diff --git a/src/bootstrapper.cc b/src/bootstrapper.cc index 3486a4a49f..884f28e7ee 100644 --- a/src/bootstrapper.cc +++ b/src/bootstrapper.cc @@ -1084,11 +1084,6 @@ void Genesis::InitializeGlobal(Handle inner_global, } { // --- aliased_arguments_boilerplate_ - Handle old_map(global_context()->arguments_boilerplate()->map()); - Handle new_map = factory->CopyMapDropTransitions(old_map); - new_map->set_pre_allocated_property_fields(2); - Handle result = factory->NewJSObjectFromMap(new_map); - new_map->set_elements_kind(NON_STRICT_ARGUMENTS_ELEMENTS); // Set up a well-formed parameter map to make assertions happy. Handle elements = factory->NewFixedArray(2); elements->set_map(heap->non_strict_arguments_elements_map()); @@ -1097,12 +1092,16 @@ void Genesis::InitializeGlobal(Handle inner_global, elements->set(0, *array); array = factory->NewFixedArray(0); elements->set(1, *array); - Handle non_strict_arguments_elements_map = - factory->GetElementsTransitionMap(result, - NON_STRICT_ARGUMENTS_ELEMENTS); - result->set_map(*non_strict_arguments_elements_map); - ASSERT(result->HasNonStrictArgumentsElements()); + + Handle old_map(global_context()->arguments_boilerplate()->map()); + Handle new_map = factory->CopyMapDropTransitions(old_map); + new_map->set_pre_allocated_property_fields(2); + Handle result = factory->NewJSObjectFromMap(new_map); + // Set elements kind after allocating the object because + // NewJSObjectFromMap assumes a fast elements map. + new_map->set_elements_kind(NON_STRICT_ARGUMENTS_ELEMENTS); result->set_elements(*elements); + ASSERT(result->HasNonStrictArgumentsElements()); global_context()->set_aliased_arguments_boilerplate(*result); } diff --git a/src/objects-debug.cc b/src/objects-debug.cc index 6d2cf5f72c..156376261a 100644 --- a/src/objects-debug.cc +++ b/src/objects-debug.cc @@ -263,6 +263,12 @@ void ExternalDoubleArray::ExternalDoubleArrayVerify() { void JSObject::JSObjectVerify() { VerifyHeapPointer(properties()); VerifyHeapPointer(elements()); + + if (GetElementsKind() == NON_STRICT_ARGUMENTS_ELEMENTS) { + ASSERT(this->elements()->IsFixedArray()); + ASSERT(this->elements()->length() >= 2); + } + if (HasFastProperties()) { CHECK_EQ(map()->unused_property_fields(), (map()->inobject_properties() + properties()->length() - diff --git a/src/objects-inl.h b/src/objects-inl.h index 001c739439..c6fa554356 100644 --- a/src/objects-inl.h +++ b/src/objects-inl.h @@ -4088,14 +4088,16 @@ ElementsKind JSObject::GetElementsKind() { reinterpret_cast(READ_FIELD(this, kElementsOffset)); Map* map = fixed_array->map(); ASSERT(((kind == FAST_ELEMENTS || kind == FAST_SMI_ONLY_ELEMENTS) && - (map == GetHeap()->fixed_array_map() || - map == GetHeap()->fixed_cow_array_map())) || - (kind == FAST_DOUBLE_ELEMENTS && - fixed_array->IsFixedDoubleArray()) || - (kind == DICTIONARY_ELEMENTS && - fixed_array->IsFixedArray() && - fixed_array->IsDictionary()) || - (kind > DICTIONARY_ELEMENTS)); + (map == GetHeap()->fixed_array_map() || + map == GetHeap()->fixed_cow_array_map())) || + (kind == FAST_DOUBLE_ELEMENTS && + fixed_array->IsFixedDoubleArray()) || + (kind == DICTIONARY_ELEMENTS && + fixed_array->IsFixedArray() && + fixed_array->IsDictionary()) || + (kind > DICTIONARY_ELEMENTS)); + ASSERT((kind != NON_STRICT_ARGUMENTS_ELEMENTS) || + (elements()->IsFixedArray() && elements()->length() >= 2)); #endif return kind; }