Follow-up for "Enable loads and stores to global vars through property cell shortcuts installed..."

src/runtime/runtime-object.cc

 // Copyright 2014 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/v8.h"
 
 #include "src/arguments.h"
 #include "src/bootstrapper.h"
 #include "src/debug.h"
 #include "src/messages.h"
@@ skipping 414 matching lines @@
   HandleScope scope(isolate);
   DCHECK(args.length() == 3);
   CONVERT_ARG_HANDLE_CHECKED(Context, script_context, 0);
   CONVERT_SMI_ARG_CHECKED(index, 1);
   CONVERT_ARG_HANDLE_CHECKED(Name, name, 2);
   DCHECK(script_context->IsScriptContext());
   DCHECK(script_context->get(index)->IsPropertyCell());
 
   Handle<GlobalObject> global(script_context->global_object());
 
-  LookupIterator it(global, name, LookupIterator::OWN);
-  if (LookupIterator::DATA == it.state()) {
+  LookupIterator it(global, name, LookupIterator::HIDDEN);
+  // Switch to fast mode only if there is a data property and it's not on
+  // a hidden prototype.
+  if (LookupIterator::DATA == it.state() &&
+      it.GetHolder<Object>()->IsJSGlobalObject()) {
     // Now update cell in the script context.
     Handle<PropertyCell> cell = it.GetPropertyCell();
     script_context->set(index, *cell);
   } else {
     // This is not a fast case, so keep this access in a slow mode.
     // Store empty_property_cell here to release the outdated property cell.
     script_context->set(index, isolate->heap()->empty_property_cell());
   }
 
   Handle<Object> result;
@@ skipping 10 matching lines @@
   CONVERT_SMI_ARG_CHECKED(index, 1);
   CONVERT_ARG_HANDLE_CHECKED(Name, name, 2);
   CONVERT_ARG_HANDLE_CHECKED(Object, value, 3);
   CONVERT_LANGUAGE_MODE_ARG_CHECKED(language_mode_arg, 4);
   DCHECK(script_context->IsScriptContext());
   DCHECK(script_context->get(index)->IsPropertyCell());
   LanguageMode language_mode = language_mode_arg;
 
   Handle<GlobalObject> global(script_context->global_object());
 
-  LookupIterator it(global, name, LookupIterator::OWN);
-  if (LookupIterator::DATA == it.state()) {
+  LookupIterator it(global, name, LookupIterator::HIDDEN);
+  // Switch to fast mode only if there is a data property and it's not on
+  // a hidden prototype.
+  if (LookupIterator::DATA == it.state() &&
+      it.GetHolder<Object>()->IsJSGlobalObject()) {
     // Now update cell in the script context.
     Handle<PropertyCell> cell = it.GetPropertyCell();
     script_context->set(index, *cell);
   } else {
     // This is not a fast case, so keep this access in a slow mode.
     // Store empty_property_cell here to release the outdated property cell.
     script_context->set(index, isolate->heap()->empty_property_cell());
   }
 
   Handle<Object> result;
@@ skipping 988 matching lines @@
   CONVERT_PROPERTY_ATTRIBUTES_CHECKED(attrs, 3);
 
   RETURN_FAILURE_ON_EXCEPTION(
       isolate,
       JSObject::DefineAccessor(object, name, isolate->factory()->null_value(),
                                setter, attrs));
   return isolate->heap()->undefined_value();
 }
 }  // namespace internal
 }  // namespace v8