Handle CALLBACKS transitions in NormalizeProperties, CopyInsert and RemoveTransitions.

src/objects.cc

Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index aef028456f61ed4411fb66927375cd050f4c8f6f..a76f841f849a8599c466fad4c415d47722815a1a 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -3415,12 +3415,17 @@ MaybeObject* JSObject::NormalizeProperties(PropertyNormalizationMode mode,
         break;
       }
       case CALLBACKS: {
-        PropertyDetails d =
-            PropertyDetails(details.attributes(), CALLBACKS, details.index());
-        Object* value = descs->GetCallbacksObject(i);
+        if (!descs->IsProperty(i)) break;
+        Descriptor desc;
+        { MaybeObject* result =
+              descs->GetDescriptorWithoutTransitions(i, &desc);
+          if (result->IsFailure()) return result;
+        }
         Object* result;
         { MaybeObject* maybe_result =
-              dictionary->Add(descs->GetKey(i), value, d);
+              dictionary->Add(desc.GetKey(),
+                              desc.GetValue(),
+                              desc.GetDetails());
           if (!maybe_result->ToObject(&result)) return maybe_result;
         }
         dictionary = StringDictionary::cast(result);
@@ -5730,6 +5735,21 @@ void DescriptorArray::SetEnumCache(FixedArray* bridge_storage,
 }
 
 
+MaybeObject* DescriptorArray::GetDescriptorWithoutTransitions(
+    int descriptor_number,
+    Descriptor* descriptor) {
+  PropertyDetails details(GetDetails(descriptor_number));
+  Object* value = GetValue(descriptor_number);
+  if (details.type() == CALLBACKS && value->IsAccessorPair()) {
+    MaybeObject* maybe_copy =
+        AccessorPair::cast(value)->CopyWithoutTransitions();
+    if (!maybe_copy->To(&value)) return maybe_copy;
+  }
+  descriptor->Init(GetKey(descriptor_number), value, details);
+  return Smi::FromInt(0);
+}
+
+
 static bool InsertionPointFound(String* key1, String* key2) {
   return key1->Hash() > key2->Hash() || key1 == key2;
 }
@@ -5818,7 +5838,12 @@ MaybeObject* DescriptorArray::CopyInsert(Descriptor* descriptor,
     } else {
       if (!(IsNullDescriptor(from_index) ||
             (remove_transitions && IsTransitionOnly(from_index)))) {
-        new_descriptors->CopyFrom(to_index++, this, from_index, witness);
+        Descriptor desc;
+        { MaybeObject* result =
+              GetDescriptorWithoutTransitions(from_index, &desc);
+          if (result->IsFailure()) return result;
+        }
+        new_descriptors->Set(to_index++, &desc, witness);
       }
       from_index++;
     }
@@ -5838,27 +5863,26 @@ MaybeObject* DescriptorArray::RemoveTransitions() {
   // with all transitions removed, or a Failure object if the new array could
   // not be allocated.
 
-  // Compute the size of the map transition entries to be removed.
+  // Allocate the new descriptor array.
   int new_number_of_descriptors = 0;
   for (int i = 0; i < number_of_descriptors(); i++) {
     if (IsProperty(i)) new_number_of_descriptors++;
   }
-
-  // Allocate the new descriptor array.
   DescriptorArray* new_descriptors;
   { MaybeObject* maybe_result = Allocate(new_number_of_descriptors);
-    if (!maybe_result->To<DescriptorArray>(&new_descriptors)) {
-      return maybe_result;
-    }
+    if (!maybe_result->To(&new_descriptors)) return maybe_result;
   }
 
-  DescriptorArray::WhitenessWitness witness(new_descriptors);
-
   // Copy the content.
+  DescriptorArray::WhitenessWitness witness(new_descriptors);
   int next_descriptor = 0;
   for (int i = 0; i < number_of_descriptors(); i++) {
     if (IsProperty(i)) {
-      new_descriptors->CopyFrom(next_descriptor++, this, i, witness);
+      Descriptor desc;
+      { MaybeObject* result = GetDescriptorWithoutTransitions(i, &desc);
+        if (result->IsFailure()) return result;
+      }
+      new_descriptors->Set(next_descriptor++, &desc, witness);
     }
   }
   ASSERT(next_descriptor == new_descriptors->number_of_descriptors());
@@ -5971,6 +5995,18 @@ int DescriptorArray::LinearSearch(String* name, int len) {
 }
 
 
+MaybeObject* AccessorPair::CopyWithoutTransitions() {
+  Heap* heap = GetHeap();
+  AccessorPair* copy;
+  { MaybeObject* maybe_copy = heap->AllocateAccessorPair();
+    if (!maybe_copy->To(&copy)) return maybe_copy;
+  }
+  copy->set_getter(getter()->IsMap() ? heap->the_hole_value() : getter());
+  copy->set_setter(setter()->IsMap() ? heap->the_hole_value() : setter());
+  return copy;
+}
+
+
 MaybeObject* DeoptimizationInputData::Allocate(int deopt_entry_count,
                                                PretenureFlag pretenure) {
   ASSERT(deopt_entry_count > 0);