate)) {
     return GENERIC;
   } else if (feedback->IsFixedArray()) {
+    // Determine state purely by our structure, don't check if the maps are
+    // cleared.
     FixedArray* array = FixedArray::cast(feedback);
     int length = array->length();
     DCHECK(length >= 3);
     return length == 3 ? MONOMORPHIC : POLYMORPHIC;
   }
 
   return UNINITIALIZED;
 }
 
 
@@ skipping 60 matching lines @@
 void KeyedLoadICNexus::ConfigurePremonomorphic() {
   SetFeedback(*vector()->PremonomorphicSentinel(GetIsolate()),
               SKIP_WRITE_BARRIER);
 }
 
 
 void LoadICNexus::ConfigureMonomorphic(Handle<HeapType> type,
                                        Handle<Code> handler) {
   Handle<FixedArray> array = EnsureArrayOfSize(2);
   Handle<Map> receiver_map = IC::TypeToMap(*type, GetIsolate());
-  array->set(0, *receiver_map);
+  Handle<WeakCell> cell = Map::WeakCellForMap(receiver_map);
+  array->set(0, *cell);
   array->set(1, *handler);
 }
 
 
 void KeyedLoadICNexus::ConfigureMonomorphic(Handle<Name> name,
                                             Handle<HeapType> type,
                                             Handle<Code> handler) {
   Handle<FixedArray> array = EnsureArrayOfSize(3);
   Handle<Map> receiver_map = IC::TypeToMap(*type, GetIsolate());
   if (name.is_null()) {
     array->set(0, Smi::FromInt(0));
   } else {
     array->set(0, *name);
   }
-  array->set(1, *receiver_map);
+  Handle<WeakCell> cell = Map::WeakCellForMap(receiver_map);
+  array->set(1, *cell);
   array->set(2, *handler);
 }
 
 
 void LoadICNexus::ConfigurePolymorphic(TypeHandleList* types,
                                        CodeHandleList* handlers) {
   int receiver_count = types->length();
   EnsureArrayOfSize(receiver_count * 2);
   InstallHandlers(0, types, handlers);
 }
@@ skipping 10 matching lines @@
     array->set(0, *name);
   }
   InstallHandlers(1, types, handlers);
 }
 
 
 int FeedbackNexus::ExtractMaps(int start_index, MapHandleList* maps) const {
   Isolate* isolate = GetIsolate();
   Object* feedback = GetFeedback();
   if (feedback->IsFixedArray()) {
+    int found = 0;
     FixedArray* array = FixedArray::cast(feedback);
     // The array should be of the form [<optional name>], then
     // [map, handler, map, handler, ... ]
     DCHECK(array->length() >= (2 + start_index));
     for (int i = start_index; i < array->length(); i += 2) {
-      Map* map = Map::cast(array->get(i));
-      maps->Add(handle(map, isolate));
+      WeakCell* cell = WeakCell::cast(array->get(i));
+      if (!cell->cleared()) {
+        Map* map = Map::cast(cell->value());
+        maps->Add(handle(map, isolate));
+        found++;
+      }
     }
-    return (array->length() - start_index) / 2;
+    return found;
   }
 
   return 0;
 }
 
 
 MaybeHandle<Code> FeedbackNexus::FindHandlerForMap(int start_index,
                                                    Handle<Map> map) const {
   Object* feedback = GetFeedback();
   if (feedback->IsFixedArray()) {
     FixedArray* array = FixedArray::cast(feedback);
     for (int i = start_index; i < array->length(); i += 2) {
-      Map* array_map = Map::cast(array->get(i));
-      if (array_map == *map) {
-        Code* code = Code::cast(array->get(i + 1));
-        DCHECK(code->kind() == Code::HANDLER);
-        return handle(code);
+      WeakCell* cell = WeakCell::cast(array->get(i));
+      if (!cell->cleared()) {
+        Map* array_map = Map::cast(cell->value());
+        if (array_map == *map) {
+          Code* code = Code::cast(array->get(i + 1));
+          DCHECK(code->kind() == Code::HANDLER);
+          return handle(code);
+        }
       }
     }
   }
 
   return MaybeHandle<Code>();
 }
 
 
 bool FeedbackNexus::FindHandlers(int start_index, CodeHandleList* code_list,
                                  int length) const {
   Object* feedback = GetFeedback();
   int count = 0;
   if (feedback->IsFixedArray()) {
     FixedArray* array = FixedArray::cast(feedback);
     // The array should be of the form [<optional name>], then
-    // [map, handler, map, handler, ... ]
+    // [map, handler, map, handler, ... ]. Be sure to skip handlers whose maps
+    // have been cleared.
     DCHECK(array->length() >= (2 + start_index));
     for (int i = start_index; i < array->length(); i += 2) {
-      Code* code = Code::cast(array->get(i + 1));
-      DCHECK(code->kind() == Code::HANDLER);
-      code_list->Add(handle(code));
-      count++;
+      WeakCell* cell = WeakCell::cast(array->get(i));
+      if (!cell->cleared()) {
+        Code* code = Code::cast(array->get(i + 1));
+        DCHECK(code->kind() == Code::HANDLER);
+        code_list->Add(handle(code));
+        count++;
+      }
     }
   }
   return count == length;
 }
 
 
 int LoadICNexus::ExtractMaps(MapHandleList* maps) const {
   return FeedbackNexus::ExtractMaps(0, maps);
 }
 
@@ skipping 37 matching lines @@
   if (feedback->IsFixedArray()) {
     FixedArray* array = FixedArray::cast(feedback);
     DCHECK(array->length() >= 3);
     Object* name = array->get(0);
     if (name->IsName()) return Name::cast(name);
   }
   return NULL;
 }
 }
 }  // namespace v8::internal