Fix bug 1070: set correct holder for primitive checks.

src/ast.cc

 // Copyright 2010 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 552 matching lines @@
   SharedFunctionInfo* info = target->shared();
   // If the number of formal parameters of the target function does
   // not match the number of arguments we're passing, we don't want to
   // deal with it. Otherwise, we can call it directly.
   return !target->NeedsArgumentsAdaption() ||
       info->formal_parameter_count() == arity;
 }
 
 
 bool Call::ComputeTarget(Handle<Map> type, Handle<String> name) {
-  holder_ = Handle<JSObject>::null();
+  if (check_type_ == RECEIVER_MAP_CHECK) {
+    // For primitive checks the holder is set up to point to the
+    // corresponding prototype object, i.e. one step of the algorithm
+    // below has been already performed.
+    // For non-primitive checks we clear it to allow computing targets
+    // for polymorphic calls.
+    holder_ = Handle<JSObject>::null();
+  }
   while (true) {
     LookupResult lookup;
     type->LookupInDescriptors(NULL, *name, &lookup);
     // If the function wasn't found directly in the map, we start
     // looking upwards through the prototype chain.
     if (!lookup.IsFound() && type->prototype()->IsJSObject()) {
       holder_ = Handle<JSObject>(JSObject::cast(type->prototype()));
       type = Handle<Map>(holder()->map());
     } else if (lookup.IsProperty() && lookup.type() == CONSTANT_FUNCTION) {
       target_ = Handle<JSFunction>(lookup.GetConstantFunctionFromMap(*type));
@@ skipping 49 matching lines @@
 #endif
   is_monomorphic_ = oracle->CallIsMonomorphic(this);
   check_type_ = oracle->GetCallCheckType(this);
   if (is_monomorphic_) {
     Handle<Map> map;
     if (receiver_types_ != NULL && receiver_types_->length() > 0) {
       ASSERT(check_type_ == RECEIVER_MAP_CHECK);
       map = receiver_types_->at(0);
     } else {
       ASSERT(check_type_ != RECEIVER_MAP_CHECK);
-      map = Handle<Map>(
-          oracle->GetPrototypeForPrimitiveCheck(check_type_)->map());
+      holder_ = Handle<JSObject>(
+          oracle->GetPrototypeForPrimitiveCheck(check_type_));
+      map = Handle<Map>(holder_->map());
     }
     is_monomorphic_ = ComputeTarget(map, name);
   }
 }
 
 
 void BinaryOperation::RecordTypeFeedback(TypeFeedbackOracle* oracle) {
   TypeInfo left = oracle->BinaryType(this, TypeFeedbackOracle::LEFT);
   TypeInfo right = oracle->BinaryType(this, TypeFeedbackOracle::RIGHT);
   is_smi_only_ = left.IsSmi() && right.IsSmi();
@@ skipping 385 matching lines @@
 
 CaseClause::CaseClause(Expression* label,
                        ZoneList<Statement*>* statements,
                        int pos)
     : label_(label),
       statements_(statements),
       position_(pos),
       compare_type_(NONE) {}
 
 } }  // namespace v8::internal