Internalize names before using them in slow-mode objects.

src/objects.cc

Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index 32127eb8b9f19afd9e3cf46c04303b900ca86772..1399e33ffab4acb74f42abd63ad646747b9b61cc 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -672,12 +672,19 @@ void JSObject::SetNormalizedProperty(Handle<JSObject> object,
                                      PropertyDetails details) {
   ASSERT(!object->HasFastProperties());
   Handle<NameDictionary> property_dictionary(object->property_dictionary());
+
+  if (!name->IsUniqueName()) {
+    name = object->GetIsolate()->factory()->InternalizedStringFromString(
+        Handle<String>::cast(name));
+  }
+
   int entry = property_dictionary->FindEntry(*name);
   if (entry == NameDictionary::kNotFound) {
     Handle<Object> store_value = value;
     if (object->IsGlobalObject()) {
       store_value = object->GetIsolate()->factory()->NewPropertyCell(value);
     }
+

[Yang, 2013/09/25 14:59:51]

stray edit.

     property_dictionary =
         NameDictionaryAdd(property_dictionary, name, store_value, details);
     object->set_properties(*property_dictionary);
@@ -2044,6 +2051,12 @@ Handle<Object> JSObject::AddProperty(Handle<JSObject> object,
                                      TransitionFlag transition_flag) {
   ASSERT(!object->IsJSGlobalProxy());
   Isolate* isolate = object->GetIsolate();
+
+  if (!name->IsUniqueName()) {
+    name = isolate->factory()->InternalizedStringFromString(
+        Handle<String>::cast(name));
+  }
+
   if (extensibility_check == PERFORM_EXTENSIBILITY_CHECK &&
       !object->map()->is_extensible()) {
     if (strict_mode == kNonStrictMode) {