Make Failure inherit from MaybeObject instead of Object.

src/ic.cc

 // Copyright 2006-2009 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 458 matching lines @@
 
   // Change the receiver to the result of calling ToObject on it.
   const int argc = this->target()->arguments_count();
   StackFrameLocator locator;
   JavaScriptFrame* frame = locator.FindJavaScriptFrame(0);
   int index = frame->ComputeExpressionsCount() - (argc + 1);
   frame->SetExpression(index, *Factory::ToObject(object));
 }
 
 
-Object* CallICBase::LoadFunction(State state,
-                                 Handle<Object> object,
-                                 Handle<String> name) {
+MaybeObject* CallICBase::LoadFunction(State state,
+                                      Handle<Object> object,
+                                      Handle<String> name) {
   // If the object is undefined or null it's illegal to try to get any
   // of its properties; throw a TypeError in that case.
   if (object->IsUndefined() || object->IsNull()) {
     return TypeError("non_object_property_call", object, name);
   }
 
   if (object->IsString() || object->IsNumber() || object->IsBoolean()) {
     ReceiverToObject(object);
   }
 
   // Check if the name is trivially convertible to an index and get
   // the element if so.
   uint32_t index;
   if (name->AsArrayIndex(&index)) {
-    Object* result = object->GetElement(index);
+    Object* result;
+    { MaybeObject* maybe_result = object->GetElement(index);
+      if (!maybe_result->ToObject(&result)) return maybe_result;
+    }
+
     if (result->IsJSFunction()) return result;
 
     // Try to find a suitable function delegate for the object at hand.
     result = TryCallAsFunction(result);
     if (result->IsJSFunction()) return result;
 
     // Otherwise, it will fail in the lookup step.
   }
 
   // Lookup the property in the object.
   LookupResult lookup;
   LookupForRead(*object, *name, &lookup);
 
   if (!lookup.IsProperty()) {
     // If the object does not have the requested property, check which
     // exception we need to throw.
     if (IsContextual(object)) {
       return ReferenceError("not_defined", name);
     }
     return TypeError("undefined_method", object, name);
   }
 
   // Lookup is valid: Update inline cache and stub cache.
   if (FLAG_use_ic) {
     UpdateCaches(&lookup, state, object, name);
   }
 
   // Get the property.
   PropertyAttributes attr;
-  Object* result = object->GetProperty(*object, &lookup, *name, &attr);
-  if (result->IsFailure()) return result;
+  Object* result;
+  { MaybeObject* maybe_result =
+        object->GetProperty(*object, &lookup, *name, &attr);
+    if (!maybe_result->ToObject(&result)) return maybe_result;
+  }
   if (lookup.type() == INTERCEPTOR) {
     // If the object does not have the requested property, check which
     // exception we need to throw.
     if (attr == ABSENT) {
       if (IsContextual(object)) {
         return ReferenceError("not_defined", name);
       }
       return TypeError("undefined_method", object, name);
     }
   }
@@ skipping 11 matching lines @@
       Debug::HandleStepIn(function, object, fp(), false);
       return *function;
     }
 #endif
 
     return result;
   }
 
   // Try to find a suitable function delegate for the object at hand.
   result = TryCallAsFunction(result);
-  return result->IsJSFunction() ?
-      result : TypeError("property_not_function", object, name);
+  MaybeObject* answer = result;
+  if (!result->IsJSFunction()) {
+    answer = TypeError("property_not_function", object, name);
+  }
+  return answer;
 }
 
 
 void CallICBase::UpdateCaches(LookupResult* lookup,
                               State state,
                               Handle<Object> object,
                               Handle<String> name) {
   // Bail out if we didn't find a result.
   if (!lookup->IsProperty() || !lookup->IsCacheable()) return;
 
   if (lookup->holder() != *object &&
       HasNormalObjectsInPrototypeChain(lookup, object->GetPrototype())) {
     // Suppress optimization for prototype chains with slow properties objects
     // in the middle.
     return;
   }
 
   // Compute the number of arguments.
   int argc = target()->arguments_count();
   InLoopFlag in_loop = target()->ic_in_loop();
-  Object* code = NULL;
-
+  MaybeObject* maybe_code = NULL;
+  Object* code;
   if (state == UNINITIALIZED) {
     // This is the first time we execute this inline cache.
     // Set the target to the pre monomorphic stub to delay
     // setting the monomorphic state.
-    code = StubCache::ComputeCallPreMonomorphic(argc, in_loop, kind_);
+    maybe_code = StubCache::ComputeCallPreMonomorphic(argc, in_loop, kind_);
   } else if (state == MONOMORPHIC) {
-    code = StubCache::ComputeCallMegamorphic(argc, in_loop, kind_);
+    maybe_code = StubCache::ComputeCallMegamorphic(argc, in_loop, kind_);
   } else {
     // Compute monomorphic stub.
     switch (lookup->type()) {
       case FIELD: {
         int index = lookup->GetFieldIndex();
-        code = StubCache::ComputeCallField(argc,
-                                           in_loop,
-                                           kind_,
-                                           *name,
-                                           *object,
-                                           lookup->holder(),
-                                           index);
+        maybe_code = StubCache::ComputeCallField(argc,
+                                                 in_loop,
+                                                 kind_,
+                                                 *name,
+                                                 *object,
+                                                 lookup->holder(),
+                                                 index);
         break;
       }
       case CONSTANT_FUNCTION: {
         // Get the constant function and compute the code stub for this
         // call; used for rewriting to monomorphic state and making sure
         // that the code stub is in the stub cache.
         JSFunction* function = lookup->GetConstantFunction();
-        code = StubCache::ComputeCallConstant(argc,
-                                              in_loop,
-                                              kind_,
-                                              *name,
-                                              *object,
-                                              lookup->holder(),
-                                              function);
+        maybe_code = StubCache::ComputeCallConstant(argc,
+                                                    in_loop,
+                                                    kind_,
+                                                    *name,
+                                                    *object,
+                                                    lookup->holder(),
+                                                    function);
         break;
       }
       case NORMAL: {
         if (!object->IsJSObject()) return;
         Handle<JSObject> receiver = Handle<JSObject>::cast(object);
 
         if (lookup->holder()->IsGlobalObject()) {
           GlobalObject* global = GlobalObject::cast(lookup->holder());
           JSGlobalPropertyCell* cell =
               JSGlobalPropertyCell::cast(global->GetPropertyCell(lookup));
           if (!cell->value()->IsJSFunction()) return;
           JSFunction* function = JSFunction::cast(cell->value());
-          code = StubCache::ComputeCallGlobal(argc,
-                                              in_loop,
-                                              kind_,
-                                              *name,
-                                              *receiver,
-                                              global,
-                                              cell,
-                                              function);
+          maybe_code = StubCache::ComputeCallGlobal(argc,
+                                                    in_loop,
+                                                    kind_,
+                                                    *name,
+                                                    *receiver,
+                                                    global,
+                                                    cell,
+                                                    function);
         } else {
           // There is only one shared stub for calling normalized
           // properties. It does not traverse the prototype chain, so the
           // property must be found in the receiver for the stub to be
           // applicable.
           if (lookup->holder() != *receiver) return;
-          code = StubCache::ComputeCallNormal(argc,
-                                              in_loop,
-                                              kind_,
-                                              *name,
-                                              *receiver);
+          maybe_code = StubCache::ComputeCallNormal(argc,
+                                                    in_loop,
+                                                    kind_,
+                                                    *name,
+                                                    *receiver);
         }
         break;
       }
       case INTERCEPTOR: {
         ASSERT(HasInterceptorGetter(lookup->holder()));
-        code = StubCache::ComputeCallInterceptor(argc,
-                                                 kind_,
-                                                 *name,
-                                                 *object,
-                                                 lookup->holder());
+        maybe_code = StubCache::ComputeCallInterceptor(argc,
+                                                       kind_,
+                                                       *name,
+                                                       *object,
+                                                       lookup->holder());
         break;
       }
       default:
         return;
     }
   }
 
   // If we're unable to compute the stub (not enough memory left), we
   // simply avoid updating the caches.
-  if (code == NULL || code->IsFailure()) return;
+  if (maybe_code == NULL || !maybe_code->ToObject(&code)) return;
 
   // Patch the call site depending on the state of the cache.
   if (state == UNINITIALIZED ||
       state == PREMONOMORPHIC ||
       state == MONOMORPHIC ||
       state == MONOMORPHIC_PROTOTYPE_FAILURE) {
     set_target(Code::cast(code));
   } else if (state == MEGAMORPHIC) {
     // Cache code holding map should be consistent with
     // GenerateMonomorphicCacheProbe. It is not the map which holds the stub.
     Map* map = JSObject::cast(object->IsJSObject() ? *object :
                               object->GetPrototype())->map();
 
     // Update the stub cache.
     StubCache::Set(*name, map, Code::cast(code));
   }
 
 #ifdef DEBUG
   TraceIC(kind_ == Code::CALL_IC ? "CallIC" : "KeyedCallIC",
       name, state, target(), in_loop ? " (in-loop)" : "");
 #endif
 }
 
 
-Object* KeyedCallIC::LoadFunction(State state,
-                                  Handle<Object> object,
-                                  Handle<Object> key) {
+MaybeObject* KeyedCallIC::LoadFunction(State state,
+                                       Handle<Object> object,
+                                       Handle<Object> key) {
   if (key->IsSymbol()) {
     return CallICBase::LoadFunction(state, object, Handle<String>::cast(key));
   }
 
   if (object->IsUndefined() || object->IsNull()) {
     return TypeError("non_object_property_call", object, key);
   }
 
   if (object->IsString() || object->IsNumber() || object->IsBoolean()) {
     ReceiverToObject(object);
   }
 
   if (FLAG_use_ic && state != MEGAMORPHIC && !object->IsAccessCheckNeeded()) {
     int argc = target()->arguments_count();
     InLoopFlag in_loop = target()->ic_in_loop();
-    Object* code = StubCache::ComputeCallMegamorphic(
+    MaybeObject* maybe_code = StubCache::ComputeCallMegamorphic(
         argc, in_loop, Code::KEYED_CALL_IC);
-    if (!code->IsFailure()) {
+    Object* code;
+    if (maybe_code->ToObject(&code)) {
       set_target(Code::cast(code));
 #ifdef DEBUG
       TraceIC(
           "KeyedCallIC", key, state, target(), in_loop ? " (in-loop)" : "");
 #endif
     }
   }
-  Object* result = Runtime::GetObjectProperty(object, key);
+  Object* result;
+  { MaybeObject* maybe_result = Runtime::GetObjectProperty(object, key);
+    if (!maybe_result->ToObject(&result)) return maybe_result;
+  }
   if (result->IsJSFunction()) return result;
   result = TryCallAsFunction(result);
-  return result->IsJSFunction() ?
-      result : TypeError("property_not_function", object, key);
+  MaybeObject* answer = result;
+  if (!result->IsJSFunction()) {
+    answer = TypeError("property_not_function", object, key);
+  }
+  return answer;
 }
 
 
 #ifdef DEBUG
 #define TRACE_IC_NAMED(msg, name) \
   if (FLAG_trace_ic) PrintF(msg, *(name)->ToCString())
 #else
 #define TRACE_IC_NAMED(msg, name)
 #endif
 
 
-Object* LoadIC::Load(State state, Handle<Object> object, Handle<String> name) {
+MaybeObject* LoadIC::Load(State state,
+                          Handle<Object> object,
+                          Handle<String> name) {
   // If the object is undefined or null it's illegal to try to get any
   // of its properties; throw a TypeError in that case.
   if (object->IsUndefined() || object->IsNull()) {
     return TypeError("non_object_property_load", object, name);
   }
 
   if (FLAG_use_ic) {
     // Use specialized code for getting the length of strings and
     // string wrapper objects.  The length property of string wrapper
     // objects is read-only and therefore always returns the length of
@@ skipping 121 matching lines @@
   }
 
   // Update inline cache and stub cache.
   if (FLAG_use_ic) {
     UpdateCaches(&lookup, state, object, name);
   }
 
   PropertyAttributes attr;
   if (lookup.IsProperty() && lookup.type() == INTERCEPTOR) {
     // Get the property.
-    Object* result = object->GetProperty(*object, &lookup, *name, &attr);
-    if (result->IsFailure()) return result;
+    Object* result;
+    { MaybeObject* maybe_result =
+          object->GetProperty(*object, &lookup, *name, &attr);
+      if (!maybe_result->ToObject(&result)) return maybe_result;
+    }
     // If the property is not present, check if we need to throw an
     // exception.
     if (attr == ABSENT && IsContextual(object)) {
       return ReferenceError("not_defined", name);
     }
     return result;
   }
 
   // Get the property.
   return object->GetProperty(*object, &lookup, *name, &attr);
 }
 
 
 void LoadIC::UpdateCaches(LookupResult* lookup,
                           State state,
                           Handle<Object> object,
                           Handle<String> name) {
   // Bail out if the result is not cacheable.
   if (!lookup->IsCacheable()) return;
 
   // Loading properties from values is not common, so don't try to
   // deal with non-JS objects here.
   if (!object->IsJSObject()) return;
   Handle<JSObject> receiver = Handle<JSObject>::cast(object);
 
   if (HasNormalObjectsInPrototypeChain(lookup, *object)) return;
 
   // Compute the code stub for this load.
-  Object* code = NULL;
+  MaybeObject* maybe_code = NULL;
+  Object* code;
   if (state == UNINITIALIZED) {
     // This is the first time we execute this inline cache.
     // Set the target to the pre monomorphic stub to delay
     // setting the monomorphic state.
-    code = pre_monomorphic_stub();
+    maybe_code = pre_monomorphic_stub();
   } else if (!lookup->IsProperty()) {
     // Nonexistent property. The result is undefined.
-    code = StubCache::ComputeLoadNonexistent(*name, *receiver);
+    maybe_code = StubCache::ComputeLoadNonexistent(*name, *receiver);
   } else {
     // Compute monomorphic stub.
     switch (lookup->type()) {
       case FIELD: {
-        code = StubCache::ComputeLoadField(*name, *receiver,
-                                           lookup->holder(),
-                                           lookup->GetFieldIndex());
+        maybe_code = StubCache::ComputeLoadField(*name, *receiver,
+                                                 lookup->holder(),
+                                                 lookup->GetFieldIndex());
         break;
       }
       case CONSTANT_FUNCTION: {
         Object* constant = lookup->GetConstantFunction();
-        code = StubCache::ComputeLoadConstant(*name, *receiver,
-                                              lookup->holder(), constant);
+        maybe_code = StubCache::ComputeLoadConstant(*name, *receiver,
+                                                    lookup->holder(), constant);
         break;
       }
       case NORMAL: {
         if (lookup->holder()->IsGlobalObject()) {
           GlobalObject* global = GlobalObject::cast(lookup->holder());
           JSGlobalPropertyCell* cell =
               JSGlobalPropertyCell::cast(global->GetPropertyCell(lookup));
-          code = StubCache::ComputeLoadGlobal(*name,
-                                              *receiver,
-                                              global,
-                                              cell,
-                                              lookup->IsDontDelete());
+          maybe_code = StubCache::ComputeLoadGlobal(*name,
+                                                    *receiver,
+                                                    global,
+                                                    cell,
+                                                    lookup->IsDontDelete());
         } else {
           // There is only one shared stub for loading normalized
           // properties. It does not traverse the prototype chain, so the
           // property must be found in the receiver for the stub to be
           // applicable.
           if (lookup->holder() != *receiver) return;
-          code = StubCache::ComputeLoadNormal();
+          maybe_code = StubCache::ComputeLoadNormal();
         }
         break;
       }
       case CALLBACKS: {
         if (!lookup->GetCallbackObject()->IsAccessorInfo()) return;
         AccessorInfo* callback =
             AccessorInfo::cast(lookup->GetCallbackObject());
         if (v8::ToCData<Address>(callback->getter()) == 0) return;
-        code = StubCache::ComputeLoadCallback(*name, *receiver,
-                                              lookup->holder(), callback);
+        maybe_code = StubCache::ComputeLoadCallback(*name, *receiver,
+                                                    lookup->holder(), callback);
         break;
       }
       case INTERCEPTOR: {
         ASSERT(HasInterceptorGetter(lookup->holder()));
-        code = StubCache::ComputeLoadInterceptor(*name, *receiver,
-                                                 lookup->holder());
+        maybe_code = StubCache::ComputeLoadInterceptor(*name, *receiver,
+                                                       lookup->holder());
         break;
       }
       default:
         return;
     }
   }
 
   // If we're unable to compute the stub (not enough memory left), we
   // simply avoid updating the caches.
-  if (code == NULL || code->IsFailure()) return;
+  if (maybe_code == NULL || !maybe_code->ToObject(&code)) return;
 
   // Patch the call site depending on the state of the cache.
   if (state == UNINITIALIZED || state == PREMONOMORPHIC ||
       state == MONOMORPHIC_PROTOTYPE_FAILURE) {
     set_target(Code::cast(code));
   } else if (state == MONOMORPHIC) {
     set_target(megamorphic_stub());
   } else if (state == MEGAMORPHIC) {
     // Cache code holding map should be consistent with
     // GenerateMonomorphicCacheProbe.
     Map* map = JSObject::cast(object->IsJSObject() ? *object :
                               object->GetPrototype())->map();
 
     StubCache::Set(*name, map, Code::cast(code));
   }
 
 #ifdef DEBUG
   TraceIC("LoadIC", name, state, target());
 #endif
 }
 
 
-Object* KeyedLoadIC::Load(State state,
-                          Handle<Object> object,
-                          Handle<Object> key) {
+MaybeObject* KeyedLoadIC::Load(State state,
+                               Handle<Object> object,
+                               Handle<Object> key) {
   if (key->IsSymbol()) {
     Handle<String> name = Handle<String>::cast(key);
 
     // If the object is undefined or null it's illegal to try to get any
     // of its properties; throw a TypeError in that case.
     if (object->IsUndefined() || object->IsNull()) {
       return TypeError("non_object_property_load", object, name);
     }
 
     if (FLAG_use_ic) {
       // Use specialized code for getting the length of strings.
       if (object->IsString() && name->Equals(Heap::length_symbol())) {
         Handle<String> string = Handle<String>::cast(object);
         Object* code = NULL;
-        code = StubCache::ComputeKeyedLoadStringLength(*name, *string);
-        if (code->IsFailure()) return code;
+        { MaybeObject* maybe_code =
+              StubCache::ComputeKeyedLoadStringLength(*name, *string);
+          if (!maybe_code->ToObject(&code)) return maybe_code;
+        }
         set_target(Code::cast(code));
 #ifdef DEBUG
         TraceIC("KeyedLoadIC", name, state, target());
 #endif  // DEBUG
         return Smi::FromInt(string->length());
       }
 
       // Use specialized code for getting the length of arrays.
       if (object->IsJSArray() && name->Equals(Heap::length_symbol())) {
         Handle<JSArray> array = Handle<JSArray>::cast(object);
-        Object* code = StubCache::ComputeKeyedLoadArrayLength(*name, *array);
-        if (code->IsFailure()) return code;
+        Object* code;
+        { MaybeObject* maybe_code =
+              StubCache::ComputeKeyedLoadArrayLength(*name, *array);
+          if (!maybe_code->ToObject(&code)) return maybe_code;
+        }
         set_target(Code::cast(code));
 #ifdef DEBUG
         TraceIC("KeyedLoadIC", name, state, target());
 #endif  // DEBUG
         return JSArray::cast(*object)->length();
       }
 
       // Use specialized code for getting prototype of functions.
       if (object->IsJSFunction() && name->Equals(Heap::prototype_symbol()) &&
         JSFunction::cast(*object)->should_have_prototype()) {
         Handle<JSFunction> function = Handle<JSFunction>::cast(object);
-        Object* code =
-            StubCache::ComputeKeyedLoadFunctionPrototype(*name, *function);
-        if (code->IsFailure()) return code;
+        Object* code;
+        { MaybeObject* maybe_code =
+              StubCache::ComputeKeyedLoadFunctionPrototype(*name, *function);
+          if (!maybe_code->ToObject(&code)) return maybe_code;
+        }
         set_target(Code::cast(code));
 #ifdef DEBUG
         TraceIC("KeyedLoadIC", name, state, target());
 #endif  // DEBUG
         return Accessors::FunctionGetPrototype(*object, 0);
       }
     }
 
     // Check if the name is trivially convertible to an index and get
     // the element or char if so.
@@ skipping 16 matching lines @@
       }
     }
 
     if (FLAG_use_ic) {
       UpdateCaches(&lookup, state, object, name);
     }
 
     PropertyAttributes attr;
     if (lookup.IsProperty() && lookup.type() == INTERCEPTOR) {
       // Get the property.
-      Object* result = object->GetProperty(*object, &lookup, *name, &attr);
-      if (result->IsFailure()) return result;
+      Object* result;
+      { MaybeObject* maybe_result =
+            object->GetProperty(*object, &lookup, *name, &attr);
+        if (!maybe_result->ToObject(&result)) return maybe_result;
+      }
       // If the property is not present, check if we need to throw an
       // exception.
       if (attr == ABSENT && IsContextual(object)) {
         return ReferenceError("not_defined", name);
       }
       return result;
     }
 
     return object->GetProperty(*object, &lookup, *name, &attr);
   }
@@ skipping 37 matching lines @@
                                Handle<Object> object, Handle<String> name) {
   // Bail out if we didn't find a result.
   if (!lookup->IsProperty() || !lookup->IsCacheable()) return;
 
   if (!object->IsJSObject()) return;
   Handle<JSObject> receiver = Handle<JSObject>::cast(object);
 
   if (HasNormalObjectsInPrototypeChain(lookup, *object)) return;
 
   // Compute the code stub for this load.
-  Object* code = NULL;
+  MaybeObject* maybe_code = NULL;
+  Object* code;
 
   if (state == UNINITIALIZED) {
     // This is the first time we execute this inline cache.
     // Set the target to the pre monomorphic stub to delay
     // setting the monomorphic state.
-    code = pre_monomorphic_stub();
+    maybe_code = pre_monomorphic_stub();
   } else {
     // Compute a monomorphic stub.
     switch (lookup->type()) {
       case FIELD: {
-        code = StubCache::ComputeKeyedLoadField(*name, *receiver,
-                                                lookup->holder(),
-                                                lookup->GetFieldIndex());
+        maybe_code = StubCache::ComputeKeyedLoadField(*name, *receiver,
+                                                      lookup->holder(),
+                                                      lookup->GetFieldIndex());
         break;
       }
       case CONSTANT_FUNCTION: {
         Object* constant = lookup->GetConstantFunction();
-        code = StubCache::ComputeKeyedLoadConstant(*name, *receiver,
-                                                   lookup->holder(), constant);
+        maybe_code = StubCache::ComputeKeyedLoadConstant(*name,
+                                                         *receiver,
+                                                         lookup->holder(),
+                                                         constant);
         break;
       }
       case CALLBACKS: {
         if (!lookup->GetCallbackObject()->IsAccessorInfo()) return;
         AccessorInfo* callback =
             AccessorInfo::cast(lookup->GetCallbackObject());
         if (v8::ToCData<Address>(callback->getter()) == 0) return;
-        code = StubCache::ComputeKeyedLoadCallback(*name, *receiver,
-                                                   lookup->holder(), callback);
+        maybe_code = StubCache::ComputeKeyedLoadCallback(*name,
+                                                         *receiver,
+                                                         lookup->holder(),
+                                                         callback);
         break;
       }
       case INTERCEPTOR: {
         ASSERT(HasInterceptorGetter(lookup->holder()));
-        code = StubCache::ComputeKeyedLoadInterceptor(*name, *receiver,
-                                                      lookup->holder());
+        maybe_code = StubCache::ComputeKeyedLoadInterceptor(*name, *receiver,
+                                                            lookup->holder());
         break;
       }
       default: {
         // Always rewrite to the generic case so that we do not
         // repeatedly try to rewrite.
-        code = generic_stub();
+        maybe_code = generic_stub();
         break;
       }
     }
   }
 
   // If we're unable to compute the stub (not enough memory left), we
   // simply avoid updating the caches.
-  if (code == NULL || code->IsFailure()) return;
+  if (maybe_code == NULL || !maybe_code->ToObject(&code)) return;
 
   // Patch the call site depending on the state of the cache.  Make
   // sure to always rewrite from monomorphic to megamorphic.
   ASSERT(state != MONOMORPHIC_PROTOTYPE_FAILURE);
   if (state == UNINITIALIZED || state == PREMONOMORPHIC) {
     set_target(Code::cast(code));
   } else if (state == MONOMORPHIC) {
     set_target(megamorphic_stub());
   }
 
@@ skipping 27 matching lines @@
     if (object->GetNamedInterceptor()->setter()->IsUndefined()) {
       object->LocalLookupRealNamedProperty(name, lookup);
       return StoreICableLookup(lookup);
     }
   }
 
   return true;
 }
 
 
-Object* StoreIC::Store(State state,
-                       Handle<Object> object,
-                       Handle<String> name,
-                       Handle<Object> value) {
+MaybeObject* StoreIC::Store(State state,
+                            Handle<Object> object,
+                            Handle<String> name,
+                            Handle<Object> value) {
   // If the object is undefined or null it's illegal to try to set any
   // properties on it; throw a TypeError in that case.
   if (object->IsUndefined() || object->IsNull()) {
     return TypeError("non_object_property_store", object, name);
   }
 
   // Ignore stores where the receiver is not a JSObject.
   if (!object->IsJSObject()) return *value;
   Handle<JSObject> receiver = Handle<JSObject>::cast(object);
 
@@ skipping 92 matching lines @@
   ASSERT(StoreICableLookup(lookup));
 
   // If the property has a non-field type allowing map transitions
   // where there is extra room in the object, we leave the IC in its
   // current state.
   PropertyType type = lookup->type();
 
   // Compute the code stub for this store; used for rewriting to
   // monomorphic state and making sure that the code stub is in the
   // stub cache.
+  MaybeObject* maybe_code = NULL;
   Object* code = NULL;
   switch (type) {
     case FIELD: {
-      code = StubCache::ComputeStoreField(*name, *receiver,
-                                          lookup->GetFieldIndex());
+      maybe_code = StubCache::ComputeStoreField(*name, *receiver,
+                                                lookup->GetFieldIndex());
       break;
     }
     case MAP_TRANSITION: {
       if (lookup->GetAttributes() != NONE) return;
       HandleScope scope;
       ASSERT(type == MAP_TRANSITION);
       Handle<Map> transition(lookup->GetTransitionMap());
       int index = transition->PropertyIndexFor(*name);
-      code = StubCache::ComputeStoreField(*name, *receiver, index, *transition);
+      maybe_code = StubCache::ComputeStoreField(*name, *receiver,
+                                                index, *transition);
       break;
     }
     case NORMAL: {
       if (receiver->IsGlobalObject()) {
         // The stub generated for the global object picks the value directly
         // from the property cell. So the property must be directly on the
         // global object.
         Handle<GlobalObject> global = Handle<GlobalObject>::cast(receiver);
         JSGlobalPropertyCell* cell =
             JSGlobalPropertyCell::cast(global->GetPropertyCell(lookup));
-        code = StubCache::ComputeStoreGlobal(*name, *global, cell);
+        maybe_code = StubCache::ComputeStoreGlobal(*name, *global, cell);
       } else {
         if (lookup->holder() != *receiver) return;
-        code = StubCache::ComputeStoreNormal();
+        maybe_code = StubCache::ComputeStoreNormal();
       }
       break;
     }
     case CALLBACKS: {
       if (!lookup->GetCallbackObject()->IsAccessorInfo()) return;
       AccessorInfo* callback = AccessorInfo::cast(lookup->GetCallbackObject());
       if (v8::ToCData<Address>(callback->setter()) == 0) return;
-      code = StubCache::ComputeStoreCallback(*name, *receiver, callback);
+      maybe_code = StubCache::ComputeStoreCallback(*name, *receiver, callback);
       break;
     }
     case INTERCEPTOR: {
       ASSERT(!receiver->GetNamedInterceptor()->setter()->IsUndefined());
-      code = StubCache::ComputeStoreInterceptor(*name, *receiver);
+      maybe_code = StubCache::ComputeStoreInterceptor(*name, *receiver);
       break;
     }
     default:
       return;
   }
 
   // If we're unable to compute the stub (not enough memory left), we
   // simply avoid updating the caches.
-  if (code == NULL || code->IsFailure()) return;
+  if (maybe_code == NULL || !maybe_code->ToObject(&code)) return;
 
   // Patch the call site depending on the state of the cache.
   if (state == UNINITIALIZED || state == MONOMORPHIC_PROTOTYPE_FAILURE) {
     set_target(Code::cast(code));
   } else if (state == MONOMORPHIC) {
     // Only move to megamorphic if the target changes.
     if (target() != Code::cast(code)) set_target(megamorphic_stub());
   } else if (state == MEGAMORPHIC) {
     // Update the stub cache.
     StubCache::Set(*name, receiver->map(), Code::cast(code));
   }
 
 #ifdef DEBUG
   TraceIC("StoreIC", name, state, target());
 #endif
 }
 
 
-Object* KeyedStoreIC::Store(State state,
-                            Handle<Object> object,
-                            Handle<Object> key,
-                            Handle<Object> value) {
+MaybeObject* KeyedStoreIC::Store(State state,
+                                 Handle<Object> object,
+                                 Handle<Object> key,
+                                 Handle<Object> value) {
   if (key->IsSymbol()) {
     Handle<String> name = Handle<String>::cast(key);
 
     // If the object is undefined or null it's illegal to try to set any
     // properties on it; throw a TypeError in that case.
     if (object->IsUndefined() || object->IsNull()) {
       return TypeError("non_object_property_store", object, name);
     }
 
     // Ignore stores where the receiver is not a JSObject.
@@ skipping 59 matching lines @@
   if (lookup->IsReadOnly()) return;
 
   // If the property has a non-field type allowing map transitions
   // where there is extra room in the object, we leave the IC in its
   // current state.
   PropertyType type = lookup->type();
 
   // Compute the code stub for this store; used for rewriting to
   // monomorphic state and making sure that the code stub is in the
   // stub cache.
+  MaybeObject* maybe_code = NULL;
   Object* code = NULL;
 
   switch (type) {
     case FIELD: {
-      code = StubCache::ComputeKeyedStoreField(*name, *receiver,
-                                               lookup->GetFieldIndex());
+      maybe_code = StubCache::ComputeKeyedStoreField(*name, *receiver,
+                                                     lookup->GetFieldIndex());
       break;
     }
     case MAP_TRANSITION: {
       if (lookup->GetAttributes() == NONE) {
         HandleScope scope;
         ASSERT(type == MAP_TRANSITION);
         Handle<Map> transition(lookup->GetTransitionMap());
         int index = transition->PropertyIndexFor(*name);
-        code = StubCache::ComputeKeyedStoreField(*name, *receiver,
-                                                 index, *transition);
+        maybe_code = StubCache::ComputeKeyedStoreField(*name, *receiver,
+                                                       index, *transition);
         break;
       }
       // fall through.
     }
     default: {
       // Always rewrite to the generic case so that we do not
       // repeatedly try to rewrite.
-      code = generic_stub();
+      maybe_code = generic_stub();
       break;
     }
   }
 
   // If we're unable to compute the stub (not enough memory left), we
   // simply avoid updating the caches.
-  if (code == NULL || code->IsFailure()) return;
+  if (maybe_code == NULL || !maybe_code->ToObject(&code)) return;
 
   // Patch the call site depending on the state of the cache.  Make
   // sure to always rewrite from monomorphic to megamorphic.
   ASSERT(state != MONOMORPHIC_PROTOTYPE_FAILURE);
   if (state == UNINITIALIZED || state == PREMONOMORPHIC) {
     set_target(Code::cast(code));
   } else if (state == MONOMORPHIC) {
     set_target(megamorphic_stub());
   }
 
@@ skipping 15 matching lines @@
   if (in_loop == IN_LOOP) {
     CompileLazyInLoop(function_handle, CLEAR_EXCEPTION);
   } else {
     CompileLazy(function_handle, CLEAR_EXCEPTION);
   }
   return *function_handle;
 }
 
 
 // Used from ic-<arch>.cc.
-Object* CallIC_Miss(Arguments args) {
+MUST_USE_RESULT MaybeObject* CallIC_Miss(Arguments args) {
   NoHandleAllocation na;
   ASSERT(args.length() == 2);
   CallIC ic;
   IC::State state = IC::StateFrom(ic.target(), args[0], args[1]);
-  Object* result =
-      ic.LoadFunction(state, args.at<Object>(0), args.at<String>(1));
+  Object* result;
+  { MaybeObject* maybe_result =
+       ic.LoadFunction(state, args.at<Object>(0), args.at<String>(1));
+    if (!maybe_result->ToObject(&result)) return maybe_result;
+  }
 
   // The first time the inline cache is updated may be the first time the
   // function it references gets called.  If the function was lazily compiled
   // then the first call will trigger a compilation.  We check for this case
   // and we do the compilation immediately, instead of waiting for the stub
   // currently attached to the JSFunction object to trigger compilation.  We
   // do this in the case where we know that the inline cache is inside a loop,
   // because then we know that we want to optimize the function.
   if (!result->IsJSFunction() || JSFunction::cast(result)->is_compiled()) {
     return result;
   }
   return CompileFunction(JSFunction::cast(result), ic.target()->ic_in_loop());
 }
 
 
 // Used from ic-<arch>.cc.
-Object* KeyedCallIC_Miss(Arguments args) {
+MUST_USE_RESULT MaybeObject* KeyedCallIC_Miss(Arguments args) {
   NoHandleAllocation na;
   ASSERT(args.length() == 2);
   KeyedCallIC ic;
   IC::State state = IC::StateFrom(ic.target(), args[0], args[1]);
-  Object* result =
+  Object* result;
+  { MaybeObject* maybe_result =
       ic.LoadFunction(state, args.at<Object>(0), args.at<Object>(1));
+    if (!maybe_result->ToObject(&result)) return maybe_result;
+  }
 
   if (!result->IsJSFunction() || JSFunction::cast(result)->is_compiled()) {
     return result;
   }
   return CompileFunction(JSFunction::cast(result), ic.target()->ic_in_loop());
 }
 
 
 // Used from ic-<arch>.cc.
-Object* LoadIC_Miss(Arguments args) {
+MUST_USE_RESULT MaybeObject* LoadIC_Miss(Arguments args) {
   NoHandleAllocation na;
   ASSERT(args.length() == 2);
   LoadIC ic;
   IC::State state = IC::StateFrom(ic.target(), args[0], args[1]);
   return ic.Load(state, args.at<Object>(0), args.at<String>(1));
 }
 
 
 // Used from ic-<arch>.cc
-Object* KeyedLoadIC_Miss(Arguments args) {
+MUST_USE_RESULT MaybeObject* KeyedLoadIC_Miss(Arguments args) {
   NoHandleAllocation na;
   ASSERT(args.length() == 2);
   KeyedLoadIC ic;
   IC::State state = IC::StateFrom(ic.target(), args[0], args[1]);
   return ic.Load(state, args.at<Object>(0), args.at<Object>(1));
 }
 
 
 // Used from ic-<arch>.cc.
-Object* StoreIC_Miss(Arguments args) {
+MUST_USE_RESULT MaybeObject* StoreIC_Miss(Arguments args) {
   NoHandleAllocation na;
   ASSERT(args.length() == 3);
   StoreIC ic;
   IC::State state = IC::StateFrom(ic.target(), args[0], args[1]);
   return ic.Store(state, args.at<Object>(0), args.at<String>(1),
                   args.at<Object>(2));
 }
 
 
-Object* StoreIC_ArrayLength(Arguments args) {
+MUST_USE_RESULT MaybeObject* StoreIC_ArrayLength(Arguments args) {
   NoHandleAllocation nha;
 
   ASSERT(args.length() == 2);
   JSObject* receiver = JSObject::cast(args[0]);
   Object* len = args[1];
 
-  Object* result = receiver->SetElementsLength(len);
-  if (result->IsFailure()) return result;
+  // The generated code should filter out non-Smis before we get here.
+  ASSERT(len->IsSmi());
+
+  Object* result;
+  { MaybeObject* maybe_result = receiver->SetElementsLength(len);
+    if (!maybe_result->ToObject(&result)) return maybe_result;
+  }
   return len;
 }
 
 
 // Extend storage is called in a store inline cache when
 // it is necessary to extend the properties array of a
 // JSObject.
-Object* SharedStoreIC_ExtendStorage(Arguments args) {
+MUST_USE_RESULT MaybeObject* SharedStoreIC_ExtendStorage(Arguments args) {
   NoHandleAllocation na;
   ASSERT(args.length() == 3);
 
   // Convert the parameters
   JSObject* object = JSObject::cast(args[0]);
   Map* transition = Map::cast(args[1]);
   Object* value = args[2];
 
   // Check the object has run out out property space.
   ASSERT(object->HasFastProperties());
   ASSERT(object->map()->unused_property_fields() == 0);
 
   // Expand the properties array.
   FixedArray* old_storage = object->properties();
   int new_unused = transition->unused_property_fields();
   int new_size = old_storage->length() + new_unused + 1;
-  Object* result = old_storage->CopySize(new_size);
-  if (result->IsFailure()) return result;
+  Object* result;
+  { MaybeObject* maybe_result = old_storage->CopySize(new_size);
+    if (!maybe_result->ToObject(&result)) return maybe_result;
+  }
   FixedArray* new_storage = FixedArray::cast(result);
   new_storage->set(old_storage->length(), value);
 
   // Set the new property value and do the map transition.
   object->set_properties(new_storage);
   object->set_map(transition);
 
   // Return the stored value.
   return value;
 }
 
 
 // Used from ic-<arch>.cc.
-Object* KeyedStoreIC_Miss(Arguments args) {
+MUST_USE_RESULT MaybeObject* KeyedStoreIC_Miss(Arguments args) {
   NoHandleAllocation na;
   ASSERT(args.length() == 3);
   KeyedStoreIC ic;
   IC::State state = IC::StateFrom(ic.target(), args[0], args[1]);
   return ic.Store(state, args.at<Object>(0), args.at<Object>(1),
                   args.at<Object>(2));
 }
 
 
 void BinaryOpIC::patch(Code* code) {
@@ skipping 44 matching lines @@
   }
 
   return GENERIC;
 }
 
 
 // defined in codegen-<arch>.cc
 Handle<Code> GetBinaryOpStub(int key, BinaryOpIC::TypeInfo type_info);
 
 
-Object* BinaryOp_Patch(Arguments args) {
+MUST_USE_RESULT MaybeObject* BinaryOp_Patch(Arguments args) {
   ASSERT(args.length() == 5);
 
   Handle<Object> left = args.at<Object>(0);
   Handle<Object> right = args.at<Object>(1);
   int key = Smi::cast(args[2])->value();
   Token::Value op = static_cast<Token::Value>(Smi::cast(args[3])->value());
 #ifdef DEBUG
   BinaryOpIC::TypeInfo prev_type_info =
       static_cast<BinaryOpIC::TypeInfo>(Smi::cast(args[4])->value());
 #endif  // DEBUG
@@ skipping 80 matching lines @@
 #undef ADDR
 };
 
 
 Address IC::AddressFromUtilityId(IC::UtilityId id) {
   return IC_utilities[id];
 }
 
 
 } }  // namespace v8::internal