[object-stats] Support boilerplate objects and arrays

Record seperate virtual instance types for boilerplates and their properties
and elements. This CL adds:
- BOILERPLATE_PROPERTY_ARRAY_TYPE
- BOILERPLATE_NAME_DICTIONARY_TYPE
- BOILERPLATE_ELEMENTS_TYPE


Bug: v8:7266
Change-Id: I2e6643d4bf067aa52eb1950a696b6535b020b097
Reviewed-on: https://chromium-review.googlesource.com/867059
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50592}

src/heap/object-stats.cc

@@ -298,6 +298,8 @@ ObjectStatsCollectorImpl::ObjectStatsCollectorImpl(Heap* heap,
       marking_state_(
           heap->mark_compact_collector()->non_atomic_marking_state()) {}
 
+// For entries which shared the same instance type (historically FixedArrays)
+// we do a pre-pass and create virtual instance types.
 void ObjectStatsCollectorImpl::CollectVirtualStatistics(HeapObject* obj) {
   if (obj->IsAllocationSite()) {
     RecordVirtualAllocationSiteDetails(AllocationSite::cast(obj));
@@ -312,18 +314,38 @@ void ObjectStatsCollectorImpl::RecordVirtualObjectStats(
 
 void ObjectStatsCollectorImpl::RecordVirtualAllocationSiteDetails(
     AllocationSite* site) {
-  if (site->PointsToLiteral()) {
-    JSObject* boilerplate = site->boilerplate();
-    if (boilerplate->IsJSArray()) {
-      RecordVirtualObjectStats(boilerplate,
-                               ObjectStats::JS_ARRAY_BOILERPLATE_TYPE,
-                               boilerplate->Size());
+  if (!site->PointsToLiteral()) return;
+  JSObject* boilerplate = site->boilerplate();
+  if (boilerplate->IsJSArray()) {
+    RecordVirtualObjectStats(boilerplate,
+                             ObjectStats::JS_ARRAY_BOILERPLATE_TYPE,
+                             boilerplate->Size());
+    // Array boilerplates cannot have properties.
+  } else {
+    RecordVirtualObjectStats(boilerplate,
+                             ObjectStats::JS_OBJECT_BOILERPLATE_TYPE,
+                             boilerplate->Size());
+    if (boilerplate->HasFastProperties()) {
+      // We'll misclassify the empty_proeprty_array here. Given that there is a
+      // single instance, this is neglible.
+      PropertyArray* properties = boilerplate->property_array();
+      RecordVirtualObjectStats(properties,
+                               ObjectStats::BOILERPLATE_PROPERTY_ARRAY_TYPE,
+                               properties->Size());
     } else {
-      RecordVirtualObjectStats(boilerplate,
-                               ObjectStats::JS_OBJECT_BOILERPLATE_TYPE,
-                               boilerplate->Size());
+      NameDictionary* properties = boilerplate->property_dictionary();
+      RecordVirtualObjectStats(properties,
+                               ObjectStats::BOILERPLATE_NAME_DICTIONARY_TYPE,
+                               properties->Size());
     }
   }
+  FixedArrayBase* elements = boilerplate->elements();
+  // We skip COW elements since they are shared, and we are sure that if the
+  // boilerplate exists there must have been at least one instantiation.
+  if (!elements->IsCowArray()) {
+    RecordVirtualObjectStats(elements, ObjectStats::BOILERPLATE_ELEMENTS_TYPE,
+                             elements->Size());
+  }
 }
 
 void ObjectStatsCollectorImpl::CollectStatistics(HeapObject* obj) {

src/heap/object-stats.h

@@ -20,6 +20,9 @@
 //
 // Update LAST_VIRTUAL_TYPE below when changing this macro.
 #define VIRTUAL_INSTANCE_TYPE_LIST(V) \
+  V(BOILERPLATE_ELEMENTS_TYPE)        \
+  V(BOILERPLATE_NAME_DICTIONARY_TYPE) \
+  V(BOILERPLATE_PROPERTY_ARRAY_TYPE)  \
   V(JS_ARRAY_BOILERPLATE_TYPE)        \
   V(JS_OBJECT_BOILERPLATE_TYPE)
 

tools/heap-stats/categories.js

@@ -72,6 +72,17 @@ const CATEGORIES = new Map([
   ],
   [
     'system', new Set([
+      'ACCESS_CHECK_INFO_TYPE',
+      'ACCESSOR_INFO_TYPE',
+      'ACCESSOR_PAIR_TYPE',
+      'ALLOCATION_MEMENTO_TYPE',
+      'ALLOCATION_SITE_TYPE',
+      'BOILERPLATE_ELEMENTS_TYPE',
+      'BOILERPLATE_NAME_DICTIONARY_TYPE',
+      'BOILERPLATE_PROPERTY_ARRAY_TYPE',
+      'BYTE_ARRAY_TYPE',
+      'CELL_TYPE',
+      'CONTEXT_EXTENSION_TYPE',
       '*FIXED_ARRAY_DEPENDENT_CODE_SUB_TYPE',
       '*FIXED_ARRAY_ENUM_CACHE_SUB_TYPE',
       '*FIXED_ARRAY_ENUM_INDICES_CACHE_SUB_TYPE',
@@ -86,18 +97,12 @@ const CATEGORIES = new Map([
       '*FIXED_ARRAY_STRING_SPLIT_CACHE_SUB_TYPE',
       '*FIXED_ARRAY_TEMPLATE_INFO_SUB_TYPE',
       '*FIXED_ARRAY_WEAK_NEW_SPACE_OBJECT_TO_CODE_SUB_TYPE',
-      'ACCESS_CHECK_INFO_TYPE',
-      'ACCESSOR_INFO_TYPE',
-      'ACCESSOR_PAIR_TYPE',
-      'ALLOCATION_MEMENTO_TYPE',
-      'ALLOCATION_SITE_TYPE',
-      'BYTE_ARRAY_TYPE',
-      'CELL_TYPE',
-      'CONTEXT_EXTENSION_TYPE',
       'FOREIGN_TYPE',
       'FUNCTION_TEMPLATE_INFO_TYPE',
       'INTERCEPTOR_INFO_TYPE',
       'JS_API_OBJECT_TYPE',
+      'JS_ARRAY_BOILERPLATE_TYPE',
+      'JS_OBJECT_BOILERPLATE_TYPE'
       'JS_SPECIAL_API_OBJECT_TYPE',
       'MAP_TYPE',
       'OBJECT_TEMPLATE_INFO_TYPE',