[roots, heap] Move invalid_prototype_validity_cell into RO space

This validity cell is already invalidated from its creation, which
means this object is actually immutable. Move it into RO space to make
use of this property.

There was one store to that object which simply overwrote that
invalid marker with the same value. This CL changes this into a
conditional store.

Bug: v8:13267
Change-Id: I12ab5a41bd9fc0a62523a4ac35607c4b38b2acee
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4055895
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84461}
This commit is contained in:
Dominik Inführ 2022-11-24 14:31:02 +01:00 committed by V8 LUCI CQ
parent 32fd715ec3
commit 8aa7720c83
6 changed files with 138 additions and 133 deletions

View File

@ -2049,7 +2049,7 @@ Map Factory::InitializeMap(Map map, InstanceType type, int instance_size,
map.SetInObjectPropertiesStartInWords(instance_size / kTaggedSize -
inobject_properties);
DCHECK_EQ(map.GetInObjectProperties(), inobject_properties);
map.set_prototype_validity_cell(roots->invalid_prototype_validity_cell(),
map.set_prototype_validity_cell(ro_roots.invalid_prototype_validity_cell(),
kRelaxedStore);
} else {
DCHECK_EQ(inobject_properties, 0);

View File

@ -445,7 +445,8 @@ bool Heap::CreateInitialMaps() {
{
// The invalid_prototype_validity_cell is needed for JSObject maps.
Smi value = Smi::FromInt(Map::kPrototypeChainInvalid);
AllocationResult alloc = AllocateRaw(Cell::kSize, AllocationType::kOld);
AllocationResult alloc =
AllocateRaw(Cell::kSize, AllocationType::kReadOnly);
if (!alloc.To(&obj)) return false;
obj.set_map_after_allocation(roots.cell_map(), SKIP_WRITE_BARRIER);
Cell::cast(obj).set_value(value);

View File

@ -4998,7 +4998,10 @@ void InvalidateOnePrototypeValidityCellInternal(Map map) {
if (maybe_cell.IsCell()) {
// Just set the value; the cell will be replaced lazily.
Cell cell = Cell::cast(maybe_cell);
cell.set_value(Smi::FromInt(Map::kPrototypeChainInvalid));
Smi invalid_value = Smi::FromInt(Map::kPrototypeChainInvalid);
if (cell.value() != invalid_value) {
cell.set_value(invalid_value);
}
}
Object maybe_prototype_info = map.prototype_info();
if (maybe_prototype_info.IsPrototypeInfo()) {

View File

@ -10,6 +10,7 @@
#include "src/handles/handles.h"
#include "src/heap/read-only-heap.h"
#include "src/objects/api-callbacks.h"
#include "src/objects/cell.h"
#include "src/objects/descriptor-array.h"
#include "src/objects/feedback-vector.h"
#include "src/objects/heap-number.h"

View File

@ -198,6 +198,7 @@ class Symbol;
V(ArrayList, empty_array_list, EmptyArrayList) \
V(WeakFixedArray, empty_weak_fixed_array, EmptyWeakFixedArray) \
V(WeakArrayList, empty_weak_array_list, EmptyWeakArrayList) \
V(Cell, invalid_prototype_validity_cell, InvalidPrototypeValidityCell) \
/* Special numbers */ \
V(HeapNumber, nan_value, NanValue) \
V(HeapNumber, hole_nan_value, HoleNanValue) \
@ -234,7 +235,6 @@ class Symbol;
/* Canonical empty values */ \
V(Script, empty_script, EmptyScript) \
V(FeedbackCell, many_closures_cell, ManyClosuresCell) \
V(Cell, invalid_prototype_validity_cell, InvalidPrototypeValidityCell) \
/* Protectors */ \
V(PropertyCell, array_constructor_protector, ArrayConstructorProtector) \
V(PropertyCell, no_elements_protector, NoElementsProtector) \

View File

@ -394,77 +394,77 @@ KNOWN_MAPS = {
("read_only_space", 0x03499): (131, "BasicBlockCountersMarkerMap"),
("read_only_space", 0x034dd): (146, "ArrayBoilerplateDescriptionMap"),
("read_only_space", 0x035dd): (158, "InterceptorInfoMap"),
("read_only_space", 0x075e9): (132, "PromiseFulfillReactionJobTaskMap"),
("read_only_space", 0x07611): (133, "PromiseRejectReactionJobTaskMap"),
("read_only_space", 0x07639): (134, "CallableTaskMap"),
("read_only_space", 0x07661): (135, "CallbackTaskMap"),
("read_only_space", 0x07689): (136, "PromiseResolveThenableJobTaskMap"),
("read_only_space", 0x076b1): (139, "FunctionTemplateInfoMap"),
("read_only_space", 0x076d9): (140, "ObjectTemplateInfoMap"),
("read_only_space", 0x07701): (141, "AccessCheckInfoMap"),
("read_only_space", 0x07729): (142, "AccessorPairMap"),
("read_only_space", 0x07751): (143, "AliasedArgumentsEntryMap"),
("read_only_space", 0x07779): (144, "AllocationMementoMap"),
("read_only_space", 0x077a1): (147, "AsmWasmDataMap"),
("read_only_space", 0x077c9): (148, "AsyncGeneratorRequestMap"),
("read_only_space", 0x077f1): (149, "BreakPointMap"),
("read_only_space", 0x07819): (150, "BreakPointInfoMap"),
("read_only_space", 0x07841): (151, "CallSiteInfoMap"),
("read_only_space", 0x07869): (152, "ClassPositionsMap"),
("read_only_space", 0x07891): (153, "DebugInfoMap"),
("read_only_space", 0x078b9): (155, "ErrorStackDataMap"),
("read_only_space", 0x078e1): (157, "FunctionTemplateRareDataMap"),
("read_only_space", 0x07909): (159, "InterpreterDataMap"),
("read_only_space", 0x07931): (160, "ModuleRequestMap"),
("read_only_space", 0x07959): (161, "PromiseCapabilityMap"),
("read_only_space", 0x07981): (162, "PromiseOnStackMap"),
("read_only_space", 0x079a9): (163, "PromiseReactionMap"),
("read_only_space", 0x079d1): (164, "PropertyDescriptorObjectMap"),
("read_only_space", 0x079f9): (165, "PrototypeInfoMap"),
("read_only_space", 0x07a21): (166, "RegExpBoilerplateDescriptionMap"),
("read_only_space", 0x07a49): (167, "ScriptMap"),
("read_only_space", 0x07a71): (168, "ScriptOrModuleMap"),
("read_only_space", 0x07a99): (169, "SourceTextModuleInfoEntryMap"),
("read_only_space", 0x07ac1): (170, "StackFrameInfoMap"),
("read_only_space", 0x07ae9): (171, "TemplateObjectDescriptionMap"),
("read_only_space", 0x07b11): (172, "Tuple2Map"),
("read_only_space", 0x07b39): (173, "WasmExceptionTagMap"),
("read_only_space", 0x07b61): (174, "WasmIndirectFunctionTableMap"),
("read_only_space", 0x07b89): (194, "SloppyArgumentsElementsMap"),
("read_only_space", 0x07bb1): (227, "DescriptorArrayMap"),
("read_only_space", 0x07bd9): (202, "UncompiledDataWithoutPreparseDataMap"),
("read_only_space", 0x07c01): (200, "UncompiledDataWithPreparseDataMap"),
("read_only_space", 0x07c29): (203, "UncompiledDataWithoutPreparseDataWithJobMap"),
("read_only_space", 0x07c51): (201, "UncompiledDataWithPreparseDataAndJobMap"),
("read_only_space", 0x07c79): (248, "OnHeapBasicBlockProfilerDataMap"),
("read_only_space", 0x07ca1): (195, "TurbofanBitsetTypeMap"),
("read_only_space", 0x07cc9): (199, "TurbofanUnionTypeMap"),
("read_only_space", 0x07cf1): (198, "TurbofanRangeTypeMap"),
("read_only_space", 0x07d19): (196, "TurbofanHeapConstantTypeMap"),
("read_only_space", 0x07d41): (197, "TurbofanOtherNumberConstantTypeMap"),
("read_only_space", 0x07d69): (244, "InternalClassMap"),
("read_only_space", 0x07d91): (255, "SmiPairMap"),
("read_only_space", 0x07db9): (254, "SmiBoxMap"),
("read_only_space", 0x07de1): (219, "ExportedSubClassBaseMap"),
("read_only_space", 0x07e09): (220, "ExportedSubClassMap"),
("read_only_space", 0x07e31): (225, "AbstractInternalClassSubclass1Map"),
("read_only_space", 0x07e59): (226, "AbstractInternalClassSubclass2Map"),
("read_only_space", 0x07e81): (193, "InternalClassWithSmiElementsMap"),
("read_only_space", 0x07ea9): (245, "InternalClassWithStructElementsMap"),
("read_only_space", 0x07ed1): (221, "ExportedSubClass2Map"),
("read_only_space", 0x07ef9): (256, "SortStateMap"),
("read_only_space", 0x07f21): (262, "WasmStringViewIterMap"),
("read_only_space", 0x07f49): (145, "AllocationSiteWithWeakNextMap"),
("read_only_space", 0x07f71): (145, "AllocationSiteWithoutWeakNextMap"),
("read_only_space", 0x0803d): (137, "LoadHandler1Map"),
("read_only_space", 0x08065): (137, "LoadHandler2Map"),
("read_only_space", 0x0808d): (137, "LoadHandler3Map"),
("read_only_space", 0x080b5): (138, "StoreHandler0Map"),
("read_only_space", 0x080dd): (138, "StoreHandler1Map"),
("read_only_space", 0x08105): (138, "StoreHandler2Map"),
("read_only_space", 0x0812d): (138, "StoreHandler3Map"),
("read_only_space", 0x075f1): (132, "PromiseFulfillReactionJobTaskMap"),
("read_only_space", 0x07619): (133, "PromiseRejectReactionJobTaskMap"),
("read_only_space", 0x07641): (134, "CallableTaskMap"),
("read_only_space", 0x07669): (135, "CallbackTaskMap"),
("read_only_space", 0x07691): (136, "PromiseResolveThenableJobTaskMap"),
("read_only_space", 0x076b9): (139, "FunctionTemplateInfoMap"),
("read_only_space", 0x076e1): (140, "ObjectTemplateInfoMap"),
("read_only_space", 0x07709): (141, "AccessCheckInfoMap"),
("read_only_space", 0x07731): (142, "AccessorPairMap"),
("read_only_space", 0x07759): (143, "AliasedArgumentsEntryMap"),
("read_only_space", 0x07781): (144, "AllocationMementoMap"),
("read_only_space", 0x077a9): (147, "AsmWasmDataMap"),
("read_only_space", 0x077d1): (148, "AsyncGeneratorRequestMap"),
("read_only_space", 0x077f9): (149, "BreakPointMap"),
("read_only_space", 0x07821): (150, "BreakPointInfoMap"),
("read_only_space", 0x07849): (151, "CallSiteInfoMap"),
("read_only_space", 0x07871): (152, "ClassPositionsMap"),
("read_only_space", 0x07899): (153, "DebugInfoMap"),
("read_only_space", 0x078c1): (155, "ErrorStackDataMap"),
("read_only_space", 0x078e9): (157, "FunctionTemplateRareDataMap"),
("read_only_space", 0x07911): (159, "InterpreterDataMap"),
("read_only_space", 0x07939): (160, "ModuleRequestMap"),
("read_only_space", 0x07961): (161, "PromiseCapabilityMap"),
("read_only_space", 0x07989): (162, "PromiseOnStackMap"),
("read_only_space", 0x079b1): (163, "PromiseReactionMap"),
("read_only_space", 0x079d9): (164, "PropertyDescriptorObjectMap"),
("read_only_space", 0x07a01): (165, "PrototypeInfoMap"),
("read_only_space", 0x07a29): (166, "RegExpBoilerplateDescriptionMap"),
("read_only_space", 0x07a51): (167, "ScriptMap"),
("read_only_space", 0x07a79): (168, "ScriptOrModuleMap"),
("read_only_space", 0x07aa1): (169, "SourceTextModuleInfoEntryMap"),
("read_only_space", 0x07ac9): (170, "StackFrameInfoMap"),
("read_only_space", 0x07af1): (171, "TemplateObjectDescriptionMap"),
("read_only_space", 0x07b19): (172, "Tuple2Map"),
("read_only_space", 0x07b41): (173, "WasmExceptionTagMap"),
("read_only_space", 0x07b69): (174, "WasmIndirectFunctionTableMap"),
("read_only_space", 0x07b91): (194, "SloppyArgumentsElementsMap"),
("read_only_space", 0x07bb9): (227, "DescriptorArrayMap"),
("read_only_space", 0x07be1): (202, "UncompiledDataWithoutPreparseDataMap"),
("read_only_space", 0x07c09): (200, "UncompiledDataWithPreparseDataMap"),
("read_only_space", 0x07c31): (203, "UncompiledDataWithoutPreparseDataWithJobMap"),
("read_only_space", 0x07c59): (201, "UncompiledDataWithPreparseDataAndJobMap"),
("read_only_space", 0x07c81): (248, "OnHeapBasicBlockProfilerDataMap"),
("read_only_space", 0x07ca9): (195, "TurbofanBitsetTypeMap"),
("read_only_space", 0x07cd1): (199, "TurbofanUnionTypeMap"),
("read_only_space", 0x07cf9): (198, "TurbofanRangeTypeMap"),
("read_only_space", 0x07d21): (196, "TurbofanHeapConstantTypeMap"),
("read_only_space", 0x07d49): (197, "TurbofanOtherNumberConstantTypeMap"),
("read_only_space", 0x07d71): (244, "InternalClassMap"),
("read_only_space", 0x07d99): (255, "SmiPairMap"),
("read_only_space", 0x07dc1): (254, "SmiBoxMap"),
("read_only_space", 0x07de9): (219, "ExportedSubClassBaseMap"),
("read_only_space", 0x07e11): (220, "ExportedSubClassMap"),
("read_only_space", 0x07e39): (225, "AbstractInternalClassSubclass1Map"),
("read_only_space", 0x07e61): (226, "AbstractInternalClassSubclass2Map"),
("read_only_space", 0x07e89): (193, "InternalClassWithSmiElementsMap"),
("read_only_space", 0x07eb1): (245, "InternalClassWithStructElementsMap"),
("read_only_space", 0x07ed9): (221, "ExportedSubClass2Map"),
("read_only_space", 0x07f01): (256, "SortStateMap"),
("read_only_space", 0x07f29): (262, "WasmStringViewIterMap"),
("read_only_space", 0x07f51): (145, "AllocationSiteWithWeakNextMap"),
("read_only_space", 0x07f79): (145, "AllocationSiteWithoutWeakNextMap"),
("read_only_space", 0x08045): (137, "LoadHandler1Map"),
("read_only_space", 0x0806d): (137, "LoadHandler2Map"),
("read_only_space", 0x08095): (137, "LoadHandler3Map"),
("read_only_space", 0x080bd): (138, "StoreHandler0Map"),
("read_only_space", 0x080e5): (138, "StoreHandler1Map"),
("read_only_space", 0x0810d): (138, "StoreHandler2Map"),
("read_only_space", 0x08135): (138, "StoreHandler3Map"),
("old_space", 0x0438d): (2116, "ExternalMap"),
("old_space", 0x043bd): (2120, "JSMessageObjectMap"),
("old_space", 0x043b5): (2120, "JSMessageObjectMap"),
}
# List of known V8 objects.
@ -503,17 +503,18 @@ KNOWN_OBJECTS = {
("read_only_space", 0x03605): "NoOpInterceptorInfo",
("read_only_space", 0x0362d): "EmptyArrayList",
("read_only_space", 0x03639): "EmptyWeakFixedArray",
("read_only_space", 0x03641): "InfinityValue",
("read_only_space", 0x0364d): "MinusZeroValue",
("read_only_space", 0x03659): "MinusInfinityValue",
("read_only_space", 0x03665): "SingleCharacterStringTable",
("read_only_space", 0x04a6d): "SelfReferenceMarker",
("read_only_space", 0x04aad): "BasicBlockCountersMarker",
("read_only_space", 0x04af1): "OffHeapTrampolineRelocationInfo",
("read_only_space", 0x04afd): "GlobalThisBindingScopeInfo",
("read_only_space", 0x04b2d): "EmptyFunctionScopeInfo",
("read_only_space", 0x04b51): "NativeScopeInfo",
("read_only_space", 0x04b69): "HashSeed",
("read_only_space", 0x03641): "InvalidPrototypeValidityCell",
("read_only_space", 0x03649): "InfinityValue",
("read_only_space", 0x03655): "MinusZeroValue",
("read_only_space", 0x03661): "MinusInfinityValue",
("read_only_space", 0x0366d): "SingleCharacterStringTable",
("read_only_space", 0x04a75): "SelfReferenceMarker",
("read_only_space", 0x04ab5): "BasicBlockCountersMarker",
("read_only_space", 0x04af9): "OffHeapTrampolineRelocationInfo",
("read_only_space", 0x04b05): "GlobalThisBindingScopeInfo",
("read_only_space", 0x04b35): "EmptyFunctionScopeInfo",
("read_only_space", 0x04b59): "NativeScopeInfo",
("read_only_space", 0x04b71): "HashSeed",
("old_space", 0x0423d): "ArgumentsIteratorAccessor",
("old_space", 0x04255): "ArrayLengthAccessor",
("old_space", 0x0426d): "BoundFunctionLengthAccessor",
@ -529,54 +530,53 @@ KNOWN_OBJECTS = {
("old_space", 0x0435d): "WrappedFunctionLengthAccessor",
("old_space", 0x04375): "WrappedFunctionNameAccessor",
("old_space", 0x0438d): "ExternalMap",
("old_space", 0x043b5): "InvalidPrototypeValidityCell",
("old_space", 0x043bd): "JSMessageObjectMap",
("old_space", 0x043e5): "EmptyScript",
("old_space", 0x04429): "ManyClosuresCell",
("old_space", 0x04435): "ArrayConstructorProtector",
("old_space", 0x04449): "NoElementsProtector",
("old_space", 0x0445d): "MegaDOMProtector",
("old_space", 0x04471): "IsConcatSpreadableProtector",
("old_space", 0x04485): "ArraySpeciesProtector",
("old_space", 0x04499): "TypedArraySpeciesProtector",
("old_space", 0x044ad): "PromiseSpeciesProtector",
("old_space", 0x044c1): "RegExpSpeciesProtector",
("old_space", 0x044d5): "StringLengthProtector",
("old_space", 0x044e9): "ArrayIteratorProtector",
("old_space", 0x044fd): "ArrayBufferDetachingProtector",
("old_space", 0x04511): "PromiseHookProtector",
("old_space", 0x04525): "PromiseResolveProtector",
("old_space", 0x04539): "MapIteratorProtector",
("old_space", 0x0454d): "PromiseThenProtector",
("old_space", 0x04561): "SetIteratorProtector",
("old_space", 0x04575): "StringIteratorProtector",
("old_space", 0x04589): "StringSplitCache",
("old_space", 0x04991): "RegExpMultipleCache",
("old_space", 0x04d99): "BuiltinsConstantsTable",
("old_space", 0x051fd): "AsyncFunctionAwaitRejectSharedFun",
("old_space", 0x05221): "AsyncFunctionAwaitResolveSharedFun",
("old_space", 0x05245): "AsyncGeneratorAwaitRejectSharedFun",
("old_space", 0x05269): "AsyncGeneratorAwaitResolveSharedFun",
("old_space", 0x0528d): "AsyncGeneratorYieldWithAwaitResolveSharedFun",
("old_space", 0x052b1): "AsyncGeneratorReturnResolveSharedFun",
("old_space", 0x052d5): "AsyncGeneratorReturnClosedRejectSharedFun",
("old_space", 0x052f9): "AsyncGeneratorReturnClosedResolveSharedFun",
("old_space", 0x0531d): "AsyncIteratorValueUnwrapSharedFun",
("old_space", 0x05341): "PromiseAllResolveElementSharedFun",
("old_space", 0x05365): "PromiseAllSettledResolveElementSharedFun",
("old_space", 0x05389): "PromiseAllSettledRejectElementSharedFun",
("old_space", 0x053ad): "PromiseAnyRejectElementSharedFun",
("old_space", 0x053d1): "PromiseCapabilityDefaultRejectSharedFun",
("old_space", 0x053f5): "PromiseCapabilityDefaultResolveSharedFun",
("old_space", 0x05419): "PromiseCatchFinallySharedFun",
("old_space", 0x0543d): "PromiseGetCapabilitiesExecutorSharedFun",
("old_space", 0x05461): "PromiseThenFinallySharedFun",
("old_space", 0x05485): "PromiseThrowerFinallySharedFun",
("old_space", 0x054a9): "PromiseValueThunkFinallySharedFun",
("old_space", 0x054cd): "ProxyRevokeSharedFun",
("old_space", 0x054f1): "ShadowRealmImportValueFulfilledSFI",
("old_space", 0x05515): "SourceTextModuleExecuteAsyncModuleFulfilledSFI",
("old_space", 0x05539): "SourceTextModuleExecuteAsyncModuleRejectedSFI",
("old_space", 0x043b5): "JSMessageObjectMap",
("old_space", 0x043dd): "EmptyScript",
("old_space", 0x04421): "ManyClosuresCell",
("old_space", 0x0442d): "ArrayConstructorProtector",
("old_space", 0x04441): "NoElementsProtector",
("old_space", 0x04455): "MegaDOMProtector",
("old_space", 0x04469): "IsConcatSpreadableProtector",
("old_space", 0x0447d): "ArraySpeciesProtector",
("old_space", 0x04491): "TypedArraySpeciesProtector",
("old_space", 0x044a5): "PromiseSpeciesProtector",
("old_space", 0x044b9): "RegExpSpeciesProtector",
("old_space", 0x044cd): "StringLengthProtector",
("old_space", 0x044e1): "ArrayIteratorProtector",
("old_space", 0x044f5): "ArrayBufferDetachingProtector",
("old_space", 0x04509): "PromiseHookProtector",
("old_space", 0x0451d): "PromiseResolveProtector",
("old_space", 0x04531): "MapIteratorProtector",
("old_space", 0x04545): "PromiseThenProtector",
("old_space", 0x04559): "SetIteratorProtector",
("old_space", 0x0456d): "StringIteratorProtector",
("old_space", 0x04581): "StringSplitCache",
("old_space", 0x04989): "RegExpMultipleCache",
("old_space", 0x04d91): "BuiltinsConstantsTable",
("old_space", 0x051f5): "AsyncFunctionAwaitRejectSharedFun",
("old_space", 0x05219): "AsyncFunctionAwaitResolveSharedFun",
("old_space", 0x0523d): "AsyncGeneratorAwaitRejectSharedFun",
("old_space", 0x05261): "AsyncGeneratorAwaitResolveSharedFun",
("old_space", 0x05285): "AsyncGeneratorYieldWithAwaitResolveSharedFun",
("old_space", 0x052a9): "AsyncGeneratorReturnResolveSharedFun",
("old_space", 0x052cd): "AsyncGeneratorReturnClosedRejectSharedFun",
("old_space", 0x052f1): "AsyncGeneratorReturnClosedResolveSharedFun",
("old_space", 0x05315): "AsyncIteratorValueUnwrapSharedFun",
("old_space", 0x05339): "PromiseAllResolveElementSharedFun",
("old_space", 0x0535d): "PromiseAllSettledResolveElementSharedFun",
("old_space", 0x05381): "PromiseAllSettledRejectElementSharedFun",
("old_space", 0x053a5): "PromiseAnyRejectElementSharedFun",
("old_space", 0x053c9): "PromiseCapabilityDefaultRejectSharedFun",
("old_space", 0x053ed): "PromiseCapabilityDefaultResolveSharedFun",
("old_space", 0x05411): "PromiseCatchFinallySharedFun",
("old_space", 0x05435): "PromiseGetCapabilitiesExecutorSharedFun",
("old_space", 0x05459): "PromiseThenFinallySharedFun",
("old_space", 0x0547d): "PromiseThrowerFinallySharedFun",
("old_space", 0x054a1): "PromiseValueThunkFinallySharedFun",
("old_space", 0x054c5): "ProxyRevokeSharedFun",
("old_space", 0x054e9): "ShadowRealmImportValueFulfilledSFI",
("old_space", 0x0550d): "SourceTextModuleExecuteAsyncModuleFulfilledSFI",
("old_space", 0x05531): "SourceTextModuleExecuteAsyncModuleRejectedSFI",
}
# Lower 32 bits of first page addresses for various heap spaces.