- Added fast case for extending the JSObject properties storage....

src/stub-cache-ia32.cc

 // Copyright 2006-2008 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 418 matching lines @@
 
   // Stub never generated for non-global objects that require access
   // checks.
   ASSERT(object->IsJSGlobalObject() || !object->IsAccessCheckNeeded());
 
   // Get the properties array (optimistically).
   __ mov(scratch, FieldOperand(receiver_reg, JSObject::kPropertiesOffset));
 
   // Perform map transition for the receiver if necessary.
   if (transition != NULL) {
-    // Update the map of the object; no write barrier updating is
-    // needed because the map is never in new space.
-    __ mov(FieldOperand(receiver_reg, HeapObject::kMapOffset),
-           Immediate(Handle<Map>(transition)));
+    if (object->map()->unused_property_fields() == 0) {
+      // The properties must be extended before we can store the value.
+      // We jump to a runtime call that extends the propeties array.
+      __ mov(Operand(ecx), Immediate(Handle<Map>(transition)));
+      Handle<Code> ic(Builtins::builtin(Builtins::StoreIC_ExtendStorage));
+      __ jmp(ic, RelocInfo::CODE_TARGET);
+    } else {
+      // Update the map of the object; no write barrier updating is
+      // needed because the map is never in new space.
+      __ mov(FieldOperand(receiver_reg, HeapObject::kMapOffset),
+             Immediate(Handle<Map>(transition)));
+    }
   }
 
   // Write to the properties array.
   int offset = index * kPointerSize + Array::kHeaderSize;
   __ mov(FieldOperand(scratch, offset), eax);
 
   // Update the write barrier for the array address.
   // Pass the value being stored in the now unused name_reg.
   __ mov(name_reg, Operand(eax));
   __ RecordWrite(scratch, offset, name_reg, receiver_reg);
@@ skipping 780 matching lines @@
   GenerateLoadMiss(masm(), Code::KEYED_LOAD_IC);
 
   // Return the generated code.
   return GetCode(CALLBACKS);
 }
 
 
 #undef __
 
 } }  // namespace v8::internal