[classes] Properly handle properties count slack

Bug: chromium:979401
Change-Id: I99ab2fd04bd2e23b4d7a494cecc056ec74cb9d04
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1687422
Auto-Submit: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62674}

src/objects/literal-objects.cc

@@ -256,8 +256,12 @@ class ObjectDescriptor {
   void IncPropertiesCount() { ++property_count_; }
   void IncElementsCount() { ++element_count_; }
 
+  explicit ObjectDescriptor(int property_slack)
+      : property_slack_(property_slack) {}
+
   bool HasDictionaryProperties() const {
-    return computed_count_ > 0 || property_count_ > kMaxNumberOfDescriptors;
+    return computed_count_ > 0 ||
+           (property_count_ + property_slack_) > kMaxNumberOfDescriptors;
   }
 
   Handle<Object> properties_template() const {
@@ -274,17 +278,17 @@ class ObjectDescriptor {
     return computed_properties_;
   }
 
-  void CreateTemplates(Isolate* isolate, int slack) {
+  void CreateTemplates(Isolate* isolate) {
     Factory* factory = isolate->factory();
     descriptor_array_template_ = factory->empty_descriptor_array();
     properties_dictionary_template_ = factory->empty_property_dictionary();
-    if (property_count_ || HasDictionaryProperties() || slack) {
+    if (property_count_ || computed_count_ || property_slack_) {
       if (HasDictionaryProperties()) {
         properties_dictionary_template_ = NameDictionary::New(
-            isolate, property_count_ + computed_count_ + slack);
+            isolate, property_count_ + computed_count_ + property_slack_);
       } else {
-        descriptor_array_template_ =
-            DescriptorArray::Allocate(isolate, 0, property_count_ + slack);
+        descriptor_array_template_ = DescriptorArray::Allocate(
+            isolate, 0, property_count_ + property_slack_);
       }
     }
     elements_dictionary_template_ =
@@ -369,6 +373,7 @@ class ObjectDescriptor {
   }
 
  private:
+  const int property_slack_;
   int property_count_ = 0;
   int next_enumeration_index_ = PropertyDetails::kInitialIndex;
   int element_count_ = 0;
@@ -404,8 +409,8 @@ Handle<ClassBoilerplate> ClassBoilerplate::BuildClassBoilerplate(
   // in CanonicalHandleScope.
   HandleScope scope(isolate);
   Factory* factory = isolate->factory();
-  ObjectDescriptor static_desc;
-  ObjectDescriptor instance_desc;
+  ObjectDescriptor static_desc(kMinimumClassPropertiesCount);
+  ObjectDescriptor instance_desc(kMinimumPrototypePropertiesCount);
 
   for (int i = 0; i < expr->properties()->length(); i++) {
     ClassLiteral::Property* property = expr->properties()->at(i);
@@ -425,7 +430,7 @@ Handle<ClassBoilerplate> ClassBoilerplate::BuildClassBoilerplate(
   //
   // Initialize class object template.
   //
-  static_desc.CreateTemplates(isolate, kMinimumClassPropertiesCount);
+  static_desc.CreateTemplates(isolate);
   STATIC_ASSERT(JSFunction::kLengthDescriptorIndex == 0);
   {
     // Add length_accessor.
@@ -459,7 +464,7 @@ Handle<ClassBoilerplate> ClassBoilerplate::BuildClassBoilerplate(
   //
   // Initialize prototype object template.
   //
-  instance_desc.CreateTemplates(isolate, kMinimumPrototypePropertiesCount);
+  instance_desc.CreateTemplates(isolate);
   {
     Handle<Object> value(
         Smi::FromInt(ClassBoilerplate::kConstructorArgumentIndex), isolate);

test/mjsunit/regress/regress-crbug-979401.js

+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let min_fields = 1015;
+let max_fields = 1025;
+
+let static_fields_src = "";
+let instance_fields_src = "";
+for (let i = 0; i < max_fields; i++) {
+  static_fields_src += "  static f" + i + "() {}\n";
+  instance_fields_src += "  g" + i + "() {}\n";
+
+  if (i >= min_fields) {
+    let src1 = "class A {\n" + static_fields_src + "}\n";
+    eval(src1);
+    let src2 = "class B {\n" + instance_fields_src + "}\n";
+    eval(src2);
+  }
+}