Keep maps when resetting elements.

src/objects.cc

Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index bdfa23cde59d32626192b08ec182f5e2784550e6..94a29febb1cf897fae97a168dc893fa2405c78ee 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -4857,28 +4857,13 @@ void JSObject::TransformToFastProperties(Handle<JSObject> object,
 
 
 void JSObject::ResetElements(Handle<JSObject> object) {
-  if (object->map()->is_observed()) {
-    // Maintain invariant that observed elements are always in dictionary mode.
-    Isolate* isolate = object->GetIsolate();
-    Factory* factory = isolate->factory();
-    Handle<SeededNumberDictionary> dictionary =
-        SeededNumberDictionary::New(isolate, 0);
-    if (object->map() == *factory->sloppy_arguments_elements_map()) {
-      FixedArray::cast(object->elements())->set(1, *dictionary);
-    } else {
-      object->set_elements(*dictionary);
-    }
-    return;
-  }
-
-  ElementsKind elements_kind = GetInitialFastElementsKind();
-  if (!FLAG_smi_only_arrays) {
-    elements_kind = FastSmiToObjectElementsKind(elements_kind);
+  Heap* heap = object->GetIsolate()->heap();
+  if (object->map() == heap->sloppy_arguments_elements_map()) {

[Toon Verwaest, 2014/06/12 21:58:03]

Are you sure this can ever happen? We never handled that case before. It's
probably worthwhile to ask the O.o guys why they decided to add it. Might just
be defensive programming... I'd prefer to not have such code clutter the
code-base confusing us, if it's not necessary.

[Jakob Kummerow, 2014/06/13 11:56:18]

Agreed, I don't see how this can happen, and it doesn't in the test suite.
Replaced it with a CHECK so clusterfuzz can correct us if we're wrong :-)

+    FixedArray::cast(object->elements())->set(
+        1, heap->empty_slow_element_dictionary());
+  } else {
+    object->set_elements(object->map()->GetInitialElements());
   }
-  Handle<Map> map = JSObject::GetElementsTransitionMap(object, elements_kind);
-  DisallowHeapAllocation no_gc;
-  Handle<FixedArrayBase> elements(map->GetInitialElements());
-  JSObject::SetMapAndElements(object, map, elements);
 }