Do not shortcut cons string symbols during garbage collection....

src/objects.cc

 // Copyright 2006-2008 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 1106 matching lines @@
 
 
 Object* JSObject::ReplaceConstantFunctionProperty(String* name,
                                                   Object* value) {
   // There are two situations to handle here:
   // 1: Replace a constant function with another function.
   // 2: Replace a constant function with an object.
   if (value->IsJSFunction()) {
     JSFunction* function = JSFunction::cast(value);
 
-    Object* new_map =
-      map()->CopyDropTransitions();
+    Object* new_map = map()->CopyDropTransitions();
     if (new_map->IsFailure()) return new_map;
     set_map(Map::cast(new_map));
 
     // Replace the function entry
     int index = map()->instance_descriptors()->Search(name);
     ASSERT(index != DescriptorArray::kNotFound);
     map()->instance_descriptors()->ReplaceConstantFunction(index, function);
   } else {
     // Allocate new instance descriptors with updated property index.
     int index = map()->NextFreePropertyIndex();
@@ skipping 1500 matching lines @@
       if (r.IsNullDescriptor()) null_descriptors++;
     }
   } else {
     for (DescriptorReader r(this); !r.eos(); r.advance()) {
       if (r.IsNullDescriptor()) null_descriptors++;
     }
   }
   int new_size = number_of_descriptors() - transitions - null_descriptors;
 
   // If key is in descriptor, we replace it in-place when filtering.
-  int index = Search(descriptor->key());
+  int index = Search(descriptor->GetKey());
   const bool inserting = (index == kNotFound);
   const bool replacing = !inserting;
   bool keep_enumeration_index = false;
   if (inserting) {
     ++new_size;
   }
   if (replacing) {
     // We are replacing an existing descriptor.  We keep the enumeration
     // index of a visible property.
     PropertyType t = PropertyDetails(GetDetails(index)).type();
@@ skipping 22 matching lines @@
       descriptor->SetEnumerationIndex(enumeration_index);
       ++enumeration_index;
     }
   }
   new_descriptors->SetNextEnumerationIndex(enumeration_index);
 
   // Copy the descriptors, filtering out transitions and null descriptors,
   // and inserting or replacing a descriptor.
   DescriptorWriter w(new_descriptors);
   DescriptorReader r(this);
-  uint32_t descriptor_hash = descriptor->key()->Hash();
+  uint32_t descriptor_hash = descriptor->GetKey()->Hash();
 
   for (; !r.eos(); r.advance()) {
     if (r.GetKey()->Hash() > descriptor_hash ||
         r.GetKey() == descriptor->GetKey()) break;
     if (r.IsNullDescriptor()) continue;
     if (remove_transitions && r.IsTransition()) continue;
     w.WriteFrom(&r);
   }
   w.Write(descriptor);
   if (replacing) {
@@ skipping 2675 matching lines @@
   }
 
   bool IsMatch(Object* other) {
     if (!other->IsString()) return false;
     return String::cast(other)->Equals(string_);
   }
 
   uint32_t Hash() { return string_->Hash(); }
 
   Object* GetObject() {
+    // If the string is a cons string, attempt to flatten it so that
+    // symbols will most often be flat strings.
+    if (string_->IsConsString()) {
+      ConsString* cons_string = ConsString::cast(string_);
+      cons_string->TryFlatten();
+      if (cons_string->second() == Heap::empty_string()) {
+        string_ = String::cast(cons_string->first());
+      }
+    }
     // Transform string to symbol if possible.
     Map* map = Heap::SymbolMapForString(string_);
     if (map != NULL) {
       string_->set_map(map);
       return string_;
     }
     // Otherwise allocate a new symbol.
     StringInputBuffer buffer(string_);
     return Heap::AllocateSymbol(&buffer, string_->length(), string_->Hash());
   }
@@ skipping 854 matching lines @@
   // No break point.
   if (break_point_objects()->IsUndefined()) return 0;
   // Single beak point.
   if (!break_point_objects()->IsFixedArray()) return 1;
   // Multiple break points.
   return FixedArray::cast(break_point_objects())->length();
 }
 
 
 } }  // namespace v8::internal