Ensure slow properties for simple {__proto__:null} literals.

src/builtins/builtins-constructor.cc

Index: src/builtins/builtins-constructor.cc
diff --git a/src/builtins/builtins-constructor.cc b/src/builtins/builtins-constructor.cc
index 0d303c90c156b3dad8c11e8dc70469bfe49ea05a..ae6dd2d6e1ce51df9905e66b162430705fef092b 100644
--- a/src/builtins/builtins-constructor.cc
+++ b/src/builtins/builtins-constructor.cc
@@ -714,7 +714,6 @@ Node* ConstructorBuiltinsAssembler::EmitFastCloneShallowObject(
     offset.Bind(IntPtrAdd(offset.value(), IntPtrConstant(kPointerSize)));
     GotoIfNot(IntPtrGreaterThanOrEqual(offset.value(), end_offset), &loop_body);
   }
-
   if (FLAG_allocation_site_pretenuring) {
     Node* memento = InnerAllocate(copy, object_size);
     StoreMapNoWriteBarrier(memento, Heap::kAllocationMementoMapRootIndex);
@@ -729,6 +728,24 @@ Node* ConstructorBuiltinsAssembler::EmitFastCloneShallowObject(
                                    memento_create_count);
   }
 
+  // Directly copy over the property store for dict-mode boilerplates.
+  Label dict_properties(this), done(this);
+  Branch(IsDictionaryMap(boilerplate_map), &dict_properties, &done);
+  Bind(&dict_properties);
+  {
+    Comment("Copy boilderplate property dict");
+    Node* boilerplate_properties = LoadProperties(boilerplate);
+    // TODO(cbruni): Use inner allocate for name dictionary
+    Node* properties = AllocateNameDictionary(
+        SmiUntag(GetCapacity<NameDictionary>(boilerplate_properties)));
+    CopyFixedArrayElements(FAST_ELEMENTS, boilerplate_properties, properties,
+                           LoadFixedArrayBaseLength(boilerplate_properties),
+                           SKIP_WRITE_BARRIER, SMI_PARAMETERS);

[Toon Verwaest, 2017/03/14 13:27:47]

With black allocation I'm not sure this is safe if the array ends up in old
space. AllocateNameDictionary isn't explicitly allocating in new space, and
could be LOS at least.

[Camillo Bruni, 2017/03/17 16:40:55]

Adding separate helper to make the contract clearer, calling to the runtime for
now, probably a very infrequent case, having large-object properties.

+    StoreObjectField(copy, JSObject::kPropertiesOffset, properties);
+    Goto(&done);
+  }
+  Bind(&done);
+
   // TODO(verwaest): Allocate and fill in double boxes.
   return copy;
 }