Layout descriptor sharing issue fixed.

src/layout-descriptor.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <sstream>
 
 #include "src/v8.h"
 
 #include "src/base/bits.h"
 #include "src/layout-descriptor.h"
@@ skipping 54 matching lines @@
     int field_index = details.field_index();
     layout_descriptor = layout_descriptor->SetRawData(field_index);
     if (details.field_width_in_words() > 1) {
       layout_descriptor = layout_descriptor->SetRawData(field_index + 1);
     }
   }
   return handle(layout_descriptor, isolate);
 }
 
 
-Handle<LayoutDescriptor> LayoutDescriptor::Append(Handle<Map> map,
-                                                  PropertyDetails details) {
+Handle<LayoutDescriptor> LayoutDescriptor::ShareAppend(
+    Handle<Map> map, PropertyDetails details) {
+  DCHECK(map->owns_descriptors());
   Isolate* isolate = map->GetIsolate();
   Handle<LayoutDescriptor> layout_descriptor(map->GetLayoutDescriptor(),
                                              isolate);
 
   if (!InobjectUnboxedField(map->inobject_properties(), details)) {
+    DCHECK(details.location() != kField ||
+           layout_descriptor->IsTagged(details.field_index()));
     return layout_descriptor;
   }
   int field_index = details.field_index();
   layout_descriptor = LayoutDescriptor::EnsureCapacity(
       isolate, layout_descriptor, field_index + details.field_width_in_words());
 
   DisallowHeapAllocation no_allocation;
   LayoutDescriptor* layout_desc = *layout_descriptor;
   layout_desc = layout_desc->SetRawData(field_index);
   if (details.field_width_in_words() > 1) {
     layout_desc = layout_desc->SetRawData(field_index + 1);
   }
   return handle(layout_desc, isolate);
 }
 
 
 Handle<LayoutDescriptor> LayoutDescriptor::AppendIfFastOrUseFull(
     Handle<Map> map, PropertyDetails details,
     Handle<LayoutDescriptor> full_layout_descriptor) {
   DisallowHeapAllocation no_allocation;
   LayoutDescriptor* layout_descriptor = map->layout_descriptor();
   if (layout_descriptor->IsSlowLayout()) {
     return full_layout_descriptor;
   }
   if (!InobjectUnboxedField(map->inobject_properties(), details)) {
+    DCHECK(details.location() != kField ||
+           layout_descriptor->IsTagged(details.field_index()));
     return handle(layout_descriptor, map->GetIsolate());
   }
   int field_index = details.field_index();
   int new_capacity = field_index + details.field_width_in_words();
   if (new_capacity > layout_descriptor->capacity()) {
     // Current map's layout descriptor runs out of space, so use the full
     // layout descriptor.
     return full_layout_descriptor;
   }
 
   layout_descriptor = layout_descriptor->SetRawData(field_index);
   if (details.field_width_in_words() > 1) {
     layout_descriptor = layout_descriptor->SetRawData(field_index + 1);
   }
   return handle(layout_descriptor, map->GetIsolate());
 }
 
 
 Handle<LayoutDescriptor> LayoutDescriptor::EnsureCapacity(
     Isolate* isolate, Handle<LayoutDescriptor> layout_descriptor,
     int new_capacity) {
   int old_capacity = layout_descriptor->capacity();
   if (new_capacity <= old_capacity) {
-    // Nothing to do with layout in Smi-form.
     return layout_descriptor;
   }
   Handle<LayoutDescriptor> new_layout_descriptor =
       LayoutDescriptor::New(isolate, new_capacity);
   DCHECK(new_layout_descriptor->IsSlowLayout());
 
   if (layout_descriptor->IsSlowLayout()) {
     memcpy(new_layout_descriptor->DataPtr(), layout_descriptor->DataPtr(),
            layout_descriptor->DataSize());
     return new_layout_descriptor;
@@ skipping 106 matching lines @@
     DCHECK(offset_in_bytes < *out_end_of_contiguous_region_offset);
     return true;
   }
   *out_end_of_contiguous_region_offset =
       offset_in_bytes + sequence_length * kPointerSize;
   DCHECK(offset_in_bytes < *out_end_of_contiguous_region_offset);
   return tagged;
 }
 }
 }  // namespace v8::internal