Revert "Inobject slack tracking is done on a per-closure basis instead of per-shared info basis."

src/runtime.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <stdlib.h>
 #include <limits>
 
 #include "v8.h"
 
 #include "accessors.h"
@@ skipping 3107 matching lines @@
   return *target;
 }
 
 
 RUNTIME_FUNCTION(Runtime_SetExpectedNumberOfProperties) {
   HandleScope scope(isolate);
   ASSERT(args.length() == 2);
   CONVERT_ARG_HANDLE_CHECKED(JSFunction, func, 0);
   CONVERT_SMI_ARG_CHECKED(num, 1);
   RUNTIME_ASSERT(num >= 0);
-
-  func->shared()->set_expected_nof_properties(num);
-  if (func->has_initial_map()) {
-    Handle<Map> new_initial_map = Map::Copy(handle(func->initial_map()));
-    new_initial_map->set_unused_property_fields(num);
-    func->set_initial_map(*new_initial_map);
+  // If objects constructed from this function exist then changing
+  // 'estimated_nof_properties' is dangerous since the previous value might
+  // have been compiled into the fast construct stub. Moreover, the inobject
+  // slack tracking logic might have adjusted the previous value, so even
+  // passing the same value is risky.
+  if (!func->shared()->live_objects_may_exist()) {
+    func->shared()->set_expected_nof_properties(num);
+    if (func->has_initial_map()) {
+      Handle<Map> new_initial_map = Map::Copy(handle(func->initial_map()));
+      new_initial_map->set_unused_property_fields(num);
+      func->set_initial_map(*new_initial_map);
+    }
   }
   return isolate->heap()->undefined_value();
 }
 
 
 RUNTIME_FUNCTION(RuntimeHidden_CreateJSGeneratorObject) {
   HandleScope scope(isolate);
   ASSERT(args.length() == 0);
 
   JavaScriptFrameIterator it(isolate);
@@ skipping 5216 matching lines @@
       // reported the same way whether or not 'Function' is called
       // using 'new'.
       return isolate->context()->global_object();
     }
   }
 
   // The function should be compiled for the optimization hints to be
   // available.
   Compiler::EnsureCompiled(function, CLEAR_EXCEPTION);
 
+  Handle<SharedFunctionInfo> shared(function->shared(), isolate);
+  if (!function->has_initial_map() &&
+      shared->IsInobjectSlackTrackingInProgress()) {
+    // The tracking is already in progress for another function. We can only
+    // track one initial_map at a time, so we force the completion before the
+    // function is called as a constructor for the first time.
+    shared->CompleteInobjectSlackTracking();
+  }
+
   Handle<JSObject> result;
   if (site.is_null()) {
     result = isolate->factory()->NewJSObject(function);
   } else {
     result = isolate->factory()->NewJSObjectWithMemento(function, site);
   }
 
   isolate->counters()->constructed_objects()->Increment();
   isolate->counters()->constructed_objects_runtime()->Increment();
 
@@ skipping 23 matching lines @@
   }
   return Runtime_NewObjectHelper(isolate, constructor, site);
 }
 
 
 RUNTIME_FUNCTION(RuntimeHidden_FinalizeInstanceSize) {
   HandleScope scope(isolate);
   ASSERT(args.length() == 1);
 
   CONVERT_ARG_HANDLE_CHECKED(JSFunction, function, 0);
-  function->CompleteInobjectSlackTracking();
+  function->shared()->CompleteInobjectSlackTracking();
 
   return isolate->heap()->undefined_value();
 }
 
 
 RUNTIME_FUNCTION(RuntimeHidden_CompileUnoptimized) {
   HandleScope scope(isolate);
   ASSERT(args.length() == 1);
   CONVERT_ARG_HANDLE_CHECKED(JSFunction, function, 0);
 #ifdef DEBUG
@@ skipping 6766 matching lines @@
   }
   return NULL;
 }
 
 
 const Runtime::Function* Runtime::FunctionForId(Runtime::FunctionId id) {
   return &(kIntrinsicFunctions[static_cast<int>(id)]);
 }
 
 } }  // namespace v8::internal