[crankshaft] Bump the fast literal properties budget.

src/crankshaft/hydrogen.h

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef V8_CRANKSHAFT_HYDROGEN_H_
 #define V8_CRANKSHAFT_HYDROGEN_H_
 
 #include "src/accessors.h"
 #include "src/allocation.h"
 #include "src/ast/ast-type-bounds.h"
@@ skipping 2097 matching lines @@
   static const int kMaxLoadPolymorphism = 4;
   static const int kMaxStorePolymorphism = 4;
 
   // Even in the 'unlimited' case we have to have some limit in order not to
   // overflow the stack.
   static const int kUnlimitedMaxInlinedSourceSize = 100000;
   static const int kUnlimitedMaxInlinedNodes = 10000;
   static const int kUnlimitedMaxInlinedNodesCumulative = 10000;
 
   // Maximum depth and total number of elements and properties for literal
-  // graphs to be considered for fast deep-copying.
+  // graphs to be considered for fast deep-copying. The limit is chosen to
+  // match the maximum number of inobject properties, to ensure that the
+  // performance of using object literals is not worse than using constructor
+  // functions, see crbug.com/v8/6211 for details.
   static const int kMaxFastLiteralDepth = 3;
-  static const int kMaxFastLiteralProperties = 8;
+  static const int kMaxFastLiteralProperties =
+      (JSObject::kMaxInstanceSize - JSObject::kHeaderSize) >> kPointerSizeLog2;
 
   // Simple accessors.
   void set_function_state(FunctionState* state) { function_state_ = state; }
 
   AstContext* ast_context() const { return ast_context_; }
   void set_ast_context(AstContext* context) { ast_context_ = context; }
 
   // Accessors forwarded to the function state.
   CompilationInfo* current_info() const {
     return function_state()->compilation_info();
@@ skipping 871 matching lines @@
   }
 
  private:
   HOptimizedGraphBuilder* builder_;
 };
 
 }  // namespace internal
 }  // namespace v8
 
 #endif  // V8_CRANKSHAFT_HYDROGEN_H_