Avoid fast short-cut in Map::GeneralizeRepresentation() for literals with non-simple transitions.

src/objects.cc

Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index 01b4a1aca09f61e9504b67a41f7f6abb66971e39..e6c46432dc5eee76b216f7d791751af2d0feb68b 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -2471,9 +2471,13 @@ Handle<Map> Map::GeneralizeRepresentation(Handle<Map> old_map,
   // modification to the object, because the default uninitialized value for
   // representation None can be overwritten by both smi and tagged values.
   // Doubles, however, would require a box allocation.
-  if (old_representation.IsNone() &&
-      !new_representation.IsNone() &&
-      !new_representation.IsDouble()) {
+  // Note that if the map has transitions that do not share descriptors we
+  // can't use this shortcut because field type and representation must be
+  // updated in all the transitions from this map.
+  if (old_representation.IsNone() && !new_representation.IsNone() &&
+      !new_representation.IsDouble() &&
+      (!old_map->HasTransitionArray() ||
+       old_map->transitions()->IsSimpleTransition())) {

[Toon Verwaest, 2014/11/12 22:52:48]

What about instead updating the fieldtype in the entire tree? There's
infrastructure to do that. Knowing we have a simple transition doesn't guarantee
(I believe) that we are sharing the descriptor array...

[Igor Sheludko, 2014/11/13 10:00:41]

Done, thanks!

     DCHECK(old_details.type() == FIELD);
     DCHECK(old_descriptors->GetFieldType(modify_index)->NowIs(
             HeapType::None()));