From 2fb58638a6c89762138b49ca012c9b2582ae1c9c Mon Sep 17 00:00:00 2001
From: "mstarzinger@chromium.org"
 <mstarzinger@chromium.org@ce2b1a6d-e550-0410-aec6-3dcde31c8c00>
Date: Tue, 4 Oct 2011 15:54:57 +0000
Subject: [PATCH] Fix verification of weak maps during initialization.

R=rossberg@chromium.org

Review URL: http://codereview.chromium.org/8135003

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@9517 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
---
 src/objects-debug.cc   | 2 +-
 src/objects-inl.h      | 2 +-
 src/objects-printer.cc | 1 -
 src/objects.cc         | 3 +--
 src/objects.h          | 2 +-
 src/runtime.cc         | 4 ++--
 6 files changed, 6 insertions(+), 8 deletions(-)

diff --git a/src/objects-debug.cc b/src/objects-debug.cc
index 567a278..6d2cf5f 100644
--- a/src/objects-debug.cc
+++ b/src/objects-debug.cc
@@ -498,7 +498,7 @@ void JSWeakMap::JSWeakMapVerify() {
   CHECK(IsJSWeakMap());
   JSObjectVerify();
   VerifyHeapPointer(table());
-  ASSERT(table()->IsHashTable());
+  ASSERT(table()->IsHashTable() || table()->IsUndefined());
 }
 
 
diff --git a/src/objects-inl.h b/src/objects-inl.h
index cd78471..11b73d3 100644
--- a/src/objects-inl.h
+++ b/src/objects-inl.h
@@ -3887,7 +3887,7 @@ void JSProxy::InitializeBody(int object_size, Object* value) {
 }
 
 
-ACCESSORS(JSWeakMap, table, ObjectHashTable, kTableOffset)
+ACCESSORS(JSWeakMap, table, Object, kTableOffset)
 ACCESSORS_GCSAFE(JSWeakMap, next, Object, kNextOffset)
 
 
diff --git a/src/objects-printer.cc b/src/objects-printer.cc
index aac79a6..fc75732 100644
--- a/src/objects-printer.cc
+++ b/src/objects-printer.cc
@@ -708,7 +708,6 @@ void JSFunctionProxy::JSFunctionProxyPrint(FILE* out) {
 void JSWeakMap::JSWeakMapPrint(FILE* out) {
   HeapObject::PrintHeader(out, "JSWeakMap");
   PrintF(out, " - map = 0x%p\n", reinterpret_cast<void*>(map()));
-  PrintF(out, " - number of elements = %d\n", table()->NumberOfElements());
   PrintF(out, " - table = ");
   table()->ShortPrint(out);
   PrintF(out, "\n");
diff --git a/src/objects.cc b/src/objects.cc
index 9e62e3f..105dfd1 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -1002,8 +1002,7 @@ void JSObject::JSObjectShortPrint(StringStream* accumulator) {
       break;
     }
     case JS_WEAK_MAP_TYPE: {
-      int elements = JSWeakMap::cast(this)->table()->NumberOfElements();
-      accumulator->Add("<JS WeakMap[%d]>", elements);
+      accumulator->Add("<JS WeakMap>");
       break;
     }
     case JS_REGEXP_TYPE: {
diff --git a/src/objects.h b/src/objects.h
index 7b522e0..74fb012 100644
--- a/src/objects.h
+++ b/src/objects.h
@@ -6897,7 +6897,7 @@ class JSFunctionProxy: public JSProxy {
 class JSWeakMap: public JSObject {
  public:
   // [table]: the backing hash table mapping keys to values.
-  DECL_ACCESSORS(table, ObjectHashTable)
+  DECL_ACCESSORS(table, Object)
 
   // [next]: linked list of encountered weak maps during GC.
   DECL_ACCESSORS(next, Object)
diff --git a/src/runtime.cc b/src/runtime.cc
index 89abf38..0e1ae44 100644
--- a/src/runtime.cc
+++ b/src/runtime.cc
@@ -716,7 +716,7 @@ RUNTIME_FUNCTION(MaybeObject*, Runtime_WeakMapGet) {
   ASSERT(args.length() == 2);
   CONVERT_ARG_CHECKED(JSWeakMap, weakmap, 0);
   CONVERT_ARG_CHECKED(JSReceiver, key, 1);
-  return weakmap->table()->Lookup(*key);
+  return ObjectHashTable::cast(weakmap->table())->Lookup(*key);
 }
 
 
@@ -726,7 +726,7 @@ RUNTIME_FUNCTION(MaybeObject*, Runtime_WeakMapSet) {
   CONVERT_ARG_CHECKED(JSWeakMap, weakmap, 0);
   CONVERT_ARG_CHECKED(JSReceiver, key, 1);
   Handle<Object> value(args[2]);
-  Handle<ObjectHashTable> table(weakmap->table());
+  Handle<ObjectHashTable> table(ObjectHashTable::cast(weakmap->table()));
   Handle<ObjectHashTable> new_table = PutIntoObjectHashTable(table, key, value);
   weakmap->set_table(*new_table);
   return *value;
-- 
2.7.4