Index: bleeding_edge/src/objects.cc |
=================================================================== |
--- bleeding_edge/src/objects.cc (revision 3473) |
+++ bleeding_edge/src/objects.cc (working copy) |
@@ -1351,6 +1351,8 @@ |
Object* JSObject::AddConstantFunctionProperty(String* name, |
JSFunction* function, |
PropertyAttributes attributes) { |
+ ASSERT(!Heap::InNewSpace(function)); |
+ |
// Allocate new instance descriptors with (name, function) added |
ConstantFunctionDescriptor d(name, function, attributes); |
Object* new_descriptors = |
@@ -1437,7 +1439,7 @@ |
// Ensure the descriptor array does not get too big. |
if (map()->instance_descriptors()->number_of_descriptors() < |
DescriptorArray::kMaxNumberOfDescriptors) { |
- if (value->IsJSFunction()) { |
+ if (value->IsJSFunction() && !Heap::InNewSpace(value)) { |
return AddConstantFunctionProperty(name, |
JSFunction::cast(value), |
attributes); |
@@ -3254,7 +3256,8 @@ |
return Heap::empty_descriptor_array(); |
} |
// Allocate the array of keys. |
- Object* array = Heap::AllocateFixedArray(ToKeyIndex(number_of_descriptors)); |
+ Object* array = |
+ Heap::AllocateFixedArray(ToKeyIndex(number_of_descriptors)); |
if (array->IsFailure()) return array; |
// Do not use DescriptorArray::cast on incomplete object. |
FixedArray* result = FixedArray::cast(array); |
@@ -7962,7 +7965,10 @@ |
PropertyType type = DetailsAt(i).type(); |
ASSERT(type != FIELD); |
instance_descriptor_length++; |
- if (type == NORMAL && !value->IsJSFunction()) number_of_fields += 1; |
+ if (type == NORMAL && |
+ (!value->IsJSFunction() || Heap::InNewSpace(value))) { |
+ number_of_fields += 1; |
+ } |
} |
} |
@@ -7993,7 +7999,7 @@ |
PropertyDetails details = DetailsAt(i); |
PropertyType type = details.type(); |
- if (value->IsJSFunction()) { |
+ if (value->IsJSFunction() && !Heap::InNewSpace(value)) { |
ConstantFunctionDescriptor d(String::cast(key), |
JSFunction::cast(value), |
details.attributes(), |