- Added conditional write barrier to object accessors....

src/bootstrapper.cc

 // Copyright 2006-2008 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 721 matching lines @@
 
   {  // --- arguments_boilerplate_
     // Make sure we can recognize argument objects at runtime.
     // This is done by introducing an anonymous function with
     // class_name equals 'Arguments'.
     Handle<String> symbol = Factory::LookupAsciiSymbol("Arguments");
     Handle<Code> code = Handle<Code>(Builtins::builtin(Builtins::Illegal));
     Handle<JSObject> prototype =
         Handle<JSObject>(
             JSObject::cast(global_context()->object_function()->prototype()));
+
     Handle<JSFunction> function =
-        Factory::NewFunctionWithPrototype(symbol, JS_OBJECT_TYPE,
-                                          JSObject::kHeaderSize, prototype,
-                                          code, true);
+        Factory::NewFunctionWithPrototype(symbol,
+                                          JS_OBJECT_TYPE,
+                                          JSObject::kHeaderSize,
+                                          prototype,
+                                          code,
+                                          false);
+    ASSERT(!function->has_initial_map());
     function->shared()->set_instance_class_name(*symbol);
-
+    function->shared()->set_expected_nof_properties(2);
     Handle<JSObject> result = Factory::NewJSObject(function);
 
     global_context()->set_arguments_boilerplate(*result);
     // Note: callee must be added as the first property and
     //       length must be added as the second property.
-    SetProperty(result, Factory::callee_symbol(), Factory::undefined_value(),
+    SetProperty(result, Factory::callee_symbol(),
+                Factory::undefined_value(),
                 DONT_ENUM);
-    SetProperty(result, Factory::length_symbol(), Factory::undefined_value(),
+    SetProperty(result, Factory::length_symbol(),
+                Factory::undefined_value(),
                 DONT_ENUM);
 
+#ifdef DEBUG
+    LookupResult lookup;
+    result->LocalLookup(Heap::callee_symbol(), &lookup);
+    ASSERT(lookup.IsValid() && (lookup.type() == FIELD));
+    ASSERT(lookup.GetFieldIndex() == Heap::arguments_callee_index);
+
+    result->LocalLookup(Heap::length_symbol(), &lookup);
+    ASSERT(lookup.IsValid() && (lookup.type() == FIELD));
+    ASSERT(lookup.GetFieldIndex() == Heap::arguments_length_index);
+
+    ASSERT(result->map()->inobject_properties() > Heap::arguments_callee_index);
+    ASSERT(result->map()->inobject_properties() > Heap::arguments_length_index);
+
     // Check the state of the object.
     ASSERT(result->HasFastProperties());
     ASSERT(result->HasFastElements());
+#endif
   }
 
   {  // --- context extension
     // Create a function for the context extension objects.
     Handle<Code> code = Handle<Code>(Builtins::builtin(Builtins::Illegal));
     Handle<JSFunction> context_extension_fun =
         Factory::NewFunction(Factory::empty_symbol(), JS_OBJECT_TYPE,
                              JSObject::kHeaderSize, code, true);
 
     Handle<String> name = Factory::LookupAsciiSymbol("context_extension");
@@ skipping 656 matching lines @@
   if (!ConfigureGlobalObjects(global_template)) return;
 
   if (!InstallExtensions(extensions)) return;
 
   if (!InstallSpecialObjects()) return;
 
   result_ = global_context_;
 }
 
 } }  // namespace v8::internal