Use the number of in-object properties when deciding how many fast...

src/objects.h

Index: src/objects.h
===================================================================
--- src/objects.h	(revision 5007)
+++ src/objects.h	(working copy)
@@ -1367,6 +1367,7 @@
   // Returns the index'th element.
   // The undefined object if index is out of bounds.
   Object* GetElementWithReceiver(JSObject* receiver, uint32_t index);
+  Object* GetElementWithInterceptor(JSObject* receiver, uint32_t index);
 
   Object* SetFastElementsCapacityAndLength(int capacity, int length);
   Object* SetSlowElements(Object* length);
@@ -1547,6 +1548,11 @@
 #endif
   Object* SlowReverseLookup(Object* value);
 
+  // Maximal number of fast properties for the JSObject. Used to
+  // restrict the number of map transitions to avoid an explosion in
+  // the number of maps for objects used as dictionaries.
+  inline int MaxFastProperties();
+
   // Maximal number of elements (numbered 0 .. kMaxElementCount - 1).
   // Also maximal value of JSArray's length property.
   static const uint32_t kMaxElementCount = 0xffffffffu;
@@ -1568,8 +1574,6 @@
 
   STATIC_CHECK(kHeaderSize == Internals::kJSObjectHeaderSize);
 
-  Object* GetElementWithInterceptor(JSObject* receiver, uint32_t index);
-
  private:
   Object* GetElementWithCallback(Object* receiver,
                                  Object* structure,