Hacky fix for SlowSloppyElementsAccessor::Set

src/elements.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/v8.h"
 
 #include "src/arguments.h"
 #include "src/conversions.h"
 #include "src/elements.h"
 #include "src/messages.h"
@@ skipping 1470 matching lines @@
   static void SetImpl(FixedArrayBase* store, uint32_t index, Object* value) {
     FixedArray* parameter_map = FixedArray::cast(store);
     Object* probe = GetParameterMapArg(parameter_map, index);
     if (!probe->IsTheHole()) {
       Context* context = Context::cast(parameter_map->get(0));
       int context_entry = Smi::cast(probe)->value();
       DCHECK(!context->get(context_entry)->IsTheHole());
       context->set(context_entry, value);
     } else {
       FixedArray* arguments = FixedArray::cast(parameter_map->get(1));
-      ArgumentsAccessor::SetImpl(arguments, index, value);
+      SeededNumberDictionary* backing_store =
+          SeededNumberDictionary::cast(arguments);
+      int entry = backing_store->FindEntry(index);
+      DCHECK_NE(entry, SeededNumberDictionary::kNotFound);
+      Object* current_value = backing_store->ValueAt(entry);
+      if (current_value->IsAliasedArgumentsEntry()) {
+        DisallowHeapAllocation no_gc;
+        AliasedArgumentsEntry* alias =
+            AliasedArgumentsEntry::cast(current_value);
+        Context* context = Context::cast(parameter_map->get(0));
+        int context_entry = alias->aliased_context_slot();
+        DCHECK(!context->get(context_entry)->IsTheHole());
+        context->set(context_entry, value);
+      } else {
+        ArgumentsAccessor::SetImpl(arguments, index, value);
+      }
     }
   }
 
   static void SetLengthImpl(Handle<JSArray> array, uint32_t length,
                             Handle<FixedArrayBase> parameter_map) {
     // Sloppy arguments objects are not arrays.
     UNREACHABLE();
   }
 
   static uint32_t GetCapacityImpl(JSObject* holder,
@@ skipping 433 matching lines @@
 #define ACCESSOR_DELETE(Class, Kind, Store) delete elements_accessors_[Kind];
   ELEMENTS_LIST(ACCESSOR_DELETE)
 #undef ACCESSOR_DELETE
   elements_accessors_ = NULL;
 }
 
 
 ElementsAccessor** ElementsAccessor::elements_accessors_ = NULL;
 }  // namespace internal
 }  // namespace v8