Version 3.31.37.1 (cherry-pick)

Merged 58553437fa25fdefca1a12515553238523a31394
Merged d9c83f6bd0c9bd6806146caaa8053f61a800543d

Revert of MIPS: Use weak cells in map checks in polymorphic ICs. (patchset #1 id:1 of https://codereview.chromium.org/767623003/)

Revert of Use weak cells in map checks in polymorphic ICs. (patchset #8 id:140001 of https://codereview.chromium.org/753993003/)

BUG=v8:3663
LOG=N
TBR=ulan@chromium.org

Review URL: https://codereview.chromium.org/719213007

Cr-Commit-Position: refs/heads/candidates@{#25312}
diff --git a/src/arm/macro-assembler-arm.cc b/src/arm/macro-assembler-arm.cc
index e45ae5c..729ce025 100644
--- a/src/arm/macro-assembler-arm.cc
+++ b/src/arm/macro-assembler-arm.cc
@@ -2269,22 +2269,6 @@
 }
 
 
-void MacroAssembler::CmpWeakValue(Register value, Handle<WeakCell> cell,
-                                  Register scratch) {
-  mov(scratch, Operand(cell));
-  ldr(scratch, FieldMemOperand(scratch, WeakCell::kValueOffset));
-  cmp(value, scratch);
-}
-
-
-void MacroAssembler::LoadWeakValue(Register value, Handle<WeakCell> cell,
-                                   Label* miss) {
-  mov(value, Operand(cell));
-  ldr(value, FieldMemOperand(value, WeakCell::kValueOffset));
-  JumpIfSmi(value, miss);
-}
-
-
 void MacroAssembler::TryGetFunctionPrototype(Register function,
                                              Register result,
                                              Register scratch,
diff --git a/src/arm/macro-assembler-arm.h b/src/arm/macro-assembler-arm.h
index 8e1c112..79d26f2 100644
--- a/src/arm/macro-assembler-arm.h
+++ b/src/arm/macro-assembler-arm.h
@@ -927,12 +927,6 @@
                    Handle<Code> success,
                    SmiCheckType smi_check_type);
 
-  // Compare the given value and the value of weak cell.
-  void CmpWeakValue(Register value, Handle<WeakCell> cell, Register scratch);
-
-  // Load the value of the weak cell in the value register. Branch to the given
-  // miss label if the weak cell was cleared.
-  void LoadWeakValue(Register value, Handle<WeakCell> cell, Label* miss);
 
   // Compare the object in a register to a value from the root list.
   // Uses the ip register as scratch.
diff --git a/src/arm64/lithium-codegen-arm64.cc b/src/arm64/lithium-codegen-arm64.cc
index 240b8f6..8129470 100644
--- a/src/arm64/lithium-codegen-arm64.cc
+++ b/src/arm64/lithium-codegen-arm64.cc
@@ -5019,6 +5019,7 @@
   Register scratch2 = x6;
   DCHECK(instr->IsMarkedAsCall());
 
+  ASM_UNIMPLEMENTED_BREAK("DoDeclareGlobals");
   // TODO(all): if Mov could handle object in new space then it could be used
   // here.
   __ LoadHeapObject(scratch1, instr->hydrogen()->pairs());
diff --git a/src/arm64/macro-assembler-arm64.cc b/src/arm64/macro-assembler-arm64.cc
index 20133c1..82f7183 100644
--- a/src/arm64/macro-assembler-arm64.cc
+++ b/src/arm64/macro-assembler-arm64.cc
@@ -3805,22 +3805,6 @@
 }
 
 
-void MacroAssembler::CmpWeakValue(Register value, Handle<WeakCell> cell,
-                                  Register scratch) {
-  Mov(scratch, Operand(cell));
-  Ldr(scratch, FieldMemOperand(scratch, WeakCell::kValueOffset));
-  Cmp(value, scratch);
-}
-
-
-void MacroAssembler::LoadWeakValue(Register value, Handle<WeakCell> cell,
-                                   Label* miss) {
-  Mov(value, Operand(cell));
-  Ldr(value, FieldMemOperand(value, WeakCell::kValueOffset));
-  JumpIfSmi(value, miss);
-}
-
-
 void MacroAssembler::TestMapBitfield(Register object, uint64_t mask) {
   UseScratchRegisterScope temps(this);
   Register temp = temps.AcquireX();
diff --git a/src/arm64/macro-assembler-arm64.h b/src/arm64/macro-assembler-arm64.h
index 142dce7..db51156 100644
--- a/src/arm64/macro-assembler-arm64.h
+++ b/src/arm64/macro-assembler-arm64.h
@@ -1487,13 +1487,6 @@
                    Handle<Code> success,
                    SmiCheckType smi_check_type);
 
-  // Compare the given value and the value of weak cell.
-  void CmpWeakValue(Register value, Handle<WeakCell> cell, Register scratch);
-
-  // Load the value of the weak cell in the value register. Branch to the given
-  // miss label if the weak cell was cleared.
-  void LoadWeakValue(Register value, Handle<WeakCell> cell, Label* miss);
-
   // Test the bitfield of the heap object map with mask and set the condition
   // flags. The object register is preserved.
   void TestMapBitfield(Register object, uint64_t mask);
diff --git a/src/factory.cc b/src/factory.cc
index 4680e75..218d3b9 100644
--- a/src/factory.cc
+++ b/src/factory.cc
@@ -802,7 +802,6 @@
       Handle<CodeCache>::cast(NewStruct(CODE_CACHE_TYPE));
   code_cache->set_default_cache(*empty_fixed_array(), SKIP_WRITE_BARRIER);
   code_cache->set_normal_type_cache(*undefined_value(), SKIP_WRITE_BARRIER);
-  code_cache->set_weak_cell_cache(*undefined_value(), SKIP_WRITE_BARRIER);
   return code_cache;
 }
 
diff --git a/src/heap/objects-visiting-inl.h b/src/heap/objects-visiting-inl.h
index f063793..1f37306 100644
--- a/src/heap/objects-visiting-inl.h
+++ b/src/heap/objects-visiting-inl.h
@@ -263,7 +263,9 @@
   // to be serialized.
   if (FLAG_cleanup_code_caches_at_gc && target->is_inline_cache_stub() &&
       !target->is_call_stub() &&
-      ((heap->flush_monomorphic_ics() && !target->is_weak_stub()) ||
+      (target->ic_state() == MEGAMORPHIC || target->ic_state() == GENERIC ||
+       target->ic_state() == POLYMORPHIC ||
+       (heap->flush_monomorphic_ics() && !target->is_weak_stub()) ||
        heap->isolate()->serializer_enabled() ||
        target->ic_age() != heap->global_ic_age() ||
        target->is_invalidated_weak_stub())) {
diff --git a/src/ia32/macro-assembler-ia32.cc b/src/ia32/macro-assembler-ia32.cc
index 6908796..06b6f6a 100644
--- a/src/ia32/macro-assembler-ia32.cc
+++ b/src/ia32/macro-assembler-ia32.cc
@@ -2580,21 +2580,6 @@
 }
 
 
-void MacroAssembler::CmpWeakValue(Register value, Handle<WeakCell> cell,
-                                  Register scratch) {
-  mov(scratch, cell);
-  cmp(value, FieldOperand(scratch, WeakCell::kValueOffset));
-}
-
-
-void MacroAssembler::LoadWeakValue(Register value, Handle<WeakCell> cell,
-                                   Label* miss) {
-  mov(value, cell);
-  mov(value, FieldOperand(value, WeakCell::kValueOffset));
-  JumpIfSmi(value, miss);
-}
-
-
 void MacroAssembler::Ret() {
   ret(0);
 }
diff --git a/src/ia32/macro-assembler-ia32.h b/src/ia32/macro-assembler-ia32.h
index 158f1b1..383233b 100644
--- a/src/ia32/macro-assembler-ia32.h
+++ b/src/ia32/macro-assembler-ia32.h
@@ -299,13 +299,6 @@
     }
   }
 
-  // Compare the given value and the value of weak cell.
-  void CmpWeakValue(Register value, Handle<WeakCell> cell, Register scratch);
-
-  // Load the value of the weak cell in the value register. Branch to the given
-  // miss label if the weak cell was cleared.
-  void LoadWeakValue(Register value, Handle<WeakCell> cell, Label* miss);
-
   // ---------------------------------------------------------------------------
   // JavaScript invokes
 
diff --git a/src/ic/arm/ic-compiler-arm.cc b/src/ic/arm/ic-compiler-arm.cc
index bfab8dd..7bef56e 100644
--- a/src/ic/arm/ic-compiler-arm.cc
+++ b/src/ic/arm/ic-compiler-arm.cc
@@ -72,8 +72,8 @@
     Handle<Map> map = IC::TypeToMap(*type, isolate());
     if (!map->is_deprecated()) {
       number_of_handled_maps++;
-      Handle<WeakCell> cell = Map::WeakCellForMap(map);
-      __ CmpWeakValue(map_reg, cell, scratch2());
+      __ mov(ip, Operand(map));
+      __ cmp(map_reg, ip);
       if (type->Is(HeapType::Number())) {
         DCHECK(!number_case.is_unused());
         __ bind(&number_case);
@@ -100,18 +100,16 @@
   __ JumpIfSmi(receiver(), &miss);
 
   int receiver_count = receiver_maps->length();
-  Register map_reg = scratch1();
-  __ ldr(map_reg, FieldMemOperand(receiver(), HeapObject::kMapOffset));
+  __ ldr(scratch1(), FieldMemOperand(receiver(), HeapObject::kMapOffset));
   for (int i = 0; i < receiver_count; ++i) {
-    Handle<WeakCell> cell = Map::WeakCellForMap(receiver_maps->at(i));
-    __ CmpWeakValue(map_reg, cell, scratch2());
+    __ mov(ip, Operand(receiver_maps->at(i)));
+    __ cmp(scratch1(), ip);
     if (transitioned_maps->at(i).is_null()) {
       __ Jump(handler_stubs->at(i), RelocInfo::CODE_TARGET, eq);
     } else {
       Label next_map;
       __ b(ne, &next_map);
-      Handle<WeakCell> cell = Map::WeakCellForMap(transitioned_maps->at(i));
-      __ LoadWeakValue(transition_map(), cell, &miss);
+      __ mov(transition_map(), Operand(transitioned_maps->at(i)));
       __ Jump(handler_stubs->at(i), RelocInfo::CODE_TARGET, al);
       __ bind(&next_map);
     }
diff --git a/src/ic/arm64/ic-compiler-arm64.cc b/src/ic/arm64/ic-compiler-arm64.cc
index f031657..ffc1069 100644
--- a/src/ic/arm64/ic-compiler-arm64.cc
+++ b/src/ic/arm64/ic-compiler-arm64.cc
@@ -71,9 +71,8 @@
     Handle<Map> map = IC::TypeToMap(*type, isolate());
     if (!map->is_deprecated()) {
       number_of_handled_maps++;
-      Handle<WeakCell> cell = Map::WeakCellForMap(map);
-      __ CmpWeakValue(map_reg, cell, scratch2());
       Label try_next;
+      __ Cmp(map_reg, Operand(map));
       __ B(ne, &try_next);
       if (type->Is(HeapType::Number())) {
         DCHECK(!number_case.is_unused());
@@ -105,18 +104,16 @@
   __ JumpIfSmi(receiver(), &miss);
 
   int receiver_count = receiver_maps->length();
-  Register map_reg = scratch1();
-  __ Ldr(map_reg, FieldMemOperand(receiver(), HeapObject::kMapOffset));
+  __ Ldr(scratch1(), FieldMemOperand(receiver(), HeapObject::kMapOffset));
   for (int i = 0; i < receiver_count; i++) {
-    Handle<WeakCell> cell = Map::WeakCellForMap(receiver_maps->at(i));
-    __ CmpWeakValue(map_reg, cell, scratch2());
+    __ Cmp(scratch1(), Operand(receiver_maps->at(i)));
+
     Label skip;
     __ B(&skip, ne);
     if (!transitioned_maps->at(i).is_null()) {
       // This argument is used by the handler stub. For example, see
       // ElementsTransitionGenerator::GenerateMapChangeElementsTransition.
-      Handle<WeakCell> cell = Map::WeakCellForMap(transitioned_maps->at(i));
-      __ LoadWeakValue(transition_map(), cell, &miss);
+      __ Mov(transition_map(), Operand(transitioned_maps->at(i)));
     }
     __ Jump(handler_stubs->at(i), RelocInfo::CODE_TARGET);
     __ Bind(&skip);
diff --git a/src/ic/ia32/ic-compiler-ia32.cc b/src/ic/ia32/ic-compiler-ia32.cc
index 6ad95a1..ac42f30b 100644
--- a/src/ic/ia32/ic-compiler-ia32.cc
+++ b/src/ic/ia32/ic-compiler-ia32.cc
@@ -75,8 +75,7 @@
     Handle<Map> map = IC::TypeToMap(*type, isolate());
     if (!map->is_deprecated()) {
       number_of_handled_maps++;
-      Handle<WeakCell> cell = Map::WeakCellForMap(map);
-      __ CmpWeakValue(map_reg, cell, scratch2());
+      __ cmp(map_reg, map);
       if (type->Is(HeapType::Number())) {
         DCHECK(!number_case.is_unused());
         __ bind(&number_case);
@@ -100,19 +99,16 @@
     MapHandleList* receiver_maps, CodeHandleList* handler_stubs,
     MapHandleList* transitioned_maps) {
   Label miss;
-  __ JumpIfSmi(receiver(), &miss);
-  Register map_reg = scratch1();
-  __ mov(map_reg, FieldOperand(receiver(), HeapObject::kMapOffset));
+  __ JumpIfSmi(receiver(), &miss, Label::kNear);
+  __ mov(scratch1(), FieldOperand(receiver(), HeapObject::kMapOffset));
   for (int i = 0; i < receiver_maps->length(); ++i) {
-    Handle<WeakCell> cell = Map::WeakCellForMap(receiver_maps->at(i));
-    __ CmpWeakValue(map_reg, cell, scratch2());
+    __ cmp(scratch1(), receiver_maps->at(i));
     if (transitioned_maps->at(i).is_null()) {
       __ j(equal, handler_stubs->at(i));
     } else {
       Label next_map;
       __ j(not_equal, &next_map, Label::kNear);
-      Handle<WeakCell> cell = Map::WeakCellForMap(transitioned_maps->at(i));
-      __ LoadWeakValue(transition_map(), cell, &miss);
+      __ mov(transition_map(), Immediate(transitioned_maps->at(i)));
       __ jmp(handler_stubs->at(i), RelocInfo::CODE_TARGET);
       __ bind(&next_map);
     }
diff --git a/src/ic/mips/ic-compiler-mips.cc b/src/ic/mips/ic-compiler-mips.cc
index fd8e6fa..c1e67f9 100644
--- a/src/ic/mips/ic-compiler-mips.cc
+++ b/src/ic/mips/ic-compiler-mips.cc
@@ -57,8 +57,7 @@
       number_of_handled_maps++;
       // Check map and tail call if there's a match.
       // Separate compare from branch, to provide path for above JumpIfSmi().
-      Handle<WeakCell> cell = Map::WeakCellForMap(map);
-      __ CmpWeakValue(match, map_reg, cell);
+      __ Subu(match, map_reg, Operand(map));
       if (type->Is(HeapType::Number())) {
         DCHECK(!number_case.is_unused());
         __ bind(&number_case);
@@ -86,20 +85,15 @@
   __ JumpIfSmi(receiver(), &miss);
 
   int receiver_count = receiver_maps->length();
-  Register map_reg = scratch1();
-  Register match = scratch2();
-  __ lw(map_reg, FieldMemOperand(receiver(), HeapObject::kMapOffset));
+  __ lw(scratch1(), FieldMemOperand(receiver(), HeapObject::kMapOffset));
   for (int i = 0; i < receiver_count; ++i) {
-    Handle<WeakCell> cell = Map::WeakCellForMap(receiver_maps->at(i));
-    __ CmpWeakValue(match, map_reg, cell);
     if (transitioned_maps->at(i).is_null()) {
-      __ Jump(handler_stubs->at(i), RelocInfo::CODE_TARGET, eq, match,
-              Operand(zero_reg));
+      __ Jump(handler_stubs->at(i), RelocInfo::CODE_TARGET, eq, scratch1(),
+              Operand(receiver_maps->at(i)));
     } else {
       Label next_map;
-      __ Branch(&next_map, ne, match, Operand(zero_reg));
-      Handle<WeakCell> cell = Map::WeakCellForMap(transitioned_maps->at(i));
-      __ LoadWeakValue(transition_map(), cell, &miss);
+      __ Branch(&next_map, ne, scratch1(), Operand(receiver_maps->at(i)));
+      __ li(transition_map(), Operand(transitioned_maps->at(i)));
       __ Jump(handler_stubs->at(i), RelocInfo::CODE_TARGET);
       __ bind(&next_map);
     }
diff --git a/src/ic/mips64/ic-compiler-mips64.cc b/src/ic/mips64/ic-compiler-mips64.cc
index 2558824..796ed87 100644
--- a/src/ic/mips64/ic-compiler-mips64.cc
+++ b/src/ic/mips64/ic-compiler-mips64.cc
@@ -57,8 +57,7 @@
       number_of_handled_maps++;
       // Check map and tail call if there's a match.
       // Separate compare from branch, to provide path for above JumpIfSmi().
-      Handle<WeakCell> cell = Map::WeakCellForMap(map);
-      __ CmpWeakValue(match, map_reg, cell);
+      __ Dsubu(match, map_reg, Operand(map));
       if (type->Is(HeapType::Number())) {
         DCHECK(!number_case.is_unused());
         __ bind(&number_case);
@@ -86,20 +85,15 @@
   __ JumpIfSmi(receiver(), &miss);
 
   int receiver_count = receiver_maps->length();
-  Register map_reg = scratch1();
-  Register match = scratch2();
-  __ ld(map_reg, FieldMemOperand(receiver(), HeapObject::kMapOffset));
+  __ ld(scratch1(), FieldMemOperand(receiver(), HeapObject::kMapOffset));
   for (int i = 0; i < receiver_count; ++i) {
-    Handle<WeakCell> cell = Map::WeakCellForMap(receiver_maps->at(i));
-    __ CmpWeakValue(match, map_reg, cell);
     if (transitioned_maps->at(i).is_null()) {
-      __ Jump(handler_stubs->at(i), RelocInfo::CODE_TARGET, eq, match,
-              Operand(zero_reg));
+      __ Jump(handler_stubs->at(i), RelocInfo::CODE_TARGET, eq, scratch1(),
+              Operand(receiver_maps->at(i)));
     } else {
       Label next_map;
-      __ Branch(&next_map, ne, match, Operand(zero_reg));
-      Handle<WeakCell> cell = Map::WeakCellForMap(transitioned_maps->at(i));
-      __ LoadWeakValue(transition_map(), cell, &miss);
+      __ Branch(&next_map, ne, scratch1(), Operand(receiver_maps->at(i)));
+      __ li(transition_map(), Operand(transitioned_maps->at(i)));
       __ Jump(handler_stubs->at(i), RelocInfo::CODE_TARGET);
       __ bind(&next_map);
     }
diff --git a/src/ic/x64/ic-compiler-x64.cc b/src/ic/x64/ic-compiler-x64.cc
index c6622e5..a5848b6 100644
--- a/src/ic/x64/ic-compiler-x64.cc
+++ b/src/ic/x64/ic-compiler-x64.cc
@@ -42,22 +42,20 @@
     MapHandleList* receiver_maps, CodeHandleList* handler_stubs,
     MapHandleList* transitioned_maps) {
   Label miss;
-  __ JumpIfSmi(receiver(), &miss);
+  __ JumpIfSmi(receiver(), &miss, Label::kNear);
 
-  Register map_reg = scratch1();
-  __ movp(map_reg, FieldOperand(receiver(), HeapObject::kMapOffset));
+  __ movp(scratch1(), FieldOperand(receiver(), HeapObject::kMapOffset));
   int receiver_count = receiver_maps->length();
   for (int i = 0; i < receiver_count; ++i) {
-    Handle<WeakCell> cell = Map::WeakCellForMap(receiver_maps->at(i));
     // Check map and tail call if there's a match
-    __ CmpWeakValue(map_reg, cell, scratch2());
+    __ Cmp(scratch1(), receiver_maps->at(i));
     if (transitioned_maps->at(i).is_null()) {
       __ j(equal, handler_stubs->at(i), RelocInfo::CODE_TARGET);
     } else {
       Label next_map;
       __ j(not_equal, &next_map, Label::kNear);
-      Handle<WeakCell> cell = Map::WeakCellForMap(transitioned_maps->at(i));
-      __ LoadWeakValue(transition_map(), cell, &miss);
+      __ Move(transition_map(), transitioned_maps->at(i),
+              RelocInfo::EMBEDDED_OBJECT);
       __ jmp(handler_stubs->at(i), RelocInfo::CODE_TARGET);
       __ bind(&next_map);
     }
@@ -111,9 +109,8 @@
     Handle<Map> map = IC::TypeToMap(*type, isolate());
     if (!map->is_deprecated()) {
       number_of_handled_maps++;
-      Handle<WeakCell> cell = Map::WeakCellForMap(map);
       // Check map and tail call if there's a match
-      __ CmpWeakValue(map_reg, cell, scratch2());
+      __ Cmp(map_reg, map);
       if (type->Is(HeapType::Number())) {
         DCHECK(!number_case.is_unused());
         __ bind(&number_case);
diff --git a/src/ic/x87/ic-compiler-x87.cc b/src/ic/x87/ic-compiler-x87.cc
index f344cd1..20b47e7 100644
--- a/src/ic/x87/ic-compiler-x87.cc
+++ b/src/ic/x87/ic-compiler-x87.cc
@@ -75,8 +75,7 @@
     Handle<Map> map = IC::TypeToMap(*type, isolate());
     if (!map->is_deprecated()) {
       number_of_handled_maps++;
-      Handle<WeakCell> cell = Map::WeakCellForMap(map);
-      __ CmpWeakValue(map_reg, cell, scratch2());
+      __ cmp(map_reg, map);
       if (type->Is(HeapType::Number())) {
         DCHECK(!number_case.is_unused());
         __ bind(&number_case);
@@ -101,18 +100,15 @@
     MapHandleList* transitioned_maps) {
   Label miss;
   __ JumpIfSmi(receiver(), &miss, Label::kNear);
-  Register map_reg = scratch1();
-  __ mov(map_reg, FieldOperand(receiver(), HeapObject::kMapOffset));
+  __ mov(scratch1(), FieldOperand(receiver(), HeapObject::kMapOffset));
   for (int i = 0; i < receiver_maps->length(); ++i) {
-    Handle<WeakCell> cell = Map::WeakCellForMap(receiver_maps->at(i));
-    __ CmpWeakValue(map_reg, cell, scratch2());
+    __ cmp(scratch1(), receiver_maps->at(i));
     if (transitioned_maps->at(i).is_null()) {
       __ j(equal, handler_stubs->at(i));
     } else {
       Label next_map;
       __ j(not_equal, &next_map, Label::kNear);
-      Handle<WeakCell> cell = Map::WeakCellForMap(transitioned_maps->at(i));
-      __ LoadWeakValue(transition_map(), cell, &miss);
+      __ mov(transition_map(), Immediate(transitioned_maps->at(i)));
       __ jmp(handler_stubs->at(i), RelocInfo::CODE_TARGET);
       __ bind(&next_map);
     }
diff --git a/src/mips/macro-assembler-mips.cc b/src/mips/macro-assembler-mips.cc
index b2f60c5..5cc505d 100644
--- a/src/mips/macro-assembler-mips.cc
+++ b/src/mips/macro-assembler-mips.cc
@@ -4021,22 +4021,6 @@
 }
 
 
-void MacroAssembler::CmpWeakValue(Register match, Register value,
-                                  Handle<WeakCell> cell) {
-  li(match, Operand(cell));
-  lw(match, FieldMemOperand(match, WeakCell::kValueOffset));
-  Subu(match, value, match);
-}
-
-
-void MacroAssembler::LoadWeakValue(Register value, Handle<WeakCell> cell,
-                                   Label* miss) {
-  li(value, Operand(cell));
-  lw(value, FieldMemOperand(value, WeakCell::kValueOffset));
-  JumpIfSmi(value, miss);
-}
-
-
 void MacroAssembler::MovFromFloatResult(DoubleRegister dst) {
   if (IsMipsSoftFloatABI) {
     if (kArchEndian == kLittle) {
diff --git a/src/mips/macro-assembler-mips.h b/src/mips/macro-assembler-mips.h
index 98f510b..d500eaa 100644
--- a/src/mips/macro-assembler-mips.h
+++ b/src/mips/macro-assembler-mips.h
@@ -1091,13 +1091,6 @@
                    Handle<Code> success,
                    SmiCheckType smi_check_type);
 
-  // Compare the given value and the value of the weak cell. Write the result
-  // to the match register.
-  void CmpWeakValue(Register match, Register value, Handle<WeakCell> cell);
-
-  // Load the value of the weak cell in the value register. Branch to the
-  // given miss label is the weak cell was cleared.
-  void LoadWeakValue(Register value, Handle<WeakCell> cell, Label* miss);
 
   // Load and check the instance type of an object for being a string.
   // Loads the type into the second argument register.
diff --git a/src/mips64/macro-assembler-mips64.cc b/src/mips64/macro-assembler-mips64.cc
index b621e86..8f0ae09 100644
--- a/src/mips64/macro-assembler-mips64.cc
+++ b/src/mips64/macro-assembler-mips64.cc
@@ -3988,22 +3988,6 @@
 }
 
 
-void MacroAssembler::CmpWeakValue(Register match, Register value,
-                                  Handle<WeakCell> cell) {
-  li(match, Operand(cell));
-  ld(match, FieldMemOperand(match, WeakCell::kValueOffset));
-  Dsubu(match, value, match);
-}
-
-
-void MacroAssembler::LoadWeakValue(Register value, Handle<WeakCell> cell,
-                                   Label* miss) {
-  li(value, Operand(cell));
-  ld(value, FieldMemOperand(value, WeakCell::kValueOffset));
-  JumpIfSmi(value, miss);
-}
-
-
 void MacroAssembler::MovFromFloatResult(const DoubleRegister dst) {
   if (IsMipsSoftFloatABI) {
     Move(dst, v0, v1);
diff --git a/src/mips64/macro-assembler-mips64.h b/src/mips64/macro-assembler-mips64.h
index f0f009f..95d6c78 100644
--- a/src/mips64/macro-assembler-mips64.h
+++ b/src/mips64/macro-assembler-mips64.h
@@ -1121,13 +1121,6 @@
                    Handle<Code> success,
                    SmiCheckType smi_check_type);
 
-  // Compare the given value and the value of the weak cell. Write the result
-  // to the match register.
-  void CmpWeakValue(Register match, Register value, Handle<WeakCell> cell);
-
-  // Load the value of the weak cell in the value register. Branch to the
-  // given miss label is the weak cell was cleared.
-  void LoadWeakValue(Register value, Handle<WeakCell> cell, Label* miss);
 
   // Load and check the instance type of an object for being a string.
   // Loads the type into the second argument register.
diff --git a/src/objects-inl.h b/src/objects-inl.h
index f6f47e5..7ba756e 100644
--- a/src/objects-inl.h
+++ b/src/objects-inl.h
@@ -5816,7 +5816,6 @@
 
 ACCESSORS(CodeCache, default_cache, FixedArray, kDefaultCacheOffset)
 ACCESSORS(CodeCache, normal_type_cache, Object, kNormalTypeCacheOffset)
-ACCESSORS(CodeCache, weak_cell_cache, Object, kWeakCellCacheOffset)
 
 ACCESSORS(PolymorphicCodeCache, cache, Object, kCacheOffset)
 
diff --git a/src/objects-printer.cc b/src/objects-printer.cc
index d0ea034..db3d041 100644
--- a/src/objects-printer.cc
+++ b/src/objects-printer.cc
@@ -847,11 +847,6 @@
 
 void WeakCell::WeakCellPrint(std::ostream& os) {  // NOLINT
   HeapObject::PrintHeader(os, "WeakCell");
-  if (cleared()) {
-    os << "\n - cleared";
-  } else {
-    os << "\n - value: " << Brief(value());
-  }
 }
 
 
diff --git a/src/objects.cc b/src/objects.cc
index d3e58e8..8945152 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -1577,14 +1577,6 @@
       os << accumulator.ToCString().get();
       break;
     }
-    case WEAK_CELL_TYPE: {
-      os << "WeakCell for ";
-      HeapStringAllocator allocator;
-      StringStream accumulator(&allocator);
-      WeakCell::cast(this)->value()->ShortPrint(&accumulator);
-      os << accumulator.ToCString().get();
-      break;
-    }
     default:
       os << "<Other heap object (" << map()->instance_type() << ")>";
       break;
@@ -3433,21 +3425,6 @@
 }
 
 
-Handle<WeakCell> Map::WeakCellForMap(Handle<Map> map) {
-  Isolate* isolate = map->GetIsolate();
-  if (map->code_cache()->IsFixedArray()) {
-    return isolate->factory()->NewWeakCell(map);
-  }
-  Handle<CodeCache> code_cache(CodeCache::cast(map->code_cache()), isolate);
-  if (code_cache->weak_cell_cache()->IsWeakCell()) {
-    return Handle<WeakCell>(WeakCell::cast(code_cache->weak_cell_cache()));
-  }
-  Handle<WeakCell> weak_cell = isolate->factory()->NewWeakCell(map);
-  code_cache->set_weak_cell_cache(*weak_cell);
-  return weak_cell;
-}
-
-
 static Handle<Map> AddMissingElementsTransitions(Handle<Map> map,
                                                  ElementsKind to_kind) {
   DCHECK(IsTransitionElementsKind(map->elements_kind()));
@@ -10590,7 +10567,6 @@
   for (RelocIterator it(this, mask); !it.done(); it.next()) {
     RelocInfo* info = it.rinfo();
     Object* object = info->target_object();
-    if (object->IsWeakCell()) object = WeakCell::cast(object)->value();
     if (object->IsHeapObject()) {
       if (HeapObject::cast(object)->map() == match_map) {
         if (--n == 0) return object;
@@ -10623,7 +10599,6 @@
     RelocInfo* info = it.rinfo();
     Object* object = info->target_object();
     if (object->IsHeapObject()) {
-      DCHECK(!object->IsWeakCell());
       Map* map = HeapObject::cast(object)->map();
       if (map == *pattern.find_[current_pattern]) {
         info->set_target_object(*pattern.replace_[current_pattern]);
@@ -10642,7 +10617,6 @@
   for (RelocIterator it(this, mask); !it.done(); it.next()) {
     RelocInfo* info = it.rinfo();
     Object* object = info->target_object();
-    if (object->IsWeakCell()) object = WeakCell::cast(object)->value();
     if (object->IsMap()) maps->Add(handle(Map::cast(object)));
   }
 }
@@ -10651,21 +10625,11 @@
 Code* Code::FindFirstHandler() {
   DCHECK(is_inline_cache_stub());
   DisallowHeapAllocation no_allocation;
-  int mask = RelocInfo::ModeMask(RelocInfo::CODE_TARGET) |
-             RelocInfo::ModeMask(RelocInfo::EMBEDDED_OBJECT);
-  bool skip_next_handler = false;
+  int mask = RelocInfo::ModeMask(RelocInfo::CODE_TARGET);
   for (RelocIterator it(this, mask); !it.done(); it.next()) {
     RelocInfo* info = it.rinfo();
-    if (info->rmode() == RelocInfo::EMBEDDED_OBJECT) {
-      Object* obj = info->target_object();
-      skip_next_handler |= obj->IsWeakCell() && WeakCell::cast(obj)->cleared();
-    } else {
-      Code* code = Code::GetCodeFromTargetAddress(info->target_address());
-      if (code->kind() == Code::HANDLER) {
-        if (!skip_next_handler) return code;
-        skip_next_handler = false;
-      }
-    }
+    Code* code = Code::GetCodeFromTargetAddress(info->target_address());
+    if (code->kind() == Code::HANDLER) return code;
   }
   return NULL;
 }
@@ -10674,27 +10638,17 @@
 bool Code::FindHandlers(CodeHandleList* code_list, int length) {
   DCHECK(is_inline_cache_stub());
   DisallowHeapAllocation no_allocation;
-  int mask = RelocInfo::ModeMask(RelocInfo::CODE_TARGET) |
-             RelocInfo::ModeMask(RelocInfo::EMBEDDED_OBJECT);
-  bool skip_next_handler = false;
+  int mask = RelocInfo::ModeMask(RelocInfo::CODE_TARGET);
   int i = 0;
   for (RelocIterator it(this, mask); !it.done(); it.next()) {
     if (i == length) return true;
     RelocInfo* info = it.rinfo();
-    if (info->rmode() == RelocInfo::EMBEDDED_OBJECT) {
-      Object* obj = info->target_object();
-      skip_next_handler |= obj->IsWeakCell() && WeakCell::cast(obj)->cleared();
-    } else {
-      Code* code = Code::GetCodeFromTargetAddress(info->target_address());
-      // IC stubs with handlers never contain non-handler code objects before
-      // handler targets.
-      if (code->kind() != Code::HANDLER) break;
-      if (!skip_next_handler) {
-        code_list->Add(Handle<Code>(code));
-        i++;
-      }
-      skip_next_handler = false;
-    }
+    Code* code = Code::GetCodeFromTargetAddress(info->target_address());
+    // IC stubs with handlers never contain non-handler code objects before
+    // handler targets.
+    if (code->kind() != Code::HANDLER) break;
+    code_list->Add(Handle<Code>(code));
+    i++;
   }
   return i == length;
 }
@@ -10709,7 +10663,6 @@
     RelocInfo* info = it.rinfo();
     if (info->rmode() == RelocInfo::EMBEDDED_OBJECT) {
       Object* object = info->target_object();
-      if (object->IsWeakCell()) object = WeakCell::cast(object)->value();
       if (object == map) return_next = true;
     } else if (return_next) {
       Code* code = Code::GetCodeFromTargetAddress(info->target_address());
diff --git a/src/objects.h b/src/objects.h
index a45eef1..d17d0d1 100644
--- a/src/objects.h
+++ b/src/objects.h
@@ -6190,8 +6190,6 @@
 
   bool IsMapInArrayPrototypeChain();
 
-  static Handle<WeakCell> WeakCellForMap(Handle<Map> map);
-
   // Dispatched behavior.
   DECLARE_PRINTER(Map)
   DECLARE_VERIFIER(Map)
@@ -8027,7 +8025,6 @@
  public:
   DECL_ACCESSORS(default_cache, FixedArray)
   DECL_ACCESSORS(normal_type_cache, Object)
-  DECL_ACCESSORS(weak_cell_cache, Object)
 
   // Add the code object to the cache.
   static void Update(
@@ -8055,8 +8052,7 @@
   static const int kDefaultCacheOffset = HeapObject::kHeaderSize;
   static const int kNormalTypeCacheOffset =
       kDefaultCacheOffset + kPointerSize;
-  static const int kWeakCellCacheOffset = kNormalTypeCacheOffset + kPointerSize;
-  static const int kSize = kWeakCellCacheOffset + kPointerSize;
+  static const int kSize = kNormalTypeCacheOffset + kPointerSize;
 
  private:
   static void UpdateDefaultCache(
diff --git a/src/version.cc b/src/version.cc
index b8dc674..44e804f 100644
--- a/src/version.cc
+++ b/src/version.cc
@@ -35,7 +35,7 @@
 #define MAJOR_VERSION     3
 #define MINOR_VERSION     31
 #define BUILD_NUMBER      37
-#define PATCH_LEVEL       0
+#define PATCH_LEVEL       1
 // Use 1 for candidates and 0 otherwise.
 // (Boolean macro values are not supported by all preprocessors.)
 #define IS_CANDIDATE_VERSION 0
diff --git a/src/x64/macro-assembler-x64.cc b/src/x64/macro-assembler-x64.cc
index 38884aa..d8878a8 100644
--- a/src/x64/macro-assembler-x64.cc
+++ b/src/x64/macro-assembler-x64.cc
@@ -2852,21 +2852,6 @@
 }
 
 
-void MacroAssembler::CmpWeakValue(Register value, Handle<WeakCell> cell,
-                                  Register scratch) {
-  Move(scratch, cell, RelocInfo::EMBEDDED_OBJECT);
-  cmpp(value, FieldOperand(scratch, WeakCell::kValueOffset));
-}
-
-
-void MacroAssembler::LoadWeakValue(Register value, Handle<WeakCell> cell,
-                                   Label* miss) {
-  Move(value, cell, RelocInfo::EMBEDDED_OBJECT);
-  movp(value, FieldOperand(value, WeakCell::kValueOffset));
-  JumpIfSmi(value, miss);
-}
-
-
 void MacroAssembler::Drop(int stack_elements) {
   if (stack_elements > 0) {
     addp(rsp, Immediate(stack_elements * kPointerSize));
diff --git a/src/x64/macro-assembler-x64.h b/src/x64/macro-assembler-x64.h
index 4431745..24eea38 100644
--- a/src/x64/macro-assembler-x64.h
+++ b/src/x64/macro-assembler-x64.h
@@ -847,13 +847,6 @@
   // Load a global cell into a register.
   void LoadGlobalCell(Register dst, Handle<Cell> cell);
 
-  // Compare the given value and the value of weak cell.
-  void CmpWeakValue(Register value, Handle<WeakCell> cell, Register scratch);
-
-  // Load the value of the weak cell in the value register. Branch to the given
-  // miss label if the weak cell was cleared.
-  void LoadWeakValue(Register value, Handle<WeakCell> cell, Label* miss);
-
   // Emit code to discard a non-negative number of pointer-sized elements
   // from the stack, clobbering only the rsp register.
   void Drop(int stack_elements);
diff --git a/src/x87/macro-assembler-x87.cc b/src/x87/macro-assembler-x87.cc
index 0d23cff..d6d2453 100644
--- a/src/x87/macro-assembler-x87.cc
+++ b/src/x87/macro-assembler-x87.cc
@@ -2544,21 +2544,6 @@
 }
 
 
-void MacroAssembler::CmpWeakValue(Register value, Handle<WeakCell> cell,
-                                  Register scratch) {
-  mov(scratch, cell);
-  cmp(value, FieldOperand(scratch, WeakCell::kValueOffset));
-}
-
-
-void MacroAssembler::LoadWeakValue(Register value, Handle<WeakCell> cell,
-                                   Label* miss) {
-  mov(value, cell);
-  mov(value, FieldOperand(value, WeakCell::kValueOffset));
-  JumpIfSmi(value, miss);
-}
-
-
 void MacroAssembler::Ret() {
   ret(0);
 }
diff --git a/src/x87/macro-assembler-x87.h b/src/x87/macro-assembler-x87.h
index 32f58e9..ad308a4 100644
--- a/src/x87/macro-assembler-x87.h
+++ b/src/x87/macro-assembler-x87.h
@@ -277,9 +277,6 @@
     }
   }
 
-  void CmpWeakValue(Register value, Handle<WeakCell> cell, Register scratch);
-  void LoadWeakValue(Register value, Handle<WeakCell> cell, Label* miss);
-
   // ---------------------------------------------------------------------------
   // JavaScript invokes
 
diff --git a/test/cctest/cctest.status b/test/cctest/cctest.status
index e8eb2dc..c40ae95 100644
--- a/test/cctest/cctest.status
+++ b/test/cctest/cctest.status
@@ -78,9 +78,6 @@
   'test-debug/RecursiveBreakpoints': [PASS, FLAKY],
   'test-debug/RecursiveBreakpointsGlobal': [PASS, FLAKY],
 
-  # BUG(3629). Known memory leak.
-  'test-heap/WeakMapInPolymorphicStoreIC': [SKIP],
-
   ##############################################################################
   # TurboFan compiler failures.
 
diff --git a/test/cctest/test-heap.cc b/test/cctest/test-heap.cc
index a21f541..825c822 100644
--- a/test/cctest/test-heap.cc
+++ b/test/cctest/test-heap.cc
@@ -3423,44 +3423,6 @@
 }
 
 
-TEST(IncrementalMarkingPreservesPolymorphicIC) {
-  if (i::FLAG_always_opt) return;
-  CcTest::InitializeVM();
-  v8::HandleScope scope(CcTest::isolate());
-  v8::Local<v8::Value> obj1, obj2;
-
-  {
-    LocalContext env;
-    CompileRun("function fun() { this.x = 1; }; var obj = new fun();");
-    obj1 = env->Global()->Get(v8_str("obj"));
-  }
-
-  {
-    LocalContext env;
-    CompileRun("function fun() { this.x = 2; }; var obj = new fun();");
-    obj2 = env->Global()->Get(v8_str("obj"));
-  }
-
-  // Prepare function f that contains a polymorphic IC for objects
-  // originating from two different native contexts.
-  CcTest::global()->Set(v8_str("obj1"), obj1);
-  CcTest::global()->Set(v8_str("obj2"), obj2);
-  CompileRun("function f(o) { return o.x; } f(obj1); f(obj1); f(obj2);");
-  Handle<JSFunction> f = v8::Utils::OpenHandle(
-      *v8::Handle<v8::Function>::Cast(CcTest::global()->Get(v8_str("f"))));
-
-  Code* ic_before = FindFirstIC(f->shared()->code(), Code::LOAD_IC);
-  CHECK(ic_before->ic_state() == POLYMORPHIC);
-
-  // Fire context dispose notification.
-  SimulateIncrementalMarking(CcTest::heap());
-  CcTest::heap()->CollectAllGarbage(Heap::kNoGCFlags);
-
-  Code* ic_after = FindFirstIC(f->shared()->code(), Code::LOAD_IC);
-  CHECK(ic_after->ic_state() == POLYMORPHIC);
-}
-
-
 TEST(IncrementalMarkingClearsPolymorphicIC) {
   if (i::FLAG_always_opt) return;
   CcTest::InitializeVM();
@@ -4418,25 +4380,6 @@
 }
 
 
-TEST(WeakMapInPolymorphicLoadIC) {
-  CheckWeakness(
-      "function loadIC(obj) {"
-      "  return obj.name;"
-      "}"
-      " (function() {"
-      "   var proto = {'name' : 'weak'};"
-      "   var obj = Object.create(proto);"
-      "   loadIC(obj);"
-      "   loadIC(obj);"
-      "   loadIC(obj);"
-      "   var poly = Object.create(proto);"
-      "   poly.x = true;"
-      "   loadIC(poly);"
-      "   return proto;"
-      " })();");
-}
-
-
 TEST(WeakMapInMonomorphicKeyedLoadIC) {
   // TODO(mvstanton): vector ics need weak support!
   if (FLAG_vector_ics) return;
@@ -4454,25 +4397,6 @@
 }
 
 
-TEST(WeakMapInPolymorphicKeyedLoadIC) {
-  CheckWeakness(
-      "function keyedLoadIC(obj, field) {"
-      "  return obj[field];"
-      "}"
-      " (function() {"
-      "   var proto = {'name' : 'weak'};"
-      "   var obj = Object.create(proto);"
-      "   keyedLoadIC(obj, 'name');"
-      "   keyedLoadIC(obj, 'name');"
-      "   keyedLoadIC(obj, 'name');"
-      "   var poly = Object.create(proto);"
-      "   poly.x = true;"
-      "   keyedLoadIC(poly, 'name');"
-      "   return proto;"
-      " })();");
-}
-
-
 TEST(WeakMapInMonomorphicStoreIC) {
   CheckWeakness("function storeIC(obj, value) {"
                 "  obj.name = value;"
@@ -4488,25 +4412,6 @@
 }
 
 
-TEST(WeakMapInPolymorphicStoreIC) {
-  CheckWeakness(
-      "function storeIC(obj, value) {"
-      "  obj.name = value;"
-      "}"
-      " (function() {"
-      "   var proto = {'name' : 'weak'};"
-      "   var obj = Object.create(proto);"
-      "   storeIC(obj, 'x');"
-      "   storeIC(obj, 'x');"
-      "   storeIC(obj, 'x');"
-      "   var poly = Object.create(proto);"
-      "   poly.x = true;"
-      "   storeIC(poly, 'x');"
-      "   return proto;"
-      " })();");
-}
-
-
 TEST(WeakMapInMonomorphicKeyedStoreIC) {
   CheckWeakness("function keyedStoreIC(obj, field, value) {"
                 "  obj[field] = value;"
@@ -4522,25 +4427,6 @@
 }
 
 
-TEST(WeakMapInPolymorphicKeyedStoreIC) {
-  CheckWeakness(
-      "function keyedStoreIC(obj, field, value) {"
-      "  obj[field] = value;"
-      "}"
-      " (function() {"
-      "   var proto = {'name' : 'weak'};"
-      "   var obj = Object.create(proto);"
-      "   keyedStoreIC(obj, 'x');"
-      "   keyedStoreIC(obj, 'x');"
-      "   keyedStoreIC(obj, 'x');"
-      "   var poly = Object.create(proto);"
-      "   poly.x = true;"
-      "   keyedStoreIC(poly, 'x');"
-      "   return proto;"
-      " })();");
-}
-
-
 TEST(WeakMapInMonomorphicCompareNilIC) {
   CheckWeakness("function compareNilIC(obj) {"
                 "  return obj == null;"
diff --git a/test/mjsunit/opt-elements-kind.js b/test/mjsunit/opt-elements-kind.js
index 5f4f437..be7303b 100644
--- a/test/mjsunit/opt-elements-kind.js
+++ b/test/mjsunit/opt-elements-kind.js
@@ -142,16 +142,10 @@
   assertTrue(%HaveSameMap(smis, doubles));
 }
 
-function clear_ic_state() {
-  %ClearFunctionTypeFeedback(construct_smis);
-  %ClearFunctionTypeFeedback(construct_doubles);
-  %ClearFunctionTypeFeedback(convert_mixed);
-}
-
 test1();
-clear_ic_state();
+gc(); // clear IC state
 test1();
-clear_ic_state();
+gc(); // clear IC state
 %OptimizeFunctionOnNextCall(test1);
 test1();
-clear_ic_state();
+gc(); // clear IC state