Fix clearing of dead dependent codes and verify weak embedded maps on full GC.

src/objects.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 9190 matching lines @@
 #endif
   }
 
   PrintF("RelocInfo (size = %d)\n", relocation_size());
   for (RelocIterator it(this); !it.done(); it.next()) it.rinfo()->Print(out);
   PrintF(out, "\n");
 }
 #endif  // ENABLE_DISASSEMBLER
 
 
+#ifdef VERIFY_HEAP
+void Code::VerifyEmbeddedMaps() {

[Michael Starzinger, 2013/01/31 14:27:50]

This whole implementation belongs into objects-debug.cc I guess.

[ulan, 2013/02/04 09:54:06]

Done.

+  int mode_mask = RelocInfo::ModeMask(RelocInfo::EMBEDDED_OBJECT);
+  for (RelocIterator it(this, mode_mask); !it.done(); it.next()) {
+    RelocInfo::Mode mode = it.rinfo()->rmode();
+    if (mode == RelocInfo::EMBEDDED_OBJECT &&
+        it.rinfo()->target_object()->IsMap()) {
+        Map* map = Map::cast(it.rinfo()->target_object());

[Michael Starzinger, 2013/01/31 14:27:50]

Indentation is off.

[ulan, 2013/02/04 09:54:06]

Done.

+        if (map->CanTransition()) {
+          CHECK(map->dependent_codes()->Contains(this));
+        }
+    }
+  }
+}
+#endif
+
+
 MaybeObject* JSObject::SetFastElementsCapacityAndLength(
     int capacity,
     int length,
     SetFastElementsCapacitySmiMode smi_mode) {
   Heap* heap = GetHeap();
   // We should never end in here with a pixel or external array.
   ASSERT(!HasExternalArrayElements());
   ASSERT(!map()->is_observed());
 
   // Allocate a new fast elements backing store.
@@ skipping 280 matching lines @@
       codes->clear_code_at(i);
     }
     codes = new_codes;
   }
   codes->set_code_at(append_index, *value);
   codes->set_number_of_codes(append_index + 1);
   return codes;
 }
 
 
+bool DependentCodes::Contains(Code* code) {
+  int limit = number_of_codes();
+  for (int i = 0; i < limit; i++) {
+    if (code_at(i) == code) return true;
+  }
+  return false;
+}
+
+
 MaybeObject* JSReceiver::SetPrototype(Object* value,
                                       bool skip_hidden_prototypes) {
 #ifdef DEBUG
   int size = Size();
 #endif
 
   Heap* heap = GetHeap();
   // Silently ignore the change if value is not a JSObject or null.
   // SpiderMonkey behaves this way.
   if (!value->IsJSReceiver() && !value->IsNull()) return value;
@@ skipping 4334 matching lines @@
   set_year(Smi::FromInt(year), SKIP_WRITE_BARRIER);
   set_month(Smi::FromInt(month), SKIP_WRITE_BARRIER);
   set_day(Smi::FromInt(day), SKIP_WRITE_BARRIER);
   set_weekday(Smi::FromInt(weekday), SKIP_WRITE_BARRIER);
   set_hour(Smi::FromInt(hour), SKIP_WRITE_BARRIER);
   set_min(Smi::FromInt(min), SKIP_WRITE_BARRIER);
   set_sec(Smi::FromInt(sec), SKIP_WRITE_BARRIER);
 }
 
 } }  // namespace v8::internal