- Fix instance size calculation to ensure that the object cannot...

src/heap.cc

 // Copyright 2006-2008 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 1648 matching lines @@
   return result;
 }
 
 
 Object* Heap::AllocateInitialMap(JSFunction* fun) {
   ASSERT(!fun->has_initial_map());
 
   // First create a new map with the expected number of properties being
   // allocated in-object.
   int expected_nof_properties = fun->shared()->expected_nof_properties();
-  Object* map_obj = Heap::AllocateMap(JS_OBJECT_TYPE,
-      JSObject::kHeaderSize + expected_nof_properties * kPointerSize);
+  int instance_size = JSObject::kHeaderSize +
+                      expected_nof_properties * kPointerSize;
+  if (instance_size > JSObject::kMaxInstanceSize) {
+    instance_size = JSObject::kMaxInstanceSize;
+    expected_nof_properties = (instance_size - JSObject::kHeaderSize) /
+                              kPointerSize;
+  }
+  Object* map_obj = Heap::AllocateMap(JS_OBJECT_TYPE, instance_size);
   if (map_obj->IsFailure()) return map_obj;
 
   // Fetch or allocate prototype.
   Object* prototype;
   if (fun->has_instance_prototype()) {
     prototype = fun->instance_prototype();
   } else {
     prototype = AllocateFunctionPrototype(fun);
     if (prototype->IsFailure()) return prototype;
   }
@@ skipping 1397 matching lines @@
       return "Scavenge";
     case MARK_COMPACTOR:
       return MarkCompactCollector::HasCompacted() ? "Mark-compact"
                                                   : "Mark-sweep";
   }
   return "Unknown GC";
 }
 
 
 } }  // namespace v8::internal