name in each prototype
https://bugs.webkit.org/show_bug.cgi?id=107378

Reviewed by Sam Weinig and Phil Pizlo.

This is a step toward object size inference.

Using a side table frees us to use a more complex key (a pair of
prototype and expected inline capacity).

It also avoids ruining inline caches for prototypes. (Adding a new private
name for a new inline capacity would change the prototype's structure,
possibly firing watchpoints, making inline caches go polymorphic, and
generally causing us to have a bad time.)

* CMakeLists.txt:
* GNUmakefile.list.am:
* JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
* JavaScriptCore.xcodeproj/project.pbxproj:
* Target.pri: Buildage.

* runtime/ArrayPrototype.cpp:
(JSC::ArrayPrototype::finishCreation): Updated to use new side table API.

* runtime/JSFunction.cpp:
(JSC::JSFunction::cacheInheritorID): Updated to use new side table API.

(JSC::JSFunction::visitChildren): Fixed a long-standing bug where JSFunction
forgot to visit one of its data members (m_cachedInheritorID). This
wasn't a user-visible problem before because JSFunction would always
visit its .prototype property, which visited its m_cachedInheritorID.
But now, function.prototype only weakly owns function.m_cachedInheritorID.

* runtime/JSGlobalData.h:
(JSGlobalData): Added the map, taking care to make sure that its
destructor would run after the heap destructor.

* runtime/JSGlobalObject.cpp:
(JSC::JSGlobalObject::reset): Updated to use new side table API.

* runtime/JSObject.cpp:
(JSC::JSObject::notifyPresenceOfIndexedAccessors):
(JSC::JSObject::setPrototype):
* runtime/JSObject.h:
(JSObject): Updated to use new side table API, and removed lots of code
that used to manage the per-object private name.

* runtime/JSProxy.cpp:
(JSC::JSProxy::setTarget):
* runtime/ObjectConstructor.cpp:
(JSC::objectConstructorCreate):
* runtime/ObjectPrototype.cpp:
(JSC::ObjectPrototype::finishCreation): Updated to use new side table API.

* runtime/PrototypeMap.cpp: Added.
(JSC):
(JSC::PrototypeMap::addPrototype):
(JSC::PrototypeMap::emptyObjectStructureForPrototype):
* runtime/PrototypeMap.h: Added.
(PrototypeMap):
(JSC::PrototypeMap::isPrototype):
(JSC::PrototypeMap::clearEmptyObjectStructureForPrototype): New side table.
This is a simple weak map, mapping an object to the structure you should
use when inheriting from that object. (In future, inline capacity will
be a part of the mapping.)

I used two maps to preserve existing behavior that allowed us to speculate
about an object becoming a prototype, even if it wasn't one at the moment.
However, I suspect that behavior can be removed without harm.

* runtime/WeakGCMap.h:
(JSC::WeakGCMap::contains):
(WeakGCMap): I would rate myself a 6 / 10 in C++.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@140259 268f45cc-cd09-0410-ab3c-d52691b4dbfc