[runtime] Set constructor field on preallocated maps.

[runtime] Set constructor field on preallocated maps.

The preallocated JSAccessorPropertyDescriptor, JSDataPropertyDescriptor and
JSIteratorResult had the constructor field unset, which in turn causes
GetCreationContext() to fail for those instances.

R=verwaest@chromium.org
BUG=v8:4738
LOG=n

Committed: https://crrev.com/9257db7781e3d43ef21db4832c006752fa672b08
Cr-Commit-Position: refs/heads/master@{#33802}

[Benedikt Meurer, 2016-02-06 17:40:44]

Hey Toon,

Quick fix. Wondering if the heap verifier should fail if it sees a JSObjectMap
that doesn't have a valid constructor?
Please take a look.

Thanks,
Benedikt

[Toon Verwaest, 2016-02-08 06:15:55]

lgtm

[Benedikt Meurer, 2016-02-08 06:16:04]

The CQ bit was checked by bmeurer@chromium.org

[commit-bot: I haz the power, 2016-02-08 06:16:10]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1676823002/1
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1676823002/1

[commit-bot: I haz the power, 2016-02-08 07:00:09]

Committed patchset #1 (id:1)

[commit-bot: I haz the power, 2016-02-08 07:00:37]

Description was changed from

==========
[runtime] Set constructor field on preallocated maps.

The preallocated JSAccessorPropertyDescriptor, JSDataPropertyDescriptor and
JSIteratorResult had the constructor field unset, which in turn causes
GetCreationContext() to fail for those instances.

R=verwaest@chromium.org
BUG=v8:4738
LOG=n
==========

to

==========
[runtime] Set constructor field on preallocated maps.

The preallocated JSAccessorPropertyDescriptor, JSDataPropertyDescriptor and
JSIteratorResult had the constructor field unset, which in turn causes
GetCreationContext() to fail for those instances.

R=verwaest@chromium.org
BUG=v8:4738
LOG=n

Committed: https://crrev.com/9257db7781e3d43ef21db4832c006752fa672b08
Cr-Commit-Position: refs/heads/master@{#33802}
==========

[commit-bot: I haz the power, 2016-02-08 07:00:38]

Patchset 1 (id:??) landed as
https://crrev.com/9257db7781e3d43ef21db4832c006752fa672b08
Cr-Commit-Position: refs/heads/master@{#33802}

[Michael Achenbach, 2016-02-08 08:48:41]

Since this, profvis crashes flakily in every revision for internal snapshot:
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20-%20internal%2...

[Michael Achenbach, 2016-02-08 08:49:09]

On 2016/02/08 08:48:41, Michael Achenbach wrote:
> Since this, profvis crashes flakily in every revision for internal snapshot:
>
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20-%20internal%2...

I meant profile.

[Benedikt Meurer, 2016-02-08 09:00:23]

On 2016/02/08 08:49:09, Michael Achenbach wrote:
> On 2016/02/08 08:48:41, Michael Achenbach wrote:
> > Since this, profvis crashes flakily in every revision for internal snapshot:
> >
>
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20-%20internal%2...
> 
> I meant profile.

I'd be rather suprised if profile.js every uses either of these maps :-)
It's probably bad luck, plus profile.js was already flaky before.