| Index: src/ic/ic.cc
|
| diff --git a/src/ic/ic.cc b/src/ic/ic.cc
|
| index 07a31577b059466b1d68d9b9e5630aa5a2ace82e..921910690cd848b296d90b628a1c4d64f70d78dc 100644
|
| --- a/src/ic/ic.cc
|
| +++ b/src/ic/ic.cc
|
| @@ -1406,9 +1406,10 @@ MaybeHandle<Object> KeyedLoadIC::Load(Handle<Object> object,
|
| bool StoreIC::LookupForWrite(LookupIterator* it, Handle<Object> value,
|
| JSReceiver::StoreFromKeyed store_mode) {
|
| // Disable ICs for non-JSObjects for now.
|
| - Handle<Object> receiver = it->GetReceiver();
|
| - if (!receiver->IsJSObject()) return false;
|
| - DCHECK(!Handle<JSObject>::cast(receiver)->map()->is_deprecated());
|
| + Handle<Object> object = it->GetReceiver();
|
| + if (!object->IsJSObject()) return false;
|
| + Handle<JSObject> receiver = Handle<JSObject>::cast(object);
|
| + DCHECK(!receiver->map()->is_deprecated());
|
|
|
| for (; it->IsFound(); it->Next()) {
|
| switch (it->state()) {
|
| @@ -1448,21 +1449,23 @@ bool StoreIC::LookupForWrite(LookupIterator* it, Handle<Object> value,
|
|
|
| // Receiver != holder.
|
| if (receiver->IsJSGlobalProxy()) {
|
| - PrototypeIterator iter(it->isolate(),
|
| - Handle<JSGlobalProxy>::cast(receiver));
|
| + PrototypeIterator iter(it->isolate(), receiver);
|
| return it->GetHolder<Object>().is_identical_to(
|
| PrototypeIterator::GetCurrent(iter));
|
| }
|
|
|
| if (it->HolderIsReceiverOrHiddenPrototype()) return false;
|
|
|
| - it->PrepareTransitionToDataProperty(value, NONE, store_mode);
|
| + if (it->ExtendingNonExtensible(receiver)) return false;
|
| + it->PrepareTransitionToDataProperty(receiver, value, NONE, store_mode);
|
| return it->IsCacheableTransition();
|
| }
|
| }
|
| }
|
|
|
| - it->PrepareTransitionToDataProperty(value, NONE, store_mode);
|
| + receiver = it->GetStoreTarget();
|
| + if (it->ExtendingNonExtensible(receiver)) return false;
|
| + it->PrepareTransitionToDataProperty(receiver, value, NONE, store_mode);
|
| return it->IsCacheableTransition();
|
| }
|
|
|
|
|