Back off normalizing on set length in sync with adding a property

BUG=

Review URL: https://codereview.chromium.org/1211833002

Cr-Commit-Position: refs/heads/master@{#29298}

src/elements.cc

@@ -1842,7 +1842,7 @@ template <typename ElementsAccessorSubclass, typename ElementsKindTraits>
 void ElementsAccessorBase<ElementsAccessorSubclass, ElementsKindTraits>::
     SetLengthImpl(Handle<JSArray> array, uint32_t length,
                   Handle<FixedArrayBase> backing_store) {
-  DCHECK(!JSArray::SetLengthWouldNormalize(array->GetHeap(), length));
+  DCHECK(!array->SetLengthWouldNormalize(length));
   DCHECK(IsFastElementsKind(array->GetElementsKind()));
   uint32_t old_length = 0;
   CHECK(array->length()->ToArrayIndex(&old_length));

src/objects.cc

@@ -11786,7 +11786,7 @@ static bool GetOldValue(Isolate* isolate,
 void JSArray::SetLength(Handle<JSArray> array, uint32_t new_length) {
   // We should never end in here with a pixel or external array.
   DCHECK(array->AllowsSetLength());
-  if (JSArray::SetLengthWouldNormalize(array->GetHeap(), new_length)) {
+  if (array->SetLengthWouldNormalize(new_length)) {
     JSObject::NormalizeElements(array);
   }
   array->GetElementsAccessor()->SetLength(array, new_length);
@@ -12519,6 +12519,16 @@ MaybeHandle<Object> JSObject::AddDataElement(Handle<JSObject> object,
 }
 
 
+bool JSArray::SetLengthWouldNormalize(uint32_t new_length) {
+  if (!HasFastElements()) return false;
+  uint32_t capacity = static_cast<uint32_t>(elements()->length());
+  uint32_t new_capacity;
+  return JSArray::SetLengthWouldNormalize(GetHeap(), new_length) &&
+         ShouldConvertToSlowElements(this, capacity, new_length - 1,
+                                     &new_capacity);
+}
+
+
 const double AllocationSite::kPretenureRatio = 0.85;
 
 

src/objects.h

@@ -10142,6 +10142,7 @@ class JSArray: public JSObject {
 
   // If the JSArray has fast elements, and new_length would result in
   // normalization, returns true.
+  bool SetLengthWouldNormalize(uint32_t new_length);
   static inline bool SetLengthWouldNormalize(Heap* heap, uint32_t new_length);
 
   // Initializes the array to a certain length.