Fix for v8:4380 introduced a regression in Octane crypto.

src/hydrogen.cc

 // Copyright 2013 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/hydrogen.h"
 
 #include <sstream>
 
 #include "src/allocation-site-scopes.h"
 #include "src/ast-numbering.h"
@@ skipping 7434 matching lines @@
   if (!has_double_maps && !has_smi_or_object_maps) return NULL;
 
   HCheckMaps* checked_object = Add<HCheckMaps>(object, maps);
   // FAST_ELEMENTS is considered more general than FAST_HOLEY_SMI_ELEMENTS.
   // If we've seen both, the consolidated load must use FAST_HOLEY_ELEMENTS.
   ElementsKind consolidated_elements_kind = has_seen_holey_elements
       ? GetHoleyElementsKind(most_general_consolidated_map->elements_kind())
       : most_general_consolidated_map->elements_kind();
   LoadKeyedHoleMode load_mode = NEVER_RETURN_HOLE;
   if (has_seen_holey_elements) {
-    if (!isolate()->IsFastArrayConstructorPrototypeChainIntact()) {
-      return NULL;
-    }
-
     // Make sure that all of the maps we are handling have the initial array
     // prototype.
+    bool saw_non_array_prototype = false;
     for (int i = 0; i < maps->length(); ++i) {
       Handle<Map> map = maps->at(i);
       if (map->prototype() != *isolate()->initial_array_prototype()) {
         // We can't guarantee that loading the hole is safe. The prototype may
         // have an element at this position.
-        return NULL;
+        saw_non_array_prototype = true;
+        break;
       }
     }
 
-    Handle<Map> holey_map =
-        handle(isolate()->get_initial_js_array_map(consolidated_elements_kind));
-    load_mode = BuildKeyedHoleMode(holey_map);
-    if (load_mode == NEVER_RETURN_HOLE) {
-      return NULL;
-    }
-
-    for (int i = 0; i < maps->length(); ++i) {
-      Handle<Map> map = maps->at(i);
-      // The prototype check was already done for the holey map in
-      // BuildKeyedHoleMode.
-      if (!map.is_identical_to(holey_map)) {
-        Handle<JSObject> prototype(JSObject::cast(map->prototype()), isolate());
-        Handle<JSObject> object_prototype =
-            isolate()->initial_object_prototype();
-        BuildCheckPrototypeMaps(prototype, object_prototype);
+    if (!saw_non_array_prototype) {
+      Handle<Map> holey_map = handle(
+          isolate()->get_initial_js_array_map(consolidated_elements_kind));
+      load_mode = BuildKeyedHoleMode(holey_map);
+      if (load_mode != NEVER_RETURN_HOLE) {
+        for (int i = 0; i < maps->length(); ++i) {
+          Handle<Map> map = maps->at(i);
+          // The prototype check was already done for the holey map in
+          // BuildKeyedHoleMode.
+          if (!map.is_identical_to(holey_map)) {
+            Handle<JSObject> prototype(JSObject::cast(map->prototype()),
+                                       isolate());
+            Handle<JSObject> object_prototype =
+                isolate()->initial_object_prototype();
+            BuildCheckPrototypeMaps(prototype, object_prototype);
+          }
+        }
       }
     }
   }
   HInstruction* instr = BuildUncheckedMonomorphicElementAccess(
       checked_object, key, val,
       most_general_consolidated_map->instance_type() == JS_ARRAY_TYPE,
       consolidated_elements_kind, LOAD, load_mode, STANDARD_STORE);
   return instr;
 }
 
@@ skipping 6017 matching lines @@
     isolate()->GetHTracer()->TraceHydrogen(name(), graph_);
   }
 
 #ifdef DEBUG
   graph_->Verify(false);  // No full verify.
 #endif
 }
 
 }  // namespace internal
 }  // namespace v8