Fix non-standard element handling

src/objects.cc

Index: src/objects.cc
diff --git a/src/objects.cc b/src/objects.cc
index eb115613daced16427f55e78cd3a14424d5bc3e3..0a023cc2981d328dbb3412a6bbe35f50d067641d 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -4799,6 +4799,18 @@ static Handle<SeededNumberDictionary> CopyFastElementsToDictionary(
 }
 
 
+void JSObject::RequireSlowElements(Handle<JSObject> obj,
+                                   Handle<SeededNumberDictionary> dictionary) {
+  if (dictionary->requires_slow_elements()) return;
+
+  dictionary->set_requires_slow_elements();
+  // TODO(verwaest): Remove this hack.
+  if (obj->map()->is_prototype_map()) {
+    obj->GetHeap()->ClearAllICsByKind(Code::KEYED_STORE_IC);
+  }
+}
+
+
 Handle<SeededNumberDictionary> JSObject::NormalizeElements(
     Handle<JSObject> object) {
   DCHECK(!object->HasExternalArrayElements() &&
@@ -5440,7 +5452,7 @@ MaybeHandle<Object> JSObject::PreventExtensions(Handle<JSObject> object) {
   DCHECK(object->HasDictionaryElements() || object->HasSlowArgumentsElements());
 
   // Make sure that we never go back to fast case.
-  dictionary->set_requires_slow_elements();
+  JSObject::RequireSlowElements(object, dictionary);
 
   // Do a map transition, other objects with this map may still
   // be extensible.
@@ -5611,11 +5623,11 @@ MaybeHandle<Object> JSObject::PreventExtensionsWithTransition(
   }
 
   if (object->elements() != isolate->heap()->empty_slow_element_dictionary()) {
-    SeededNumberDictionary* dictionary = object->element_dictionary();
+    Handle<SeededNumberDictionary> dictionary(object->element_dictionary());
     // Make sure we never go back to the fast case
-    dictionary->set_requires_slow_elements();
+    JSObject::RequireSlowElements(object, dictionary);
     if (attrs != NONE) {
-      ApplyAttributesToDictionary(dictionary, attrs);
+      ApplyAttributesToDictionary(*dictionary, attrs);
     }
   }
 
@@ -6234,11 +6246,20 @@ bool Map::DictionaryElementsInPrototypeChainOnly() {
     if (iter.GetCurrent()->IsJSProxy()) return true;
     // String wrappers have non-configurable, non-writable elements.
     if (iter.GetCurrent()->IsStringWrapper()) return true;
+    JSObject* current = JSObject::cast(iter.GetCurrent());
 
-    if (IsDictionaryElementsKind(
-            JSObject::cast(iter.GetCurrent())->map()->elements_kind())) {
+    if (current->HasDictionaryElements() &&
+        current->element_dictionary()->requires_slow_elements()) {
       return true;
     }
+
+    if (current->HasSloppyArgumentsElements()) {
+      FixedArray* parameter_map = FixedArray::cast(current->elements());
+      Object* arguments = parameter_map->get(1);
+      if (SeededNumberDictionary::cast(arguments)->requires_slow_elements()) {
+        return true;
+      }
+    }
   }
 
   return false;
@@ -14670,6 +14691,8 @@ void SeededNumberDictionary::UpdateMaxNumberKey(uint32_t key) {
   // Check if this index is high enough that we should require slow
   // elements.
   if (key > kRequiresSlowElementsLimit) {
+    // TODO(verwaest): Remove this hack.
+    GetHeap()->ClearAllICsByKind(Code::KEYED_STORE_IC);

[Igor Sheludko, 2015/07/15 10:53:18]

JSObject::RequireSlowElements()?

     set_requires_slow_elements();
     return;
   }