From 3c869652b039fc1fc9fbe035c6af879317e8b9f3 Mon Sep 17 00:00:00 2001
From: Leszek Swirski <leszeks@chromium.org>
Date: Mon, 04 May 2026 12:27:58 +0200
Subject: [PATCH] [objects] Abort TryFastAddDataProperty if map becomes slow

When class fields are added to a constructor-created function object
when the class extends Function, TryFastAddDataProperty is invoked
to perform a fast transition. However, Map::PrepareForDataProperty may
instead normalize the map and return a slow dictionary map.

This CL fixes the issue by aborting the fast transition in
TryFastAddDataProperty and returning false if
Map::PrepareForDataProperty returns a dictionary map, falling back
to the standard slow property addition path.

TAG=agy
CONV=7233c224-ccbc-421c-88b3-34be1f425294

Change-Id: If323afa0297782cd7a13efb02368e0dfdec00707
Fixed: 506689381
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7807043
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#107009}
---

diff --git a/src/objects/js-objects.cc b/src/objects/js-objects.cc
index 876ad24..2d37866 100644
--- a/src/objects/js-objects.cc
+++ b/src/objects/js-objects.cc
@@ -3704,6 +3704,7 @@
   InternalIndex descriptor = new_map->LastAdded();
   new_map = Map::PrepareForDataProperty(isolate, new_map, descriptor,
                                         PropertyConstness::kConst, value);
+  if (new_map->is_dictionary_map()) return false;
   JSObject::MigrateToMap(isolate, object, new_map);
   // TODO(leszeks): Avoid re-loading the property details, which we already
   // loaded in PrepareForDataProperty.
diff --git a/test/mjsunit/regress/regress-crbug-506689381.js b/test/mjsunit/regress/regress-crbug-506689381.js
new file mode 100644
index 0000000..6ba2dc8
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-506689381.js
@@ -0,0 +1,20 @@
+// Copyright 2026 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let key = 'AA';
+let value = 2;
+class C extends Function {
+  [key] = value;
+}
+
+// First object creation triggers transition MapA----(AA, kData, SMI)--->MapB
+let o1 = new C('\'use strict\'');
+
+value = 1.1;
+
+// Second object creation triggers TryFastAddDataProperty() which reconfigures
+// the property from Smi to Double. This reconfigures MapB in-place (or
+// normalizes it). TryFastAddDataProperty must not crash if the map is
+// normalized during preparation.
+let o2 = new C('\'use strict\'');

diff --git a/test/mjsunit/regress/regress-crbug-506689381.js b/test/mjsunit/regress/regress-crbug-506689381.js
new file mode 100644
index 0000000..6ba2dc8
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-506689381.js
@@ -0,0 +1,20 @@
+// Copyright 2026 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let key = 'AA';
+let value = 2;
+class C extends Function {
+  [key] = value;
+}
+
+// First object creation triggers transition MapA----(AA, kData, SMI)--->MapB
+let o1 = new C('\'use strict\'');
+
+value = 1.1;
+
+// Second object creation triggers TryFastAddDataProperty() which reconfigures
+// the property from Smi to Double. This reconfigures MapB in-place (or
+// normalizes it). TryFastAddDataProperty must not crash if the map is
+// normalized during preparation.
+let o2 = new C('\'use strict\'');