Bugfix: A TransitionArray can disappear during copy.

src/transitions.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 62 matching lines @@
                                origin->GetKey(origin_transition),
                                origin->GetTarget(origin_transition));
 }
 
 
 static bool InsertionPointFound(Name* key1, Name* key2) {
   return key1->Hash() > key2->Hash();
 }
 
 
-Handle<TransitionArray> TransitionArray::NewWith(SimpleTransitionFlag flag,
-                                                 Handle<Name> key,
+Handle<TransitionArray> TransitionArray::NewWith(Handle<Map> map,
+                                                 Handle<Name> name,
                                                  Handle<Map> target,
-                                                 Handle<Object> back_pointer) {
+                                                 SimpleTransitionFlag flag) {
   Handle<TransitionArray> result;
-  Factory* factory = key->GetIsolate()->factory();
+  Factory* factory = name->GetIsolate()->factory();
 
   if (flag == SIMPLE_TRANSITION) {
     result = factory->NewSimpleTransitionArray(target);
   } else {
     result = factory->NewTransitionArray(1);
-    result->NoIncrementalWriteBarrierSet(0, *key, *target);
+    result->NoIncrementalWriteBarrierSet(0, *name, *target);
   }
-  result->set_back_pointer_storage(*back_pointer);
+  result->set_back_pointer_storage(map->GetBackPointer());
   return result;
 }
 
 
 MaybeObject* TransitionArray::ExtendToFullTransitionArray() {
   ASSERT(!IsFullTransitionArray());
   int nof = number_of_transitions();
   TransitionArray* result;
   MaybeObject* maybe_result = Allocate(GetIsolate(), nof);
   if (!maybe_result->To(&result)) return maybe_result;
 
   if (nof == 1) {
     result->NoIncrementalWriteBarrierCopyFrom(this, kSimpleTransitionIndex, 0);
   }
 
   result->set_back_pointer_storage(back_pointer_storage());
   return result;
 }
 
 
 Handle<TransitionArray> TransitionArray::CopyInsert(Handle<Map> map,
                                                     Handle<Name> name,
-                                                    Handle<Map> target) {
-  ASSERT(map->HasTransitionArray());
-  Handle<TransitionArray> result;
+                                                    Handle<Map> target,
+                                                    SimpleTransitionFlag flag) {
+  if (!map->HasTransitionArray()) {
+    return TransitionArray::NewWith(map, name, target, flag);
+  }
 
   int number_of_transitions = map->transitions()->number_of_transitions();
   int new_size = number_of_transitions;
 
   int insertion_index = map->transitions()->Search(*name);
   if (insertion_index == kNotFound) ++new_size;
 
-  result = map->GetIsolate()->factory()->NewTransitionArray(new_size);
+  Handle<TransitionArray> result =
+      map->GetIsolate()->factory()->NewTransitionArray(new_size);
 
-  // The map's transition array may have grown smaller during the allocation
-  // above as it was weakly traversed. Trim the result copy if needed, and
-  // recompute variables.
+  // The map's transition array may have disappeared or grown smaller during
+  // the allocation above as it was weakly traversed. Trim the result copy if
+  // needed, and recompute variables.
   DisallowHeapAllocation no_gc;
+  if (!map->HasTransitionArray()) {
+    if (flag == SIMPLE_TRANSITION) {
+      ASSERT(result->length() >= kSimpleTransitionSize);
+      result->Shrink(kSimpleTransitionSize);
+      result->set(kSimpleTransitionTarget, *target);
+    } else {
+      ASSERT(result->length() >= ToKeyIndex(1));
+      result->Shrink(ToKeyIndex(1));
+      result->set(kPrototypeTransitionsIndex, Smi::FromInt(0));
+      result->NoIncrementalWriteBarrierSet(0, *name, *target);
+    }
+    result->set_back_pointer_storage(map->GetBackPointer());
+
+    return result;
+  }
+
   TransitionArray* array = map->transitions();
   if (array->number_of_transitions() != number_of_transitions) {
     ASSERT(array->number_of_transitions() < number_of_transitions);
 
     number_of_transitions = array->number_of_transitions();
     new_size = number_of_transitions;
 
     insertion_index = array->Search(*name);
     if (insertion_index == kNotFound) ++new_size;
 
-    result->Shrink(new_size);
+    result->Shrink(ToKeyIndex(new_size));
   }
 
   if (array->HasPrototypeTransitions()) {
     result->SetPrototypeTransitions(array->GetPrototypeTransitions());
   }
 
   if (insertion_index != kNotFound) {
     for (int i = 0; i < number_of_transitions; ++i) {
       if (i != insertion_index) {
         result->NoIncrementalWriteBarrierCopyFrom(array, i, i);
@@ skipping 17 matching lines @@
     result->NoIncrementalWriteBarrierCopyFrom(
         array, insertion_index, insertion_index + 1);
   }
 
   result->set_back_pointer_storage(array->back_pointer_storage());
   return result;
 }
 
 
 } }  // namespace v8::internal