Ensure slow properties for simple {__proto__:null} literals.

src/builtins/builtins-constructor-gen.cc

Index: src/builtins/builtins-constructor-gen.cc
diff --git a/src/builtins/builtins-constructor-gen.cc b/src/builtins/builtins-constructor-gen.cc
index b9cd77dc9c73bf79a0af3e7303150efbeae36050..4b3feb739c345c4288d35c0a4ecd628c48ea3cd0 100644
--- a/src/builtins/builtins-constructor-gen.cc
+++ b/src/builtins/builtins-constructor-gen.cc
@@ -644,6 +644,22 @@ Node* ConstructorBuiltinsAssembler::EmitFastCloneShallowObject(
       feedback_vector, literals_index, 0, CodeStubAssembler::SMI_PARAMETERS);
   GotoIf(IsUndefined(allocation_site), call_runtime);
 
+  Node* boilerplate =
+      LoadObjectField(allocation_site, AllocationSite::kTransitionInfoOffset);
+  Node* boilerplate_map = LoadMap(boilerplate);
+  Variable properties(this, MachineRepresentation::kTagged,
+                      EmptyFixedArrayConstant());
+  // Directly copy over the property store for dict-mode boilerplates.
+  Label dict_properties(this), allocate_object(this);
+  Branch(IsDictionaryMap(boilerplate_map), &dict_properties, &allocate_object);
+  Bind(&dict_properties);
+  {
+    properties.Bind(
+        CopyNameDictionary(LoadProperties(boilerplate), call_runtime));
+    Goto(&allocate_object);
+  }
+  Bind(&allocate_object);
+
   // Calculate the object and allocation size based on the properties count.
   Node* object_size = IntPtrAdd(WordShl(properties_count, kPointerSizeLog2),
                                 IntPtrConstant(JSObject::kHeaderSize));
@@ -652,15 +668,15 @@ Node* ConstructorBuiltinsAssembler::EmitFastCloneShallowObject(
     allocation_size =
         IntPtrAdd(object_size, IntPtrConstant(AllocationMemento::kSize));
   }
-  Node* boilerplate =
-      LoadObjectField(allocation_site, AllocationSite::kTransitionInfoOffset);
-  Node* boilerplate_map = LoadMap(boilerplate);
+
   Node* instance_size = LoadMapInstanceSize(boilerplate_map);
   Node* size_in_words = WordShr(object_size, kPointerSizeLog2);
   GotoIfNot(WordEqual(instance_size, size_in_words), call_runtime);
 
   Node* copy = AllocateInNewSpace(allocation_size);
 
+  StoreObjectFieldNoWriteBarrier(copy, JSObject::kPropertiesOffset,
+                                 properties.value());

[Toon Verwaest, 2017/03/20 14:47:11]

Isn't this field overwritten by the initialization loop below, effectively
sharing the "empty dictionary" between all boilerplate copies?

   // Copy boilerplate elements.
   Variable offset(this, MachineType::PointerRepresentation());
   offset.Bind(IntPtrConstant(-kHeapObjectTag));