Don't use the same descriptor array in several maps

src/objects.cc

Index: src/objects.cc
===================================================================
--- src/objects.cc	(revision 2777)
+++ src/objects.cc	(working copy)
@@ -2929,8 +2929,11 @@
   if (pre_allocated_property_fields() > 0) {
     ASSERT(constructor()->IsJSFunction());
     JSFunction* ctor = JSFunction::cast(constructor());
+    Object* descriptors =

[William Hesse, 2009/08/28 11:07:19]

This entire test should be removed from CopyDropDescriptors, and instead done at
the call site where CopyDropDescriptors is used without immediately overwriting
the empty descriptor array.  But this is OK for now.

+        ctor->initial_map()->instance_descriptors()->RemoveTransitions();
+    if (descriptors->IsFailure()) return descriptors;
     Map::cast(result)->set_instance_descriptors(
-        ctor->initial_map()->instance_descriptors());
+        DescriptorArray::cast(descriptors));
     Map::cast(result)->set_pre_allocated_property_fields(
         pre_allocated_property_fields());
   }