From c34042cc6441d7d3d600d3c1c6f7459c8ae7ad63 Mon Sep 17 00:00:00 2001
From: Alexei Filippov <alph@chromium.org>
Date: Thu, 26 Oct 2017 12:07:52 -0700
Subject: [PATCH] [heap-profiler] Do not treat WeakMap values as weak.

For the WeakHashTable objects only mark keys as weak while leaving values as strong references.

BUG=chomium:773722

Change-Id: Iabd5ba293d05fe68a2af6503fcdd711ecc182482
Reviewed-on: https://chromium-review.googlesource.com/730771
Commit-Queue: Alexei Filippov <alph@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48985}
---
 src/objects/hash-table.h                | 10 ++++------
 src/profiler/heap-snapshot-generator.cc | 17 +++++++++++++----
 test/cctest/test-heap-profiler.cc       |  2 +-
 3 files changed, 18 insertions(+), 11 deletions(-)

diff --git a/src/objects/hash-table.h b/src/objects/hash-table.h
index e95e915681..9f57851dbb 100644
--- a/src/objects/hash-table.h
+++ b/src/objects/hash-table.h
@@ -597,17 +597,15 @@ class WeakHashTable : public HashTable<WeakHashTable, WeakHashTableShape<2>> {
                                                    Handle<HeapObject> key,
                                                    Handle<HeapObject> value);
 
-  static Handle<FixedArray> GetValues(Handle<WeakHashTable> table);
+  // Returns the index to the value of an entry.
+  static inline int EntryToValueIndex(int entry) {
+    return EntryToIndex(entry) + 1;
+  }
 
  private:
   friend class MarkCompactCollector;
 
   void AddEntry(int entry, Handle<WeakCell> key, Handle<HeapObject> value);
-
-  // Returns the index to the value of an entry.
-  static inline int EntryToValueIndex(int entry) {
-    return EntryToIndex(entry) + 1;
-  }
 };
 
 // This is similar to the OrderedHashTable, except for the memory
diff --git a/src/profiler/heap-snapshot-generator.cc b/src/profiler/heap-snapshot-generator.cc
index 7316f2d71c..8cf8c892ea 100644
--- a/src/profiler/heap-snapshot-generator.cc
+++ b/src/profiler/heap-snapshot-generator.cc
@@ -1345,12 +1345,21 @@ void V8HeapExplorer::ExtractFixedArrayReferences(int entry, FixedArray* array) {
     return;
   }
   switch (it->second) {
-    case JS_WEAK_COLLECTION_SUB_TYPE:
-      for (int i = 0, l = array->length(); i < l; ++i) {
-        SetWeakReference(array, entry, i, array->get(i),
-                         array->OffsetOfElementAt(i));
+    case JS_WEAK_COLLECTION_SUB_TYPE: {
+      WeakHashTable* table = WeakHashTable::cast(array);
+      for (int i = 0, capacity = table->Capacity(); i < capacity; ++i) {
+        int key_index =
+            WeakHashTable::EntryToIndex(i) + WeakHashTable::kEntryKeyIndex;
+        int value_index = WeakHashTable::EntryToValueIndex(i);
+        SetWeakReference(table, entry, key_index, table->get(key_index),
+                         table->OffsetOfElementAt(key_index));
+        SetInternalReference(table, entry, value_index, table->get(value_index),
+                             table->OffsetOfElementAt(value_index));
+        // TODO(alph): Add a strong link (shortcut?) from key to value per
+        //             WeakMap the key was added to. See crbug.com/778739
       }
       break;
+    }
 
     // TODO(alph): Add special processing for other types of FixedArrays.
 
diff --git a/test/cctest/test-heap-profiler.cc b/test/cctest/test-heap-profiler.cc
index 6f307644cf..1552daf376 100644
--- a/test/cctest/test-heap-profiler.cc
+++ b/test/cctest/test-heap-profiler.cc
@@ -558,7 +558,7 @@ TEST(HeapSnapshotWeakCollection) {
       ++weak_entries;
     }
   }
-  CHECK_EQ(2, weak_entries);
+  CHECK_EQ(1, weak_entries);  // Key is the only weak.
   const v8::HeapGraphNode* wm_s =
       GetProperty(env->GetIsolate(), wm, v8::HeapGraphEdge::kProperty, "str");
   CHECK(wm_s);