Index: src/ia32/macro-assembler-ia32.cc |
diff --git a/src/ia32/macro-assembler-ia32.cc b/src/ia32/macro-assembler-ia32.cc |
index 42a151e27afa2c7205600f290328c6cc2748ec80..16b47d10cd862cd5744d86605c2c3bb3ec781b40 100644 |
--- a/src/ia32/macro-assembler-ia32.cc |
+++ b/src/ia32/macro-assembler-ia32.cc |
@@ -3178,14 +3178,22 @@ void MacroAssembler::JumpIfDictionaryInPrototypeChain( |
DCHECK(!scratch1.is(scratch0)); |
Factory* factory = isolate()->factory(); |
Register current = scratch0; |
- Label loop_again; |
+ Label loop_again, end; |
// scratch contained elements pointer. |
mov(current, object); |
+ mov(current, FieldOperand(current, HeapObject::kMapOffset)); |
+ mov(current, FieldOperand(current, Map::kPrototypeOffset)); |
+ cmp(current, Immediate(factory->null_value())); |
+ j(equal, &end); |
// Loop based on the map going up the prototype chain. |
bind(&loop_again); |
mov(current, FieldOperand(current, HeapObject::kMapOffset)); |
+ STATIC_ASSERT(JS_PROXY_TYPE < JS_OBJECT_TYPE); |
+ STATIC_ASSERT(JS_VALUE_TYPE < JS_OBJECT_TYPE); |
+ CmpInstanceType(current, JS_OBJECT_TYPE); |
+ j(below, found); |
mov(scratch1, FieldOperand(current, Map::kBitField2Offset)); |
DecodeField<Map::ElementsKindBits>(scratch1); |
cmp(scratch1, Immediate(DICTIONARY_ELEMENTS)); |
@@ -3193,6 +3201,8 @@ void MacroAssembler::JumpIfDictionaryInPrototypeChain( |
mov(current, FieldOperand(current, Map::kPrototypeOffset)); |
cmp(current, Immediate(factory->null_value())); |
j(not_equal, &loop_again); |
+ |
+ bind(&end); |
} |