Fix corner case when transforming dictionary to fast elements.

src/objects.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 12429 matching lines @@
       PropertyType type = DetailsAt(i).type();
       ASSERT(type != FIELD);
       instance_descriptor_length++;
       if (type == NORMAL &&
           (!value->IsJSFunction() || heap->InNewSpace(value))) {
         number_of_fields += 1;
       }
     }
   }
 
+  // Allocate new map.
+  Map* new_map;
+  MaybeObject* maybe_new_map = obj->map()->CopyDropDescriptors();
+  if (!maybe_new_map->To(&new_map)) return maybe_new_map;
+
+  // Calculate fields to allocate.
+  int inobject_props = obj->map()->inobject_properties();
+  int number_of_allocated_fields =
+      number_of_fields + unused_property_fields - inobject_props;
+  if (number_of_allocated_fields < 0) {
+    // There is enough inobject space for all fields (including unused).
+    number_of_allocated_fields = 0;
+    unused_property_fields = inobject_props - number_of_fields;
+  }

[Toon Verwaest, 2012/07/20 13:47:49]

What about moving all of this code (starting from // Calculate fields ...) below
the == 0?

+
+  if (instance_descriptor_length == 0) {
+    ASSERT_EQ(0, number_of_allocated_fields);

[Toon Verwaest, 2012/07/20 13:47:49]

Here we can just use number_of_fields.

+    // Transform the object.
+    obj->set_map(new_map);
+    obj->set_properties(heap->empty_fixed_array());
+    // Check that it really works.
+    ASSERT(obj->HasFastProperties());
+    return obj;
+  }
+
   // Allocate the instance descriptor.
   DescriptorArray* descriptors;
   MaybeObject* maybe_descriptors =
       DescriptorArray::Allocate(instance_descriptor_length,
                                 DescriptorArray::MAY_BE_SHARED);
   if (!maybe_descriptors->To(&descriptors)) {
     return maybe_descriptors;
   }
 
   FixedArray::WhitenessWitness witness(descriptors);
 
-  int inobject_props = obj->map()->inobject_properties();
-  int number_of_allocated_fields =
-      number_of_fields + unused_property_fields - inobject_props;
-  if (number_of_allocated_fields < 0) {
-    // There is enough inobject space for all fields (including unused).
-    number_of_allocated_fields = 0;
-    unused_property_fields = inobject_props - number_of_fields;
-  }
-
   // Allocate the fixed array for the fields.
   FixedArray* fields;
   MaybeObject* maybe_fields =
       heap->AllocateFixedArray(number_of_allocated_fields);
   if (!maybe_fields->To(&fields)) return maybe_fields;
 
   // Fill in the instance descriptor and the fields.
   int next_descriptor = 0;
   int current_offset = 0;
   for (int i = 0; i < capacity; i++) {
@@ skipping 36 matching lines @@
         descriptors->Set(next_descriptor, &d, witness);
       } else {
         UNREACHABLE();
       }
       ++next_descriptor;
     }
   }
   ASSERT(current_offset == number_of_fields);
 
   descriptors->Sort(witness);
-  // Allocate new map.
-  Map* new_map;
-  MaybeObject* maybe_new_map = obj->map()->CopyDropDescriptors();
-  if (!maybe_new_map->To(&new_map)) return maybe_new_map;
 
   new_map->InitializeDescriptors(descriptors);
   new_map->set_unused_property_fields(unused_property_fields);
 
   // Transform the object.
   obj->set_map(new_map);
 
   obj->set_properties(fields);
   ASSERT(obj->IsJSObject());
 
@@ skipping 501 matching lines @@
   set_year(Smi::FromInt(year), SKIP_WRITE_BARRIER);
   set_month(Smi::FromInt(month), SKIP_WRITE_BARRIER);
   set_day(Smi::FromInt(day), SKIP_WRITE_BARRIER);
   set_weekday(Smi::FromInt(weekday), SKIP_WRITE_BARRIER);
   set_hour(Smi::FromInt(hour), SKIP_WRITE_BARRIER);
   set_min(Smi::FromInt(min), SKIP_WRITE_BARRIER);
   set_sec(Smi::FromInt(sec), SKIP_WRITE_BARRIER);
 }
 
 } }  // namespace v8::internal