Fix prototype registration upon SlowToFast migration
authorjkummerow <jkummerow@chromium.org>
Tue, 28 Jul 2015 15:41:20 +0000 (08:41 -0700)
committerCommit bot <commit-bot@chromium.org>
Tue, 28 Jul 2015 15:41:29 +0000 (15:41 +0000)
commitc906efd5d18dba6e391fc536a594a50885c13f49
treed77025892f1ce1106db6fa403e6228c33750745d
parentb8568ec86c91628d5662aa2aabca8fa187e9c952
Fix prototype registration upon SlowToFast migration

When a prototype object migrates from a slow to a fast map, where the slow map
was registered as a user of its own prototype, then the registration must be
transferred to the new map (just like MigrateToMap does for all other cases).

BUG=chromium:513602
LOG=y
NOTREECHECKS=true

Review URL: https://codereview.chromium.org/1263543004

Cr-Commit-Position: refs/heads/master@{#29898}
src/objects.cc
test/mjsunit/regress/regress-crbug-513602.js [new file with mode: 0644]