From 00148b3de100a2e28962a7f2cf9051cba38d6ab8 Mon Sep 17 00:00:00 2001
From: Ali Ijaz Sheikh <ofrobots@google.com>
Date: Mon, 11 Jan 2016 11:39:51 -0800
Subject: [PATCH] deps: backport 066747e from upstream V8
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This backport fixes a performance pathology in how arrays grow/shrink.

Fixes: https://github.com/nodejs/node/issues/3538
V8-Commit: https://github.com/v8/v8/commit/066747ea053012a99e0cd3e20f36b8ed053b2124
PR-URL: https://github.com/nodejs/node/pull/4625
Reviewed-By: cjihrig - Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: targos - Michaël Zasso <mic.besace@gmail.com>
Reviewed-By: indutny - Fedor Indutny <fedor.indutny@gmail.com>

Original commit message:
  Make sure that NormalizeElements and ShouldConvertToFastElements are …

  …based on the same values

  BUG=v8:4518
  LOG=n

  Review URL: https://codereview.chromium.org/1472293002

  Cr-Commit-Position: refs/heads/master@{#32265}
---
 deps/v8/src/elements.cc | 17 +++++++++++------
 deps/v8/src/objects.cc  |  2 ++
 2 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/deps/v8/src/elements.cc b/deps/v8/src/elements.cc
index 3e80d5570b90e4..caa596102f3535 100644
--- a/deps/v8/src/elements.cc
+++ b/deps/v8/src/elements.cc
@@ -1071,13 +1071,18 @@ class FastElementsAccessor
       }
       int num_used = 0;
       for (int i = 0; i < backing_store->length(); ++i) {
-        if (!backing_store->is_the_hole(i)) ++num_used;
-        // Bail out early if more than 1/4 is used.
-        if (4 * num_used > backing_store->length()) break;
-      }
-      if (4 * num_used <= backing_store->length()) {
-        JSObject::NormalizeElements(obj);
+        if (!backing_store->is_the_hole(i)) {
+          ++num_used;
+          // Bail out if a number dictionary wouldn't be able to save at least
+          // 75% space.
+          if (4 * SeededNumberDictionary::ComputeCapacity(num_used) *
+                  SeededNumberDictionary::kEntrySize >
+              backing_store->length()) {
+            return;
+          }
+        }
       }
+      JSObject::NormalizeElements(obj);
     }
   }
 
diff --git a/deps/v8/src/objects.cc b/deps/v8/src/objects.cc
index 65d5d5f528de79..f6902fc2071273 100644
--- a/deps/v8/src/objects.cc
+++ b/deps/v8/src/objects.cc
@@ -12226,6 +12226,8 @@ static bool ShouldConvertToFastElements(JSObject* object,
 
   uint32_t dictionary_size = static_cast<uint32_t>(dictionary->Capacity()) *
                              SeededNumberDictionary::kEntrySize;
+
+  // Turn fast if the dictionary only saves 50% space.
   return 2 * dictionary_size >= *new_capacity;
 }