v8: backport codereview.chromium.org/11362182

Keep the number of descriptors below
DescriptorArray::kMaxNumberOfDescriptors even for accessors

Review URL: https://codereview.chromium.org/11362182

diff --git a/deps/v8/src/objects.cc b/deps/v8/src/objects.cc
index 37f8361d8fa6d5c6ddbefa98e04119b02710c4ff..9935c222e407d97867290421f9b7294d2b4e616f 100644 (file)
--- a/deps/v8/src/objects.cc
+++ b/deps/v8/src/objects.cc
@@ -4453,7 +4453,9 @@ MaybeObject* JSObject::DefinePropertyAccessor(String* name,
   // to do a lookup, which seems to be a bit of overkill.
   Heap* heap = GetHeap();
   bool only_attribute_changes = getter->IsNull() && setter->IsNull();
-  if (HasFastProperties() && !only_attribute_changes) {
+  if (HasFastProperties() && !only_attribute_changes &&
+      (map()->NumberOfOwnDescriptors() <
+       DescriptorArray::kMaxNumberOfDescriptors)) {
     MaybeObject* getterOk = heap->undefined_value();
     if (!getter->IsNull()) {
       getterOk = DefineFastAccessor(name, ACCESSOR_GETTER, getter, attributes);