[ubsan] Port WeakFixedArray and subclasses

TransitionArray, NormalizedMapCache, DependentCode to the new design.

Bug: v8:3770
Change-Id: I8bd56f231fb62b146e0fb05989418aedb62a628b
Reviewed-on: https://chromium-review.googlesource.com/c/1350287
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57921}

src/feedback-vector.cc

@@ -611,7 +611,7 @@ InlineCacheState FeedbackNexus::StateFromFeedback() const {
         if (heap_object->IsName()) {
           DCHECK(IsKeyedLoadICKind(kind()) || IsKeyedStoreICKind(kind()));
           Object* extra = GetFeedbackExtra()->GetHeapObjectAssumeStrong();
-          WeakFixedArray* extra_array = WeakFixedArray::cast(extra);
+          WeakFixedArray extra_array = WeakFixedArray::cast(extra);
           return extra_array->length() > 2 ? POLYMORPHIC : MONOMORPHIC;
         }
       }
@@ -923,7 +923,7 @@ int FeedbackNexus::ExtractMaps(MapHandles* maps) const {
        heap_object->IsWeakFixedArray()) ||
       is_named_feedback) {
     int found = 0;
-    WeakFixedArray* array;
+    WeakFixedArray array;
     if (is_named_feedback) {
       array =
           WeakFixedArray::cast(GetFeedbackExtra()->GetHeapObjectAssumeStrong());
@@ -970,7 +970,7 @@ MaybeObjectHandle FeedbackNexus::FindHandlerForMap(Handle<Map> map) const {
   if ((feedback->GetHeapObjectIfStrong(&heap_object) &&
        heap_object->IsWeakFixedArray()) ||
       is_named_feedback) {
-    WeakFixedArray* array;
+    WeakFixedArray array;
     if (is_named_feedback) {
       array =
           WeakFixedArray::cast(GetFeedbackExtra()->GetHeapObjectAssumeStrong());
@@ -1017,7 +1017,7 @@ bool FeedbackNexus::FindHandlers(MaybeObjectHandles* code_list,
   if ((feedback->GetHeapObjectIfStrong(&heap_object) &&
        heap_object->IsWeakFixedArray()) ||
       is_named_feedback) {
-    WeakFixedArray* array;
+    WeakFixedArray array;
     if (is_named_feedback) {
       array =
           WeakFixedArray::cast(GetFeedbackExtra()->GetHeapObjectAssumeStrong());

src/heap/concurrent-marking.cc

@@ -328,7 +328,7 @@ class ConcurrentMarkingVisitor final
     return 0;
   }
 
-  int VisitTransitionArray(Map map, TransitionArray* array) {
+  int VisitTransitionArray(Map map, TransitionArray array) {
     if (!ShouldVisit(array)) return 0;
     VisitMapPointer(array, array->map_slot());
     int size = TransitionArray::BodyDescriptor::SizeOf(map, array);

src/heap/factory.cc

@@ -14,6 +14,7 @@
 #include "src/compiler.h"
 #include "src/conversions.h"
 #include "src/counters.h"
+#include "src/heap/mark-compact-inl.h"
 #include "src/interpreter/interpreter.h"
 #include "src/isolate-inl.h"
 #include "src/macro-assembler.h"
@@ -22,6 +23,7 @@
 #include "src/objects/bigint.h"
 #include "src/objects/debug-objects-inl.h"
 #include "src/objects/embedder-data-array-inl.h"
+#include "src/objects/fixed-array-inl.h"
 #include "src/objects/frame-array-inl.h"
 #include "src/objects/instance-type-inl.h"
 #include "src/objects/js-array-inl.h"
@@ -2147,7 +2149,7 @@ Handle<WeakFixedArray> Factory::CopyWeakFixedArrayAndGrow(
   DCHECK_EQ(old_len, src->length());
   obj->set_map_after_allocation(src->map(), SKIP_WRITE_BARRIER);
 
-  WeakFixedArray* result = WeakFixedArray::cast(obj);
+  WeakFixedArray result = WeakFixedArray::cast(obj);
   result->set_length(new_len);
 
   // Copy the content.

src/heap/heap.cc

@@ -2668,14 +2668,14 @@ void Heap::RightTrimFixedArray(FixedArrayBase object, int elements_to_trim) {
   CreateFillerForArray<FixedArrayBase>(object, elements_to_trim, bytes_to_trim);
 }
 
-void Heap::RightTrimWeakFixedArray(WeakFixedArray* object,
+void Heap::RightTrimWeakFixedArray(WeakFixedArray object,
                                    int elements_to_trim) {
   // This function is safe to use only at the end of the mark compact
   // collection: When marking, we record the weak slots, and shrinking
   // invalidates them.
   DCHECK_EQ(gc_state(), MARK_COMPACT);
-  CreateFillerForArray<WeakFixedArray*>(object, elements_to_trim,
+  CreateFillerForArray<WeakFixedArray>(object, elements_to_trim,
-                                        elements_to_trim * kPointerSize);
+                                       elements_to_trim * kPointerSize);
 }
 
 template <typename T>

src/heap/heap.h

@@ -399,7 +399,7 @@ class Heap {
 
   // Trim the given array from the right.
   void RightTrimFixedArray(FixedArrayBase obj, int elements_to_trim);
-  void RightTrimWeakFixedArray(WeakFixedArray* obj, int elements_to_trim);
+  void RightTrimWeakFixedArray(WeakFixedArray obj, int elements_to_trim);
 
   // Converts the given boolean condition to JavaScript boolean value.
   inline Oddball* ToBoolean(bool condition);

src/heap/mark-compact-inl.h

@@ -12,6 +12,7 @@
 #include "src/objects/js-collection-inl.h"
 #include "src/objects/js-weak-refs-inl.h"
 #include "src/objects/slots-inl.h"
+#include "src/transitions.h"
 
 namespace v8 {
 namespace internal {
@@ -168,7 +169,7 @@ template <FixedArrayVisitationMode fixed_array_mode,
           TraceRetainingPathMode retaining_path_mode, typename MarkingState>
 int MarkingVisitor<fixed_array_mode, retaining_path_mode,
                    MarkingState>::VisitTransitionArray(Map map,
-                                                       TransitionArray* array) {
+                                                       TransitionArray array) {
   int size = TransitionArray::BodyDescriptor::SizeOf(map, array);
   TransitionArray::BodyDescriptor::IterateBody(map, array, size, this);
   collector_->AddTransitionArray(array);
@@ -440,6 +441,10 @@ void MarkCompactCollector::RecordSlot(HeapObject* object, HeapObjectSlot slot,
   }
 }
 
+void MarkCompactCollector::AddTransitionArray(TransitionArray array) {
+  weak_objects_.transition_arrays.Push(kMainThread, array);
+}
+
 template <LiveObjectIterationMode mode>
 LiveObjectRange<mode>::iterator::iterator(MemoryChunk* chunk, Bitmap* bitmap,
                                           Address start)

src/heap/mark-compact.cc

@@ -1939,7 +1939,7 @@ void MarkCompactCollector::ClearPotentialSimpleMapTransition(Map map,
 }
 
 void MarkCompactCollector::ClearFullMapTransitions() {
-  TransitionArray* array;
+  TransitionArray array;
   while (weak_objects_.transition_arrays.Pop(kMainThread, &array)) {
     int num_transitions = array->number_of_entries();
     if (num_transitions > 0) {
@@ -1964,7 +1964,7 @@ void MarkCompactCollector::ClearFullMapTransitions() {
 }
 
 bool MarkCompactCollector::CompactTransitionArray(
-    Map map, TransitionArray* transitions, DescriptorArray* descriptors) {
+    Map map, TransitionArray transitions, DescriptorArray* descriptors) {
   DCHECK(!map->is_prototype_map());
   int num_transitions = transitions->number_of_entries();
   bool descriptors_owner_died = false;

src/heap/mark-compact.h

@@ -415,7 +415,7 @@ typedef Worklist<Ephemeron, 64> EphemeronWorklist;
 
 // Weak objects encountered during marking.
 struct WeakObjects {
-  Worklist<TransitionArray*, 64> transition_arrays;
+  Worklist<TransitionArray, 64> transition_arrays;
 
   // Keep track of all EphemeronHashTables in the heap to process
   // them in the atomic pause.
@@ -653,9 +653,7 @@ class MarkCompactCollector final : public MarkCompactCollectorBase {
 
   WeakObjects* weak_objects() { return &weak_objects_; }
 
-  void AddTransitionArray(TransitionArray* array) {
+  inline void AddTransitionArray(TransitionArray array);
-    weak_objects_.transition_arrays.Push(kMainThread, array);
-  }
 
   void AddEphemeronHashTable(EphemeronHashTable table) {
     weak_objects_.ephemeron_hash_tables.Push(kMainThread, table);
@@ -755,9 +753,6 @@ class MarkCompactCollector final : public MarkCompactCollectorBase {
   // otherwise they can die and try to deoptimize the underlying code.
   void ProcessTopOptimizedFrame(ObjectVisitor* visitor);
 
-  // Collects a list of dependent code from maps embedded in optimize code.
-  DependentCode* DependentCodeListFromNonLiveMaps();
-
   // Drains the main thread marking work list. Will mark all pending objects
   // if no concurrent threads are running.
   void ProcessMarkingWorklist() override;
@@ -805,10 +800,10 @@ class MarkCompactCollector final : public MarkCompactCollectorBase {
   // Compact every array in the global list of transition arrays and
   // trim the corresponding descriptor array if a transition target is non-live.
   void ClearFullMapTransitions();
-  bool CompactTransitionArray(Map map, TransitionArray* transitions,
-                              DescriptorArray* descriptors);
   void TrimDescriptorArray(Map map, DescriptorArray* descriptors);
   void TrimEnumCache(Map map, DescriptorArray* descriptors);
+  bool CompactTransitionArray(Map map, TransitionArray transitions,
+                              DescriptorArray* descriptors);
 
   // After all reachable objects have been marked those weak map entries
   // with an unreachable key are removed from all encountered weak maps.
@@ -934,7 +929,7 @@ class MarkingVisitor final
   V8_INLINE int VisitJSDataView(Map map, JSDataView* object);
   V8_INLINE int VisitJSTypedArray(Map map, JSTypedArray* object);
   V8_INLINE int VisitMap(Map map, Map object);
-  V8_INLINE int VisitTransitionArray(Map map, TransitionArray* object);
+  V8_INLINE int VisitTransitionArray(Map map, TransitionArray object);
   V8_INLINE int VisitJSWeakCell(Map map, JSWeakCell* object);
 
   // ObjectVisitor implementation.

src/heap/objects-visiting.h

@@ -73,7 +73,7 @@ class WasmInstanceObject;
   V(SmallOrderedNameDictionary, SmallOrderedNameDictionary)                    \
   V(Symbol, Symbol)                                                            \
   V(ThinString, ThinString)                                                    \
-  V(TransitionArray, TransitionArray*)                                         \
+  V(TransitionArray, TransitionArray)                                          \
   V(UncompiledDataWithoutPreParsedScope, UncompiledDataWithoutPreParsedScope*) \
   V(UncompiledDataWithPreParsedScope, UncompiledDataWithPreParsedScope*)       \
   V(WasmInstanceObject, WasmInstanceObject*)

src/objects-debug.cc

@@ -1967,7 +1967,7 @@ void Script::ScriptVerify(Isolate* isolate) {
 }
 
 void NormalizedMapCache::NormalizedMapCacheVerify(Isolate* isolate) {
-  WeakFixedArray::cast(this)->WeakFixedArrayVerify(isolate);
+  WeakFixedArray::cast(*this)->WeakFixedArrayVerify(isolate);
   if (FLAG_enable_slow_asserts) {
     for (int i = 0; i < length(); i++) {
       MaybeObject e = WeakFixedArray::Get(i);

src/objects-inl.h

@@ -501,6 +501,11 @@ OBJECT_CONSTRUCTORS_IMPL(SmallOrderedNameDictionary,
 OBJECT_CONSTRUCTORS_IMPL(RegExpMatchInfo, FixedArray)
 OBJECT_CONSTRUCTORS_IMPL(ScopeInfo, FixedArray)
 
+NormalizedMapCache::NormalizedMapCache(Address ptr) : WeakFixedArray(ptr) {
+  // TODO(jkummerow): Introduce IsNormalizedMapCache() and use
+  // OBJECT_CONSTRUCTORS_IMPL macro?
+}
+
 // ------------------------------------
 // Cast operations
 
@@ -521,7 +526,7 @@ CAST_ACCESSOR(HeapNumber)
 CAST_ACCESSOR(MutableHeapNumber)
 CAST_ACCESSOR2(OrderedNameDictionary)
 CAST_ACCESSOR2(NameDictionary)
-CAST_ACCESSOR(NormalizedMapCache)
+CAST_ACCESSOR2(NormalizedMapCache)
 CAST_ACCESSOR2(NumberDictionary)
 CAST_ACCESSOR(Object)
 CAST_ACCESSOR2(ObjectHashSet)
@@ -965,7 +970,7 @@ Handle<Object> Oddball::ToNumber(Isolate* isolate, Handle<Oddball> input) {
 
 ACCESSORS(Cell, value, Object, kValueOffset)
 ACCESSORS(FeedbackCell, value, HeapObject, kValueOffset)
-ACCESSORS(PropertyCell, dependent_code, DependentCode, kDependentCodeOffset)
+ACCESSORS2(PropertyCell, dependent_code, DependentCode, kDependentCodeOffset)
 ACCESSORS2(PropertyCell, name, Name, kNameOffset)
 ACCESSORS(PropertyCell, value, Object, kValueOffset)
 ACCESSORS(PropertyCell, property_details_raw, Object, kDetailsOffset)
@@ -1565,7 +1570,7 @@ int HeapObject::SizeFromMap(Map map) const {
   if (IsInRange(instance_type, FIRST_WEAK_FIXED_ARRAY_TYPE,
                 LAST_WEAK_FIXED_ARRAY_TYPE)) {
     return WeakFixedArray::SizeFor(
-        reinterpret_cast<const WeakFixedArray*>(this)->synchronized_length());
+        WeakFixedArray::unchecked_cast(this)->synchronized_length());
   }
   if (instance_type == WEAK_ARRAY_LIST_TYPE) {
     return WeakArrayList::SizeForCapacity(

src/objects-printer.cc

@@ -1080,7 +1080,7 @@ void WeakArrayList::WeakArrayListPrint(std::ostream& os) {
 }
 
 void TransitionArray::TransitionArrayPrint(std::ostream& os) {  // NOLINT
-  HeapObject::PrintHeader(os, "TransitionArray");
+  PrintHeader(os, "TransitionArray");
   PrintInternal(os);
 }
 

src/objects.cc

@@ -14143,10 +14143,11 @@ int SharedFunctionInfo::FindIndexInScript(Isolate* isolate) const {
   Object* script_obj = script();
   if (!script_obj->IsScript()) return FunctionLiteral::kIdTypeInvalid;
 
-  WeakFixedArray* shared_info_list =
+  WeakFixedArray shared_info_list =
       Script::cast(script_obj)->shared_function_infos();
   SharedFunctionInfo::ScriptIterator iterator(
-      isolate, Handle<WeakFixedArray>(&shared_info_list));
+      isolate,
+      Handle<WeakFixedArray>(reinterpret_cast<Address*>(&shared_info_list)));
 
   for (SharedFunctionInfo shared = iterator.Next(); !shared.is_null();
        shared = iterator.Next()) {
@@ -15326,7 +15327,7 @@ void JSArray::SetLength(Handle<JSArray> array, uint32_t new_length) {
   array->GetElementsAccessor()->SetLength(array, new_length);
 }
 
-DependentCode* DependentCode::GetDependentCode(Handle<HeapObject> object) {
+DependentCode DependentCode::GetDependentCode(Handle<HeapObject> object) {
   if (object->IsMap()) {
     return Handle<Map>::cast(object)->dependent_code();
   } else if (object->IsPropertyCell()) {
@@ -17548,7 +17549,7 @@ int SearchLiteralsMapEntry(CompilationCacheTable cache, int cache_entry,
   // object used to be a FixedArray here).
   DCHECK(!obj->IsFixedArray());
   if (obj->IsWeakFixedArray()) {
-    WeakFixedArray* literals_map = WeakFixedArray::cast(obj);
+    WeakFixedArray literals_map = WeakFixedArray::cast(obj);
     int length = literals_map->length();
     for (int i = 0; i < length; i += kLiteralEntryLength) {
       DCHECK(literals_map->Get(i + kLiteralContextOffset)->IsWeakOrCleared());
@@ -17635,8 +17636,7 @@ FeedbackCell* SearchLiteralsMap(CompilationCacheTable cache, int cache_entry,
   FeedbackCell* result = nullptr;
   int entry = SearchLiteralsMapEntry(cache, cache_entry, native_context);
   if (entry >= 0) {
-    WeakFixedArray* literals_map =
+    WeakFixedArray literals_map = WeakFixedArray::cast(cache->get(cache_entry));
-        WeakFixedArray::cast(cache->get(cache_entry));
     DCHECK_LE(entry + kLiteralEntryLength, literals_map->length());
     MaybeObject object = literals_map->Get(entry + kLiteralLiteralsOffset);
 

src/objects.h

@@ -1569,7 +1569,7 @@ class PropertyCell : public HeapObject {
   DECL_ACCESSORS(value, Object)
   // [dependent_code]: dependent code that depends on the type of the global
   // property.
-  DECL_ACCESSORS(dependent_code, DependentCode)
+  DECL_ACCESSORS2(dependent_code, DependentCode)
 
   inline PropertyDetails property_details() const;
   inline void set_property_details(PropertyDetails details);

src/objects/allocation-site-inl.h

@@ -25,7 +25,7 @@ ACCESSORS(AllocationSite, nested_site, Object, kNestedSiteOffset)
 INT32_ACCESSORS(AllocationSite, pretenure_data, kPretenureDataOffset)
 INT32_ACCESSORS(AllocationSite, pretenure_create_count,
                 kPretenureCreateCountOffset)
-ACCESSORS(AllocationSite, dependent_code, DependentCode, kDependentCodeOffset)
+ACCESSORS2(AllocationSite, dependent_code, DependentCode, kDependentCodeOffset)
 ACCESSORS_CHECKED(AllocationSite, weak_next, Object, kWeakNextOffset,
                   HasWeakNext())
 ACCESSORS(AllocationMemento, allocation_site, Object, kAllocationSiteOffset)

src/objects/allocation-site.h

@@ -48,7 +48,7 @@ class AllocationSite : public Struct, public NeverReadOnlySpaceObject {
   DECL_INT32_ACCESSORS(pretenure_data)
 
   DECL_INT32_ACCESSORS(pretenure_create_count)
-  DECL_ACCESSORS(dependent_code, DependentCode)
+  DECL_ACCESSORS2(dependent_code, DependentCode)
 
   // heap->allocation_site_list() points to the last AllocationSite which form
   // a linked list through the weak_next property. The GC might remove elements

src/objects/code-inl.h

@@ -25,6 +25,7 @@ namespace internal {
 OBJECT_CONSTRUCTORS_IMPL(DeoptimizationData, FixedArray)
 OBJECT_CONSTRUCTORS_IMPL(BytecodeArray, FixedArrayBase)
 OBJECT_CONSTRUCTORS_IMPL(AbstractCode, HeapObjectPtr)
+OBJECT_CONSTRUCTORS_IMPL(DependentCode, WeakFixedArray)
 
 NEVER_READ_ONLY_SPACE_IMPL(AbstractCode)
 
@@ -32,7 +33,7 @@ CAST_ACCESSOR2(AbstractCode)
 CAST_ACCESSOR2(BytecodeArray)
 CAST_ACCESSOR2(Code)
 CAST_ACCESSOR(CodeDataContainer)
-CAST_ACCESSOR(DependentCode)
+CAST_ACCESSOR2(DependentCode)
 CAST_ACCESSOR2(DeoptimizationData)
 CAST_ACCESSOR(SourcePositionTableWithFrameCache)
 
@@ -146,11 +147,11 @@ BytecodeArray AbstractCode::GetBytecodeArray() {
   return BytecodeArray::cast(*this);
 }
 
-DependentCode* DependentCode::next_link() {
+DependentCode DependentCode::next_link() {
   return DependentCode::cast(Get(kNextLinkIndex)->GetHeapObjectAssumeStrong());
 }
 
-void DependentCode::set_next_link(DependentCode* next) {
+void DependentCode::set_next_link(DependentCode next) {
   Set(kNextLinkIndex, HeapObjectReference::Strong(next));
 }
 

src/objects/code.h

@@ -594,7 +594,7 @@ class AbstractCode : public HeapObjectPtr {
 
 class DependentCode : public WeakFixedArray {
  public:
-  DECL_CAST(DependentCode)
+  DECL_CAST2(DependentCode)
 
   enum DependencyGroup {
     // Group of code that embed a transition to this map, and depend on being
@@ -635,13 +635,13 @@ class DependentCode : public WeakFixedArray {
   inline DependencyGroup group();
   inline MaybeObject object_at(int i);
   inline int count();
-  inline DependentCode* next_link();
+  inline DependentCode next_link();
 
  private:
   static const char* DependencyGroupName(DependencyGroup group);
 
   // Get/Set {object}'s {DependentCode}.
-  static DependentCode* GetDependentCode(Handle<HeapObject> object);
+  static DependentCode GetDependentCode(Handle<HeapObject> object);
   static void SetDependentCode(Handle<HeapObject> object,
                                Handle<DependentCode> dep);
 
@@ -669,7 +669,7 @@ class DependentCode : public WeakFixedArray {
   static const int kFlagsIndex = 1;
   static const int kCodesStartIndex = 2;
 
-  inline void set_next_link(DependentCode* next);
+  inline void set_next_link(DependentCode next);
   inline void set_count(int value);
   inline void set_object_at(int i, MaybeObject object);
   inline void clear_at(int i);
@@ -680,6 +680,8 @@ class DependentCode : public WeakFixedArray {
   class GroupField : public BitField<int, 0, 3> {};
   class CountField : public BitField<int, 3, 27> {};
   STATIC_ASSERT(kGroupCount <= GroupField::kMax + 1);
+
+  OBJECT_CONSTRUCTORS(DependentCode, WeakFixedArray)
 };
 
 // BytecodeArray represents a sequence of interpreter bytecodes.

src/objects/fixed-array-inl.h

@@ -29,6 +29,7 @@ OBJECT_CONSTRUCTORS_IMPL(FixedTypedArrayBase, FixedArrayBase)
 OBJECT_CONSTRUCTORS_IMPL(ArrayList, FixedArray)
 OBJECT_CONSTRUCTORS_IMPL(ByteArray, FixedArrayBase)
 OBJECT_CONSTRUCTORS_IMPL(TemplateList, FixedArray)
+OBJECT_CONSTRUCTORS_IMPL(WeakFixedArray, HeapObjectPtr)
 
 FixedArrayBase::FixedArrayBase(Address ptr, AllowInlineSmiStorage allow_smi)
     : HeapObjectPtr(ptr, allow_smi) {
@@ -51,7 +52,7 @@ CAST_ACCESSOR2(FixedArrayBase)
 CAST_ACCESSOR2(FixedDoubleArray)
 CAST_ACCESSOR2(FixedTypedArrayBase)
 CAST_ACCESSOR2(TemplateList)
-CAST_ACCESSOR(WeakFixedArray)
+CAST_ACCESSOR2(WeakFixedArray)
 CAST_ACCESSOR(WeakArrayList)
 
 SMI_ACCESSORS(FixedArrayBase, length, kLengthOffset)
@@ -290,11 +291,11 @@ void WeakFixedArray::Set(int index, MaybeObject value, WriteBarrierMode mode) {
 }
 
 MaybeObjectSlot WeakFixedArray::data_start() {
-  return HeapObject::RawMaybeWeakField(this, kHeaderSize);
+  return RawMaybeWeakField(kHeaderSize);
 }
 
 MaybeObjectSlot WeakFixedArray::RawFieldOfElementAt(int index) {
-  return HeapObject::RawMaybeWeakField(this, OffsetOfElementAt(index));
+  return RawMaybeWeakField(OffsetOfElementAt(index));
 }
 
 MaybeObject WeakArrayList::Get(int index) const {

src/objects/fixed-array.h

@@ -270,9 +270,9 @@ class FixedDoubleArray : public FixedArrayBase {
 
 // WeakFixedArray describes fixed-sized arrays with element type
 // MaybeObject.
-class WeakFixedArray : public HeapObject {
+class WeakFixedArray : public HeapObjectPtr {
  public:
-  DECL_CAST(WeakFixedArray)
+  DECL_CAST2(WeakFixedArray)
 
   inline MaybeObject Get(int index) const;
 
@@ -327,7 +327,7 @@ class WeakFixedArray : public HeapObject {
 
   static const int kFirstIndex = 1;
 
-  DISALLOW_IMPLICIT_CONSTRUCTORS(WeakFixedArray);
+  OBJECT_CONSTRUCTORS(WeakFixedArray, HeapObjectPtr);
 };
 
 // WeakArrayList is like a WeakFixedArray with static convenience methods for

src/objects/map-inl.h

@@ -694,7 +694,7 @@ void Map::SetBackPointer(Object* value, WriteBarrierMode mode) {
   set_constructor_or_backpointer(value, mode);
 }
 
-ACCESSORS(Map, dependent_code, DependentCode, kDependentCodeOffset)
+ACCESSORS2(Map, dependent_code, DependentCode, kDependentCodeOffset)
 ACCESSORS(Map, prototype_validity_cell, Object, kPrototypeValidityCellOffset)
 ACCESSORS(Map, constructor_or_backpointer, Object,
           kConstructorOrBackPointerOffset)
@@ -763,6 +763,8 @@ int Map::SlackForArraySize(int old_size, int size_limit) {
   return Min(max_slack, old_size / 4);
 }
 
+NEVER_READ_ONLY_SPACE_IMPL(NormalizedMapCache)
+
 int NormalizedMapCache::GetIndex(Handle<Map> map) {
   return map->Hash() % NormalizedMapCache::kEntries;
 }
@@ -774,8 +776,7 @@ bool NormalizedMapCache::IsNormalizedMapCache(const HeapObject* obj) {
   }
 #ifdef VERIFY_HEAP
   if (FLAG_verify_heap) {
-    NormalizedMapCache* cache =
+    NormalizedMapCache cache = NormalizedMapCache::cast(obj);
-        reinterpret_cast<NormalizedMapCache*>(const_cast<HeapObject*>(obj));
     cache->NormalizedMapCacheVerify(cache->GetIsolate());
   }
 #endif

src/objects/map.h

@@ -592,7 +592,7 @@ class Map : public HeapObjectPtr {
                                     LayoutDescriptor layout_descriptor);
 
   // [dependent code]: list of optimized codes that weakly embed this map.
-  DECL_ACCESSORS(dependent_code, DependentCode)
+  DECL_ACCESSORS2(dependent_code, DependentCode)
 
   // [prototype_validity_cell]: Cell containing the validity bit for prototype
   // chains or Smi(0) if uninitialized.
@@ -975,16 +975,16 @@ class Map : public HeapObjectPtr {
 // The cache for maps used by normalized (dictionary mode) objects.
 // Such maps do not have property descriptors, so a typical program
 // needs very limited number of distinct normalized maps.
-class NormalizedMapCache : public WeakFixedArray,
+class NormalizedMapCache : public WeakFixedArray {
-                           public NeverReadOnlySpaceObject {
  public:
+  NEVER_READ_ONLY_SPACE
   static Handle<NormalizedMapCache> New(Isolate* isolate);
 
   V8_WARN_UNUSED_RESULT MaybeHandle<Map> Get(Handle<Map> fast_map,
                                              PropertyNormalizationMode mode);
   void Set(Handle<Map> fast_map, Handle<Map> normalized_map);
 
-  DECL_CAST(NormalizedMapCache)
+  DECL_CAST2(NormalizedMapCache)
 
   static inline bool IsNormalizedMapCache(const HeapObject* obj);
 
@@ -998,6 +998,8 @@ class NormalizedMapCache : public WeakFixedArray,
   // The following declarations hide base class methods.
   Object* get(int index);
   void set(int index, Object* value);
+
+  OBJECT_CONSTRUCTORS(NormalizedMapCache, WeakFixedArray)
 };
 
 }  // namespace internal

src/objects/script-inl.h

@@ -32,8 +32,8 @@ ACCESSORS_CHECKED(Script, eval_from_shared_or_wrapped_arguments, Object,
                   this->type() != TYPE_WASM)
 SMI_ACCESSORS_CHECKED(Script, eval_from_position, kEvalFromPositionOffset,
                       this->type() != TYPE_WASM)
-ACCESSORS(Script, shared_function_infos, WeakFixedArray,
+ACCESSORS2(Script, shared_function_infos, WeakFixedArray,
-          kSharedFunctionInfosOffset)
+           kSharedFunctionInfosOffset)
 SMI_ACCESSORS(Script, flags, kFlagsOffset)
 ACCESSORS(Script, source_url, Object, kSourceUrlOffset)
 ACCESSORS(Script, source_mapping_url, Object, kSourceMappingUrlOffset)

src/objects/script.h

@@ -83,7 +83,7 @@ class Script : public Struct, public NeverReadOnlySpaceObject {
 
   // [shared_function_infos]: weak fixed array containing all shared
   // function infos created from this script.
-  DECL_ACCESSORS(shared_function_infos, WeakFixedArray)
+  DECL_ACCESSORS2(shared_function_infos, WeakFixedArray)
 
   // [flags]: Holds an exciting bitfield.
   DECL_INT_ACCESSORS(flags)

src/profiler/heap-snapshot-generator.cc

@@ -995,7 +995,7 @@ void V8HeapExplorer::ExtractMapReferences(HeapEntry* entry, Map map) {
   } else if (maybe_raw_transitions_or_prototype_info->GetHeapObjectIfStrong(
                  &raw_transitions_or_prototype_info)) {
     if (raw_transitions_or_prototype_info->IsTransitionArray()) {
-      TransitionArray* transitions =
+      TransitionArray transitions =
           TransitionArray::cast(raw_transitions_or_prototype_info);
       if (map->CanTransition() && transitions->HasPrototypeTransitions()) {
         TagObject(transitions->GetPrototypeTransitions(),
@@ -1264,7 +1264,7 @@ void V8HeapExplorer::ExtractDescriptorArrayReferences(HeapEntry* entry,
 
 template <typename T>
 void V8HeapExplorer::ExtractWeakArrayReferences(int header_size,
-                                                HeapEntry* entry, T* array) {
+                                                HeapEntry* entry, T array) {
   for (int i = 0; i < array->length(); ++i) {
     MaybeObject object = array->Get(i);
     HeapObject* heap_object;

src/profiler/heap-snapshot-generator.h

@@ -381,7 +381,7 @@ class V8HeapExplorer : public HeapEntriesAllocator {
   void ExtractDescriptorArrayReferences(HeapEntry* entry,
                                         DescriptorArray* array);
   template <typename T>
-  void ExtractWeakArrayReferences(int header_size, HeapEntry* entry, T* array);
+  void ExtractWeakArrayReferences(int header_size, HeapEntry* entry, T array);
   void ExtractPropertyReferences(JSObject* js_obj, HeapEntry* entry);
   void ExtractAccessorPairProperty(HeapEntry* entry, Name key,
                                    Object* callback_obj, int field_offset = -1);

src/roots.h

@@ -206,7 +206,7 @@ class RootVisitor;
   V(PropertyCell*, empty_property_cell, EmptyPropertyCell)                     \
   V(NameDictionary, empty_property_dictionary, EmptyPropertyDictionary)        \
   V(InterceptorInfo*, noop_interceptor_info, NoOpInterceptorInfo)              \
-  V(WeakFixedArray*, empty_weak_fixed_array, EmptyWeakFixedArray)              \
+  V(WeakFixedArray, empty_weak_fixed_array, EmptyWeakFixedArray)               \
   V(WeakArrayList*, empty_weak_array_list, EmptyWeakArrayList)                 \
   /* Special numbers */                                                        \
   V(HeapNumber*, nan_value, NanValue)                                          \

src/transitions-inl.h

@@ -19,18 +19,20 @@
 namespace v8 {
 namespace internal {
 
-TransitionArray* TransitionsAccessor::transitions() {
+TransitionArray TransitionsAccessor::transitions() {
   DCHECK_EQ(kFullTransitionArray, encoding());
   return TransitionArray::cast(raw_transitions_->GetHeapObjectAssumeStrong());
 }
 
-CAST_ACCESSOR(TransitionArray)
+OBJECT_CONSTRUCTORS_IMPL(TransitionArray, WeakFixedArray)
+
+CAST_ACCESSOR2(TransitionArray)
 
 bool TransitionArray::HasPrototypeTransitions() {
   return Get(kPrototypeTransitionsIndex) != MaybeObject::FromSmi(Smi::zero());
 }
 
-WeakFixedArray* TransitionArray::GetPrototypeTransitions() {
+WeakFixedArray TransitionArray::GetPrototypeTransitions() {
   DCHECK(HasPrototypeTransitions());  // Callers must check first.
   Object* prototype_transitions =
       Get(kPrototypeTransitionsIndex)->GetHeapObjectAssumeStrong();
@@ -42,14 +44,14 @@ HeapObjectSlot TransitionArray::GetKeySlot(int transition_number) {
   return HeapObjectSlot(RawFieldOfElementAt(ToKeyIndex(transition_number)));
 }
 
-void TransitionArray::SetPrototypeTransitions(WeakFixedArray* transitions) {
+void TransitionArray::SetPrototypeTransitions(WeakFixedArray transitions) {
   DCHECK(transitions->IsWeakFixedArray());
   WeakFixedArray::Set(kPrototypeTransitionsIndex,
                       HeapObjectReference::Strong(transitions));
 }
 
 int TransitionArray::NumberOfPrototypeTransitions(
-    WeakFixedArray* proto_transitions) {
+    WeakFixedArray proto_transitions) {
   if (proto_transitions->length() == 0) return 0;
   MaybeObject raw =
       proto_transitions->Get(kProtoTransitionNumberOfEntriesOffset);

src/transitions.cc

@@ -127,7 +127,7 @@ void TransitionsAccessor::Insert(Handle<Name> name, Handle<Map> target,
 
   {
     DisallowHeapAllocation no_gc;
-    TransitionArray* array = transitions();
+    TransitionArray array = transitions();
     number_of_transitions = array->number_of_transitions();
     new_nof = number_of_transitions;
 
@@ -170,7 +170,7 @@ void TransitionsAccessor::Insert(Handle<Name> name, Handle<Map> target,
   // result copy if needed, and recompute variables.
   Reload();
   DisallowHeapAllocation no_gc;
-  TransitionArray* array = transitions();
+  TransitionArray array = transitions();
   if (array->number_of_transitions() != number_of_transitions) {
     DCHECK(array->number_of_transitions() < number_of_transitions);
 
@@ -313,7 +313,7 @@ bool TransitionsAccessor::IsMatchingMap(Map target, Name name,
 
 // static
 bool TransitionArray::CompactPrototypeTransitionArray(Isolate* isolate,
-                                                      WeakFixedArray* array) {
+                                                      WeakFixedArray array) {
   const int header = kProtoTransitionHeaderSize;
   int number_of_transitions = NumberOfPrototypeTransitions(array);
   if (number_of_transitions == 0) {
@@ -344,7 +344,6 @@ bool TransitionArray::CompactPrototypeTransitionArray(Isolate* isolate,
   return new_number_of_transitions < number_of_transitions;
 }
 
-
 // static
 Handle<WeakFixedArray> TransitionArray::GrowPrototypeTransitionArray(
     Handle<WeakFixedArray> array, int new_capacity, Isolate* isolate) {
@@ -399,7 +398,7 @@ void TransitionsAccessor::PutPrototypeTransition(Handle<Object> prototype,
 Handle<Map> TransitionsAccessor::GetPrototypeTransition(
     Handle<Object> prototype) {
   DisallowHeapAllocation no_gc;
-  WeakFixedArray* cache = GetPrototypeTransitions();
+  WeakFixedArray cache = GetPrototypeTransitions();
   int length = TransitionArray::NumberOfPrototypeTransitions(cache);
   for (int i = 0; i < length; i++) {
     MaybeObject target =
@@ -416,7 +415,7 @@ Handle<Map> TransitionsAccessor::GetPrototypeTransition(
   return Handle<Map>();
 }
 
-WeakFixedArray* TransitionsAccessor::GetPrototypeTransitions() {
+WeakFixedArray TransitionsAccessor::GetPrototypeTransitions() {
   if (encoding() != kFullTransitionArray ||
       !transitions()->HasPrototypeTransitions()) {
     return ReadOnlyRoots(isolate_).empty_weak_fixed_array();
@@ -426,7 +425,7 @@ WeakFixedArray* TransitionsAccessor::GetPrototypeTransitions() {
 
 // static
 void TransitionArray::SetNumberOfPrototypeTransitions(
-    WeakFixedArray* proto_transitions, int value) {
+    WeakFixedArray proto_transitions, int value) {
   DCHECK_NE(proto_transitions->length(), 0);
   proto_transitions->Set(kProtoTransitionNumberOfEntriesOffset,
                          MaybeObject::FromSmi(Smi::FromInt(value)));
@@ -472,7 +471,7 @@ void TransitionArray::Zap(Isolate* isolate) {
 
 void TransitionsAccessor::ReplaceTransitions(MaybeObject new_transitions) {
   if (encoding() == kFullTransitionArray) {
-    TransitionArray* old_transitions = transitions();
+    TransitionArray old_transitions = transitions();
 #if DEBUG
     CheckNewTransitionsAreConsistent(
         old_transitions, new_transitions->GetHeapObjectAssumeStrong());
@@ -531,7 +530,7 @@ void TransitionsAccessor::TraverseTransitionTreeInternal(
     }
     case kFullTransitionArray: {
       if (transitions()->HasPrototypeTransitions()) {
-        WeakFixedArray* proto_trans = transitions()->GetPrototypeTransitions();
+        WeakFixedArray proto_trans = transitions()->GetPrototypeTransitions();
         int length = TransitionArray::NumberOfPrototypeTransitions(proto_trans);
         for (int i = 0; i < length; ++i) {
           int index = TransitionArray::kProtoTransitionHeaderSize + i;
@@ -557,10 +556,10 @@ void TransitionsAccessor::TraverseTransitionTreeInternal(
 
 #ifdef DEBUG
 void TransitionsAccessor::CheckNewTransitionsAreConsistent(
-    TransitionArray* old_transitions, Object* transitions) {
+    TransitionArray old_transitions, Object* transitions) {
   // This function only handles full transition arrays.
   DCHECK_EQ(kFullTransitionArray, encoding());
-  TransitionArray* new_transitions = TransitionArray::cast(transitions);
+  TransitionArray new_transitions = TransitionArray::cast(transitions);
   for (int i = 0; i < old_transitions->number_of_transitions(); i++) {
     Map target = old_transitions->GetTarget(i);
     if (target->instance_descriptors() == map_->instance_descriptors()) {

src/transitions.h

@@ -123,7 +123,7 @@ class TransitionsAccessor {
                            DisallowHeapAllocation* no_gc);
 #endif
 #if DEBUG
-  void CheckNewTransitionsAreConsistent(TransitionArray* old_transitions,
+  void CheckNewTransitionsAreConsistent(TransitionArray old_transitions,
                                         Object* transitions);
   bool IsConsistentWithBackPointers();
   bool IsSortedNoDuplicates();
@@ -177,12 +177,12 @@ class TransitionsAccessor {
 
   void EnsureHasFullTransitionArray();
   void SetPrototypeTransitions(Handle<WeakFixedArray> proto_transitions);
-  WeakFixedArray* GetPrototypeTransitions();
+  WeakFixedArray GetPrototypeTransitions();
 
   void TraverseTransitionTreeInternal(TraverseCallback callback, void* data,
                                       DisallowHeapAllocation* no_gc);
 
-  inline TransitionArray* transitions();
+  inline TransitionArray transitions();
 
   Isolate* isolate_;
   Handle<Map> map_handle_;
@@ -210,9 +210,9 @@ class TransitionsAccessor {
 // [3 + number of transitions * kTransitionSize]: start of slack
 class TransitionArray : public WeakFixedArray {
  public:
-  DECL_CAST(TransitionArray)
+  DECL_CAST2(TransitionArray)
 
-  inline WeakFixedArray* GetPrototypeTransitions();
+  inline WeakFixedArray GetPrototypeTransitions();
   inline bool HasPrototypeTransitions();
 
   // Accessors for fetching instance transition at transition number.
@@ -282,11 +282,11 @@ class TransitionArray : public WeakFixedArray {
   static const int kProtoTransitionHeaderSize = 1;
   static const int kMaxCachedPrototypeTransitions = 256;
 
-  inline void SetPrototypeTransitions(WeakFixedArray* prototype_transitions);
+  inline void SetPrototypeTransitions(WeakFixedArray prototype_transitions);
 
   static inline int NumberOfPrototypeTransitions(
-      WeakFixedArray* proto_transitions);
+      WeakFixedArray proto_transitions);
-  static void SetNumberOfPrototypeTransitions(WeakFixedArray* proto_transitions,
+  static void SetNumberOfPrototypeTransitions(WeakFixedArray proto_transitions,
                                               int value);
 
   static const int kProtoTransitionNumberOfEntriesOffset = 0;
@@ -313,7 +313,7 @@ class TransitionArray : public WeakFixedArray {
   inline int number_of_transitions() const;
 
   static bool CompactPrototypeTransitionArray(Isolate* isolate,
-                                              WeakFixedArray* array);
+                                              WeakFixedArray array);
 
   static Handle<WeakFixedArray> GrowPrototypeTransitionArray(
       Handle<WeakFixedArray> array, int new_capacity, Isolate* isolate);
@@ -341,7 +341,7 @@ class TransitionArray : public WeakFixedArray {
 
   void Zap(Isolate* isolate);
 
-  DISALLOW_IMPLICIT_CONSTRUCTORS(TransitionArray);
+  OBJECT_CONSTRUCTORS(TransitionArray, WeakFixedArray);
 };
 
 }  // namespace internal

test/cctest/heap/test-heap.cc

@@ -3641,7 +3641,7 @@ TEST(EnsureAllocationSiteDependentCodesProcessed) {
                 .ToLocalChecked())));
 
     int dependency_group_count = 0;
-    DependentCode* dependency = site->dependent_code();
+    DependentCode dependency = site->dependent_code();
     while (dependency != ReadOnlyRoots(heap).empty_weak_fixed_array()) {
       CHECK(dependency->group() ==
                 DependentCode::kAllocationSiteTransitionChangedGroup ||

test/cctest/test-api.cc

@@ -22194,7 +22194,7 @@ THREADED_TEST(ReadOnlyIndexedProperties) {
 }
 
 static int CountLiveMapsInMapCache(i::Context context) {
-  i::WeakFixedArray* map_cache = i::WeakFixedArray::cast(context->map_cache());
+  i::WeakFixedArray map_cache = i::WeakFixedArray::cast(context->map_cache());
   int length = map_cache->length();
   int count = 0;
   for (int i = 0; i < length; i++) {

test/cctest/test-serialize.cc

@@ -3616,7 +3616,7 @@ TEST(SerializationStats) {
   }
 }
 
-void CheckSFIsAreWeak(WeakFixedArray* sfis, Isolate* isolate) {
+void CheckSFIsAreWeak(WeakFixedArray sfis, Isolate* isolate) {
   CHECK_GT(sfis->length(), 0);
   int no_of_weak = 0;
   for (int i = 0; i < sfis->length(); ++i) {
@@ -3675,7 +3675,7 @@ TEST(WeakArraySerializizationInSnapshot) {
         Handle<JSFunction>::cast(v8::Utils::OpenHandle(*x));
 
     // Verify that the pointers in shared_function_infos are weak.
-    WeakFixedArray* sfis =
+    WeakFixedArray sfis =
         Script::cast(function->shared()->script())->shared_function_infos();
     CheckSFIsAreWeak(sfis, CcTest::i_isolate());
   }
@@ -3705,7 +3705,7 @@ TEST(WeakArraySerializationInCodeCache) {
       isolate, src, src, cache, v8::ScriptCompiler::kConsumeCodeCache);
 
   // Verify that the pointers in shared_function_infos are weak.
-  WeakFixedArray* sfis = Script::cast(copy->script())->shared_function_infos();
+  WeakFixedArray sfis = Script::cast(copy->script())->shared_function_infos();
   CheckSFIsAreWeak(sfis, isolate);
 
   delete cache;