Add map-based read barrier to WeakCell

src/objects.cc

Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index 28c6ebb47ed393300ff5e9a73de2b6b5b06f51d4..85e2974038bfa96046e41f42c6b6d7fa30c11aed 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -1399,7 +1399,7 @@ void HeapObject::HeapObjectShortPrint(std::ostream& os) {  // NOLINT
       os << "WeakCell for ";
       HeapStringAllocator allocator;
       StringStream accumulator(&allocator);
-      WeakCell::cast(this)->value()->ShortPrint(&accumulator);
+      WeakCell::cast(this)->value(heap)->ShortPrint(&accumulator);
       os << accumulator.ToCString().get();
       break;
     }
@@ -8052,12 +8052,12 @@ Handle<WeakFixedArray> WeakFixedArray::Add(
 
   if (search_for_duplicates == kAddIfNotFound) {
     for (int i = 0; i < array->Length(); ++i) {
-      if (array->Get(i) == *value) return array;
+      if (array->EqualAt(i, *value)) return array;
     }
   } else {
 #ifdef DEBUG
     for (int i = 0; i < array->Length(); ++i) {
-      DCHECK_NE(*value, array->Get(i));
+      DCHECK(!array->EqualAt(i, *value));
     }
 #endif
   }
@@ -8093,7 +8093,7 @@ void WeakFixedArray::Remove(Handle<HeapObject> value) {
   // Optimize for the most recently added element to be removed again.
   int first_index = last_used_index();
   for (int i = first_index;;) {
-    if (Get(i) == *value) {
+    if (EqualAt(i, *value)) {
       clear(i);
       // Users of WeakFixedArray should make sure that there are no duplicates,
       // they can use Add(..., kAddIfNotFound) if necessary.
@@ -10156,7 +10156,7 @@ Handle<JSObject> Script::GetWrapper(Handle<Script> script) {
     Handle<WeakCell> cell(WeakCell::cast(script->wrapper()));
     if (!cell->cleared()) {
       // Return a handle for the existing script wrapper from the cache.
-      return handle(JSObject::cast(cell->value()));
+      return handle(JSObject::cast(cell->value(isolate->heap())));
     }
     // If we found an empty WeakCell, that means the script wrapper was
     // GCed.  We are not notified directly of that, so we decrement here
@@ -10659,10 +10659,15 @@ Object* Code::FindNthObject(int n, Map* match_map) {
   for (RelocIterator it(this, mask); !it.done(); it.next()) {
     RelocInfo* info = it.rinfo();
     Object* object = info->target_object();
-    if (object->IsWeakCell()) object = WeakCell::cast(object)->value();
+    Object* original_object = object;
+    if (object->IsWeakCell())
+      object = WeakCell::cast(object)->ValueNoReadBarrier();
     if (object->IsHeapObject()) {
       if (HeapObject::cast(object)->map() == match_map) {
-        if (--n == 0) return object;
+        if (--n == 0) {
+          WeakCell::TriggerReadBarrier(original_object);
+          return object;
+        }
       }
     }
   }
@@ -10691,12 +10696,13 @@ void Code::FindAndReplace(const FindAndReplacePattern& pattern) {
   for (RelocIterator it(this, mask); !it.done(); it.next()) {
     RelocInfo* info = it.rinfo();
     Object* object = info->target_object();
+    Object* original_object = object;
+    if (object->IsWeakCell())
+      object = WeakCell::cast(object)->ValueNoReadBarrier();
     if (object->IsHeapObject()) {
-      if (object->IsWeakCell()) {
-        object = HeapObject::cast(WeakCell::cast(object)->value());
-      }
       Map* map = HeapObject::cast(object)->map();
       if (map == *pattern.find_[current_pattern]) {
+        WeakCell::TriggerReadBarrier(original_object);
         info->set_target_object(*pattern.replace_[current_pattern]);
         if (++current_pattern == pattern.count_) return;
       }
@@ -10713,8 +10719,13 @@ void Code::FindAllMaps(MapHandleList* maps) {
   for (RelocIterator it(this, mask); !it.done(); it.next()) {
     RelocInfo* info = it.rinfo();
     Object* object = info->target_object();
-    if (object->IsWeakCell()) object = WeakCell::cast(object)->value();
-    if (object->IsMap()) maps->Add(handle(Map::cast(object)));
+    Object* original_object = object;
+    if (object->IsWeakCell())
+      object = WeakCell::cast(object)->ValueNoReadBarrier();
+    if (object->IsMap()) {
+      WeakCell::TriggerReadBarrier(original_object);
+      maps->Add(handle(Map::cast(object)));
+    }
   }
 }
 
@@ -10780,8 +10791,13 @@ MaybeHandle<Code> Code::FindHandlerForMap(Map* map) {
     RelocInfo* info = it.rinfo();
     if (info->rmode() == RelocInfo::EMBEDDED_OBJECT) {
       Object* object = info->target_object();
-      if (object->IsWeakCell()) object = WeakCell::cast(object)->value();
-      if (object == map) return_next = true;
+      Object* original_object = object;
+      if (object->IsWeakCell())
+        object = WeakCell::cast(object)->ValueNoReadBarrier();
+      if (object == map) {
+        WeakCell::TriggerReadBarrier(original_object);
+        return_next = true;
+      }
     } else if (return_next) {
       Code* code = Code::GetCodeFromTargetAddress(info->target_address());
       DCHECK(code->kind() == Code::HANDLER);
@@ -11069,7 +11085,7 @@ WeakCell* Code::CachedWeakCell() {
   Object* weak_cell_cache =
       DeoptimizationInputData::cast(deoptimization_data())->WeakCellCache();
   if (weak_cell_cache->IsWeakCell()) {
-    DCHECK(this == WeakCell::cast(weak_cell_cache)->value());
+    DCHECK(this == WeakCell::cast(weak_cell_cache)->ValueNoReadBarrier());
     return WeakCell::cast(weak_cell_cache);
   }
   return NULL;