Clear the EnumLength fields of maps that lose their enumeration cache.

src/objects.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 1795 matching lines @@
   // transitions with the same key.
 
   if (old_map->owns_descriptors()) {
     // If the old map owns its own descriptors, transfer ownership to the
     // new_map and install its descriptors in the old_map. Since the old_map
     // stores the descriptors for the new_map, remove the transition array of
     // the new_map that is only in place to store the descriptors.
     old_map->transitions()->set_descriptors(new_map->instance_descriptors());
     new_map->ClearTransitions(GetHeap());
     old_map->set_owns_descriptors(false);
+    Map* map;
+    JSGlobalPropertyCell* pointer =
+        old_map->transitions()->descriptors_pointer();
+    for (Object* current = old_map;
+         !current->IsUndefined();
+         current = map->GetBackPointer()) {
+      map = Map::cast(current);
+      if (!map->HasTransitionArray()) break;
+      TransitionArray* transitions = map->transitions();
+      if (transitions->descriptors_pointer() != pointer) break;
+      map->SetEnumLength(Map::kInvalidEnumCache);
+    }
   } else if (old_target->instance_descriptors() ==
              old_map->instance_descriptors()) {
     // Since the conversion above generated a new fast map with an additional
     // property which can be shared as well, install this descriptor pointer
     // along the entire chain of smaller maps; and remove the transition array
     // that is only in place to hold the descriptor array in the new map.
     Map* map;
     JSGlobalPropertyCell* new_pointer =
         new_map->transitions()->descriptors_pointer();
     JSGlobalPropertyCell* old_pointer =
         old_map->transitions()->descriptors_pointer();
     for (Object* current = old_map;
          !current->IsUndefined();
          current = map->GetBackPointer()) {
       map = Map::cast(current);
       if (!map->HasTransitionArray()) break;
       TransitionArray* transitions = map->transitions();
       if (transitions->descriptors_pointer() != old_pointer) break;
+      map->SetEnumLength(Map::kInvalidEnumCache);
       transitions->set_descriptors_pointer(new_pointer);
     }
     new_map->ClearTransitions(GetHeap());
   }
 
   old_map->SetTransition(transition_index, new_map);
   new_map->SetBackPointer(old_map);
   return result;
 }
 
@@ skipping 11634 matching lines @@
   set_year(Smi::FromInt(year), SKIP_WRITE_BARRIER);
   set_month(Smi::FromInt(month), SKIP_WRITE_BARRIER);
   set_day(Smi::FromInt(day), SKIP_WRITE_BARRIER);
   set_weekday(Smi::FromInt(weekday), SKIP_WRITE_BARRIER);
   set_hour(Smi::FromInt(hour), SKIP_WRITE_BARRIER);
   set_min(Smi::FromInt(min), SKIP_WRITE_BARRIER);
   set_sec(Smi::FromInt(sec), SKIP_WRITE_BARRIER);
 }
 
 } }  // namespace v8::internal