Revert "Inobject slack tracking is done on a per-closure basis instead of per-shared info basis."

src/runtime.cc

Index: src/runtime.cc
diff --git a/src/runtime.cc b/src/runtime.cc
index c41d5c434376f12d9a8e3b6992d558660ce8d0e0..d5cedc7e9ca51c4eb39506a5b5c0b40e81f8bd08 100644
--- a/src/runtime.cc
+++ b/src/runtime.cc
@@ -3125,12 +3125,18 @@ RUNTIME_FUNCTION(Runtime_SetExpectedNumberOfProperties) {
   CONVERT_ARG_HANDLE_CHECKED(JSFunction, func, 0);
   CONVERT_SMI_ARG_CHECKED(num, 1);
   RUNTIME_ASSERT(num >= 0);
-
-  func->shared()->set_expected_nof_properties(num);
-  if (func->has_initial_map()) {
-    Handle<Map> new_initial_map = Map::Copy(handle(func->initial_map()));
-    new_initial_map->set_unused_property_fields(num);
-    func->set_initial_map(*new_initial_map);
+  // If objects constructed from this function exist then changing
+  // 'estimated_nof_properties' is dangerous since the previous value might
+  // have been compiled into the fast construct stub. Moreover, the inobject
+  // slack tracking logic might have adjusted the previous value, so even
+  // passing the same value is risky.
+  if (!func->shared()->live_objects_may_exist()) {
+    func->shared()->set_expected_nof_properties(num);
+    if (func->has_initial_map()) {
+      Handle<Map> new_initial_map = Map::Copy(handle(func->initial_map()));
+      new_initial_map->set_unused_property_fields(num);
+      func->set_initial_map(*new_initial_map);
+    }
   }
   return isolate->heap()->undefined_value();
 }
@@ -8367,6 +8373,15 @@ static Object* Runtime_NewObjectHelper(Isolate* isolate,
   // available.
   Compiler::EnsureCompiled(function, CLEAR_EXCEPTION);
 
+  Handle<SharedFunctionInfo> shared(function->shared(), isolate);
+  if (!function->has_initial_map() &&
+      shared->IsInobjectSlackTrackingInProgress()) {
+    // The tracking is already in progress for another function. We can only
+    // track one initial_map at a time, so we force the completion before the
+    // function is called as a constructor for the first time.
+    shared->CompleteInobjectSlackTracking();
+  }
+
   Handle<JSObject> result;
   if (site.is_null()) {
     result = isolate->factory()->NewJSObject(function);
@@ -8410,7 +8425,7 @@ RUNTIME_FUNCTION(RuntimeHidden_FinalizeInstanceSize) {
   ASSERT(args.length() == 1);
 
   CONVERT_ARG_HANDLE_CHECKED(JSFunction, function, 0);
-  function->CompleteInobjectSlackTracking();
+  function->shared()->CompleteInobjectSlackTracking();
 
   return isolate->heap()->undefined_value();
 }