[map] Don't update maps in PrepareForDataProperty

LeszekSwirski · V8 LUCI CQ · commit cbd847cb1c2e · 2024-05-31T11:19:31.000Z
... because we might update to a dictionary map. Instead, DCHECK that the map isn't deprecated, and fix callers to first update the map. Bug: 342456991 Change-Id: I8a966437d816c8e0200333c4068854432caf5729 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5588058 Reviewed-by: Igor Sheludko <ishell@chromium.org> Auto-Submit: Leszek Swirski <leszeks@chromium.org> Commit-Queue: Leszek Swirski <leszeks@chromium.org> Cr-Commit-Position: refs/heads/main@{#94175}
diff --git a/src/objects/js-objects.cc b/src/objects/js-objects.cc
@@ -3547,7 +3547,12 @@ bool TryFastAddDataProperty(Isolate* isolate, Handle<JSObject> object,
   DCHECK(!map->is_dictionary_map());
 
   Handle<Map> new_map = handle(map, isolate);
-  InternalIndex descriptor = map->LastAdded();
+  if (map->is_deprecated()) {
+    new_map = Map::Update(isolate, new_map);
+    if (new_map->is_dictionary_map()) return false;
+  }
+
+  InternalIndex descriptor = new_map->LastAdded();
   new_map = Map::PrepareForDataProperty(isolate, new_map, descriptor,
                                         PropertyConstness::kConst, value);
   JSObject::MigrateToMap(isolate, object, new_map);
diff --git a/src/objects/map.cc b/src/objects/map.cc
@@ -1928,8 +1928,8 @@ Handle<Map> Map::PrepareForDataProperty(Isolate* isolate, Handle<Map> map,
                                         InternalIndex descriptor,
                                         PropertyConstness constness,
                                         Handle<Object> value) {
-  // Update to the newest map before storing the property.
-  map = Update(isolate, map);
+  // The map should already be fully updated before storing the property.
+  DCHECK(!map->is_deprecated());
   // Dictionaries can store any property value.
   DCHECK(!map->is_dictionary_map());
   return UpdateDescriptorForValue(isolate, map, descriptor, constness, value);
