Fixed type feedback in presence of negative lookups.

src/ia32/stub-cache-ia32.cc

Index: src/ia32/stub-cache-ia32.cc
diff --git a/src/ia32/stub-cache-ia32.cc b/src/ia32/stub-cache-ia32.cc
index 66333755ef4a5c2943333f45b6afcb442cc1098d..081de32f76ea237a95ef88bfe2228ec62fb1ac96 100644
--- a/src/ia32/stub-cache-ia32.cc
+++ b/src/ia32/stub-cache-ia32.cc
@@ -1132,6 +1132,9 @@ Register StubCompiler::CheckPrototypes(Handle<JSObject> object,
                                        int save_at_depth,
                                        Label* miss,
                                        PrototypeCheckType check) {
+  // Make sure that the type feedback oracle harvests the receiver map.
+  __ mov(scratch1, Handle<Map>(object->map()));

[Michael Starzinger, 2013/07/17 15:03:30]

The StubCompiler::CheckPrototypes() helper is used in many places, even several
times within the same stub. So I think this should be hoisted out of this helper
to only add the embedded map at the top of each stub that actually needs it.

[Michael Starzinger, 2013/07/17 15:15:17]

To be precise, this should go into CallStubCompiler::CompileCallConstant(). Toon
also made a good point, the CheckPrototypes is also used for loads and stores,
not just calls.

+
   Handle<JSObject> first = object;
   // Make sure there's no overlap between holder and object registers.
   ASSERT(!scratch1.is(object_reg) && !scratch1.is(holder_reg));