Mark as prototype only after instantiating the function

src/objects.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/v8.h"
 
 #include "src/accessors.h"
 #include "src/allocation-site-scopes.h"
 #include "src/api.h"
 #include "src/arguments.h"
@@ skipping 7221 matching lines @@
     new_map->InitializeDescriptors(map->instance_descriptors());
   }
 
   Handle<Name> name = isolate->factory()->observed_symbol();
   ConnectTransition(map, new_map, name, FULL_TRANSITION);
 
   return new_map;
 }
 
 
-Handle<Map> Map::CopyAsPrototypeMap(Handle<Map> map) {
-  if (map->is_prototype_map()) return map;
-  Handle<Map> result = Copy(map);
-  result->mark_prototype_map();
-  return result;
-}
-
-
 Handle<Map> Map::Copy(Handle<Map> map) {
   Handle<DescriptorArray> descriptors(map->instance_descriptors());
   int number_of_own_descriptors = map->NumberOfOwnDescriptors();
   Handle<DescriptorArray> new_descriptors =
       DescriptorArray::CopyUpTo(descriptors, number_of_own_descriptors);
   return CopyReplaceDescriptors(
       map, new_descriptors, OMIT_TRANSITION, MaybeHandle<Name>());
 }
 
 
@@ skipping 2607 matching lines @@
   return initial_map;
 }
 
 
 void JSFunction::SetInstancePrototype(Handle<JSFunction> function,
                                       Handle<Object> value) {
   Isolate* isolate = function->GetIsolate();
 
   DCHECK(value->IsJSReceiver());
 
-  // First some logic for the map of the prototype to make sure it is in fast
-  // mode.
-  if (value->IsJSObject()) {
-    Handle<JSObject> js_proto = Handle<JSObject>::cast(value);
-    JSObject::OptimizeAsPrototype(js_proto);
-    if (js_proto->HasFastProperties()) {
-      Handle<Map> new_map = Map::CopyAsPrototypeMap(handle(js_proto->map()));
-      JSObject::MigrateToMap(js_proto, new_map);
-    }
-  }
-
   // Now some logic for the maps of the objects that are created by using this
   // function as a constructor.
   if (function->has_initial_map()) {
     // If the function has allocated the initial map replace it with a
     // copy containing the new prototype.  Also complete any in-object
     // slack tracking that is in progress at this point because it is
     // still tracking the old copy.
     if (function->IsInobjectSlackTrackingInProgress()) {
       function->CompleteInobjectSlackTracking();
     }
     Handle<Map> initial_map(function->initial_map(), isolate);
     Handle<Map> new_map = Map::Copy(initial_map);
     new_map->set_prototype(*value);
 
     // If the function is used as the global Array function, cache the
     // initial map (and transitioned versions) in the native context.
     Context* native_context = function->context()->native_context();
     Object* array_function = native_context->get(Context::ARRAY_FUNCTION_INDEX);
     if (array_function->IsJSFunction() &&
         *function == JSFunction::cast(array_function)) {
       CacheInitialJSArrayMaps(handle(native_context, isolate), new_map);
     }
 
-    function->set_initial_map(*new_map);
+    JSFunction::SetInitialMap(function, new_map);
 
     // Deoptimize all code that embeds the previous initial map.
     initial_map->dependent_code()->DeoptimizeDependentCodeGroup(
         isolate, DependentCode::kInitialMapChangedGroup);
   } else {
     // Put the value in the initial map field until an initial map is
     // needed.  At that point, a new initial map is created and the
     // prototype is put into the initial map where it belongs.
     function->set_prototype_or_initial_map(*value);
   }
@@ skipping 46 matching lines @@
     return false;
   }
 #endif
 
   set_map(no_prototype_map);
   set_prototype_or_initial_map(no_prototype_map->GetHeap()->the_hole_value());
   return true;
 }
 
 
+void JSFunction::SetInitialMap(Handle<JSFunction> function, Handle<Map> map) {
+  if (map->prototype()->IsJSObject()) {
+    Handle<JSObject> js_proto = handle(JSObject::cast(map->prototype()));
+    if (!js_proto->map()->is_prototype_map() &&
+        !js_proto->map()->IsGlobalObjectMap() &&
+        !js_proto->map()->IsJSGlobalProxyMap()) {
+      // Normalize and turn fast again to make all functions CONSTANT
+      // properties.
+      if (!js_proto->GetIsolate()->bootstrapper()->IsActive()) {
+        JSObject::NormalizeProperties(js_proto, KEEP_INOBJECT_PROPERTIES, 0);
+      }
+      if (!js_proto->HasFastProperties()) {
+        JSObject::MigrateSlowToFast(js_proto, 0);
+      }
+      if (js_proto->HasFastProperties()) {
+        Handle<Map> new_map = Map::Copy(handle(js_proto->map()));
+        JSObject::MigrateToMap(js_proto, new_map);
+        js_proto->map()->set_is_prototype_map(true);
+      }
+    }
+  }
+  function->set_prototype_or_initial_map(*map);
+  map->set_constructor(*function);
+}
+
+
 void JSFunction::EnsureHasInitialMap(Handle<JSFunction> function) {
   if (function->has_initial_map()) return;
   Isolate* isolate = function->GetIsolate();
 
   // First create a new map with the size and number of in-object properties
   // suggested by the function.
   InstanceType instance_type;
   int instance_size;
   int in_object_properties;
   if (function->shared()->is_generator()) {
@@ skipping 13 matching lines @@
     prototype = handle(function->instance_prototype(), isolate);
   } else {
     prototype = isolate->factory()->NewFunctionPrototype(function);
   }
   map->set_inobject_properties(in_object_properties);
   map->set_unused_property_fields(in_object_properties);
   map->set_prototype(*prototype);
   DCHECK(map->has_fast_object_elements());
 
   // Finally link initial map and constructor function.
-  function->set_initial_map(*map);
-  map->set_constructor(*function);
+  JSFunction::SetInitialMap(function, map);
 
   if (!function->shared()->is_generator()) {
     function->StartInobjectSlackTracking();
   }
 }
 
 
 void JSFunction::SetInstanceClassName(String* name) {
   shared()->set_instance_class_name(name);
 }
@@ skipping 6867 matching lines @@
 #define ERROR_MESSAGES_TEXTS(C, T) T,
   static const char* error_messages_[] = {
       ERROR_MESSAGES_LIST(ERROR_MESSAGES_TEXTS)
   };
 #undef ERROR_MESSAGES_TEXTS
   return error_messages_[reason];
 }
 
 
 } }  // namespace v8::internal