Fix corner case when transforming dictionary to fast elements.

src/objects.cc

Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index 7ce612d83b1c79dfd49adabbe7b694ba3fbcd122..b88c73d1f38981efcfab5ebc44ea9c3dd40266a5 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -12447,6 +12447,31 @@ MaybeObject* StringDictionary::TransformPropertiesToFastFor(
     }
   }
 
+  // Allocate new map.
+  Map* new_map;
+  MaybeObject* maybe_new_map = obj->map()->CopyDropDescriptors();
+  if (!maybe_new_map->To(&new_map)) return maybe_new_map;
+
+  // Calculate fields to allocate.
+  int inobject_props = obj->map()->inobject_properties();
+  int number_of_allocated_fields =
+      number_of_fields + unused_property_fields - inobject_props;
+  if (number_of_allocated_fields < 0) {
+    // There is enough inobject space for all fields (including unused).
+    number_of_allocated_fields = 0;
+    unused_property_fields = inobject_props - number_of_fields;
+  }

[Toon Verwaest, 2012/07/20 13:47:49]

What about moving all of this code (starting from // Calculate fields ...) below
the == 0?

+
+  if (instance_descriptor_length == 0) {
+    ASSERT_EQ(0, number_of_allocated_fields);

[Toon Verwaest, 2012/07/20 13:47:49]

Here we can just use number_of_fields.

+    // Transform the object.
+    obj->set_map(new_map);
+    obj->set_properties(heap->empty_fixed_array());
+    // Check that it really works.
+    ASSERT(obj->HasFastProperties());
+    return obj;
+  }
+
   // Allocate the instance descriptor.
   DescriptorArray* descriptors;
   MaybeObject* maybe_descriptors =
@@ -12458,15 +12483,6 @@ MaybeObject* StringDictionary::TransformPropertiesToFastFor(
 
   FixedArray::WhitenessWitness witness(descriptors);
 
-  int inobject_props = obj->map()->inobject_properties();
-  int number_of_allocated_fields =
-      number_of_fields + unused_property_fields - inobject_props;
-  if (number_of_allocated_fields < 0) {
-    // There is enough inobject space for all fields (including unused).
-    number_of_allocated_fields = 0;
-    unused_property_fields = inobject_props - number_of_fields;
-  }
-
   // Allocate the fixed array for the fields.
   FixedArray* fields;
   MaybeObject* maybe_fields =
@@ -12523,10 +12539,6 @@ MaybeObject* StringDictionary::TransformPropertiesToFastFor(
   ASSERT(current_offset == number_of_fields);
 
   descriptors->Sort(witness);
-  // Allocate new map.
-  Map* new_map;
-  MaybeObject* maybe_new_map = obj->map()->CopyDropDescriptors();
-  if (!maybe_new_map->To(&new_map)) return maybe_new_map;
 
   new_map->InitializeDescriptors(descriptors);
   new_map->set_unused_property_fields(unused_property_fields);