Properly complete in-object slack tracking.

BUG=chromium:599003
LOG=N

Review URL: https://codereview.chromium.org/1856653002

Cr-Commit-Position: refs/heads/master@{#35232}

src/objects.cc

@@ -12519,6 +12519,9 @@ static void ShrinkInstanceSize(Map* map, void* data) {
   map->set_visitor_id(Heap::GetStaticVisitorIdForMap(map));
 }
 
+static void StopSlackTracking(Map* map, void* data) {
+  map->set_construction_counter(Map::kNoSlackTracking);
+}
 
 void Map::CompleteInobjectSlackTracking() {
   // Has to be an initial map.
@@ -12529,6 +12532,8 @@ void Map::CompleteInobjectSlackTracking() {
   if (slack != 0) {
     // Resize the initial map and all maps in its transition tree.
     TransitionArray::TraverseTransitionTree(this, &ShrinkInstanceSize, &slack);
+  } else {
+    TransitionArray::TraverseTransitionTree(this, &StopSlackTracking, nullptr);
   }
 }
 

test/mjsunit/regress/regress-crbug-599003.js

+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --expose-gc --verify-heap
+
+function A() {}
+
+function g1() {
+  var obj = new A();
+  obj.v0 = 0;
+  obj.v1 = 0;
+  obj.v2 = 0;
+  obj.v3 = 0;
+  obj.v4 = 0;
+  obj.v5 = 0;
+  obj.v6 = 0;
+  obj.v7 = 0;
+  obj.v8 = 0;
+  obj.v9 = 0;
+  return obj;
+}
+
+function g2() {
+  return new A();
+}
+
+var o = g1();
+%OptimizeFunctionOnNextCall(g2);
+g2();
+o = null;
+gc();
+
+for (var i = 0; i < 20; i++) {
+  var o = new A();
+}
+g2();
+
+gc();  // Boom!