[runtime] Object.create(null) creates a slow object

src/builtins/builtins-object.cc

Index: src/builtins/builtins-object.cc
diff --git a/src/builtins/builtins-object.cc b/src/builtins/builtins-object.cc
index 6cc2d705b4f556585f60c1793fdfb8207a6d6d13..a19e94718f7cd2c2daf60b5cf3c3f720ee891f19 100644
--- a/src/builtins/builtins-object.cc
+++ b/src/builtins/builtins-object.cc
@@ -505,6 +505,7 @@ void Builtins::Generate_ObjectCreate(CodeStubAssembler* a) {
   a->Bind(&no_properties);
   {
     Variable map(a, MachineRepresentation::kTagged);
+    Variable properties(a, MachineRepresentation::kTagged);
     Label non_null_proto(a), instantiate_map(a), good(a);
 
     a->Branch(a->WordEqual(prototype, a->NullConstant()), &good,
@@ -512,13 +513,16 @@ void Builtins::Generate_ObjectCreate(CodeStubAssembler* a) {
 
     a->Bind(&good);
     {
-      map.Bind(a->LoadContextElement(context,
-                                     Context::OBJECT_WITH_NULL_PROTOTYPE_MAP));
+      map.Bind(a->LoadContextElement(
+          context, Context::SLOW_OBJECT_WITH_NULL_PROTOTYPE_MAP));
+      properties.Bind(
+          a->AllocateNameDictionary(NameDictionary::kInitialCapacity));

[Camillo Bruni, 2016/10/21 13:37:15]

How can I make sure the GC updates the properties pointer correctly if we
trigger a GC later-on when allocating the JSObject in AllocateJSObjectFromMap?

[Igor Sheludko, 2016/10/21 15:01:09]

You marked the variable as kTagged, so the compiler will make GC know about yet
another value to update. 

       a->Goto(&instantiate_map);
     }
 
     a->Bind(&non_null_proto);
     {
+      properties.Bind(a->EmptyFixedArrayConstant());
       Node* object_function =
           a->LoadContextElement(context, Context::OBJECT_FUNCTION_INDEX);
       Node* object_function_map = a->LoadObjectField(
@@ -539,7 +543,8 @@ void Builtins::Generate_ObjectCreate(CodeStubAssembler* a) {
 
     a->Bind(&instantiate_map);
     {
-      Node* instance = a->AllocateJSObjectFromMap(map.value());
+      Node* instance =
+          a->AllocateJSObjectFromMap(map.value(), properties.value());
       a->Return(instance);
     }
   }