Fix GC error in ES5 read-only properties implementation.

Fix GC error in ES5 read-only properties implementation.

Committed: http://code.google.com/p/v8/source/detail?r=5676

[Søren Thygesen Gjesse, 2010-10-20 12:07:36]

LGTM

[Kevin Millikin (Chromium), 2010-10-20 12:35:55]

Drive by.

http://codereview.chromium.org/3920005/diff/1/2
File src/runtime.cc (right):

http://codereview.chromium.org/3920005/diff/1/2#newcode3541
src/runtime.cc:3541: Object* ok = js_object->NormalizeElements();
I really don't like mixing HandleScope code with explicit checking.  Can't you
just handlify the whole mess since you're inside a handle scope?

NormalizeElements(js_object);
Handle<NumberDictionary> dictionary(js_object->element_dictionary());
dictionary->set_requires_slow_elements();
PropertyDetails details = PropertyDetails(attr, NORMAL);
DictionarySet(dictionary, obj_value, details);  // You might have to define this
one.

etc?

http://codereview.chromium.org/3920005/diff/1/2#newcode4160
src/runtime.cc:4160: Object* ok =
js_object->NormalizeProperties(CLEAR_INOBJECT_PROPERTIES, 0);
Similarly:

NormalizeProperties(js_object, CLEAR_INOBJECT_PROPERTIES, 0);

[Erik Corry, 2010-10-20 12:49:42]

It's already committed.

[Erik Corry, 2010-10-20 13:12:01]

Oh, it wasn't committed after all.

New version uploaded.

[Kevin Millikin (Chromium), 2010-10-20 13:16:51]

http://codereview.chromium.org/3920005/diff/7001/8003
File src/runtime.cc (right):

http://codereview.chromium.org/3920005/diff/7001/8003#newcode4158
src/runtime.cc:4158: if (ok->IsFailure()) return ok;
You can do the same trick here (use the handle version of NormalizeProperties).