Fix issue 386, a bug in JSObject::ReplaceSlowProperty with constant transitio...

Fix issue 386, a bug in JSObject::ReplaceSlowProperty with constant transitions.

Committed: http://code.google.com/p/v8/source/detail?r=2228

[William Hesse, 2009-06-21 13:00:39]

Two issues with this fix:
1) The bug is only reproducible with the submitted reduction.  I could not
create a reduction that reproduced it.  The submitted reduction comes from a
contributor, derived from a commercial product.  Therefore, maybe we don't need
the regression test.
2) The bug was not caught more easily because using -1 for the "not found" index
from HashTable and Dictionary lookups does not trigger the asserts that using
-10 or -100 would, since FixedArray::get() is called with a valid index by
lookups of -1 in a HashTable, because of the HashTable header.
If we changed -1 to kInvalidIndex = -100, it would be more stable, but this is a
bigger change.

[Mads Ager (chromium), 2009-06-22 07:01:00]

LGTM

http://codereview.chromium.org/141031/diff/1/2
File test/mjsunit/regress/regress-386.js (right):

http://codereview.chromium.org/141031/diff/1/2#newcode39
Line 39: c={ c1 : false, c2 : false, c3 : false, c4 : false, c5 : false };
We can do something simpler than this.  We hit your new assert with something
like:

function A() {
  for (var i = 0; i < 13; i++) {
    this['a' + i] = i;
  }
  this.i = function(){};
};

new A();
new A();