Fix array boilerplate object transitioning.

src/runtime.cc

Index: src/runtime.cc
diff --git a/src/runtime.cc b/src/runtime.cc
index 0726b3d68aea560e6603f98980a61070e42d458f..bf10ad9c8dc1fb7771929034c18c94bb52e74c67 100644
--- a/src/runtime.cc
+++ b/src/runtime.cc
@@ -4669,7 +4669,7 @@ RUNTIME_FUNCTION(MaybeObject*, Runtime_StoreArrayLiteralElement) {
   HandleScope scope;
 
   Object* raw_boilerplate_object = literals->get(literal_index);
-  Handle<JSArray> boilerplate_object(JSArray::cast(raw_boilerplate_object));
+  Handle<JSArray> boilerplate(JSArray::cast(raw_boilerplate_object));
 #if DEBUG
   ElementsKind elements_kind = object->GetElementsKind();
 #endif
@@ -4680,19 +4680,23 @@ RUNTIME_FUNCTION(MaybeObject*, Runtime_StoreArrayLiteralElement) {
   if (value->IsNumber()) {
     ASSERT(elements_kind == FAST_SMI_ONLY_ELEMENTS);
     JSObject::TransitionElementsKind(object, FAST_DOUBLE_ELEMENTS);
-    JSObject::TransitionElementsKind(boilerplate_object, FAST_DOUBLE_ELEMENTS);
+    if (boilerplate->GetElementsKind() != FAST_DOUBLE_ELEMENTS) {
+      ASSERT(elements_kind == boilerplate->GetElementsKind());

[danno, 2012/04/03 15:47:46]

The boilerplate could also be FAST_ELEMENTS at this point. You need to make sure
that the boilerplate has transitioned to at least the ElementsKind that's
needed, but beyond is OK, too. You might want to use
IsMoreGeneralElementsKindTransition for this test.

[Michael Starzinger, 2012/04/03 16:31:52]

Done.

+      JSObject::TransitionElementsKind(boilerplate, FAST_DOUBLE_ELEMENTS);
+    }
     ASSERT(object->GetElementsKind() == FAST_DOUBLE_ELEMENTS);
-    FixedDoubleArray* double_array =
-        FixedDoubleArray::cast(object->elements());
+    FixedDoubleArray* double_array = FixedDoubleArray::cast(object->elements());
     HeapNumber* number = HeapNumber::cast(*value);
     double_array->set(store_index, number->Number());
   } else {
     ASSERT(elements_kind == FAST_SMI_ONLY_ELEMENTS ||
            elements_kind == FAST_DOUBLE_ELEMENTS);
     JSObject::TransitionElementsKind(object, FAST_ELEMENTS);
-    JSObject::TransitionElementsKind(boilerplate_object, FAST_ELEMENTS);
-    FixedArray* object_array =
-        FixedArray::cast(object->elements());
+    if (boilerplate->GetElementsKind() != FAST_ELEMENTS) {
+      ASSERT(elements_kind == boilerplate->GetElementsKind());
+      JSObject::TransitionElementsKind(boilerplate, FAST_ELEMENTS);
+    }

[danno, 2012/04/03 15:47:46]

Same here.

[Michael Starzinger, 2012/04/03 16:31:52]

Done.

+    FixedArray* object_array = FixedArray::cast(object->elements());
     object_array->set(store_index, *value);
   }
   return *object;