Add map-based read barrier to WeakCell

src/objects.cc

Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index e8a945407733b880a26aa75bd76ad83fe5646d0d..d4c56ab1539fa9d4baa7813ca6344e53a81eec86 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -1402,7 +1402,7 @@ void HeapObject::HeapObjectShortPrint(std::ostream& os) {  // NOLINT
       os << "WeakCell for ";
       HeapStringAllocator allocator;
       StringStream accumulator(&allocator);
-      WeakCell::cast(this)->value()->ShortPrint(&accumulator);
+      WeakCell::cast(this)->value(heap)->ShortPrint(&accumulator);
       os << accumulator.ToCString().get();
       break;
     }
@@ -8047,12 +8047,12 @@ Handle<WeakFixedArray> WeakFixedArray::Add(
 
   if (search_for_duplicates == kAddIfNotFound) {
     for (int i = 0; i < array->Length(); ++i) {
-      if (array->Get(i) == *value) return array;
+      if (array->EqualAt(i, *value)) return array;
     }
   } else {
 #ifdef DEBUG
     for (int i = 0; i < array->Length(); ++i) {
-      DCHECK_NE(*value, array->Get(i));
+      DCHECK(!array->EqualAt(i, *value));
     }
 #endif
   }
@@ -8088,7 +8088,7 @@ void WeakFixedArray::Remove(Handle<HeapObject> value) {
   // Optimize for the most recently added element to be removed again.
   int first_index = last_used_index();
   for (int i = first_index;;) {
-    if (Get(i) == *value) {
+    if (EqualAt(i, *value)) {
       clear(i);
       // Users of WeakFixedArray should make sure that there are no duplicates,
       // they can use Add(..., kAddIfNotFound) if necessary.
@@ -10152,7 +10152,7 @@ Handle<JSObject> Script::GetWrapper(Handle<Script> script) {
     Handle<WeakCell> cell(WeakCell::cast(script->wrapper()));
     if (!cell->cleared()) {
       // Return a handle for the existing script wrapper from the cache.
-      return handle(JSObject::cast(cell->value()));
+      return handle(JSObject::cast(cell->value(isolate->heap())));
     }
     // If we found an empty WeakCell, that means the script wrapper was
     // GCed.  We are not notified directly of that, so we decrement here
@@ -10655,10 +10655,15 @@ Object* Code::FindNthObject(int n, Map* match_map) {
   for (RelocIterator it(this, mask); !it.done(); it.next()) {
     RelocInfo* info = it.rinfo();
     Object* object = info->target_object();
-    if (object->IsWeakCell()) object = WeakCell::cast(object)->value();
+    Object* original_object = object;
+    if (object->IsWeakCell())
+      object = WeakCell::cast(object)->ValueNoReadBarrier();
     if (object->IsHeapObject()) {
       if (HeapObject::cast(object)->map() == match_map) {
-        if (--n == 0) return object;
+        if (--n == 0) {
+          WeakCell::TriggerReadBarrier(original_object);
+          return object;
+        }
       }
     }
   }
@@ -10674,7 +10679,14 @@ AllocationSite* Code::FindFirstAllocationSite() {
 
 Map* Code::FindFirstMap() {
   Object* result = FindNthObject(1, GetHeap()->meta_map());
-  return (result != NULL) ? Map::cast(result) : NULL;
+  if (result == NULL) return NULL;
+  Map* map = Map::cast(result);
+  if (map->instance_type() == WEAK_CELL_TYPE) {
+    // There may be reloc info with weak cell maps. These are just in use by
+    // the read barrier and are not useful to harvest for the type feedback.
+    map = reinterpret_cast<Map*>(FindNthObject(2, GetHeap()->meta_map()));
+  }
+  return map;
 }
 
 
@@ -10687,12 +10699,13 @@ void Code::FindAndReplace(const FindAndReplacePattern& pattern) {
   for (RelocIterator it(this, mask); !it.done(); it.next()) {
     RelocInfo* info = it.rinfo();
     Object* object = info->target_object();
+    Object* original_object = object;
+    if (object->IsWeakCell())
+      object = WeakCell::cast(object)->ValueNoReadBarrier();
     if (object->IsHeapObject()) {
-      if (object->IsWeakCell()) {
-        object = HeapObject::cast(WeakCell::cast(object)->value());
-      }
       Map* map = HeapObject::cast(object)->map();
       if (map == *pattern.find_[current_pattern]) {
+        WeakCell::TriggerReadBarrier(original_object);
         info->set_target_object(*pattern.replace_[current_pattern]);
         if (++current_pattern == pattern.count_) return;
       }
@@ -10709,8 +10722,17 @@ void Code::FindAllMaps(MapHandleList* maps) {
   for (RelocIterator it(this, mask); !it.done(); it.next()) {
     RelocInfo* info = it.rinfo();
     Object* object = info->target_object();
-    if (object->IsWeakCell()) object = WeakCell::cast(object)->value();
-    if (object->IsMap()) maps->Add(handle(Map::cast(object)));
+    Object* original_object = object;
+    if (object->IsWeakCell())
+      object = WeakCell::cast(object)->ValueNoReadBarrier();
+    if (object->IsMap()) {
+      Map* map = Map::cast(object);
+      // This 'if' filters out the weak cell map used by the read barrier.
+      if (map->instance_type() != WEAK_CELL_TYPE) {
+        WeakCell::TriggerReadBarrier(original_object);
+        maps->Add(handle(map));
+      }
+    }
   }
 }
 
@@ -10776,8 +10798,13 @@ MaybeHandle<Code> Code::FindHandlerForMap(Map* map) {
     RelocInfo* info = it.rinfo();
     if (info->rmode() == RelocInfo::EMBEDDED_OBJECT) {
       Object* object = info->target_object();
-      if (object->IsWeakCell()) object = WeakCell::cast(object)->value();
-      if (object == map) return_next = true;
+      Object* original_object = object;
+      if (object->IsWeakCell())
+        object = WeakCell::cast(object)->ValueNoReadBarrier();
+      if (object == map) {
+        WeakCell::TriggerReadBarrier(original_object);
+        return_next = true;
+      }
     } else if (return_next) {
       Code* code = Code::GetCodeFromTargetAddress(info->target_address());
       DCHECK(code->kind() == Code::HANDLER);
@@ -11077,7 +11104,7 @@ WeakCell* Code::CachedWeakCell() {
   Object* weak_cell_cache =
       DeoptimizationInputData::cast(deoptimization_data())->WeakCellCache();
   if (weak_cell_cache->IsWeakCell()) {
-    DCHECK(this == WeakCell::cast(weak_cell_cache)->value());
+    DCHECK(this == WeakCell::cast(weak_cell_cache)->ValueNoReadBarrier());
     return WeakCell::cast(weak_cell_cache);
   }
   return NULL;