Revert "Allow code to be cached in shared maps." due to GC stress crashes.

src/objects.cc

Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index 53607d020245c96f333727bfb155a496afb755d1..cca11323df8b427088cbe2952b02590a98ae7c3d 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -4449,6 +4449,16 @@ void HeapObject::UpdateMapCodeCache(Handle<HeapObject> object,
                                     Handle<Name> name,
                                     Handle<Code> code) {
   Handle<Map> map(object->map());
+  if (map->is_shared()) {
+    Handle<JSObject> receiver = Handle<JSObject>::cast(object);
+    // Fast case maps are never marked as shared.
+    ASSERT(!receiver->HasFastProperties());
+    // Replace the map with an identical copy that can be safely modified.
+    map = Map::CopyNormalized(map, KEEP_INOBJECT_PROPERTIES,
+                              UNIQUE_NORMALIZED_MAP);
+    receiver->GetIsolate()->counters()->normalized_maps()->Increment();
+    receiver->set_map(*map);
+  }
   Map::UpdateCodeCache(map, name, code);
 }
 
@@ -7013,6 +7023,8 @@ void Map::UpdateCodeCache(Handle<Map> map,
 
 
 MaybeObject* Map::UpdateCodeCache(Name* name, Code* code) {
+  ASSERT(!is_shared() || code->allowed_in_shared_map_code_cache());
+
   // Allocate the code cache if not present.
   if (code_cache()->IsFixedArray()) {
     Object* result;
@@ -10455,6 +10467,13 @@ BailoutId Code::TranslatePcOffsetToAstId(uint32_t pc_offset) {
 }
 
 
+bool Code::allowed_in_shared_map_code_cache() {
+  return is_keyed_load_stub() || is_keyed_store_stub() ||
+      (is_compare_ic_stub() &&
+       ICCompareStub::CompareState(stub_info()) == CompareIC::KNOWN_OBJECT);
+}
+
+
 void Code::MakeCodeAgeSequenceYoung(byte* sequence, Isolate* isolate) {
   PatchPlatformCodeAge(isolate, sequence, kNoAge, NO_MARKING_PARITY);
 }