Fix non-standard element handling

src/lookup.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/v8.h"
 
 #include "src/bootstrapper.h"
 #include "src/deoptimizer.h"
 #include "src/lookup.h"
 #include "src/lookup-inl.h"
@@ skipping 300 matching lines @@
 
 void LookupIterator::TransitionToAccessorPair(Handle<Object> pair,
                                               PropertyAttributes attributes) {
   Handle<JSObject> receiver = GetStoreTarget();
   holder_ = receiver;
 
   PropertyDetails details(attributes, ACCESSOR_CONSTANT, 0,
                           PropertyCellType::kMutable);
 
   if (IsElement()) {
     // TODO(verwaest): Remove this hack once we have a quick way to check the

[Igor Sheludko, 2015/07/15 10:53:17]

This TODO does not belong here anymore. Maybe move it to
JSObject::RequireSlowElements().

     // prototype chain in element setters.
     // TODO(verwaest): Move code into the element accessor.
-    bool was_dictionary = receiver->HasDictionaryElements();
     Handle<SeededNumberDictionary> dictionary =
         JSObject::NormalizeElements(receiver);
-    was_dictionary = was_dictionary && dictionary->requires_slow_elements();
 
     dictionary = SeededNumberDictionary::Set(dictionary, index_, pair, details);
-    dictionary->set_requires_slow_elements();
+    JSObject::RequireSlowElements(receiver, dictionary);
 
     if (receiver->HasSlowArgumentsElements()) {
       FixedArray* parameter_map = FixedArray::cast(receiver->elements());
       uint32_t length = parameter_map->length() - 2;
       if (number_ < length) {
         parameter_map->set(number_ + 2, heap()->the_hole_value());
       }
       FixedArray::cast(receiver->elements())->set(1, *dictionary);
     } else {
       receiver->set_elements(*dictionary);
-      if (!was_dictionary) heap()->ClearAllICsByKind(Code::KEYED_STORE_IC);
     }
   } else {
     PropertyNormalizationMode mode = receiver->map()->is_prototype_map()
                                          ? KEEP_INOBJECT_PROPERTIES
                                          : CLEAR_INOBJECT_PROPERTIES;
     // Normalize object to make this operation simple.
     JSObject::NormalizeProperties(receiver, mode, 0,
                                   "TransitionToAccessorPair");
 
     JSObject::SetNormalizedProperty(receiver, name_, pair, details);
@@ skipping 208 matching lines @@
       case InterceptorState::kSkipNonMasking:
         return true;
       case InterceptorState::kProcessNonMasking:
         return false;
     }
   }
   return interceptor_state_ == InterceptorState::kProcessNonMasking;
 }
 }  // namespace internal
 }  // namespace v8