Keep maps when resetting elements.

src/objects.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/v8.h"
 
 #include "src/accessors.h"
 #include "src/allocation-site-scopes.h"
 #include "src/api.h"
 #include "src/arguments.h"
@@ skipping 4839 matching lines @@
 
   object->set_properties(*fields);
   ASSERT(object->IsJSObject());
 
   // Check that it really works.
   ASSERT(object->HasFastProperties());
 }
 
 
 void JSObject::ResetElements(Handle<JSObject> object) {
-  if (object->map()->is_observed()) {
-    // Maintain invariant that observed elements are always in dictionary mode.
-    Isolate* isolate = object->GetIsolate();
-    Factory* factory = isolate->factory();
-    Handle<SeededNumberDictionary> dictionary =
-        SeededNumberDictionary::New(isolate, 0);
-    if (object->map() == *factory->sloppy_arguments_elements_map()) {
-      FixedArray::cast(object->elements())->set(1, *dictionary);
-    } else {
-      object->set_elements(*dictionary);
-    }
-    return;
+  Heap* heap = object->GetIsolate()->heap();
+  if (object->map() == heap->sloppy_arguments_elements_map()) {

[Toon Verwaest, 2014/06/12 21:58:03]

Are you sure this can ever happen? We never handled that case before. It's
probably worthwhile to ask the O.o guys why they decided to add it. Might just
be defensive programming... I'd prefer to not have such code clutter the
code-base confusing us, if it's not necessary.

[Jakob Kummerow, 2014/06/13 11:56:18]

Agreed, I don't see how this can happen, and it doesn't in the test suite.
Replaced it with a CHECK so clusterfuzz can correct us if we're wrong :-)

+    FixedArray::cast(object->elements())->set(
+        1, heap->empty_slow_element_dictionary());
+  } else {
+    object->set_elements(object->map()->GetInitialElements());
   }
-
-  ElementsKind elements_kind = GetInitialFastElementsKind();
-  if (!FLAG_smi_only_arrays) {
-    elements_kind = FastSmiToObjectElementsKind(elements_kind);
-  }
-  Handle<Map> map = JSObject::GetElementsTransitionMap(object, elements_kind);
-  DisallowHeapAllocation no_gc;
-  Handle<FixedArrayBase> elements(map->GetInitialElements());
-  JSObject::SetMapAndElements(object, map, elements);
 }
 
 
 static Handle<SeededNumberDictionary> CopyFastElementsToDictionary(
     Handle<FixedArrayBase> array,
     int length,
     Handle<SeededNumberDictionary> dictionary) {
   Isolate* isolate = array->GetIsolate();
   Factory* factory = isolate->factory();
   bool has_double_elements = array->IsFixedDoubleArray();
@@ skipping 12202 matching lines @@
 #define ERROR_MESSAGES_TEXTS(C, T) T,
   static const char* error_messages_[] = {
       ERROR_MESSAGES_LIST(ERROR_MESSAGES_TEXTS)
   };
 #undef ERROR_MESSAGES_TEXTS
   return error_messages_[reason];
 }
 
 
 } }  // namespace v8::internal