Don't track representations in context extensions.

This also enables verification of representations.

BUG=
R=jkummerow@chromium.org

Review URL: https://chromiumcodereview.appspot.com/15411003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@14735 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

diff --git a/src/objects-debug.cc b/src/objects-debug.cc
index ecbf9d6..891f0d2 100644 (file)
--- a/src/objects-debug.cc
+++ b/src/objects-debug.cc
@@ -306,6 +306,17 @@ void JSObject::JSObjectVerify() {
     CHECK_EQ(map()->unused_property_fields(),
              (map()->inobject_properties() + properties()->length() -
               map()->NextFreePropertyIndex()));
+    DescriptorArray* descriptors = map()->instance_descriptors();
+    for (int i = 0; i < map()->NumberOfOwnDescriptors(); i++) {
+      if (descriptors->GetDetails(i).type() == FIELD) {
+        Representation r = descriptors->GetDetails(i).representation();
+        int field = descriptors->GetFieldIndex(i);
+        Object* value = RawFastPropertyAt(field);
+        if (r.IsSmi()) ASSERT(value->IsSmi());
+        if (r.IsDouble()) ASSERT(value->IsHeapNumber());
+        if (r.IsHeapObject()) ASSERT(value->IsHeapObject());
+      }
+    }
   }
   CHECK_EQ((map()->has_fast_smi_or_object_elements() ||
              (elements() == GetHeap()->empty_fixed_array())),

diff --git a/src/objects.cc b/src/objects.cc
index 1e586e8..6513482 100644 (file)
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -1801,7 +1801,9 @@ MaybeObject* JSObject::AddFastProperty(Name* name,
   int index = map()->NextFreePropertyIndex();
 
   // Allocate new instance descriptors with (name, index) added
-  Representation representation = value->OptimalRepresentation();
+  Representation representation = IsJSContextExtensionObject()
+      ? Representation::Tagged() : value->OptimalRepresentation();
+
   FieldDescriptor new_field(name, index, attributes, representation);
 
   ASSERT(index < map()->inobject_properties() ||
@@ -2105,7 +2107,8 @@ MaybeObject* JSObject::ConvertDescriptorToField(Name* name,
     return ReplaceSlowProperty(name, new_value, attributes);
   }
 
-  Representation representation = new_value->OptimalRepresentation();
+  Representation representation = IsJSContextExtensionObject()
+      ? Representation::Tagged() : new_value->OptimalRepresentation();
   int index = map()->NextFreePropertyIndex();
   FieldDescriptor new_field(name, index, attributes, representation);