Extending map verification to also verify LastAdded/DescriptorArray consistency.

Removed ASSERT now subsumed by extended map verification.

Review URL: https://chromiumcodereview.appspot.com/10827037

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@12204 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/heap.cc

@@ -4159,8 +4159,6 @@ MaybeObject* Heap::AllocateGlobalObject(JSFunction* constructor) {
   MaybeObject* maybe_map = map->CopyDropDescriptors();
   if (!maybe_map->To(&new_map)) return maybe_map;
 
-  ASSERT(new_map->LastAdded() == Map::kNoneAdded);
-
   // Set up the global object as a normalized object.
   global->set_map(new_map);
   global->set_properties(dictionary);

src/objects-debug.cc

@@ -302,6 +302,12 @@ void Map::MapVerify() {
           instance_size() < HEAP->Capacity()));
   VerifyHeapPointer(prototype());
   VerifyHeapPointer(instance_descriptors());
+  if (instance_descriptors()->number_of_descriptors() == 0) {
+    ASSERT(LastAdded() == kNoneAdded);
+  } else {
+    ASSERT(instance_descriptors()->GetDetails(LastAdded()).index() ==
+           instance_descriptors()->number_of_descriptors());
+  }
   SLOW_ASSERT(instance_descriptors()->IsSortedNoDuplicates());
   if (HasTransitionArray()) {
     SLOW_ASSERT(transitions()->IsSortedNoDuplicates());

src/objects.cc

@@ -4872,7 +4872,7 @@ MaybeObject* Map::CopyReplaceDescriptors(DescriptorArray* descriptors,
   if (!maybe_result->To(&result)) return maybe_result;
 
   if (last_added == kNoneAdded) {
-    ASSERT(descriptors->IsEmpty());
+    ASSERT(descriptors->number_of_descriptors() == 0);
   } else {
     ASSERT(descriptors->GetDetails(last_added).index() ==
            descriptors->number_of_descriptors());