Revert "Avoid some unnecessary fast-properties map creations."

This reverts commit e1f23eab4255d63344011dfb885b8e8962cb60e2.

Broke cctest/test-heap/ReleaseOverReservedPages on a bunch of builders

http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20debug/builds/928/steps/Check/logs/ReleaseOverReservedPa..

BUG=None
LOG=N
TBR=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/709123002

Cr-Commit-Position: refs/heads/master@{#25224}
git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@25224 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/objects.cc

@@ -9505,17 +9505,13 @@ void JSObject::OptimizeAsPrototype(Handle<JSObject> object,
     JSObject::NormalizeProperties(object, KEEP_INOBJECT_PROPERTIES, 0,
                                   "NormalizeAsPrototype");
   }
-  bool has_just_copied_map = false;
   if (!object->HasFastProperties()) {
     JSObject::MigrateSlowToFast(object, 0, "OptimizeAsPrototype");
-    has_just_copied_map = true;
   }
   if (mode == FAST_PROTOTYPE && object->HasFastProperties() &&
       !object->map()->is_prototype_map()) {
-    if (!has_just_copied_map) {
     Handle<Map> new_map = Map::Copy(handle(object->map()), "CopyAsPrototype");
     JSObject::MigrateToMap(object, new_map);
-    }
     object->map()->set_is_prototype_map(true);
   }
 }

src/runtime/runtime-object.cc

@@ -1455,8 +1455,10 @@ RUNTIME_FUNCTION(Runtime_DefineAccessorPropertyUnchecked) {
   RUNTIME_ASSERT((unchecked & ~(READ_ONLY | DONT_ENUM | DONT_DELETE)) == 0);
   PropertyAttributes attr = static_cast<PropertyAttributes>(unchecked);
 
+  bool fast = obj->HasFastProperties();
   RETURN_FAILURE_ON_EXCEPTION(
       isolate, JSObject::DefineAccessor(obj, name, getter, setter, attr));
+  if (fast) JSObject::MigrateSlowToFast(obj, 0, "RuntimeDefineAccessor");
   return isolate->heap()->undefined_value();
 }
 

test/mjsunit/object-freeze.js

@@ -303,7 +303,7 @@ assertTrue(Object.isFrozen(Object.freeze(function(){"use strict";})));
 
 // Also test a simpler case
 obj = {};
-Object.defineProperty(obj, 'accessor2', {
+Object.defineProperty(obj, 'accessor', {
   get: function() { return 42 },
   set: function() { accessorDidRun = true },
   configurable: true,

test/mjsunit/regress/regress-crbug-137689.js

@@ -44,4 +44,5 @@ assertTrue(%HaveSameMap(o, o2));
 
 Object.defineProperty(o, "foo", { set: setter, configurable: true });
 Object.defineProperty(o2, "foo", { set: setter, configurable: true });
-assertTrue(%HaveSameMap(o, o2));
+// TODO(ishell): this should eventually become assertTrue().
+assertFalse(%HaveSameMap(o, o2));