Object.oberve: assertions to narrow down flaky crashes with array length mutation.

Object.oberve: assertions to narrow down flaky crashes with array length mutation.

R=mstarzinger@chromium.org
BUG=v8:2409
Committed: http://code.google.com/p/v8/source/detail?r=13221

[Michael Starzinger, 2012-12-14 11:47:51]

https://codereview.chromium.org/11566027/diff/1/src/objects-inl.h
File src/objects-inl.h (right):

https://codereview.chromium.org/11566027/diff/1/src/objects-inl.h#newcode1425
src/objects-inl.h:1425: if (is_observed) old_map->set_is_observed(false);
This modifies the old_map before a new one is allocated. If the allocation fails
it will kick you out of this function and on re-entry observation bit is gone.
In short: This function is no longer idempotent.

[rossberg, 2012-12-14 12:18:14]

https://codereview.chromium.org/11566027/diff/1/src/objects-inl.h
File src/objects-inl.h (right):

https://codereview.chromium.org/11566027/diff/1/src/objects-inl.h#newcode1425
src/objects-inl.h:1425: if (is_observed) old_map->set_is_observed(false);
On 2012/12/14 11:47:51, Michael Starzinger wrote:
> This modifies the old_map before a new one is allocated. If the allocation
fails
> it will kick you out of this function and on re-entry observation bit is gone.
> In short: This function is no longer idempotent.

Indeed. This was way too ugly anyway.

Removed use of NormalizeElements and instead construct an empty dictionary
directly. While this duplicates the special-casing of arguments objects, it
ultimately is simpler than before.

[Michael Starzinger, 2012-12-14 12:26:10]

LGTM.