Index: src/ia32/macro-assembler-ia32.cc |
diff --git a/src/ia32/macro-assembler-ia32.cc b/src/ia32/macro-assembler-ia32.cc |
index 56a6e0e70ba3cf815edff6c10c9732cdca467eff..2e00980f16f208ada9015bea708bccac2ccc6bef 100644 |
--- a/src/ia32/macro-assembler-ia32.cc |
+++ b/src/ia32/macro-assembler-ia32.cc |
@@ -3585,10 +3585,16 @@ void MacroAssembler::CheckEnumCache(Label* call_runtime) { |
// Check that there are no elements. Register rcx contains the current JS |
// object we've reached through the prototype chain. |
+ Label no_elements; |
mov(ecx, FieldOperand(ecx, JSObject::kElementsOffset)); |
cmp(ecx, isolate()->factory()->empty_fixed_array()); |
+ j(equal, &no_elements); |
+ |
+ // Second chance, the object may be using the empty slow element dictionary. |
+ cmp(ecx, isolate()->factory()->empty_slow_element_dictionary()); |
j(not_equal, call_runtime); |
+ bind(&no_elements); |
mov(ecx, FieldOperand(ebx, Map::kPrototypeOffset)); |
cmp(ecx, isolate()->factory()->null_value()); |
j(not_equal, &next); |