Fix issue 386, a bug in JSObject::ReplaceSlowProperty with constant transitio...

src/objects.cc

 // Copyright 2006-2009 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 1284 matching lines @@
   if (result.IsValid()) return SetProperty(&result, name, value, attributes);
   // Add real property.
   return AddProperty(name, value, attributes);
 }
 
 
 Object* JSObject::ReplaceSlowProperty(String* name,
                                        Object* value,
                                        PropertyAttributes attributes) {
   Dictionary* dictionary = property_dictionary();
-  PropertyDetails old_details =
-      dictionary->DetailsAt(dictionary->FindStringEntry(name));
-  int new_index = old_details.index();
-  if (old_details.IsTransition()) new_index = 0;
+  int old_index = dictionary->FindStringEntry(name);
+  int new_enumeration_index = 0;  // 0 means "Use the next available index."
+  if (old_index != -1) {
+    // All calls to ReplaceSlowProperty have had all transitions removed.
+    ASSERT(!dictionary->DetailsAt(old_index).IsTransition());
+    new_enumeration_index = dictionary->DetailsAt(old_index).index();
+  }
 
-  PropertyDetails new_details(attributes, NORMAL, old_details.index());
+  PropertyDetails new_details(attributes, NORMAL, new_enumeration_index);
   Object* result =
-      property_dictionary()->SetOrAddStringEntry(name, value, new_details);
+      dictionary->SetOrAddStringEntry(name, value, new_details);
   if (result->IsFailure()) return result;
-  if (property_dictionary() != result) {
+  if (dictionary != result) {
     set_properties(Dictionary::cast(result));
   }
   return value;
 }
 
 Object* JSObject::ConvertDescriptorToFieldAndMapTransition(
     String* name,
     Object* new_value,
     PropertyAttributes attributes) {
   Map* old_map = map();
@@ skipping 6152 matching lines @@
   // No break point.
   if (break_point_objects()->IsUndefined()) return 0;
   // Single beak point.
   if (!break_point_objects()->IsFixedArray()) return 1;
   // Multiple break points.
   return FixedArray::cast(break_point_objects())->length();
 }
 #endif
 
 } }  // namespace v8::internal