Fix transition conversion from CONSTANT_FUNCTION to FIELD.

src/objects.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 1753 matching lines @@
   Map* old_target = old_map->GetTransition(transition_index);
   Object* result;
 
   // To sever a transition to a map with which the descriptors are shared, the
   // larger map (more descriptors) needs to store its own descriptors array.
   // Both sides of the severed chain need to have their own descriptors pointer
   // to store distinct descriptor arrays.
 
   // If the old_target did not yet store its own descriptors, the new
   // descriptors pointer is created for the old_target by temporarily clearing
-  // the back pointer and setting its descriptor array. The ownership of the
-  // descriptor array is returned to the smaller maps by installing a reduced
-  // copy of the descriptor array in the old_map.
+  // the back pointer and setting its descriptor array.
 
   // This phase is executed before creating the new map since it requires
   // allocation that may fail.
   if (!old_target->StoresOwnDescriptors()) {
     DescriptorArray* old_descriptors = old_map->instance_descriptors();
 
     old_target->SetBackPointer(GetHeap()->undefined_value());
     MaybeObject* maybe_failure = old_target->SetDescriptors(old_descriptors);
     // Reset the backpointer before returning failure, otherwise the map ends up
     // with an undefined backpointer and no descriptors, losing its own
     // descriptors. Setting the backpointer always succeeds.
     old_target->SetBackPointer(old_map);
     if (maybe_failure->IsFailure()) return maybe_failure;
-
-    old_map->set_owns_descriptors(true);
   }
 
   MaybeObject* maybe_result =
       ConvertDescriptorToField(name, new_value, attributes);
   if (!maybe_result->To(&result)) return maybe_result;
 
   if (!HasFastProperties()) return result;
 
   // This method should only be used to convert existing transitions. Objects
   // with the map of "new Object()" cannot have transitions in the first place.
   Map* new_map = map();
   ASSERT(new_map != GetIsolate()->empty_object_map());
 
   // TODO(verwaest): From here on we lose existing map transitions, causing
   // invalid back pointers. This will change once we can store multiple
   // transitions with the same key.
 
   if (old_map->owns_descriptors()) {
     // If the old map owns its own descriptors, transfer ownership to the
     // new_map and install its descriptors in the old_map. Since the old_map
     // stores the descriptors for the new_map, remove the transition array of
     // the new_map that is only in place to store the descriptors.
     old_map->transitions()->descriptors_pointer()->set_value(
         new_map->instance_descriptors());
     new_map->ClearTransitions(GetHeap());
     old_map->set_owns_descriptors(false);
-    Map* map;
-    JSGlobalPropertyCell* pointer =
-        old_map->transitions()->descriptors_pointer();
-    for (Object* current = old_map;
-         !current->IsUndefined();
-         current = map->GetBackPointer()) {
-      map = Map::cast(current);
-      if (!map->HasTransitionArray()) break;
-      TransitionArray* transitions = map->transitions();
-      if (transitions->descriptors_pointer() != pointer) break;
-      map->SetEnumLength(Map::kInvalidEnumCache);
-    }
   } else if (old_target->instance_descriptors() ==
              old_map->instance_descriptors()) {
     // Since the conversion above generated a new fast map with an additional
     // property which can be shared as well, install this descriptor pointer
     // along the entire chain of smaller maps; and remove the transition array
     // that is only in place to hold the descriptor array in the new map.
     Map* map;
     JSGlobalPropertyCell* new_pointer =
         new_map->transitions()->descriptors_pointer();
     JSGlobalPropertyCell* old_pointer =
@@ skipping 3148 matching lines @@
   result->set_is_shared(false);
   result->ClearCodeCache(GetHeap());
   return result;
 }
 
 
 MaybeObject* Map::ShareDescriptor(Descriptor* descriptor) {
   // Sanity check. This path is only to be taken if the map owns its descriptor
   // array, implying that its NumberOfOwnDescriptors equals the number of
   // descriptors in the descriptor array.
-  ASSERT(NumberOfOwnDescriptors() ==
-         instance_descriptors()->number_of_descriptors());
+  if (NumberOfOwnDescriptors() !=
+      instance_descriptors()->number_of_descriptors()) {
+    Isolate::Current()->PushStackTraceAndDie(
+          0xDEAD0002, GetBackPointer(), this, 0xDEAD0003);
+  }
   Map* result;
   MaybeObject* maybe_result = CopyDropDescriptors();
   if (!maybe_result->To(&result)) return maybe_result;
 
   String* name = descriptor->GetKey();
 
   TransitionArray* transitions;
   MaybeObject* maybe_transitions =
       AddTransition(name, result, SIMPLE_TRANSITION);
   if (!maybe_transitions->To(&transitions)) return maybe_transitions;
@@ skipping 69 matching lines @@
          ? SIMPLE_TRANSITION
          : FULL_TRANSITION;
     MaybeObject* maybe_transitions = AddTransition(name, result, simple_flag);
     if (!maybe_transitions->To(&transitions)) return maybe_transitions;
 
     if (descriptors->IsEmpty()) {
       if (owns_descriptors()) {
         // If the copied map has no added fields, and the parent map owns its
         // descriptors, those descriptors have to be empty. In that case,
         // transfer ownership of the descriptors to the new child.
-        ASSERT(instance_descriptors()->IsEmpty());
+        CHECK(instance_descriptors()->IsEmpty());
         set_owns_descriptors(false);
       } else {
         // If the parent did not own its own descriptors, it may share a larger
         // descriptors array already. In that case, force a split by setting
         // the descriptor array of the new map to the empty descriptor array.
         MaybeObject* maybe_failure =
             result->SetDescriptors(GetHeap()->empty_descriptor_array());
         if (maybe_failure->IsFailure()) return maybe_failure;
       }
     }
@@ skipping 8450 matching lines @@
   set_year(Smi::FromInt(year), SKIP_WRITE_BARRIER);
   set_month(Smi::FromInt(month), SKIP_WRITE_BARRIER);
   set_day(Smi::FromInt(day), SKIP_WRITE_BARRIER);
   set_weekday(Smi::FromInt(weekday), SKIP_WRITE_BARRIER);
   set_hour(Smi::FromInt(hour), SKIP_WRITE_BARRIER);
   set_min(Smi::FromInt(min), SKIP_WRITE_BARRIER);
   set_sec(Smi::FromInt(sec), SKIP_WRITE_BARRIER);
 }
 
 } }  // namespace v8::internal