Merge r3768 from bleeding_edge to branches/1.3 to fix...

src/heap.cc

 // Copyright 2009 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 2279 matching lines @@
     if (count > in_object_properties) {
       count = in_object_properties;
     }
     Object* descriptors_obj = DescriptorArray::Allocate(count);
     if (descriptors_obj->IsFailure()) return descriptors_obj;
     DescriptorArray* descriptors = DescriptorArray::cast(descriptors_obj);
     for (int i = 0; i < count; i++) {
       String* name = fun->shared()->GetThisPropertyAssignmentName(i);
       ASSERT(name->IsSymbol());
       FieldDescriptor field(name, i, NONE);
+      field.SetEnumerationIndex(i);
       descriptors->Set(i, &field);
     }
+    descriptors->SetNextEnumerationIndex(count);
     descriptors->Sort();
     map->set_instance_descriptors(descriptors);
     map->set_pre_allocated_property_fields(count);
     map->set_unused_property_fields(in_object_properties - count);
   }
   return map;
 }
 
 
 void Heap::InitializeJSObjectFromMap(JSObject* obj,
@@ skipping 1790 matching lines @@
   for (int i = 0; i < kNumberOfCaches; i++) {
     if (caches_[i] != NULL) {
       delete caches_[i];
       caches_[i] = NULL;
     }
   }
 }
 
 
 } }  // namespace v8::internal