Keep the inline caches for the builtins object monomorphic when...

src/ic.cc

 // Copyright 2006-2008 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 149 matching lines @@
     }
 
     // Clear the code cache for this map to avoid hitting the same
     // invalid stub again.  It seems likely that most of the code in
     // the cache is invalid if one of the stubs is so we flush the
     // entire code cache.
     map->ClearCodeCache();
 
     return MONOMORPHIC_PROTOTYPE_FAILURE;
   }
+
+  // The builtins object is special.  It only changes when javascript
+  // builtins are loaded lazily.  It is important to keep inline
+  // caches for the builtins object monomorphic.  Therefore, if we get
+  // an inline cache miss for the builtins object after lazily loading
+  // javascript builtins, we clear the code cache and return
+  // uninitialized as the state to force the inline cache back to
+  // monomorphic state.
+  if (receiver->IsJSBuiltinsObject()) {
+    map->ClearCodeCache();
+    return UNINITIALIZED;
+  }
+
   return MONOMORPHIC;
 }
 
 
 RelocMode IC::ComputeMode() {
   Address addr = address();
   Code* code = Code::cast(Heap::FindCodeObject(addr));
   for (RelocIterator it(code, RelocInfo::kCodeTargetMask);
        !it.done(); it.next()) {
     RelocInfo* info = it.rinfo();
@@ skipping 970 matching lines @@
 #undef ADDR
 };
 
 
 Address IC::AddressFromUtilityId(IC::UtilityId id) {
   return IC_utilities[id];
 }
 
 
 } }  // namespace v8::internal