BASELINE: Update Chromium to 85.0.4183.14085-based

Change-Id: Iaa42f4680837c57725b1344f108c0196741f6057
Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>

1 files changed, 34 insertions, 49 deletions

diff --git a/chromium/v8/src/objects/transitions.cc b/chromium/v8/src/objects/transitions.cc
index e0ba40ce7d0..1309ca82be5 100644
--- a/chromium/v8/src/objects/transitions.cc
+++ b/chromium/v8/src/objects/transitions.cc
@@ -36,6 +36,7 @@ bool TransitionsAccessor::HasSimpleTransitionTo(Map map) {
 void TransitionsAccessor::Insert(Handle<Name> name, Handle<Map> target,
                                  SimpleTransitionFlag flag) {
   DCHECK(!map_handle_.is_null());
+  DCHECK_NE(kPrototypeInfo, encoding());
   target->SetBackPointer(map_);
 
   // If the map doesn't have any transitions at all yet, install the new one.
@@ -49,23 +50,25 @@ void TransitionsAccessor::Insert(Handle<Name> name, Handle<Map> target,
         isolate_->factory()->NewTransitionArray(0, 1);
     ReplaceTransitions(MaybeObject::FromObject(*result));
     Reload();
+    DCHECK_EQ(kFullTransitionArray, encoding());
   }
 
-  bool is_special_transition = flag == SPECIAL_TRANSITION;
   // If the map has a simple transition, check if it should be overwritten.
   Map simple_transition = GetSimpleTransition();
   if (!simple_transition.is_null()) {
-    Name key = GetSimpleTransitionKey(simple_transition);
-    PropertyDetails old_details = GetSimpleTargetDetails(simple_transition);
-    PropertyDetails new_details = is_special_transition
-                                      ? PropertyDetails::Empty()
-                                      : GetTargetDetails(*name, *target);
-    if (flag == SIMPLE_PROPERTY_TRANSITION && key.Equals(*name) &&
-        old_details.kind() == new_details.kind() &&
-        old_details.attributes() == new_details.attributes()) {
-      ReplaceTransitions(HeapObjectReference::Weak(*target));
-      return;
+    DCHECK_EQ(kWeakRef, encoding());
+
+    if (flag == SIMPLE_PROPERTY_TRANSITION) {
+      Name key = GetSimpleTransitionKey(simple_transition);
+      PropertyDetails old_details = GetSimpleTargetDetails(simple_transition);
+      PropertyDetails new_details = GetTargetDetails(*name, *target);
+      if (key.Equals(*name) && old_details.kind() == new_details.kind() &&
+          old_details.attributes() == new_details.attributes()) {
+        ReplaceTransitions(HeapObjectReference::Weak(*target));
+        return;
+      }
     }
+
     // Otherwise allocate a full TransitionArray with slack for a new entry.
     Handle<Map> map(simple_transition, isolate_);
     Handle<TransitionArray> result =
@@ -75,12 +78,9 @@ void TransitionsAccessor::Insert(Handle<Name> name, Handle<Map> target,
     simple_transition = GetSimpleTransition();
     if (!simple_transition.is_null()) {
       DCHECK_EQ(*map, simple_transition);
-      if (encoding_ == kWeakRef) {
-        result->Set(0, GetSimpleTransitionKey(simple_transition),
-                    HeapObjectReference::Weak(simple_transition));
-      } else {
-        UNREACHABLE();
-      }
+      DCHECK_EQ(kWeakRef, encoding());
+      result->Set(0, GetSimpleTransitionKey(simple_transition),
+                  HeapObjectReference::Weak(simple_transition));
     } else {
       result->SetNumberOfTransitions(0);
     }
@@ -94,6 +94,7 @@ void TransitionsAccessor::Insert(Handle<Name> name, Handle<Map> target,
   int number_of_transitions = 0;
   int new_nof = 0;
   int insertion_index = kNotFound;
+  const bool is_special_transition = flag == SPECIAL_TRANSITION;
   DCHECK_EQ(is_special_transition,
             IsSpecialTransition(ReadOnlyRoots(isolate_), *name));
   PropertyDetails details = is_special_transition
@@ -104,7 +105,6 @@ void TransitionsAccessor::Insert(Handle<Name> name, Handle<Map> target,
     DisallowHeapAllocation no_gc;
     TransitionArray array = transitions();
     number_of_transitions = array.number_of_transitions();
-    new_nof = number_of_transitions;
 
     int index = is_special_transition
                     ? array.SearchSpecial(Symbol::cast(*name), &insertion_index)
@@ -116,19 +116,20 @@ void TransitionsAccessor::Insert(Handle<Name> name, Handle<Map> target,
       return;
     }
 
-    ++new_nof;
+    new_nof = number_of_transitions + 1;
     CHECK_LE(new_nof, kMaxNumberOfTransitions);
-    DCHECK(insertion_index >= 0 && insertion_index <= number_of_transitions);
+    DCHECK_GE(insertion_index, 0);
+    DCHECK_LE(insertion_index, number_of_transitions);
 
     // If there is enough capacity, insert new entry into the existing array.
     if (new_nof <= array.Capacity()) {
       array.SetNumberOfTransitions(new_nof);
-      for (index = number_of_transitions; index > insertion_index; --index) {
-        array.SetKey(index, array.GetKey(index - 1));
-        array.SetRawTarget(index, array.GetRawTarget(index - 1));
+      for (int i = number_of_transitions; i > insertion_index; --i) {
+        array.SetKey(i, array.GetKey(i - 1));
+        array.SetRawTarget(i, array.GetRawTarget(i - 1));
       }
-      array.SetKey(index, *name);
-      array.SetRawTarget(index, HeapObjectReference::Weak(*target));
+      array.SetKey(insertion_index, *name);
+      array.SetRawTarget(insertion_index, HeapObjectReference::Weak(*target));
       SLOW_DCHECK(array.IsSortedNoDuplicates());
       return;
     }
@@ -146,23 +147,19 @@ void TransitionsAccessor::Insert(Handle<Name> name, Handle<Map> target,
   DisallowHeapAllocation no_gc;
   TransitionArray array = transitions();
   if (array.number_of_transitions() != number_of_transitions) {
-    DCHECK(array.number_of_transitions() < number_of_transitions);
+    DCHECK_LT(array.number_of_transitions(), number_of_transitions);
 
-    number_of_transitions = array.number_of_transitions();
-    new_nof = number_of_transitions;
-
-    insertion_index = kNotFound;
     int index = is_special_transition
                     ? array.SearchSpecial(Symbol::cast(*name), &insertion_index)
                     : array.Search(details.kind(), *name, details.attributes(),
                                    &insertion_index);
-    if (index == kNotFound) {
-      ++new_nof;
-    } else {
-      insertion_index = index;
-    }
-    DCHECK(insertion_index >= 0 && insertion_index <= number_of_transitions);
+    CHECK_EQ(index, kNotFound);
+    USE(index);
+    DCHECK_GE(insertion_index, 0);
+    DCHECK_LE(insertion_index, number_of_transitions);
 
+    number_of_transitions = array.number_of_transitions();
+    new_nof = number_of_transitions + 1;
     result->SetNumberOfTransitions(new_nof);
   }
 
@@ -405,26 +402,14 @@ Map TransitionsAccessor::GetMigrationTarget() {
   return Map();
 }
 
-void TransitionArray::Zap(Isolate* isolate) {
-  MemsetTagged(ObjectSlot(RawFieldOfElementAt(kPrototypeTransitionsIndex)),
-               ReadOnlyRoots(isolate).the_hole_value(),
-               length() - kPrototypeTransitionsIndex);
-  SetNumberOfTransitions(0);
-}
-
 void TransitionsAccessor::ReplaceTransitions(MaybeObject new_transitions) {
   if (encoding() == kFullTransitionArray) {
-    TransitionArray old_transitions = transitions();
 #if DEBUG
+    TransitionArray old_transitions = transitions();
     CheckNewTransitionsAreConsistent(
         old_transitions, new_transitions->GetHeapObjectAssumeStrong());
     DCHECK(old_transitions != new_transitions->GetHeapObjectAssumeStrong());
 #endif
-    // Transition arrays are not shared. When one is replaced, it should not
-    // keep referenced objects alive, so we zap it.
-    // When there is another reference to the array somewhere (e.g. a handle),
-    // not zapping turns from a waste of memory into a source of crashes.
-    old_transitions.Zap(isolate_);
   }
   map_.set_raw_transitions(new_transitions);
   MarkNeedsReload();