Limit initial size of hidden properties and store identity hashes inline.

test/cctest/test-heap.cc

Index: test/cctest/test-heap.cc
diff --git a/test/cctest/test-heap.cc b/test/cctest/test-heap.cc
index 9229a97125e681b69a502a967a5e52c5f9d429af..0785c7cc421e0ea5e4d6be34a76e7aff0338c096 100644
--- a/test/cctest/test-heap.cc
+++ b/test/cctest/test-heap.cc
@@ -1966,3 +1966,50 @@ TEST(Regress2237) {
   HEAP->CollectAllGarbage(Heap::kNoGCFlags);
   CHECK(SlicedString::cast(*slice)->parent()->IsSeqAsciiString());
 }
+
+
+TEST(Regress2211) {
+  InitializeVM();
+  v8::HandleScope scope;
+
+  Handle<String> key = v8::Utils::OpenHandle(*v8::String::New("key"));
+  Handle<String> val = v8::Utils::OpenHandle(*v8::String::New("val"));
+  Smi* hash = Smi::FromInt(321);
+  Heap* heap = Isolate::Current()->heap();
+
+  // Store identity hash first and common hidden property second.
+  Handle<JSObject> object = v8::Utils::OpenHandle(*v8::Object::New());
+  CHECK(object->HasFastProperties());
+
+  MaybeObject* maybe_obj = object->SetIdentityHash(hash, ALLOW_CREATION);
+  CHECK(!maybe_obj->IsFailure());
+
+  DescriptorArray* descriptors = object->map()->instance_descriptors();
+  Object* inline_stored = object->FastPropertyAt(descriptors->GetFieldIndex(0));
+  CHECK_EQ(hash, Smi::cast(inline_stored));
+  CHECK_EQ(hash, object->GetHiddenProperty(heap->identity_hash_symbol()));
+
+  JSObject::SetHiddenProperty(object, key, val);
+  CHECK_EQ(hash, object->GetHiddenProperty(heap->identity_hash_symbol()));
+  CHECK(val->Equals(String::cast(object->GetHiddenProperty(*key))));
+
+  ObjectHashTable* hashtable = ObjectHashTable::cast(
+      object->FastPropertyAt(descriptors->GetFieldIndex(0)));
+  CHECK_LE(hashtable->SizeFor(hashtable->length()), 52);  // Reasonable size.
+
+  // Store common hidden property first and identity hash second.
+  object = v8::Utils::OpenHandle(*v8::Object::New());
+  CHECK(object->HasFastProperties());
+
+  JSObject::SetHiddenProperty(object, key, val);
+  maybe_obj = object->SetIdentityHash(hash, ALLOW_CREATION);
+  CHECK(!maybe_obj->IsFailure());
+
+  CHECK_EQ(hash, object->GetHiddenProperty(heap->identity_hash_symbol()));
+  CHECK(val->Equals(String::cast(object->GetHiddenProperty(*key))));
+
+  descriptors = object->map()->instance_descriptors();
+  hashtable = ObjectHashTable::cast(
+      object->FastPropertyAt(descriptors->GetFieldIndex(0)));
+  CHECK_LE(hashtable->SizeFor(hashtable->length()), 52);  // Reasonable size.
+}