Avoid some unnecessary fast-properties map creations.

(1) When we have just normalized and re-fastified a map, we don't need to copy it again to set the is_prototype bit.
(2) When defining accessors causes a non-prototype object to go slow, don't force re-fastification.

BUG=v8:3267
LOG=n
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/706243002

Cr-Commit-Position: refs/heads/master@{#25221}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25221 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

diff --git a/src/objects.cc b/src/objects.cc
index 63b7312c5108b3a4bc7953fbe450d7bdacbfa7c0..8303489701dd5522e758866856d7ac5d599fa5f9 100644 (file)
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -9505,13 +9505,17 @@ void JSObject::OptimizeAsPrototype(Handle<JSObject> object,
     JSObject::NormalizeProperties(object, KEEP_INOBJECT_PROPERTIES, 0,
                                   "NormalizeAsPrototype");
   }
+  bool has_just_copied_map = false;
   if (!object->HasFastProperties()) {
     JSObject::MigrateSlowToFast(object, 0, "OptimizeAsPrototype");
+    has_just_copied_map = true;
   }
   if (mode == FAST_PROTOTYPE && object->HasFastProperties() &&
       !object->map()->is_prototype_map()) {
-    Handle<Map> new_map = Map::Copy(handle(object->map()), "CopyAsPrototype");
-    JSObject::MigrateToMap(object, new_map);
+    if (!has_just_copied_map) {
+      Handle<Map> new_map = Map::Copy(handle(object->map()), "CopyAsPrototype");
+      JSObject::MigrateToMap(object, new_map);
+    }
     object->map()->set_is_prototype_map(true);
   }
 }

diff --git a/src/runtime/runtime-object.cc b/src/runtime/runtime-object.cc
index b2a736d7a5bb41e07532366ac815da3693bcbace..524c88451dad3e773ab20065e03e083ed5c8a89b 100644 (file)
--- a/src/runtime/runtime-object.cc
+++ b/src/runtime/runtime-object.cc
@@ -1455,10 +1455,8 @@ RUNTIME_FUNCTION(Runtime_DefineAccessorPropertyUnchecked) {
   RUNTIME_ASSERT((unchecked & ~(READ_ONLY | DONT_ENUM | DONT_DELETE)) == 0);
   PropertyAttributes attr = static_cast<PropertyAttributes>(unchecked);
 
-  bool fast = obj->HasFastProperties();
   RETURN_FAILURE_ON_EXCEPTION(
       isolate, JSObject::DefineAccessor(obj, name, getter, setter, attr));
-  if (fast) JSObject::MigrateSlowToFast(obj, 0, "RuntimeDefineAccessor");
   return isolate->heap()->undefined_value();
 }
 

diff --git a/test/mjsunit/object-freeze.js b/test/mjsunit/object-freeze.js
index 4144936d06437396b5625f5a51493c45db42732d..a48251304d85c536c055261c88867f623df97d99 100644 (file)
--- a/test/mjsunit/object-freeze.js
+++ b/test/mjsunit/object-freeze.js
@@ -303,7 +303,7 @@ assertTrue(Object.isFrozen(Object.freeze(function(){"use strict";})));
 
 // Also test a simpler case
 obj = {};
-Object.defineProperty(obj, 'accessor', {
+Object.defineProperty(obj, 'accessor2', {
   get: function() { return 42 },
   set: function() { accessorDidRun = true },
   configurable: true,

diff --git a/test/mjsunit/regress/regress-crbug-137689.js b/test/mjsunit/regress/regress-crbug-137689.js
index 0ff0c4e76bafdb3f1795f6bb9216674049419420..ef79d240f8926a39c3fffe31c5f9b7de3a521a48 100644 (file)
--- a/test/mjsunit/regress/regress-crbug-137689.js
+++ b/test/mjsunit/regress/regress-crbug-137689.js
@@ -44,5 +44,4 @@ assertTrue(%HaveSameMap(o, o2));
 
 Object.defineProperty(o, "foo", { set: setter, configurable: true });
 Object.defineProperty(o2, "foo", { set: setter, configurable: true });
-// TODO(ishell): this should eventually become assertTrue().
-assertFalse(%HaveSameMap(o, o2));
+assertTrue(%HaveSameMap(o, o2));