Serializer: reset typed array cell type.

src/bootstrapper.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/bootstrapper.h"
 
 #include "src/accessors.h"
 #include "src/code-stubs.h"
 #include "src/extensions/externalize-string-extension.h"
 #include "src/extensions/free-buffer-extension.h"
@@ skipping 2795 matching lines @@
 
     do {
       isolate->random_number_generator()->NextBytes(state, num_bytes);
     } while (state[0] == 0 || state[1] == 0);
 
     v8::Local<v8::ArrayBuffer> buffer = v8::ArrayBuffer::New(
         reinterpret_cast<v8::Isolate*>(isolate), state, num_bytes);
     Utils::OpenHandle(*buffer)->set_should_be_freed(true);
     v8::Local<v8::Uint32Array> ta = v8::Uint32Array::New(buffer, 0, num_elems);
     Handle<JSBuiltinsObject> builtins(native_context()->builtins());
-    Runtime::DefineObjectProperty(builtins, factory()->InternalizeOneByteString(
-                                                STATIC_CHAR_VECTOR("rngstate")),
-                                  Utils::OpenHandle(*ta), NONE).Assert();
+
+    Handle<String> rngstate =
+        factory()->InternalizeOneByteString(STATIC_CHAR_VECTOR("rngstate"));
+    // Reset property cell type before (re)initializing.
+    JSBuiltinsObject::InvalidatePropertyCell(builtins, rngstate);
+    JSObject::SetOwnPropertyIgnoreAttributes(
+        builtins, rngstate, Utils::OpenHandle(*ta), DONT_DELETE).Assert();
 
     // Initialize trigonometric lookup tables and constants.
     const int constants_size = arraysize(fdlibm::MathConstants::constants);
     const int table_num_bytes = constants_size * kDoubleSize;
     v8::Local<v8::ArrayBuffer> trig_buffer = v8::ArrayBuffer::New(
         reinterpret_cast<v8::Isolate*>(isolate),
         const_cast<double*>(fdlibm::MathConstants::constants), table_num_bytes);
     v8::Local<v8::Float64Array> trig_table =
         v8::Float64Array::New(trig_buffer, 0, constants_size);
 
-    Runtime::DefineObjectProperty(
-        builtins,
-        factory()->InternalizeOneByteString(STATIC_CHAR_VECTOR("kMath")),
-        Utils::OpenHandle(*trig_table), NONE).Assert();
+    Handle<String> kmath =
+        factory()->InternalizeOneByteString(STATIC_CHAR_VECTOR("kMath"));
+    // Reset property cell type before (re)initializing.
+    JSBuiltinsObject::InvalidatePropertyCell(builtins, kmath);
+    JSObject::SetOwnPropertyIgnoreAttributes(
+        builtins, kmath, Utils::OpenHandle(*trig_table), DONT_DELETE).Assert();
   }
 
   result_ = native_context();
 }
 
 
 // Support for thread preemption.
 
 // Reserve space for statics needing saving and restoring.
 int Bootstrapper::ArchiveSpacePerThread() {
@@ skipping 15 matching lines @@
   return from + sizeof(NestingCounterType);
 }
 
 
 // Called when the top-level V8 mutex is destroyed.
 void Bootstrapper::FreeThreadResources() {
   DCHECK(!IsActive());
 }
 
 } }  // namespace v8::internal