Fix crashes during GC caused by partially initialized objects. The...

src/x64/stub-cache-x64.cc

 // Copyright 2010 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 2872 matching lines @@
                       scratch1, scratch2, scratch3, name, miss);
 
   // Return the constant value.
   __ Move(rax, Handle<Object>(value));
   __ ret(0);
 }
 
 
 // Specialized stub for constructing objects from functions which only have only
 // simple assignments of the form this.x = ...; in their body.
-MaybeObject* ConstructStubCompiler::CompileConstructStub(
-    SharedFunctionInfo* shared) {
+MaybeObject* ConstructStubCompiler::CompileConstructStub(JSFunction* function) {
   // ----------- S t a t e -------------
   //  -- rax : argc
   //  -- rdi : constructor
   //  -- rsp[0] : return address
   //  -- rsp[4] : last argument
   // -----------------------------------
   Label generic_stub_call;
 
   // Use r8 for holding undefined which is used in several places below.
   __ Move(r8, Factory::undefined_value());
@@ skipping 52 matching lines @@
   // return address on top of the argc arguments.
   __ lea(rcx, Operand(rsp, rax, times_pointer_size, 0));
 
   // rax: argc
   // rcx: first argument
   // rdx: JSObject (untagged)
   // r8: undefined
   // r9: first in-object property of the JSObject
   // Fill the initialized properties with a constant value or a passed argument
   // depending on the this.x = ...; assignment in the function.
+  SharedFunctionInfo* shared = function->shared();
   for (int i = 0; i < shared->this_property_assignments_count(); i++) {
     if (shared->IsThisPropertyAssignmentArgument(i)) {
       // Check if the argument assigned to the property is actually passed.
       // If argument is not passed the property is set to undefined,
       // otherwise find it on the stack.
       int arg_number = shared->GetThisPropertyAssignmentArgument(i);
       __ movq(rbx, r8);
       __ cmpq(rax, Immediate(arg_number));
       __ cmovq(above, rbx, Operand(rcx, arg_number * -kPointerSize));
       // Store value in the property.
       __ movq(Operand(r9, i * kPointerSize), rbx);
     } else {
       // Set the property to the constant value.
       Handle<Object> constant(shared->GetThisPropertyAssignmentConstant(i));
       __ Move(Operand(r9, i * kPointerSize), constant);
     }
   }
 
   // Fill the unused in-object property fields with undefined.
+  ASSERT(function->has_initial_map());
   for (int i = shared->this_property_assignments_count();
-       i < shared->CalculateInObjectProperties();
+       i < function->initial_map()->inobject_properties();
        i++) {
     __ movq(Operand(r9, i * kPointerSize), r8);
   }
 
   // rax: argc
   // rdx: JSObject (untagged)
   // Move argc to rbx and the JSObject to return to rax and tag it.
   __ movq(rbx, rax);
   __ movq(rax, rdx);
   __ or_(rax, Immediate(kHeapObjectTag));
@@ skipping 18 matching lines @@
   // Return the generated code.
   return GetCode();
 }
 
 
 #undef __
 
 } }  // namespace v8::internal
 
 #endif  // V8_TARGET_ARCH_X64